stage0: break apart -insecure-skip-verify

[jonboulle]

Currently the -insecure-skip-verify flag is a sledgehammer for disabling various security mechanisms. This was an intentional design decision early in rkt's development to minimise flag churn as different security options evolved.

As rkt matures and approaches 1.0 we need to tease apart the actual functionality of this flag into separate, well-defined options.

Here are the things that the flag does today:

• disables signature validation for images (including preventing rkt from attempting to retrieve signatures)
• skips certificate verification for TLS (i.e. causes rkt to accept any certificate presented by HTTPS servers)
• skips prompting the user to trust a key (during rkt trust)
• allows discovery to drop back to HTTP (instead of being strictly HTTPS)

A couple of suggested options for what the new flags can look like:

• separate (but similar) flags for each: -insecure-skip-verify-tls, -insecure-skip-verify-image, etc
• distinct and arguably more accurately named flags: -no-verify-tls-certs, -enable-http-fallback, etc.
• a combined "options" flag - e.g. -insecure-options=image,tls

[blixtra]

I'll start on this. I think it's most clear to go with the "a combined 'options' flag " described above.

[jonboulle]

Sounds reasonable to me. @robszumski ?

[robszumski]

Sounds good to me as long as a table of all the options makes it in the docs as part of this. Maybe throw up a deprecation warning? or are we going to support both?

[alban]

@blixtra should have a PR ready today but moving to next milestone to consider the time needed for reviewing.

[alban]

@blixtra when this gets merged, please check if the acbuild documentation and containers/build#100 still use --insecure-skip-verify.

[blixtra]

@robszumski So this is in the last stage of review. Wanted to get a last ok from you regarding the UX.

The documentation for the new option (and all global options) is here.

One last thing I'm adding is --insecure-skip-verify that is equivalent to --insecure-options=all and marked as deprecated and hidden, meaning the user will get a warning when using it and it won't show up in the help.

Otherwise the global flag section of the help looks like this now

OPTIONS:
      --debug[=false]           print out more debug information to stderr
      --dir=/var/lib/rkt        rkt data directory
  -h, --help[=false]            help for rkt
      --insecure-options=none       comma-separated list of security features to disable. Allowed values: "none", "image", "tls", "all"
      --local-config=/etc/rkt       local configuration directory
      --system-config=/usr/lib/rkt  system configuration directory
      --trust-keys-from-https[=true]    automatically trust gpg keys fetched from https

(excuse github formatting)

[robszumski]

@blixtra LGTM, thanks for checking