Unable to authorize renovate to fetch latest images on ghcr.io (github packages) registry on private package #8643

rslinckx · 2021-02-11T10:17:01Z

rslinckx
Feb 11, 2021

I recently switched my packages to the new github registry ghcr.io instead of the older docker.pkg.github.com github packages registry. In both cases the packages are private and can only be accessed via a github token which i encrypted and setup in the config as password

The older registry worked fine, using a config like this:

  "hostRules": [
    {
      "domainName": "docker.pkg.github.com",
      "username": "xxxx",
      "encrypted": {
        "password": "xxxxx"
      }
    }
]

I used the following to authenticate to the newer ghcr.io registry (only the domainName part has changed):

    {
      "domainName": "ghcr.io",
      "username": "xxx",
      "encrypted": {
        "password": "xxx"
      }
    }

Note that the actual config is using both like this, in case it matters:

  "hostRules": [
    {
      "domainName": "docker.pkg.github.com",
      "username": "xxx",
      "encrypted": {
        "password": "xxx"
      }
    },
    {
      "domainName": "ghcr.io",
      "username": "xxx",
      "encrypted": {
        "password": "xxxx"
      }
    }
]

Now when renovate runs i get the following error in the logs (for example in run #299102059) :

DEBUG: Datasource unauthorized
{
  "datasource": "docker",
  "lookupName": "ghcr.io/xxx/xxx/xxx/xxx",
  "url": "https://ghcr.io/v2/xxx/xxx/xxx/xxx/tags/list?n=10000"
}
DEBUG: Failed to look up dependency ghcr.io/xxx/xxx/xxx/xxx (ghcr.io/xxx/xxx/xxx/xxx)(packageFile="docker-compose.yml", dependency="ghcr.io/xxx/xxx/xxx/xxx")

I can't find any other issue or discussion about ghcr.io, so i'm not sure whether this is a problem with ghcr.io support in general, or just my configuration that's missing something, although i can't see what could be misconfigured?

viceice · 2021-02-11T10:37:39Z

viceice
Feb 11, 2021
Maintainer

Did you tried to login directly from local docker daemon? Are the credentials working?

5 replies

rslinckx Feb 11, 2021
Author

Yes everything is working fine when using the docker CLI on both registries using the same credentials

rslinckx Feb 11, 2021
Author

The password is a github token with read:packages scope, although i tried also with wider scopes, but renovate won't auth correctly

rslinckx Feb 11, 2021
Author

Another interesting data-point, in the github interface where i have a list of my tokens, the token i use in the renovate config states that it was never accessed, as if renovate won't even try to authenticate at all

viceice Feb 11, 2021
Maintainer

i know it works for public images on ghcr.io, did you checked the urls in log? are they right?

eg: should look like https://ghcr.io/v2/org/image/tags/list?n=10000

working sample url: https://ghcr.io/v2/visualon/builder/tags/list (need auth token from https://ghcr.io/token of cause)

rslinckx Feb 11, 2021
Author

in my case the path is org/something/something/something and the logs show the path as pasted above. This is in a docker-compose file, which i can run successfully, so the paths are fine, in theory.

cubic3d · 2021-07-21T22:20:46Z

cubic3d
Jul 21, 2021

Did you get it fixed? I also experience problems with ghcr.io and auth.

1 reply

rslinckx Jul 22, 2021
Author

No still not working

h-no · 2021-08-25T17:16:08Z

h-no
Aug 25, 2021

I have the same problems.
I tried with:

  "hostRules": [
    {
      "matchHost": "ghcr.io",
      "username": "***",
      "encrypted": {
        "password": "***"
      }
    }
  ],

and

  "hostRules": [
    {
      "matchHost": "ghcr.io",
      "encrypted": {
        "username": "***",
        "password": "***"
      }
    }
  ],

Results with:

DEBUG: Datasource unauthorized
{
 "datasource": "docker",
 "lookupName": "ghcr.io/x/y/z",
 "url": "https://ghcr.io/v2/x/y/z/tags/list?n=10000"
}
DEBUG: Failed to look up dependency ghcr.io/x/y/z (ghcr.io/x/y/z)(packageFile="xxx/kustomization.yaml", dependency="ghcr.io/x/y/z")

2 replies

h-no Aug 25, 2021

Verified that the username and PAT before encryption works using docker login ghcr.io

h-no Aug 26, 2021

Troubleshooting a bit..

