use timestamp from challenge, fallback to local time

server/auth.go

@@ -20,9 +20,10 @@ import (
 )
 
 type registryChallenge struct {
-	Realm   string
-	Service string
-	Scope   string
+	Realm     string
+	Service   string
+	Scope     string
+	Timestamp time.Time
 }
 
 func (r registryChallenge) URL() (*url.URL, error) {
@@ -37,7 +38,7 @@ func (r registryChallenge) URL() (*url.URL, error) {
 		values.Add("scope", s)
 	}
 
-	values.Add("ts", strconv.FormatInt(time.Now().Unix(), 10))
+	values.Add("ts", strconv.FormatInt(r.Timestamp.Unix(), 10))
 
 	nonce, err := auth.NewNonce(rand.Reader, 16)
 	if err != nil {

server/images.go

@@ -21,6 +21,7 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/ollama/ollama/api"
 	"github.com/ollama/ollama/auth"
@@ -1111,10 +1112,16 @@ func getValue(header, key string) string {
 func parseRegistryChallenge(authStr string) registryChallenge {
 	authStr = strings.TrimPrefix(authStr, "Bearer ")
 
+	s, err := strconv.ParseInt(getValue(authStr, "timestamp"), 10, 64)
+	if err != nil {
+		s = time.Now().Unix()
+	}
+
 	return registryChallenge{
-		Realm:   getValue(authStr, "realm"),
-		Service: getValue(authStr, "service"),
-		Scope:   getValue(authStr, "scope"),
+		Realm:     getValue(authStr, "realm"),
+		Service:   getValue(authStr, "service"),
+		Scope:     getValue(authStr, "scope"),
+		Timestamp: time.Unix(s, 0),
 	}
 }