From 70d31c1e9a7cce9863ce3e1fa1349908eabdf09e Mon Sep 17 00:00:00 2001
From: Michael Yang <mxyng@pm.me>
Date: Tue, 25 Jun 2024 10:12:02 -0700
Subject: [PATCH] use timestamp from challenge, fallback to local time

---
 server/auth.go   |  9 +++++----
 server/images.go | 13 ++++++++++---
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/server/auth.go b/server/auth.go
index e92a5b657..d2293bf40 100644
--- a/server/auth.go
+++ b/server/auth.go
@@ -20,9 +20,10 @@ import (
 )
 
 type registryChallenge struct {
-	Realm   string
-	Service string
-	Scope   string
+	Realm     string
+	Service   string
+	Scope     string
+	Timestamp time.Time
 }
 
 func (r registryChallenge) URL() (*url.URL, error) {
@@ -37,7 +38,7 @@ func (r registryChallenge) URL() (*url.URL, error) {
 		values.Add("scope", s)
 	}
 
-	values.Add("ts", strconv.FormatInt(time.Now().Unix(), 10))
+	values.Add("ts", strconv.FormatInt(r.Timestamp.Unix(), 10))
 
 	nonce, err := auth.NewNonce(rand.Reader, 16)
 	if err != nil {
diff --git a/server/images.go b/server/images.go
index e949fb18a..b9a1dc699 100644
--- a/server/images.go
+++ b/server/images.go
@@ -21,6 +21,7 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/ollama/ollama/api"
 	"github.com/ollama/ollama/auth"
@@ -1111,10 +1112,16 @@ func getValue(header, key string) string {
 func parseRegistryChallenge(authStr string) registryChallenge {
 	authStr = strings.TrimPrefix(authStr, "Bearer ")
 
+	s, err := strconv.ParseInt(getValue(authStr, "timestamp"), 10, 64)
+	if err != nil {
+		s = time.Now().Unix()
+	}
+
 	return registryChallenge{
-		Realm:   getValue(authStr, "realm"),
-		Service: getValue(authStr, "service"),
-		Scope:   getValue(authStr, "scope"),
+		Realm:     getValue(authStr, "realm"),
+		Service:   getValue(authStr, "service"),
+		Scope:     getValue(authStr, "scope"),
+		Timestamp: time.Unix(s, 0),
 	}
 }