From de075fff8a18b0357a175f3e8c5bc43e69a380f2 Mon Sep 17 00:00:00 2001
From: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
Date: Thu, 30 Apr 2026 03:29:54 +0800
Subject: [PATCH] Fix: bad request will remove header and retry login (#711)

If you're requesting on `/v2/` with basic auth, AWS ECR will return 400
Bad Request and won't provide `www-authenticate` information.

Retry the request after removing the Authorization header.

Continue PR #429

Fixed apple/container#847

Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
---
 Sources/ContainerizationOCI/Client/RegistryClient.swift | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Sources/ContainerizationOCI/Client/RegistryClient.swift b/Sources/ContainerizationOCI/Client/RegistryClient.swift
index 4e3ac2e6..14f3142c 100644
--- a/Sources/ContainerizationOCI/Client/RegistryClient.swift
+++ b/Sources/ContainerizationOCI/Client/RegistryClient.swift
@@ -210,6 +210,11 @@ public final class RegistryClient: ContentClient {
                         throw err
                     }
 
+                    continue
+                } else if _response.status == .badRequest && request.headers.contains(name: "Authorization") {
+                    // Retry without basic auth
+                    request.headers.remove(name: "Authorization")
+                    retryCount += 1
                     continue
                 }
                 guard let retryOptions = self.retryOptions else {