Fix GitLab authentication guidance for Enroot

[chadvoegele]

Prepared by Chad's Agent.

What does this PR do?

Type of change: documentation

Fixes the Enroot guidance for authenticated GitLab container-registry imports. The documented flow now:

• writes a GitLab username/token received over stdin to a mode-0600 ephemeral credential file;
• keeps the credential machine port-free while allowing an explicit reachable port in the URI;
• imports a tag-only URI on Enroot 4.1.x and verifies reproducibility by checking its digest before and after;
• requires a real import/layer preflight instead of treating manifest access as sufficient; and
• distinguishes registry 401 responses from proxy CONNECT 403 failures.

The prior token-permission diagnosis was incorrect. A token with read_registry completed GitLab's bearer flow and fetched an ARM64 layer. The failed Enroot command pinned the URI with @sha256:; the proxy permitted the initial manifest-by-digest request, so Enroot 4.1.2 skipped bearer authentication and later requested protected blobs anonymously. A separate :5005 attempt failed at the network proxy before registry authentication. A port-qualified credential machine also cannot match Enroot 4.1.x, which strips the port during lookup.

Usage

# Token arrives on stdin. The complete secure example is in
# plugins/modelopt/skills/common/credentials.md.
ENROOT_CONFIG_PATH="$auth_dir" enroot import --output "$output" \
  "docker://${registry_user}@${registry_host}:${registry_port}#${repository}:${tag}"

Testing

• Successfully imported the 14-layer ARM64 nemo-evaluator-next:0.5.0.1-harbor image on OCI-JHB with Enroot 4.1.2 using tag-only auth and default parallel downloads; resulting squashfs: 2,469,605,376 bytes.
• Verified authenticated ARM64 index, child manifest, and layer access (HTTP 206, no redirect).
• pytest plugins/modelopt/skills/: 106 passed, 1 skipped.
• All applicable pre-commit hooks passed, including Ruff, mypy, Bandit, markdownlint, and skill-link synchronization.
• Secret-value scan passed; no token values, hashes, or secret paths are committed.

Before your PR is "Ready for review"

Make sure you read and follow Contributor guidelines and your commits are signed (git commit -s -S).

Make sure you read and follow the Security Best Practices (e.g. avoiding hardcoded trust_remote_code=True, torch.load(..., weights_only=False), pickle, etc.).

• Is this change backward compatible?: ✅
• If you copied code from any other sources or added a new PIP dependency, did you follow guidance in CONTRIBUTING.md: N/A
• Did you write any new necessary tests?: ✅
• Did you update Changelog?: N/A — documentation-only correction
• Did you get Claude approval on this PR?: N/A

Additional Information

The PR is intentionally draft pending maintainer review of the GitLab/Enroot guidance.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.13%. Comparing base (fc4c40f) to head (58c903d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2493   +/-   ##
=======================================
  Coverage   71.13%   71.13%           
=======================================
  Files         602      602           
  Lines       66403    66403           
=======================================
  Hits        47239    47239           
  Misses      19164    19164           

Flag	Coverage Δ
unit	58.11% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.