Ensure basic auth when getting manifest

CHANGELOG.md

@@ -14,6 +14,7 @@ and **Merged pull requests**. Critical items to know are:
 The versions coincide with releases on pip. Only major versions will be released as tags on Github.
 
 ## [0.0.x](https://github.com/oras-project/oras-py/tree/main) (0.0.x)
+ - use basic auth for getting manifest, avoid authentication failures with Nexus repos and addressing [85](https://github.com/oras-project/oras-py/issues/85) (0.1.18)
   - patch fix to correct session url pattern, closes issue [78](https://github.com/oras-project/oras-py/issues/78) (0.1.17)
   - add support for tag deletion and retry decorators (0.1.16)
  - bugfix that pagination sets upper limit of 10K (0.1.15)

oras/provider.py

@@ -110,6 +110,7 @@ def _load_auth(self, hostname: str) -> bool:
             elif not auth:
                 return False
             self._basic_auth = auth
+            self.set_header("Authorization", "Basic %s" % self._basic_auth)
             return True
         return False
 
@@ -791,6 +792,7 @@ def get_manifest(
         if not allowed_media_type:
             allowed_media_type = [oras.defaults.default_manifest_media_type]
         headers = {"Accept": ";".join(allowed_media_type)}
+        headers.update(self.headers)
 
         get_manifest = f"{self.prefix}://{container.manifest_url()}"  # type: ignore
         response = self.do_request(get_manifest, "GET", headers=headers)

oras/version.py

@@ -2,7 +2,7 @@
 __copyright__ = "Copyright The ORAS Authors."
 __license__ = "Apache-2.0"
 
-__version__ = "0.1.17"
+__version__ = "0.1.18"
 AUTHOR = "Vanessa Sochat"
 EMAIL = "[email protected]"
 NAME = "oras"