From 6ec5ff413006419cabf92189d86a2bd07a8a7046 Mon Sep 17 00:00:00 2001
From: Nayan Das <ndas@digitalocean.com>
Date: Tue, 23 Dec 2025 11:26:32 +0000
Subject: [PATCH 1/2] chore(gcmarker): Add Stat to manifest store

---
 manifests.go                      |  4 ++++
 registry/storage/manifeststore.go | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/manifests.go b/manifests.go
index 8f84a220a97..5a4dec28523 100644
--- a/manifests.go
+++ b/manifests.go
@@ -61,6 +61,10 @@ type ManifestService interface {
 	// Delete removes the manifest specified by the given digest. Deleting
 	// a manifest that doesn't exist will return ErrManifestNotFound
 	Delete(ctx context.Context, dgst digest.Digest) error
+
+	// Stat provides metadata about a manifest identified by the digest. If the
+	// manifest is unknown to the describer, ErrManifestUnknownRevision will be returned.
+	Stat(ctx context.Context, dgst digest.Digest) (Descriptor, error)
 }
 
 // ManifestEnumerator enables iterating over manifests
diff --git a/registry/storage/manifeststore.go b/registry/storage/manifeststore.go
index 3a897ab197b..43ea3f6b08d 100644
--- a/registry/storage/manifeststore.go
+++ b/registry/storage/manifeststore.go
@@ -72,6 +72,24 @@ func (ms *manifestStore) Exists(ctx context.Context, dgst digest.Digest) (bool,
 	return true, nil
 }
 
+func (ms *manifestStore) Stat(ctx context.Context, dgst digest.Digest) (distribution.Descriptor, error) {
+	dcontext.GetLogger(ms.ctx).Debug("(*manifestStore).Exists")
+
+	descriptor, err := ms.blobStore.Stat(ctx, dgst)
+	if err != nil {
+		if err == distribution.ErrBlobUnknown {
+			return distribution.Descriptor{}, distribution.ErrManifestUnknownRevision{
+				Name:     ms.repository.Named().Name(),
+				Revision: dgst,
+			}
+		}
+
+		return distribution.Descriptor{}, err
+	}
+
+	return descriptor, nil
+}
+
 func (ms *manifestStore) Get(ctx context.Context, dgst digest.Digest, options ...distribution.ManifestServiceOption) (distribution.Manifest, error) {
 	dcontext.GetLogger(ms.ctx).Debug("(*manifestStore).Get")
 

From 4c1d8c2e5299a4caec67ae5fd01e65fbe85cba69 Mon Sep 17 00:00:00 2001
From: Nayan Das <ndas@digitalocean.com>
Date: Tue, 20 Jan 2026 03:20:39 +0000
Subject: [PATCH 2/2] forkedchanges: add InvalidAccessKeyIdError type for
 invalid access key from s3 api

---
 registry/storage/driver/base/base.go     |  3 +++
 registry/storage/driver/s3-aws/s3.go     |  4 +++-
 registry/storage/driver/storagedriver.go | 10 ++++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/registry/storage/driver/base/base.go b/registry/storage/driver/base/base.go
index f39bceac71e..d4750109050 100644
--- a/registry/storage/driver/base/base.go
+++ b/registry/storage/driver/base/base.go
@@ -84,6 +84,9 @@ func (base *Base) setDriverName(e error) error {
 	case storagedriver.UserSuspendedError:
 		actual.DriverName = base.StorageDriver.Name()
 		return actual
+	case storagedriver.InvalidAccessKeyIdError:
+		actual.DriverName = base.StorageDriver.Name()
+		return actual
 	default:
 		storageError := storagedriver.Error{
 			DriverName: base.StorageDriver.Name(),
diff --git a/registry/storage/driver/s3-aws/s3.go b/registry/storage/driver/s3-aws/s3.go
index e654d553dd7..88f92dd187a 100644
--- a/registry/storage/driver/s3-aws/s3.go
+++ b/registry/storage/driver/s3-aws/s3.go
@@ -1207,7 +1207,7 @@ func (d *driver) Walk(ctx context.Context, from string, f storagedriver.WalkFn)
 
 	var objectCount int64
 	if err := d.doWalk(ctx, &objectCount, d.s3Path(path), prefix, f); err != nil {
-		return err
+		return parseError(from, err)
 	}
 
 	// S3 doesn't have the concept of empty directories, so it'll return path not found if there are no objects
@@ -1414,6 +1414,8 @@ func parseError(path string, err error) error {
 			return storagedriver.QuotaExceededError{}
 		case "UserSuspended":
 			return storagedriver.UserSuspendedError{}
+		case "InvalidAccessKeyId":
+			return storagedriver.InvalidAccessKeyIdError{}
 		}
 	}
 	return err
diff --git a/registry/storage/driver/storagedriver.go b/registry/storage/driver/storagedriver.go
index ef0d41e2c4f..7075d4dd3ee 100644
--- a/registry/storage/driver/storagedriver.go
+++ b/registry/storage/driver/storagedriver.go
@@ -178,6 +178,16 @@ func (err UserSuspendedError) Error() string {
 	return fmt.Sprintf("%s: user is suspended", err.DriverName)
 }
 
+// InvalidAccessKeyIdError is returned when an invalided access key and/or secret key
+// is provided to the S3 api.
+type InvalidAccessKeyIdError struct {
+	DriverName string
+}
+
+func (err InvalidAccessKeyIdError) Error() string {
+	return fmt.Sprintf("%s: access key and secret key is invalid", err.DriverName)
+}
+
 // Error is a catch-all error type which captures an error string and
 // the driver type on which it occurred.
 type Error struct {