When mounting blobs, oci-client currently uses a token that has only push,pull permission for the destination repo.
docker.io requires that the token also has pull permissions on the source repo (even if the source repo is public).
I have a very messy patch (not in any state to be published at the moment) that demonstrates that changing the token to include both permissions fixes the problem, and enables successful cross-repo mounting on docker.io.
When mounting blobs,
oci-clientcurrently uses a token that has onlypush,pullpermission for the destination repo.docker.io requires that the token also has
pullpermissions on the source repo (even if the source repo is public).I have a very messy patch (not in any state to be published at the moment) that demonstrates that changing the token to include both permissions fixes the problem, and enables successful cross-repo mounting on docker.io.