Summary
new_proxy_config() (crates/lib/src/deploy.rs) only sets user_agent_prefix. Every auth field on ImageProxyConfig is left at its default (anonymous). Neither a CLI flag on to-existing-root nor REGISTRY_AUTH_FILE in the environment reaches the spawned image-proxy subprocess, so installing from a private --source-imgref fails with unauthorized regardless of valid local credentials. Confirmed skopeo itself succeeds against the same registry using the same credentials.
Worked around this by making the target image public. Not sure if the gap is intentional or an oversight, flagging either way.
Summary
new_proxy_config()(crates/lib/src/deploy.rs) only setsuser_agent_prefix. Every auth field onImageProxyConfigis left at its default (anonymous). Neither a CLI flag onto-existing-rootnorREGISTRY_AUTH_FILEin the environment reaches the spawned image-proxy subprocess, so installing from a private--source-imgreffails withunauthorizedregardless of valid local credentials. Confirmedskopeoitself succeeds against the same registry using the same credentials.Worked around this by making the target image public. Not sure if the gap is intentional or an oversight, flagging either way.