Improve registry client error handling

[mtrmac]

See #1293 (comment) and the added comment.

The primary expected benefit is that this should turn

Error initializing source docker://foobar:latest: Error reading manifest latest in docker.io/library/foobar: errors:
denied: requested access to the resource is denied
unauthorized: authentication required

into

Error initializing source docker://foobar:latest: Error reading manifest latest in docker.io/library/foobar: denied: requested access to the resource is denied

⚠️

• Currently absolutely untested. We should see what this changes in practice for a variety of registries and situations.
• This could potentially silently break callers; notably https://github.com/containers/common/blob/a38eda676e2adea08a5138aa639f873537cac335/pkg/retry/retry.go#L60 almost certainly needs to add a case for ErrorCodeDenied because the second ErrorCodeUnauthorized will not be visible.

@vrothberg PTAL.

---

Tests pass in containers/skopeo#1522 .

[mtrmac]

Potentially fixes #1293, though distribution/distribution might want to add an error case to their parser anyway.

[vrothberg]

Changes LGTM

I guess we need to vendor this PR into one of c/common and then vendor both into Skopeo? Once green, we can merge c/image, then c/common, then c/skopeo #vendorDance 🕺

[mtrmac]

c/common first, I think. (Along with thinking how to prepare it for other error reporting changes discussed, like the manifest unknown: manifest unknown text.)

[mtrmac]

I’n re-purposing this PR for a much more general error handling clean-up:

• Note: This starts to use error.Unwrap etc instead of pkg/errors.
• /tags/list now uses registryHTTPResponseToError. (⚠️ may break the existing skopeo inspect special cases)
• Drop the GetBlobAt special cases from generic code
• Error messages with default error text stutter less, manifest unknown instead of manifest unknown: manifest unknown
• TO DO: Use registryHTTPResponseToError in many other places, possibly even the OAuth2 clients

[rhatdan]

@mtrmac Any progress on this?

[mtrmac]

Some examples (old / new)

% c inspect docker://libpod/doesnotexist      
FATA[0001] Error parsing image name "docker://libpod/doesnotexist": reading manifest latest in docker.io/libpod/doesnotexist: errors:
denied: requested access to the resource is denied
unauthorized: authentication required 

FATA[0001] Error parsing image name "docker://libpod/doesnotexist": reading manifest latest in docker.io/libpod/doesnotexist: requested access to the resource is denied 

% c inspect docker://quay.io/libpod/doesnotexist
FATA[0002] Error parsing image name "docker://quay.io/libpod/doesnotexist": reading manifest latest in quay.io/libpod/doesnotexist: unauthorized: access to the requested resource is not authorized 

FATA[0001] Error parsing image name "docker://quay.io/libpod/doesnotexist": reading manifest latest in quay.io/libpod/doesnotexist: unauthorized: access to the requested resource is not authorized 

% c inspect docker://busybox:doesnotexist       
FATA[0001] Error parsing image name "docker://busybox:doesnotexist": reading manifest doesnotexist in docker.io/library/busybox: manifest unknown: manifest unknown 

FATA[0001] Error parsing image name "docker://busybox:doesnotexist": reading manifest doesnotexist in docker.io/library/busybox: manifest unknown 

% c sync --insecure-policy --scoped --src docker --dest dir google.com/namespace/imagename t
INFO[0000] Tag presence check                            imagename=google.com/namespace/imagename tagged=false
INFO[0000] Getting tags                                  image=google.com/namespace/imagename
FATA[0000] Error determining repository tags for image google.com/namespace/imagename: pinging container registry google.com: invalid status code from registry 404 (Not Found) 

INFO[0000] Tag presence check                            imagename=google.com/namespace/imagename tagged=false
INFO[0000] Getting tags                                  image=google.com/namespace/imagename
FATA[0000] Error determining repository tags for image google.com/namespace/imagename: pinging container registry google.com: StatusCode: 404, <!DOCTYPE html>
<html lang=en>
  <meta charset=utf... 

% c sync --authfile /dev/doesnotexist --insecure-policy --scoped --src docker --dest dir hopefully_no_images_will_ever_be_called_like_this t        
INFO[0000] Tag presence check                            imagename=hopefully_no_images_will_ever_be_called_like_this tagged=false
INFO[0000] Getting tags                                  image=docker.io/library/hopefully_no_images_will_ever_be_called_like_this
WARN[0001] Registry disallows tag list retrieval: unable to retrieve auth token: invalid username/password: errors:
denied: requested access to the resource is denied
unauthorized: authentication required 
FATA[0001] No images to sync found in "hopefully_no_images_will_ever_be_called_like_this" 

INFO[0000] Tag presence check                            imagename=hopefully_no_images_will_ever_be_called_like_this tagged=false
INFO[0000] Getting tags                                  image=docker.io/library/hopefully_no_images_will_ever_be_called_like_this
WARN[0002] Registry disallows tag list retrieval: fetching tags list: requested access to the resource is denied 
FATA[0002] No images to sync found in "hopefully_no_images_will_ever_be_called_like_this" 

[mtrmac]

The failing Skopeo tests will be updated in containers/skopeo#1522 .

[mtrmac]

Note to self: I should prepare also test Buildah/Podman PRs — and probably update the tests this breaks.

[rhatdan]

LGTM, do the skopeo tests need to be updated to be able to pass?

[mtrmac]

Test passed in containers/skopeo#1522 , merging.