[cherry-pick: release-v0.37.x] fix(bundle): gate name.Insecure behind --remote-skip-tls (CWE-319)

docs/cmd/tkn_bundle_list.md

@@ -42,7 +42,7 @@ Caching:
   -o, --output string                 Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
       --remote-bearer string          A Bearer token to authenticate against the repository
       --remote-password string        A password to pass to the registry for basic auth. Must be used with --remote-username
-      --remote-skip-tls               If set to true, skips TLS check when connecting to the registry
+      --remote-skip-tls               Skip TLS certificate verification and allow plain-HTTP connections to the registry (opt-in insecure mode)
       --remote-username string        A username to pass to the registry for basic auth. Must be used with --remote-password
       --show-managed-fields           If true, keep the managedFields when printing objects in JSON or YAML format.
       --template string               Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

docs/cmd/tkn_bundle_push.md

@@ -39,7 +39,7 @@ Created time:
       --label strings            OCI Config labels in the form of key=value to be added to the OCI image. Can be provided multiple times to add multiple labels.
       --remote-bearer string     A Bearer token to authenticate against the repository
       --remote-password string   A password to pass to the registry for basic auth. Must be used with --remote-username
-      --remote-skip-tls          If set to true, skips TLS check when connecting to the registry
+      --remote-skip-tls          Skip TLS certificate verification and allow plain-HTTP connections to the registry (opt-in insecure mode)
       --remote-username string   A username to pass to the registry for basic auth. Must be used with --remote-password
 ```
 

docs/cmd/tkn_task_start.md

@@ -68,7 +68,7 @@ For passing the workspaces via flags:
       --prefix-name string        specify a prefix for the TaskRun name (must be lowercase alphanumeric characters)
       --remote-bearer string      A Bearer token to authenticate against the repository
       --remote-password string    A password to pass to the registry for basic auth. Must be used with --remote-username
-      --remote-skip-tls           If set to true, skips TLS check when connecting to the registry
+      --remote-skip-tls           Skip TLS certificate verification and allow plain-HTTP connections to the registry (opt-in insecure mode)
       --remote-username string    A username to pass to the registry for basic auth. Must be used with --remote-password
   -s, --serviceaccount string     pass the serviceaccount name
       --showlog                   show logs right after starting the Task

docs/man/man1/tkn-bundle-list.1

@@ -78,7 +78,7 @@ Caching:
 
 .PP
 \fB\-\-remote\-skip\-tls\fP[=false]
-    If set to true, skips TLS check when connecting to the registry
+    Skip TLS certificate verification and allow plain\-HTTP connections to the registry (opt\-in insecure mode)
 
 .PP
 \fB\-\-remote\-username\fP=""

docs/man/man1/tkn-bundle-push.1

@@ -75,7 +75,7 @@ Created time:
 
 .PP
 \fB\-\-remote\-skip\-tls\fP[=false]
-    If set to true, skips TLS check when connecting to the registry
+    Skip TLS certificate verification and allow plain\-HTTP connections to the registry (opt\-in insecure mode)
 
 .PP
 \fB\-\-remote\-username\fP=""

docs/man/man1/tkn-task-start.1

@@ -69,7 +69,7 @@ Start Tasks
 
 .PP
 \fB\-\-remote\-skip\-tls\fP[=false]
-    If set to true, skips TLS check when connecting to the registry
+    Skip TLS certificate verification and allow plain\-HTTP connections to the registry (opt\-in insecure mode)
 
 .PP
 \fB\-\-remote\-username\fP=""

pkg/bundle/flags.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/name"
 	remoteimg "github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/spf13/pflag"
 )
@@ -39,7 +40,7 @@ func (r *RemoteOptions) ToOptions() []remoteimg.Option {
 		opts = []remoteimg.Option{remoteimg.WithAuthFromKeychain(keychains)}
 	}
 
-	transport := http.DefaultTransport.(*http.Transport)
+	transport := http.DefaultTransport.(*http.Transport).Clone()
 	if r.skipTLS {
 		transport.TLSClientConfig.InsecureSkipVerify = r.skipTLS
 	}
@@ -48,6 +49,17 @@ func (r *RemoteOptions) ToOptions() []remoteimg.Option {
 	return opts
 }
 
+// NameOptions returns name-parsing options that reflect the current remote settings.
+// name.Insecure is only included when --remote-skip-tls is set, to prevent
+// unintentional plain-HTTP registry connections (CWE-319).
+// Callers that require strict reference validation should add name.StrictValidation themselves.
+func (r *RemoteOptions) NameOptions() []name.Option {
+	if r.skipTLS {
+		return []name.Option{name.Insecure}
+	}
+	return nil
+}
+
 // AddRemoteFlags will define a common set of flags that can be used to change how images are pushed/fetched from remote
 // image repositories.
 func AddRemoteFlags(flags *pflag.FlagSet, opts *RemoteOptions) {
@@ -56,7 +68,7 @@ func AddRemoteFlags(flags *pflag.FlagSet, opts *RemoteOptions) {
 	flags.StringVar(&opts.basicPassword, "remote-password", "", "A password to pass to the registry for basic auth. Must be used with --remote-username")
 
 	// TLS related flags.
-	flags.BoolVar(&opts.skipTLS, "remote-skip-tls", false, "If set to true, skips TLS check when connecting to the registry")
+	flags.BoolVar(&opts.skipTLS, "remote-skip-tls", false, "Skip TLS certificate verification and allow plain-HTTP connections to the registry (opt-in insecure mode)")
 }
 
 // PullOptions configure how an image is cached once it is fetched from the remote.

pkg/cmd/bundle/list.go

@@ -85,7 +85,7 @@ Caching:
 				return errInvalidRef
 			}
 
-			ref, err := name.ParseReference(args[0], name.StrictValidation, name.Insecure)
+			ref, err := name.ParseReference(args[0], append([]name.Option{name.StrictValidation}, opts.remoteOptions.NameOptions()...)...)
 			if err != nil {
 				return err
 			}

pkg/cmd/bundle/push.go

@@ -84,7 +84,7 @@ Created time:
 				return errInvalidRef
 			}
 
-			if _, err := name.ParseReference(args[0], name.StrictValidation, name.Insecure); err != nil {
+			if _, err := name.ParseReference(args[0], append([]name.Option{name.StrictValidation}, opts.remoteOptions.NameOptions()...)...); err != nil {
 				return err
 			}
 
@@ -112,7 +112,7 @@ Created time:
 // Reads the positional arguments and the `-f` flag to fill in the `bunldeContents` parameter with all of the raw Tekton
 // contents.
 func (p *pushOptions) parseArgsAndFlags(args []string) (err error) {
-	p.ref, _ = name.ParseReference(args[0], name.StrictValidation, name.Insecure)
+	p.ref, _ = name.ParseReference(args[0], append([]name.Option{name.StrictValidation}, p.remoteOptions.NameOptions()...)...)
 
 	// If there are file paths specified, then read them and include their contents.
 	for _, path := range p.bundleContentPaths {