@@ -732,50 +732,51 @@ func (c *dockerClient) setupRequestAuth(req *http.Request, extraScope *authScope
732732
733733// obtainBearerToken gets an "Authorization: Bearer" token if one is available, or obtains a fresh one.
734734func (c * dockerClient ) obtainBearerToken (ctx context.Context , challenge challenge , extraScope * authScope ) (string , error ) {
735- registryToken := c .registryToken
736- if registryToken == "" {
737- cacheKey := ""
738- scopes := []authScope {c .scope }
739- if extraScope != nil {
740- // Using ':' as a separator here is unambiguous because getBearerToken below
741- // uses the same separator when formatting a remote request (and because
742- // repository names that we create can't contain colons, and extraScope values
743- // coming from a server come from `parseAuthScope`, which also splits on colons).
744- cacheKey = fmt .Sprintf ("%s:%s:%s" , extraScope .resourceType , extraScope .remoteName , extraScope .actions )
745- if colonCount := strings .Count (cacheKey , ":" ); colonCount != 2 {
746- return "" , fmt .Errorf (
747- "Internal error: there must be exactly 2 colons in the cacheKey ('%s') but got %d" ,
748- cacheKey ,
749- colonCount ,
750- )
751- }
752- scopes = append (scopes , * extraScope )
753- }
754- var token bearerToken
755- t , inCache := c .tokenCache .Load (cacheKey )
756- if inCache {
757- token = t .(bearerToken )
758- }
759- if ! inCache || time .Now ().After (token .expirationTime ) {
760- var (
761- t * bearerToken
762- err error
735+ if c .registryToken != "" {
736+ return c .registryToken , nil
737+ }
738+
739+ cacheKey := ""
740+ scopes := []authScope {c .scope }
741+ if extraScope != nil {
742+ // Using ':' as a separator here is unambiguous because getBearerToken below
743+ // uses the same separator when formatting a remote request (and because
744+ // repository names that we create can't contain colons, and extraScope values
745+ // coming from a server come from `parseAuthScope`, which also splits on colons).
746+ cacheKey = fmt .Sprintf ("%s:%s:%s" , extraScope .resourceType , extraScope .remoteName , extraScope .actions )
747+ if colonCount := strings .Count (cacheKey , ":" ); colonCount != 2 {
748+ return "" , fmt .Errorf (
749+ "Internal error: there must be exactly 2 colons in the cacheKey ('%s') but got %d" ,
750+ cacheKey ,
751+ colonCount ,
763752 )
764- if c .auth .IdentityToken != "" {
765- t , err = c .getBearerTokenOAuth2 (ctx , challenge , scopes )
766- } else {
767- t , err = c .getBearerToken (ctx , challenge , scopes )
768- }
769- if err != nil {
770- return "" , err
771- }
753+ }
754+ scopes = append (scopes , * extraScope )
755+ }
772756
773- token = * t
774- c .tokenCache .Store (cacheKey , token )
757+ var token bearerToken
758+ t , inCache := c .tokenCache .Load (cacheKey )
759+ if inCache {
760+ token = t .(bearerToken )
761+ }
762+ if ! inCache || time .Now ().After (token .expirationTime ) {
763+ var (
764+ t * bearerToken
765+ err error
766+ )
767+ if c .auth .IdentityToken != "" {
768+ t , err = c .getBearerTokenOAuth2 (ctx , challenge , scopes )
769+ } else {
770+ t , err = c .getBearerToken (ctx , challenge , scopes )
775771 }
776- registryToken = token .token
772+ if err != nil {
773+ return "" , err
774+ }
775+
776+ token = * t
777+ c .tokenCache .Store (cacheKey , token )
777778 }
778- return registryToken , nil
779+ return token . token , nil
779780}
780781
781782func (c * dockerClient ) getBearerTokenOAuth2 (ctx context.Context , challenge challenge ,
0 commit comments