add -allow-insecure-registry flag to permit unsecured container registries

[dekkagaijin]

Fixes #311

[priyawadhwa]

lgtm! you could write a quick test by starting an insecure registry in docker, pushing an image, signing & verifying it (that's basically why we needed this in chains)

[dekkagaijin]

@priyawadhwa

$ ./cosign sign -key cosign.key localhost:443/my-image
error: signing [localhost:443/my-image]: getting remote image: Get "https://localhost:443/v2/": x509: certificate is not valid for any names, but wanted to match localhost; Get "http://localhost:443/v2/": net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"
$ ./cosign sign -allow-insecure-registry -key cosign.key localhost:443/my-image
Enter password for private key: Pushing signature to: localhost:443/my-image:sha256-69704ef328d05a9f806b6b8502915e6a0a4faa4d72018dc42343f511490daf8a.sig
$ ./cosign verify -allow-insecure-registry -key cosign.pub localhost:443/my-image

Verification for localhost:443/my-image --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
  - Any certificates were verified against the Fulcio roots.

[{"critical":{"identity":{"docker-reference":"localhost:443/my-image"},"image":{"docker-manifest-digest":"sha256:69704ef328d05a9f806b6b8502915e6a0a4faa4d72018dc42343f511490daf8a"},"type":"cosign container image signature"},"optional":null}]
jsand-macbookpro3:cosign jsand$ 

[mattmoor]

Is dropping the LHS intentional, since IIRC it's the default behavior?

[dekkagaijin]

?

The effect of the change on this line specifically should be to a) propagate ctx, b) allow for broken TLS when the flag is set

[mattmoor]

I think what confused me was that the LHS wasn't using DefaultRegistryClientOpts and the implementation of this function delegates to that which hides the fact that it is a superset. I left a comment on that below, let's kill DefaultRegistryClientOpts completely if we can.

[dekkagaijin]

roger

[mattmoor]

I wonder whether it's worth getting rid of this helper? Just inline it so that folks use the appropriate new one?

[dekkagaijin]

It would gently nudge people in the right direction...