Catalog service validation fails for public packages hosted on GHCR (github)

[alex-mabrouk]

Describe the Bug

Adding a catalog service backed by a public package hosted on GitHub Container Registry (ghcr.io) fails during validation.

The validation process verifies that the package exists by listing the repository tags. This works with registries such as Quay, but fails with GHCR because GHCR always responds to anonymous requests with a 401 Unauthorized and a WWW-Authenticate: Bearer challenge, even for public repositories.

The current implementation treats this 401 as a hard failure instead of completing the anonymous bearer-token authentication flow required by the OCI Distribution specification.

As a result, public packages hosted on GHCR cannot be added to the catalog.

Steps to Reproduce

1. Publish a public OCI package to GHCR (for example ghcr.io/alex-mabrouk/okdp-packages/rustfs:0.1.0).
2. Create a catalog service using that repository:

POST /api/platform-services

{
  "name": "rustfs",
  "versions": ["0.1.0"],
  "defaultVersion": "0.1.0",
  "repository": "ghcr.io/alex-mabrouk/okdp-packages/rustfs"
}

3. Observe that the request fails during package validation.

Expected Behavior

The server should successfully validate the package and add the catalog service, just as it does with public packages hosted on other OCI registries.

Actual Behavior

The request fails with an error similar to:

invalid catalog service: could not verify package "rustfs" in the registry registry returned status 401 for https://ghcr.io/v2/alex-mabrouk/okdp-packages/rustfs/tags/list

The package is public. Accessing the endpoint directly returns GHCR's authentication challenge:

{
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "authentication required"
    }
  ]
}

Environment

Kubernetes version

Details

$ kubectl version
Client Version: v1.36.2
Kustomize Version: v5.8.1
Server Version: v1.34.0
Warning: version difference between client (1.36) and server (1.34) exceeds the supported minor version skew of +/-1

Helm version

Details

$ helm version
version.BuildInfo{Version:"v4.2.2", GitCommit:"b05881cf967a5a09e19866799d0edfd40675803a", GitTreeState:"clean", GoVersion:"go1.26.4", KubeClientVersion:"v1.36"}

Chart / component version:

Cluster setup (Kind version, node count, any custom config):

• OKDP Server: 0.6.1
• Chart: 0.6.0
• Kubernetes: Kind cluster
• Deployment: okdp-sandbox

Logs

Anything else we need to know?

No response