code: func (pm *Manager) Privileges(ctx context.Context, ref reference.Named, metaHeader http.Header, authConfig *types.AuthConfig) (types.PluginPrivileges, error) {
  	// create image store instance
  	cs := &tempConfigStore{}
  
  	// DownloadManager not defined because only pulling configuration.
  	pluginPullConfig := &distribution.ImagePullConfig{
  		Config: distribution.Config{
  			MetaHeaders:      metaHeader,
  			AuthConfig:       authConfig,
  			RegistryService:  pm.config.RegistryService,
  			ImageEventLogger: func(string, string, string) {},
  			ImageStore:       cs,
  		},
  		Schema2Types: distribution.PluginTypes,
  	}
  
  	if err := pm.pull(ctx, ref, pluginPullConfig, nil); err != nil {
  		return nil, err
  	}
  
  	if cs.config == nil {
  		return nil, errors.New("no configuration pulled")
  	}
  	var config types.PluginConfig
  	if err := json.Unmarshal(cs.config, &config); err != nil {
  		return nil, errdefs.System(err)
  	}
  
  	return computePrivileges(config), nil
  }
docs: // Privileges pulls a plugin config and computes the privileges required to install it.