Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix interacting with insecure HTTPS registries #2028

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

aler9
Copy link

@aler9 aler9 commented Oct 22, 2024

The Docker daemon allows to interact with insecure registries served through plain HTTP or served through HTTPS with self-signed certificates, when the target registry is included inside insecureRegistries. In this library it should be possible to interact with insecure registries likewise by using the name.Insecure option when creating references.

Nonetheless it's currently not possible to interact with insecure registries served with HTTPS and self-signed certificates, since the TLS certificate is checked anyway and an "invalid certificate" error is returned.

A common workaround consists into passing a tls.Config with InsecureSkipVerify set to true, but this disables TLS validation for every HTTP request, while the desired behavior is disabling TLS validation only when name.Insecure is in use.

This patch changes the default remote options in order to provide a default tls.Config with InsecureSkipVerify set to true if and only if name.Insecure is in use.

This also fixes bugs in dependent tools like Skaffold, that are passing name.Insecure and not InsecureSKipVerify as arguments to this library and are expecting to be able to interact with insecure HTTPS registries anyway.

Sample code:

ref, err := name.ParseReference("my.insecure.registry", name.Insecure)
if err != nil {
	panic(err)
}

img, err := remote.Image(ref, remote.WithAuth(&authn.Basic{Username: "user", Password: "pass"}))
if err != nil {
	panic(err)
}

fmt.Println(img)

I am expecting this to work when my.insecure.registry is either a plain HTTP server or a self-signed HTTPS server, but it works only in the former case.

The Docker daemon allows to interact with insecure registries served
through plain HTTP or served through HTTPS with self-signed
certificates, when the target registry is included inside
"insecureRegistries". In this library it should be possible to interact
with insecure registries likewise by using the "name.Insecure" option
when creating references.

Nonetheless it's currently not possible to interact with insecure
registries served with HTTPS and self-signed certificates, since the
TLS certificate is checked anyway and an "invalid certificate" error is
returned.

A common workaround consists into passing a tls.Config with
InsecureSkipVerify set to true, but this disables TLS validation for
every HTTP request, while the desired behavior is disabling TLS
validation only when "name.Insecure" is in use.

This patch changes the default "remote" options in order to provide a
default tls.Config with InsecureSkipVerify set to true if and only if
"name.Insecure" is in use.

This also fixes bugs in dependent tools like Skaffold, that are using
"name.Insecure", are not using InsecureSKipVerify and are expecting to
be able to interact with insecure registries anyway.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant