@VisibleForTesting
  static boolean canAttemptBlobMount(@Nullable Authorization authorization, String repository) {
    if (!isBearerAuth(authorization)) {
      // Authorization methods other than the Docker Container Registry Token don't provide
      // information as to which repositories are accessible.  The caller should attempt the mount
      // and rely on the registry fallback as required by the spec.
      // https://docs.docker.com/registry/spec/api/#pushing-an-image
      return true;
    }
    // if null then does not appear to be a DCRT
    Multimap<String, String> repositoryGrants =
        decodeTokenRepositoryGrants(Verify.verifyNotNull(authorization).getToken());
    return repositoryGrants == null || repositoryGrants.containsEntry(repository, "pull");
  }
Check if the authorization allows using the specified repository can be mounted by the remote
registry as a source for blobs. More specifically, we can only check if the repository is not
disallowed.

@param repository repository in question
@return {@code true} if the repository appears to be mountable
jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryClient.java