2 files changed, 11 insertions, 11 deletions
diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index f423c011d..419225007 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -140,7 +140,7 @@ func getAuthCredentials(headers []string) (*types.DockerAuthConfig, map[string]t
 
 // MakeXRegistryConfigHeader returns a map with the "X-Registry-Config" header set, which can
 // conveniently be used in the http stack.
-func MakeXRegistryConfigHeader(sys *types.SystemContext, username, password string) (map[string]string, error) {
+func MakeXRegistryConfigHeader(sys *types.SystemContext, username, password string) (http.Header, error) {
 	if sys == nil {
 		sys = &types.SystemContext{}
 	}
@@ -163,18 +163,18 @@ func MakeXRegistryConfigHeader(sys *types.SystemContext, username, password stri
 	if err != nil {
 		return nil, err
 	}
-	return map[string]string{xRegistryConfigHeader: content}, nil
+	return http.Header{xRegistryConfigHeader: []string{content}}, nil
 }
 
 // MakeXRegistryAuthHeader returns a map with the "X-Registry-Auth" header set, which can
 // conveniently be used in the http stack.
-func MakeXRegistryAuthHeader(sys *types.SystemContext, username, password string) (map[string]string, error) {
+func MakeXRegistryAuthHeader(sys *types.SystemContext, username, password string) (http.Header, error) {
 	if username != "" {
 		content, err := encodeSingleAuthConfig(types.DockerAuthConfig{Username: username, Password: password})
 		if err != nil {
 			return nil, err
 		}
-		return map[string]string{xRegistryAuthHeader: content}, nil
+		return http.Header{xRegistryAuthHeader: []string{content}}, nil
 	}
 
 	if sys == nil {
@@ -188,7 +188,7 @@ func MakeXRegistryAuthHeader(sys *types.SystemContext, username, password string
 	if err != nil {
 		return nil, err
 	}
-	return map[string]string{xRegistryAuthHeader: content}, nil
+	return http.Header{xRegistryAuthHeader: []string{content}}, nil
 }
 
 // RemoveAuthfile is a convenience function that is meant to be called in a
diff --git a/pkg/auth/auth_test.go b/pkg/auth/auth_test.go
index f7e6e4ef6..2c79f0b7c 100644
--- a/pkg/auth/auth_test.go
+++ b/pkg/auth/auth_test.go
@@ -85,8 +85,8 @@ func TestMakeXRegistryConfigHeaderGetCredentialsRoundtrip(t *testing.T) {
 		require.NoError(t, err)
 		req, err := http.NewRequest(http.MethodPost, "/", nil)
 		require.NoError(t, err, tc.name)
-		for k, v := range headers {
-			req.Header.Set(k, v)
+		for _, v := range headers.Values(xRegistryConfigHeader) {
+			req.Header.Add(xRegistryConfigHeader, v)
 		}
 
 		override, resPath, err := GetCredentials(req)
@@ -137,8 +137,8 @@ func TestMakeXRegistryAuthHeaderGetCredentialsRoundtrip(t *testing.T) {
 		require.NoError(t, err)
 		req, err := http.NewRequest(http.MethodPost, "/", nil)
 		require.NoError(t, err, tc.name)
-		for k, v := range headers {
-			req.Header.Set(k, v)
+		for _, v := range headers.Values(xRegistryAuthHeader) {
+			req.Header.Set(xRegistryAuthHeader, v)
 		}
 
 		override, resPath, err := GetCredentials(req)
@@ -219,7 +219,7 @@ func TestMakeXRegistryConfigHeader(t *testing.T) {
 				require.Len(t, res, 1, tc.name)
 				header, ok := res[xRegistryConfigHeader]
 				require.True(t, ok, tc.name)
-				decodedHeader, err := base64.URLEncoding.DecodeString(header)
+				decodedHeader, err := base64.URLEncoding.DecodeString(header[0])
 				require.NoError(t, err, tc.name)
 				// Don't test for a specific JSON representation, just for the expected contents.
 				expected := map[string]interface{}{}
@@ -282,7 +282,7 @@ func TestMakeXRegistryAuthHeader(t *testing.T) {
 				require.Len(t, res, 1, tc.name)
 				header, ok := res[xRegistryAuthHeader]
 				require.True(t, ok, tc.name)
-				decodedHeader, err := base64.URLEncoding.DecodeString(header)
+				decodedHeader, err := base64.URLEncoding.DecodeString(header[0])
 				require.NoError(t, err, tc.name)
 				// Don't test for a specific JSON representation, just for the expected contents.
 				expected := map[string]interface{}{}