unable to create a zarf package containing images from a registry with a self-signed certificate

[blancharda]

Context

We are attempting to package a helm chart which uses an image from a private internal docker registry. The registry is configured with a self-signed cert. Our local development environments are configured to properly trust and verify the cert, we are able to interact with the registry using (secure) docker commands.

Error Case

zarf package create fails to pull images -- even when using the --insecure flag.
This may also impact genuinely insecure registries (configured entirely without https), though that is untested.

Environment

Device and OS: MacOS, Ubuntu22.04
Zarf version: v0.22.2

Steps to reproduce

Run zarf package create --insecure -l trace on a package containing an image from a registry with an unverified or otherwise invalid cert.

Expected result

Zarf/Crane will bypass any certificate validation errors while pulling images due to the --insecure flag, resulting in a successful zarf package creation..

Actual Results

MacOS:

...
  ✔  Loading 4 K8s manifests
  DEBUG   Get "https://harbor.valkyrie.lan/v2/": x509: “Valkyrie” certificate is not standards compliant; Get "https://harbor.valkyrie.lan:443/v2/": x509: “Valkyrie” certificate is not standards compliant
└ (/home/runner/work/zarf/zarf/src/internal/message/spinner.go:116)
     ERROR:  Unable to pull the image "harbor.valkyrie.lan/valkyrie/arkime3:latest"
└ (/home/runner/work/zarf/zarf/src/internal/images/pull.go:48)

On MacOS, I believe this specific error is related to a golang issue involving a change to the crypto package. Additional testing indicated this was not the root of the problem -- to validate, we also tested on Ubuntu, shown below.

Ubuntu22.04:

...
  ✔  Loading 4 K8s manifests
  DEBUG   Get "https://harbor.valkyrie.lan/v2/": x509: certificate is not valid for any names, but wanted to match harbor.valkyrie.lan; Get "https://harbor.valkyrie.lan:443/v2/": x509: certificate is not valid for any names, but wanted to match harbor.valkyrie.lan
└ (/home/runner/work/zarf/zarf/src/internal/message/spinner.go:116)
     ERROR:  Unable to pull the image "harbor.valkyrie.lan/valkyrie/arkime3:latest"
└ (/home/runner/work/zarf/zarf/src/internal/images/pull.go:48)

Similarly on Ubuntu, if we eliminate the hostname matching altogether and attempt to pull from the server IP, we see the following despite using the --insecure flag:

...
  ✔  Loading 4 K8s manifests
  DEBUG   Get "https://10.1.25.34/v2/": x509: certificate signed by unknown authority; Get "https://10.1.25.34:443/v2/": x509: certificate signed by unknown authority
└ (/home/runner/work/zarf/zarf/src/internal/message/spinner.go:116)
     ERROR:  Unable to pull the image "10.1.25.34/valkyrie/arkime3:latest"
└ (/home/runner/work/zarf/zarf/src/internal/images/pull.go:48)

[blancharda]

May relate to #561

[Racer159]

Fixed in #1280