build-support/docker: pass tlsVerify to support http registries

[edwtjo]

Disable TLS fetch for skopeo, default is unchanged and to use TLS.

Motivation for this change

Sometimes you have to deal with internal registries which do not have TLS gasp. In such cases this option should be useful.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Added a release notes entry if the change is major or breaking
• Fits CONTRIBUTING.md.

[roberth]

Thanks!

[teto]

I've just tried to update one of my images with

let
  pkgs = import ./nixpkgs.nix { };

  # To enable sandboxing the container has to be started with the --privileged flag and sandbox = true set in /etc/nix/nix.conf.
  nixBase = pkgs.dockerTools.pullImage {
    imageName = "nixos/nix";
    imageDigest = "sha256:d9bb3b85b846eb0b6c5204e0d76639dff72c7871fb68f5d4edcfbb727f8a5653";
    sha256 = "sha256-+ZEWyHjZ65P8Fl0rhFY5e5tGBogHDy3gHhv+lqJaHWs=";
    finalImageTag = "2.3.12";
    finalImageName = "nix";
  };

  haskellBase = pkgs.dockerTools.buildImage {
    name = "jinko-base-layer";
    # depending from nix-base brings certificates support etc
    fromImage = nixBase;
    contents = with pkgs; [
      bashInteractive
      coreutils
      llvm_8.lib
      libxml2
      postgresql.lib # for libpq
      sundials
      liblapack
      gmp
      xz
      openblas
      nlopt
      curl
    ];
  };
in
{
  inherit haskellBase;
  inherit nixBase;

  uncompressedImage = pkgs.runCommand "base-image" { } ''
    mkdir -p $out
    gunzip -c ${haskellBase} > $out/image
  '';
}

but I got (nixos-unstable).

       last 1 log lines:
       > FATA[0000] unknown flag: --src-tls-verify

NB: the image hash is wrong but that shouldn't matter

[roberth]

To prevent this, we need something like #133739 and use it to define skopeo.passthru.tests.dockerTools-pullImage