With incus version 7.0.1 I get password character @ encoded to %40 at places where it shouldn’t.
The effect is not being able to get images from an OCI registry, e.g. https://dhi.io
Consider this topic a bugreport. If there are better places for such reports, please say so.
Slightly longer problem description:
My (redacted) password is p@ssw0rD, password that has a replaced with @, the o with a zero and the d with a capital D. And I’m using docker-credential-pass.
$ echo https://dhi.io | docker-credential-pass get
{"ServerURL":"https://dhi.io","Username":"account","Secret":"p@ssw0rD"}
$
With incus launch harder:harbor-portal:2-debian-dev harbor --debug did I capture this:
DEBUG [2026-08-27T14:23:30+02:00]
{
"architecture": "",
"config": {},
"devices": {},
"ephemeral": false,
"profiles": null,
"stateful": false,
"description": "",
"name": "harbor",
"source": {
"type": "image",
"certificate": "",
"alias": "harbor-portal:2-debian-dev",
"server": "https://account:p%40ssw0rD@dhi.io",
"protocol": "oci",
"mode": "pull",
"allow_inconsistent": false
},
"instance_type": "",
"type": "container",
"start": true
}
But that incus launch commands bails out with:
Error: Failed instance creation: Failed getting remote \
image info: Failed to run: skopeo --insecure-policy \
inspect docker://dhi.io/harbor-portal:2-debian-dev --no-tags \
--authfile=/var/lib/incus/images/incus_client_auth_261862000: exit status \
1 (time="2026-08-27T14:23:31+02:00" level=fatal msg="Error parsing \
image name \"docker://dhi.io/harbor-portal:2-debian-dev\": unable to \
retrieve auth token: invalid username/password: authentication required")
Zooming in on the authfile reveals {"auths":{"https://dhi.io":{"auth":"YWNjb3VudDpwJTQwc3N3MHJE"}}}.
However the "auth" should be "YWNjb3VudDpwQHNzdzByRA==".
Decoding both "auth" fields:
$ echo YWNjb3VudDpwJTQwc3N3MHJE | base64 -d ; echo
account:p%40ssw0rD
$ echo YWNjb3VudDpwQHNzdzByRA== | base64 -d ; echo
account:p@ssw0rD
$
The %40 in "server": "https://account:p%40ssw0rD@dhi.io" is valid,
the base64 encoded %40 in {"auth":"YWNjb3VudDpwJTQwc3N3MHJE"} is not valid.