{"record":{"id":"30688471662b1823","repo":"GoogleContainerTools/jib","slug":"helpfulsuggestions-forcredentialsnotsent","errorCode":null,"errorMessage":"${helpfulSuggestions.forCredentialsNotSent()}","messagePattern":"\\$\\{helpfulSuggestions\\.forCredentialsNotSent\\(\\)\\}","errorType":"exception","errorClass":"BuildStepsExecutionException","httpStatus":null,"severity":"error","filePath":"jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/JibBuildRunner.java","lineNumber":259,"sourceCode":"        Files.write(imageIdOutputPath, imageId.getBytes(StandardCharsets.UTF_8));\n      }\n      if (imageJsonOutputPath != null) {\n        ImageMetadataOutput metadataOutput = ImageMetadataOutput.fromJibContainer(jibContainer);\n        String imageJson = metadataOutput.toJson();\n        Files.write(imageJsonOutputPath, imageJson.getBytes(StandardCharsets.UTF_8));\n      }\n\n      return jibContainer;\n\n    } catch (HttpHostConnectException ex) {\n      // Failed to connect to registry.\n      throw new BuildStepsExecutionException(helpfulSuggestions.forHttpHostConnect(), ex);\n\n    } catch (RegistryUnauthorizedException ex) {\n      handleRegistryUnauthorizedException(ex, helpfulSuggestions);\n\n    } catch (RegistryCredentialsNotSentException ex) {\n      throw new BuildStepsExecutionException(helpfulSuggestions.forCredentialsNotSent(), ex);\n\n    } catch (RegistryAuthenticationFailedException ex) {\n      if (ex.getCause() instanceof ResponseException) {\n        handleRegistryUnauthorizedException(\n            new RegistryUnauthorizedException(\n                ex.getServerUrl(), ex.getImageName(), (ResponseException) ex.getCause()),\n            helpfulSuggestions);\n      } else {\n        // Unknown cause\n        throw new BuildStepsExecutionException(helpfulSuggestions.none(), ex);\n      }\n\n    } catch (UnknownHostException ex) {\n      throw new BuildStepsExecutionException(helpfulSuggestions.forUnknownHost(), ex);\n\n    } catch (InsecureRegistryException ex) {\n      throw new BuildStepsExecutionException(helpfulSuggestions.forInsecureRegistry(), ex);\n","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/JibBuildRunner.java#L241-L277","documentation":"runBuild catches RegistryCredentialsNotSentException and wraps it in a BuildStepsExecutionException with HelpfulSuggestions.forCredentialsNotSent(). This occurs when the registry connection required authentication, but Jib did not send credentials over the (non-encrypted or unexpected) connection — usually when a server redirects or is accessed over plain HTTP and credentials were withheld.","triggerScenarios":"The registry rejects a request because Jib refused to send credentials — typically when the registry/redirect endpoint is not HTTPS or is an insecure registry, so Jib avoids leaking credentials.","commonSituations":"Pushing to a plain-HTTP private registry; self-signed or misconfigured TLS termination that downgrades the connection; registry behind a load balancer redirecting to HTTP.","solutions":["Serve the registry over proper HTTPS (fix TLS certificates/load balancer config).","If it's a trusted insecure registry, mark it as such (`jib.to.setAllowInsecureRegistries(true)` or `-DsendCredentialsOverHttp=true` for plain HTTP).","Prefer configuring credentials so Jib can use the HTTPS endpoint correctly.","Check for redirects to http:// and eliminate them at the proxy/registry level."],"exampleFix":"// before (plain HTTP registry, credentials withheld)\njib.to.image = \"myregistry.local:5000/app\"\n// after\nplugins { id 'com.google.cloud.tools.jib' }\njib.to.allowInsecureRegistries = true\njib.to.image = \"myregistry.local:5000/app\"  // plus -DsendCredentialsOverHttp=true if truly HTTP","handlingStrategy":"validation","validationCode":"// ensure the registry endpoint is HTTPS before sending credentials\nif (!registryUrl.startsWith(\"https://\") && !allowInsecure) {\n  throw new IllegalStateException(\"insecure registry; enable allowInsecureRegistries or use TLS\");\n}","typeGuard":null,"tryCatchPattern":"try { jibBuild() } catch (BuildStepsExecutionException e) {\n  if (e.getCause() instanceof RegistryCredentialsNotSentException) {\n    // fix TLS on the registry or explicitly allow insecure registries\n  }\n}","preventionTips":["Always serve private registries over valid HTTPS","Avoid HTTP redirects from the registry endpoint","If plain HTTP is required, set -DsendCredentialsOverHttp=true knowingly","Monitor certificate expiry on registry TLS termination"],"tags":["docker","registry","authentication","tls"],"backgroundTag":"credentials-not-sent","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}