Pass insecure registry flags through to referrers

[cmurphy]

Fixes #4466

• Tests

Summary

Release Note

Documentation

[codecov]

Codecov Report

❌ Patch coverage is 45.45455% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 36.72%. Comparing base (2ef6022) to head (8a0638e).
⚠️ Report is 572 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/verify/verify.go	0.00%	4 Missing ⚠️
cmd/cosign/cli/verify/verify_attestation.go	0.00%	4 Missing ⚠️
cmd/cosign/cli/attest/attest.go	0.00%	2 Missing ⚠️
cmd/cosign/cli/sign/sign.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4489      +/-   ##
==========================================
- Coverage   40.10%   36.72%   -3.38%     
==========================================
  Files         155      220      +65     
  Lines       10044    12125    +2081     
==========================================
+ Hits         4028     4453     +425     
- Misses       5530     6984    +1454     
- Partials      486      688     +202     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[steiza]

I'm not sure if this is working right, or if I'm doing something wrong while testing this.

I'm working off the instructions on https://github.com/tstromberg/sigstore-the-local-way?tab=readme-ov-file#11-starting-a-local-registry.

I think cosign does something special with localhost, because even on main this works:

$ go run cmd/cosign/main.go verify --key cosign.pub --allow-insecure-registry=true --allow-http-registry=true localhost:1338/demo/sigstore-go-verification-ce4f5bf3233ac2b951c3667b2d19da3a:latest 

Verification for localhost:1338/demo/sigstore-go-verification-ce4f5bf3233ac2b951c3667b2d19da3a:latest --
...

But if I set up a DNS alias in /etc/hosts:

$ cat /etc/hosts | grep 'asdf.example.com'
127.0.0.1 asdf.example.com
$ ping asdf.example.com
PING asdf.example.com (127.0.0.1): 56 data bytes

... then verification fails, both on main and with these changes:

$ go run cmd/cosign/main.go verify --key cosign.pub --allow-insecure-registry=true --allow-http-registry=true asdf.example.com:1338/demo/sigstore-go-verification-ce4f5bf3233ac2b951c3667b2d19da3a:latest 
Error: no signatures found

Again, I might be doing something wrong here!

[cmurphy]

I think cosign does something special with localhost, because even on main this works:

Yep, cosign treats localhost and *.local as special because of google/go-containerregistry#125

then verification fails, both on main and with these changes:

I think no signatures found could be a bundle/no bundle problem, was that image signed with an old version of cosign? Does it work when you add --new-bundle-format=false?

[steiza]

I think no signatures found could be a bundle/no bundle problem, was that image signed with an old version of cosign? Does it work when you add --new-bundle-format=false?

I don't think this is it, because I'm running off an up-to-date main and your branch. The only thing I'm changing between the verification commands is if the container starts with localhost or asdf.example.com (which resolves to 127.0.0.1).

But just to be sure, I checked again and got the same behavior.

[cmurphy]

@steiza you were right, and I fixed the tests to catch that issue.

[steiza]

One minor comment, but I'm also in favor of landing this as-is, since it is definitely an improvement!

[steiza]

Minor: so our RegistryOptions.AllowHTTPRegistry maps to name.Insecure which both mean "it's okay if the registry uses plain HTTP without TLS.

But my interpretation of RegistryOptions.AllowInsecure is that the registry is using TLS, but with a self-signed certificate (or at least a certificate that doesn't verify with the machine's certificate store).

🤷 Are there people actually using that configuration? Or is everyone just using an HTTP registry? I guess we'll find out! I didn't see a "use TLS but allow certificates that don't verify with the machine's certificate store" on https://pkg.go.dev/github.com/google/[email protected]/pkg/name.

[cmurphy]

Yeah, it didn't seem like go-containerregistry makes a distinction between them.