diff --git a/docs/cmd/tkn_bundle_list.md b/docs/cmd/tkn_bundle_list.md index fab6ef338d..2fc56ae21e 100644 --- a/docs/cmd/tkn_bundle_list.md +++ b/docs/cmd/tkn_bundle_list.md @@ -42,7 +42,7 @@ Caching: -o, --output string Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file). --remote-bearer string A Bearer token to authenticate against the repository --remote-password string A password to pass to the registry for basic auth. Must be used with --remote-username - --remote-skip-tls If set to true, skips TLS check when connecting to the registry + --remote-skip-tls Skip TLS certificate verification and allow plain-HTTP connections to the registry (opt-in insecure mode) --remote-username string A username to pass to the registry for basic auth. Must be used with --remote-password --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format. --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview]. diff --git a/docs/cmd/tkn_bundle_push.md b/docs/cmd/tkn_bundle_push.md index dcdd3b6fd3..e2b1143e81 100644 --- a/docs/cmd/tkn_bundle_push.md +++ b/docs/cmd/tkn_bundle_push.md @@ -39,7 +39,7 @@ Created time: --label strings OCI Config labels in the form of key=value to be added to the OCI image. Can be provided multiple times to add multiple labels. --remote-bearer string A Bearer token to authenticate against the repository --remote-password string A password to pass to the registry for basic auth. Must be used with --remote-username - --remote-skip-tls If set to true, skips TLS check when connecting to the registry + --remote-skip-tls Skip TLS certificate verification and allow plain-HTTP connections to the registry (opt-in insecure mode) --remote-username string A username to pass to the registry for basic auth. Must be used with --remote-password ``` diff --git a/docs/cmd/tkn_task_start.md b/docs/cmd/tkn_task_start.md index 8cde7c12a5..a0f0b59f2f 100644 --- a/docs/cmd/tkn_task_start.md +++ b/docs/cmd/tkn_task_start.md @@ -68,7 +68,7 @@ For passing the workspaces via flags: --prefix-name string specify a prefix for the TaskRun name (must be lowercase alphanumeric characters) --remote-bearer string A Bearer token to authenticate against the repository --remote-password string A password to pass to the registry for basic auth. Must be used with --remote-username - --remote-skip-tls If set to true, skips TLS check when connecting to the registry + --remote-skip-tls Skip TLS certificate verification and allow plain-HTTP connections to the registry (opt-in insecure mode) --remote-username string A username to pass to the registry for basic auth. Must be used with --remote-password -s, --serviceaccount string pass the serviceaccount name --showlog show logs right after starting the Task diff --git a/docs/man/man1/tkn-bundle-list.1 b/docs/man/man1/tkn-bundle-list.1 index 0e2832b0b5..39c104b0db 100644 --- a/docs/man/man1/tkn-bundle-list.1 +++ b/docs/man/man1/tkn-bundle-list.1 @@ -78,7 +78,7 @@ Caching: .PP \fB\-\-remote\-skip\-tls\fP[=false] - If set to true, skips TLS check when connecting to the registry + Skip TLS certificate verification and allow plain\-HTTP connections to the registry (opt\-in insecure mode) .PP \fB\-\-remote\-username\fP="" diff --git a/docs/man/man1/tkn-bundle-push.1 b/docs/man/man1/tkn-bundle-push.1 index bc935cfaed..25795a06e9 100644 --- a/docs/man/man1/tkn-bundle-push.1 +++ b/docs/man/man1/tkn-bundle-push.1 @@ -75,7 +75,7 @@ Created time: .PP \fB\-\-remote\-skip\-tls\fP[=false] - If set to true, skips TLS check when connecting to the registry + Skip TLS certificate verification and allow plain\-HTTP connections to the registry (opt\-in insecure mode) .PP \fB\-\-remote\-username\fP="" diff --git a/docs/man/man1/tkn-task-start.1 b/docs/man/man1/tkn-task-start.1 index eb7b8753d9..e8f60ccbd8 100644 --- a/docs/man/man1/tkn-task-start.1 +++ b/docs/man/man1/tkn-task-start.1 @@ -69,7 +69,7 @@ Start Tasks .PP \fB\-\-remote\-skip\-tls\fP[=false] - If set to true, skips TLS check when connecting to the registry + Skip TLS certificate verification and allow plain\-HTTP connections to the registry (opt\-in insecure mode) .PP \fB\-\-remote\-username\fP="" diff --git a/pkg/bundle/flags.go b/pkg/bundle/flags.go index 4f946127b3..e155ceee03 100644 --- a/pkg/bundle/flags.go +++ b/pkg/bundle/flags.go @@ -4,6 +4,7 @@ import ( "net/http" "github.com/google/go-containerregistry/pkg/authn" + "github.com/google/go-containerregistry/pkg/name" remoteimg "github.com/google/go-containerregistry/pkg/v1/remote" "github.com/spf13/pflag" ) @@ -39,7 +40,7 @@ func (r *RemoteOptions) ToOptions() []remoteimg.Option { opts = []remoteimg.Option{remoteimg.WithAuthFromKeychain(keychains)} } - transport := http.DefaultTransport.(*http.Transport) + transport := http.DefaultTransport.(*http.Transport).Clone() if r.skipTLS { transport.TLSClientConfig.InsecureSkipVerify = r.skipTLS } @@ -48,6 +49,17 @@ func (r *RemoteOptions) ToOptions() []remoteimg.Option { return opts } +// NameOptions returns name-parsing options that reflect the current remote settings. +// name.Insecure is only included when --remote-skip-tls is set, to prevent +// unintentional plain-HTTP registry connections (CWE-319). +// Callers that require strict reference validation should add name.StrictValidation themselves. +func (r *RemoteOptions) NameOptions() []name.Option { + if r.skipTLS { + return []name.Option{name.Insecure} + } + return nil +} + // AddRemoteFlags will define a common set of flags that can be used to change how images are pushed/fetched from remote // image repositories. func AddRemoteFlags(flags *pflag.FlagSet, opts *RemoteOptions) { @@ -56,7 +68,7 @@ func AddRemoteFlags(flags *pflag.FlagSet, opts *RemoteOptions) { flags.StringVar(&opts.basicPassword, "remote-password", "", "A password to pass to the registry for basic auth. Must be used with --remote-username") // TLS related flags. - flags.BoolVar(&opts.skipTLS, "remote-skip-tls", false, "If set to true, skips TLS check when connecting to the registry") + flags.BoolVar(&opts.skipTLS, "remote-skip-tls", false, "Skip TLS certificate verification and allow plain-HTTP connections to the registry (opt-in insecure mode)") } // PullOptions configure how an image is cached once it is fetched from the remote. diff --git a/pkg/cmd/bundle/list.go b/pkg/cmd/bundle/list.go index a2f67fd0d2..628e45c08d 100644 --- a/pkg/cmd/bundle/list.go +++ b/pkg/cmd/bundle/list.go @@ -85,7 +85,7 @@ Caching: return errInvalidRef } - ref, err := name.ParseReference(args[0], name.StrictValidation, name.Insecure) + ref, err := name.ParseReference(args[0], append([]name.Option{name.StrictValidation}, opts.remoteOptions.NameOptions()...)...) if err != nil { return err } diff --git a/pkg/cmd/bundle/push.go b/pkg/cmd/bundle/push.go index 350e5ddcd8..48607f761c 100644 --- a/pkg/cmd/bundle/push.go +++ b/pkg/cmd/bundle/push.go @@ -84,7 +84,7 @@ Created time: return errInvalidRef } - if _, err := name.ParseReference(args[0], name.StrictValidation, name.Insecure); err != nil { + if _, err := name.ParseReference(args[0], append([]name.Option{name.StrictValidation}, opts.remoteOptions.NameOptions()...)...); err != nil { return err } @@ -112,7 +112,7 @@ Created time: // Reads the positional arguments and the `-f` flag to fill in the `bunldeContents` parameter with all of the raw Tekton // contents. func (p *pushOptions) parseArgsAndFlags(args []string) (err error) { - p.ref, _ = name.ParseReference(args[0], name.StrictValidation, name.Insecure) + p.ref, _ = name.ParseReference(args[0], append([]name.Option{name.StrictValidation}, p.remoteOptions.NameOptions()...)...) // If there are file paths specified, then read them and include their contents. for _, path := range p.bundleContentPaths {