GoogleContainerTools/jib · error · BuildStepsExecutionException

${helpfulSuggestions.forCredentialsNotSent()}

Error message

${helpfulSuggestions.forCredentialsNotSent()}

What it means

runBuild catches RegistryCredentialsNotSentException and wraps it in a BuildStepsExecutionException with HelpfulSuggestions.forCredentialsNotSent(). This occurs when the registry connection required authentication, but Jib did not send credentials over the (non-encrypted or unexpected) connection — usually when a server redirects or is accessed over plain HTTP and credentials were withheld.

Source

Thrown at jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/JibBuildRunner.java:259

        Files.write(imageIdOutputPath, imageId.getBytes(StandardCharsets.UTF_8));
      }
      if (imageJsonOutputPath != null) {
        ImageMetadataOutput metadataOutput = ImageMetadataOutput.fromJibContainer(jibContainer);
        String imageJson = metadataOutput.toJson();
        Files.write(imageJsonOutputPath, imageJson.getBytes(StandardCharsets.UTF_8));
      }

      return jibContainer;

    } catch (HttpHostConnectException ex) {
      // Failed to connect to registry.
      throw new BuildStepsExecutionException(helpfulSuggestions.forHttpHostConnect(), ex);

    } catch (RegistryUnauthorizedException ex) {
      handleRegistryUnauthorizedException(ex, helpfulSuggestions);

    } catch (RegistryCredentialsNotSentException ex) {
      throw new BuildStepsExecutionException(helpfulSuggestions.forCredentialsNotSent(), ex);

    } catch (RegistryAuthenticationFailedException ex) {
      if (ex.getCause() instanceof ResponseException) {
        handleRegistryUnauthorizedException(
            new RegistryUnauthorizedException(
                ex.getServerUrl(), ex.getImageName(), (ResponseException) ex.getCause()),
            helpfulSuggestions);
      } else {
        // Unknown cause
        throw new BuildStepsExecutionException(helpfulSuggestions.none(), ex);
      }

    } catch (UnknownHostException ex) {
      throw new BuildStepsExecutionException(helpfulSuggestions.forUnknownHost(), ex);

    } catch (InsecureRegistryException ex) {
      throw new BuildStepsExecutionException(helpfulSuggestions.forInsecureRegistry(), ex);

View on GitHub (pinned to fb949e2676)

Solutions

1. Serve the registry over proper HTTPS (fix TLS certificates/load balancer config).
2. If it's a trusted insecure registry, mark it as such (`jib.to.setAllowInsecureRegistries(true)` or `-DsendCredentialsOverHttp=true` for plain HTTP).
3. Prefer configuring credentials so Jib can use the HTTPS endpoint correctly.
4. Check for redirects to http:// and eliminate them at the proxy/registry level.

Example fix

// before (plain HTTP registry, credentials withheld)
jib.to.image = "myregistry.local:5000/app"
// after
plugins { id 'com.google.cloud.tools.jib' }
jib.to.allowInsecureRegistries = true
jib.to.image = "myregistry.local:5000/app"  // plus -DsendCredentialsOverHttp=true if truly HTTP

// ensure the registry endpoint is HTTPS before sending credentials
if (!registryUrl.startsWith("https://") && !allowInsecure) {
  throw new IllegalStateException("insecure registry; enable allowInsecureRegistries or use TLS");
}

try { jibBuild() } catch (BuildStepsExecutionException e) {
  if (e.getCause() instanceof RegistryCredentialsNotSentException) {
    // fix TLS on the registry or explicitly allow insecure registries
  }
}

When it happens

Trigger: The registry rejects a request because Jib refused to send credentials — typically when the registry/redirect endpoint is not HTTPS or is an insecure registry, so Jib avoids leaking credentials.

Common situations: Pushing to a plain-HTTP private registry; self-signed or misconfigured TLS termination that downgrades the connection; registry behind a load balancer redirecting to HTTP.

Related errors

• ${helpfulSuggestions.none()}
• ${helpfulSuggestions.forNoCredentialsDefined(registryUnautho
• 'Bearer' was not found in the 'WWW-Authenticate' header, tri
• 'realm' was not found in the 'WWW-Authenticate' header, trie
• Did not get token in authentication response from ${authenti

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/30688471662b1823. Report an issue: GitHub.