fix(login): accept equivalent registry hosts in auth creds callback

[xianyuwu]

PR Title

fix(login): accept equivalent registry hosts in auth creds callback

PR Body

Summary

nerdctl login fails against registries served on the default HTTPS port (443)
with:

FATA failed to call rh.Authorizer.AddResponses: expected acArg to be "harbor.example.io:443", got "harbor.example.io"

docker login works fine against the same registry.

Fixes #3992
Refs #3245

Root cause

In pkg/cmd/login/login.go, the credentials callback passed to the containerd
authorizer used a strict string equality check:

authCreds := func(acArg string) (string, string, error) {
    if acArg == host { ... }
    return "", "", fmt.Errorf("expected acArg to be %q, got %q", host, acArg)
}

However, the two sides of the comparison are built differently:

• host comes from dockerconfigresolver.Parse(), which appends the
  standard HTTPS port explicitly when the user did not specify one
  (registryurl.go), so host is harbor.example.io:443.
• acArg is passed by containerd's dockerAuthorizer.AddResponses() as
  last.Request.URL.Host, i.e. the host of the actual request, which is
  harbor.example.io — without the default port.

The same fragility produces #3245: logging in to docker.io resolves to
index.docker.io:443, while the actual registry endpoint calling back is
registry-1.docker.io.

Fix

Replace the strict equality check with an equivalence check
(isEquivalentRegistryHost) that additionally accepts:

1. The same hostname with the default HTTPS port (443) omitted — when the user
   did not explicitly configure a non-default port.
2. Docker Hub aliases: index.docker.io (the address docker.io resolves to)
   and registry-1.docker.io (the actual registry endpoint).

Callback hosts carrying an explicit non-standard port still must match
exactly, so credentials are never served to a different endpoint.

This mirrors the equivalence rules already encoded in
RegistryURL.AllIdentifiers() for credential lookup.

Test plan

Added pkg/cmd/login/login_test.go with table-driven cases covering:

• exact host with standard port (unchanged behavior)
• host without default port — reproduces Unable to log in to private registry #3992
• registry-1.docker.io with/without port against a docker.io login —
  reproduces Login to docker.io failed. (expected acArg to be "docker.io", got "registry-1.docker.io") #3245
• mismatched hostname — still rejected
• explicit non-standard port (:8443) — not silently dropped or matched

$ go test -v -run TestLoginAuthCredsAcceptsEquivalentHosts ./pkg/cmd/login/...
--- PASS: TestLoginAuthCredsAcceptsEquivalentHosts (0.00s)
    --- PASS: .../exact_host_with_standard_port
    --- PASS: .../host_without_default_port
    --- PASS: .../docker.io_alias_without_port
    --- PASS: .../docker.io_alias_with_port
    --- PASS: .../mismatched_host
    --- PASS: .../explicit_non-standard_port_not_dropped
    --- PASS: .../different_explicit_port
PASS
ok      github.com/containerd/nerdctl/v2/pkg/cmd/login

The failing scenarios from both issues were reproduced against a private Harbor
registry served on port 443 (nerdctl login --insecure-registry); the unit
test cases above encode exactly those mismatches.

[xianyuwu]

The failing in-host / rootless linux job appears to be a flake unrelated to this change: the only failing test is TestComposeUpWithExternalNetwork (1 out of 1385), where nerdctl exec con-1 wget -qO- http://con-2 failed with wget: bad address — a container DNS resolution hiccup in the rootless environment. The cmd/nerdctl/login tests (which cover this PR) pass, and the other rootless variants (arm, slirp4netns, old ubuntu) are all green.

Unfortunately I don't have permission to re-run the job. Could a maintainer re-run the failed check? A review would also be much appreciated. @AkihiroSuda PTAL when you have a moment, thanks!

[Copilot]

Pull request overview

Fixes login credential callbacks for equivalent registry hosts and Docker Hub aliases.

Changes:

• Adds host-equivalence logic for omitted HTTPS ports and Docker Hub aliases.
• Adds table-driven credential callback tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pkg/cmd/login/login.go	Implements equivalent-host credential matching.
pkg/cmd/login/login_test.go	Tests accepted and rejected host variants.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[xianyuwu]

Fixed in e604593 — the Docker Hub alias is now only honored when the login target uses the standard HTTPS port, and the index.docker.io:8443 rejection cases are covered in the test table.

[xianyuwu]

Fixed in e604593 — the port-less fallback now goes through url.URL.Hostname(), so [::1] matches ::1. Added [::1] and [::1]:443 cases to the test table.