The trusted-places router caught every request with an Authorization
header. A docker pull sends the anonymous registry token as "Bearer" on
its manifest and blob reads, so pulling a public package from outside the
trusted places failed with 403. Registry GET and HEAD with a bearer token
are public again. Fetching a token with credentials, and every registry
write, still need a trusted place.
Assisted-by: Claude Opus 5 <noreply@anthropic.com>
LibrePortal
926832b9e6