I read https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate and following that guide I can curl the requests needed in my terminal like this:

Initial request to figure out auth (x/y/z is my image, i.e. organization/repo/imgname):

curl -i https://ghcr.io/v2/x/y/z/tags/list?n=10000
HTTP/2 401
content-type: application/json
www-authenticate: Bearer realm="https://ghcr.io/token",service="ghcr.io",scope="repository:x/y/z:pull"
date: Thu, 26 Aug 2021 13:13:35 GMT
content-length: 73
x-github-request-id: xxx

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required"}]}

Getting the token (password is a GitHub Personal Access Token):

curl -i -H "Authorization: Basic <base64encoded username:password>" "https://ghcr.io/token?service=ghcr.io&scope=repository:x/y/z:pull"
HTTP/2 200
content-type: application/json
docker-distribution-api-version: registry/2.0
date: Thu, 26 Aug 2021 13:23:15 GMT
content-length: 69
x-github-request-id: xxx

{"token":"BASE64TOKEN"}

Performing the original request with auth token from previous request:

curl -i -H "Authorization: Bearer BASE64TOKEN" "https://ghcr.io/v2/x/y/z/tags/list?n=10000"
HTTP/2 200
content-type: application/json
docker-distribution-api-version: registry/2.0
date: Thu, 26 Aug 2021 13:24:42 GMT
content-length: 846
x-github-request-id: xxx

{"name":"x/y/z","tags":["v0.0.1", ... ]}

So on the ghcr.io side, the API requests seem to work.

h-no · 2021-08-27T17:19:25Z

h-no
Aug 27, 2021

This is the same issue as #11446 👍

0 replies

dargmuesli · 2025-07-24T10:46:12Z

dargmuesli
Jul 24, 2025

I found the following to be working:

{
  "matchHost": "ghcr.io",
  "hostType": "docker",
  "username": "your-user-name",
  "password": "***********"
}

or in the UI:

0 replies

Unable to authorize renovate to fetch latest images on ghcr.io (github packages) registry on private package #8643

Uh oh!

rslinckx Feb 11, 2021

Replies: 5 comments · 8 replies

Uh oh!

viceice Feb 11, 2021 Maintainer

Uh oh!

rslinckx Feb 11, 2021 Author

Uh oh!

rslinckx Feb 11, 2021 Author

Uh oh!

rslinckx Feb 11, 2021 Author

Uh oh!

viceice Feb 11, 2021 Maintainer

Uh oh!

rslinckx Feb 11, 2021 Author

Uh oh!

cubic3d Jul 21, 2021

Uh oh!

rslinckx Jul 22, 2021 Author

Uh oh!

h-no Aug 25, 2021

Uh oh!

h-no Aug 25, 2021

Uh oh!

Uh oh!

h-no Aug 26, 2021

Uh oh!

h-no Aug 27, 2021

Uh oh!

dargmuesli Jul 24, 2025

rslinckx
Feb 11, 2021

Replies: 5 comments 8 replies

viceice
Feb 11, 2021
Maintainer

rslinckx Feb 11, 2021
Author

rslinckx Feb 11, 2021
Author

rslinckx Feb 11, 2021
Author

viceice Feb 11, 2021
Maintainer

rslinckx Feb 11, 2021
Author

cubic3d
Jul 21, 2021

rslinckx Jul 22, 2021
Author

h-no
Aug 25, 2021

h-no
Aug 27, 2021

dargmuesli
Jul 24, 2025