Jib authentication logic may not determine if authentication is required correctly

[clecompte-apple]

Environment:

• Jib version: 3.4.4
• Build tool: Maven
• OS: linux/macos

Description of the issue:

Jib may in some circumstances incorrectly determine that a repository does not require authentication. Take for instance the case where caching is used for the manifests or other components of a base image. If the initial request succeeds then Jib assumes the repository does not require authentication. In the case of a cache miss where authentication is required, this may result in a 401 which is not handled and fails the build. Jib should use the /v2/ endpoint to initially determine if the repository requires authentication.
Additionally, better error handling for 401 related errors at other points in the pull process would help mitigate any further errors such as the case where a token refresh may be necessary.

Expected behavior:

Jib should correctly determine if the target repository requires authentication via the method mentioned in the description as opposed to an attempt authentication based upon pull of the base image manifest.

[diegomarquezp]

Hi @clecompte-apple, thanks for reporting this!

Do you happen to have a sample setup that reproduces the issue?

cc @mpeddada1 @ldetmer Are there tests for builds with authenticated endpoints?