From ac58beed263b21dd32fef9138226f1d532eb9ffc Mon Sep 17 00:00:00 2001
From: Alessandro Verzicco
 <152161683+alessandro-verzicco@users.noreply.github.com>
Date: Thu, 6 Nov 2025 17:29:58 +0100
Subject: [PATCH] Ignore auth header with empty JSON object

Signed-off-by: Alessandro Verzicco <152161683+alessandro-verzicco@users.noreply.github.com>
---
 pkg/auth/auth.go      | 3 +++
 pkg/auth/auth_test.go | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index f9b9b4368e..87c042496b 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -336,6 +336,9 @@ func parseMultiAuthHeader(authHeader string) (map[string]types.DockerAuthConfig,
 
 	// Now convert to the internal types.
 	authConfigs := make(map[string]types.DockerAuthConfig)
+	if len(dockerAuthConfigs) == 0 {
+		return nil, nil
+	}
 	for server := range dockerAuthConfigs {
 		authConfigs[server] = dockerAuthToImageAuth(dockerAuthConfigs[server])
 	}
diff --git a/pkg/auth/auth_test.go b/pkg/auth/auth_test.go
index 5a1c447e21..0edc38f4d7 100644
--- a/pkg/auth/auth_test.go
+++ b/pkg/auth/auth_test.go
@@ -392,6 +392,8 @@ func TestParseMultiAuthHeader(t *testing.T) {
 	}{
 		// Empty header
 		{input: "", expected: nil},
+		// Empty JSON object {}=e30= base64-encoded
+		{input: "e30=", expected: nil},
 		// "null"
 		{input: "null", expected: nil},
 		// Invalid JSON