无法通过CLI推送ML模型至GitLab Model Registry：401未授权错误

尝试用curl将机器学习模型推送到GitLab Model Registry，持有能正常推送文件至包仓库的全权限token，但始终返回401未授权错误。

使用的curl命令：

curl --header "PRIVATE-TOKEN: $MODEL_REGISTRY_GITLAB" \
     --upload-file /path/to/model/file.pt \
   "https://gitlab.com/api/v4/projects/PROJECT_ID/packages/ml_models/1/files/model_file.pt"

已知信息 #

• Token：存储在MODEL_REGISTRY_GITLAB的token拥有全部权限，可成功推送文件至包仓库
• 项目ID：PROJECT_ID已确认无误
• 文件路径：本地文件路径正确且可访问

已排查步骤 #

1. 验证token及其权限
2. 确认PROJECT_ID和文件路径正确
3. 用curl verbose模式调试（已隐去隐私信息）：

* Host gitlab.com:443 was resolved.
* IPv6: [IPv6_ADDRESS]
* IPv4: [IPv4_ADDRESS]
*   Trying [2606:4700:90:0:f22e:fbec:5bed:a9b9]:443...
* Connected to gitlab.com ([IPv6_ADDRESS]) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=gitlab.com
*  start date: Apr 12 00:00:00 2025 GMT
*  expire date: May 11 23:59:59 2026 GMT
*  subjectAltName: host "gitlab.com" matched cert's "gitlab.com"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha384WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha384WithRSAEncryption
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://gitlab.com/api/v4/projects/[PROJECT_ID]/packages/ml_models/1/files/ibsa_detection_yolo_n.pt
* [HTTP/2] [1] [:method: PUT]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: gitlab.com]
* [HTTP/2] [1] [:path: /api/v4/projects/[PROJECT_ID]/packages/ml_models/1/files/ibsa_detection_yolo_n.pt]
* [HTTP/2] [1] [user-agent: curl/8.5.0]
* [HTTP/2] [1] [accept: */*]
* [HTTP/2] [1] [private-token: [TOKEN]]
* [HTTP/2] [1] [content-length: 5498010]
> PUT /api/v4/projects/[PROJECT_ID]/packages/ml_models/1/files/ibsa_detection_yolo_n.pt HTTP/2
> Host: gitlab.com
> User-Agent: curl/8.5.0
> Accept: */*
> PRIVATE-TOKEN: [TOKEN]
> Content-Length: 5498010
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* We are completely uploaded and fine
< HTTP/2 401
< date: Tue, 15 Jul 2025 15:49:07 GMT
< content-type: application/json
< content-length: 30
< cf-ray: [RAY_ID]
< cf-cache-status: DYNAMIC
< cache-control: no-cache
< strict-transport-security: max-age=31536000
< vary: Origin
< www-authenticate: Basic realm="GitLab Packages Registry"
< content-security-policy: default-src 'none'
< gitlab-lb: [LB_INFO]
< gitlab-sv: [SERVER_INFO]
< nel: {"max_age": 0}
< referrer-policy: strict-origin-when-cross-origin
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-gitlab-meta: {"correlation_id":"[CORRELATION_ID]","version":"1"}
< x-request-id: [REQUEST_ID]
< x-runtime: 0.018765
< set-cookie: [COOKIE_INFO]
< server: cloudflare
<
* Connection #0 to host gitlab.com left intact

核心疑问 #

1. 是否可以不使用MLflow将模型推送至GitLab Model Registry？
2. 若可以，导致401未授权错误的原因是什么，该如何解决？
3. 若不可行，MLflow是否是推送模型至GitLab Model Registry的唯一支持方式？

关于是否必须使用MLflow #

GitLab Model Registry主要推荐通过MLflow集成推送模型，但并非唯一方式——你也可以通过GitLab REST API直接操作，但需要遵循特定流程，不能复用普通包仓库的上传逻辑。

401错误的原因及解决方法 #

你遇到401的核心问题是使用了错误的API端点和请求流程：GitLab的ML模型仓库不支持直接通过/packages/ml_models/:id/files/:filename的PUT请求上传文件，该端点的权限校验逻辑与普通包仓库不同，即使token有包仓库权限也无法通过。

正确的API推送流程分为两步：

1. 创建ML模型版本：先调用POST接口创建模型版本，获取对应的版本ID和上传参数
2. 上传模型文件：使用第一步返回的预签名URL（已包含权限信息）上传文件

具体步骤示例 #

1. 创建模型版本（替换占位符）：

curl --request POST "https://gitlab.com/api/v4/projects/PROJECT_ID/packages/ml_models" \
     --header "PRIVATE-TOKEN: $MODEL_REGISTRY_GITLAB" \
     --header "Content-Type: application/json" \
     --data '{
       "name": "your-model-name",
       "version": "1.0.0",
       "description": "Model description"
     }'

该请求会返回包含模型版本ID和package_files上传信息的响应。

2. 上传模型文件：
   使用第一步返回的预签名URL上传文件，无需携带PRIVATE-TOKEN：

curl --upload-file /path/to/model/file.pt "返回的预签名上传URL"

补充说明 #

• 若坚持不用MLflow，必须严格遵循GitLab官方定义的ML模型API流程，不能复用普通包仓库的上传逻辑
• 确认token除包仓库权限外，还拥有api和write_repository权限（即使是全权限也建议再次核对）
• 检查GitLab实例版本：较旧版本对ML模型API的支持可能有限，建议使用最新稳定版

内容的提问来源于stack exchange，提问作者Ivan