Installer must complete on restricted/corporate networks (proxy, TLS-inspection, blocked hosts) — handle network conditions internally

[shujaatTracebloc]

Filed from a field install on a restricted corporate network + a second user's k3d-download failure. Companion issues: log-hygiene and graceful-failure (which this depends on for clean output). Folds in #574 (cosign/sigstore).

Problem statement

A user should be able to install regardless of the network they are on. Real users on corporate/restricted networks currently cannot finish:

• a restricted corporate network: the network blocks sigstore's transparency log — rekor.sigstore.dev returns a cert valid for the corporate domain (a TLS-inspecting proxy) — so cosign's keyless verification fails and the install dies.
• A second user: the k3d binary download fails checksum verification (the network is corrupting or blocking the github download).

Other users will hit other blocked hosts. The goal: the installer should detect and handle these network conditions internally and still complete a verified install — put yourself in the user's shoes; they shouldn't need to know anything about proxies, CAs, or sigstore.

Explanation (the network taxonomy)

The install pulls from github (k3d/helm/kubectl/cosign), sigstore (rekor/fulcio/tuf), docker.io + ghcr.io (images), and the tracebloc backend. Each network condition breaks a different piece:

Condition	Effect
TLS-inspecting proxy w/ corporate CA (common at enterprise / restricted-network sites)	re-signs TLS with a corporate root in the Windows store; downloads/verification fail x509 unless the installer trusts that root everywhere
Explicit HTTP(S) proxy	tools that don't inherit the system proxy fail to connect
Hard block of sigstore (seen in the field)	rekor.sigstore.dev unreachable → keyless cosign can't verify. Proven: --insecure-ignore-tlog alone CANNOT verify our manifest — the keyless Fulcio cert is short-lived/expired and needs Rekor's timestamp (or an offline bundle carrying it)
Hard block of github (tool binaries) / docker.io + ghcr.io (images)	the software itself isn't reachable without a mirror or offline path
Rate-limited shared NAT (Docker Hub 100/6h)	image pulls fail intermittently

Proposed solution (layered)

1. Preflight network probe (fast, upfront, clear output). Before the long work, test reachability + TLS behaviour of each endpoint, detect a proxy and a TLS-inspection CA, and print a plain "network profile: corporate proxy + TLS inspection detected — using your company's certificate" line. The user sees what's happening instead of dying minutes in.
2. Auto-configure the whole install for that profile. One corporate CA + one proxy wired into every tool — curl/PowerShell already can; add cosign (SSL_CERT_FILE), docker/k3d, and helm. Auto-detect the MITM on first x509 and retry with the store CA. This handles the majority of enterprise networks automatically — including the k3d-checksum failure when it's TLS inspection.
3. Remove the sigstore live dependency. Ship an offline Sigstore bundle with the release (cosign sign-blob --bundle …) and verify with --offline: full verification (signature + identity + tlog inclusion) with no live Rekor call → immune to sigstore blocks. This is the correct version of Bootstrap cosign fails on networks that block sigstore Rekor (client/Airtel) — add tlog-skip opt-in + clear error #574 (the --insecure-ignore-tlog shortcut was proven not to verify our expired keyless cert; the bundle carries the proof/timestamp so it can). Needs the signing-workflow change + a new release.
4. Registry resilience. Support a private/mirror registry (the chart already allows images.*.repository + a pull secret) and an air-gapped image bundle (pre-loaded into the cluster) for sites that block docker/ghcr; the installer detects the block and switches to / guides to the mirror or offline mode — cleanly, not a crash.
5. Everything above emits clean, PII-free, internals-free output and never crashes — depends on the log-hygiene + graceful-failure issues.

Honest limit

A site that blocks the container registries and offers no reachable mirror and won't accept an offline bundle cannot be served — the software isn't reachable by definition. Everything short of that (proxy, TLS-inspection, sigstore block, github block, rate-limits) is handleable. The realistic, deliverable promise: "installs on any network that lets you reach some copy of the artifacts — directly, via proxy, via mirror, or via an offline bundle — and never leaks or crashes doing it."

Severity: Tier 1 — install-blocking for enterprise/restricted networks. Confidence: CONFIRMED (both failure modes reproduced from field logs).

[shujaatTracebloc]

Installer-robustness set: #576 log hygiene · #577 graceful failure · #578 network resilience (this). Depends on #576+#577 for clean output; folds in the former #574.

[LukasWodka]

@shujaatTracebloc — context for the network-resilience piece. The diagnosis and the network taxonomy here are right; my main steer is scope.

The bar

A user should be able to install regardless of the network they're on — corporate proxy, TLS-inspection with a corporate root CA, a hard block of sigstore, a blocked GitHub/registry — without needing to know anything about proxies, CAs, or sigstore. The installer detects the condition, says in plain language what it's doing ("corporate proxy + TLS inspection detected — using your company's certificate"), and still completes a verified install. The realistic, honest promise: installs on any network that lets you reach some copy of the artifacts — directly, via proxy, via mirror, or via an offline bundle — and never leaks or crashes doing it.

Direction: this is an epic — split it

Please break this into shippable children rather than one mega-PR. I'd cut it as:

1. Preflight network probe — fast, upfront reachability + TLS-behaviour check of each endpoint; detect proxy + TLS-inspection CA; print a plain "network profile" line before the long work, so the user sees what's happening instead of dying minutes in.
2. Auto-configure the whole install for that profile — one corporate CA + one proxy wired into every tool. curl/PowerShell already inherit it; add cosign (SSL_CERT_FILE), docker/k3d, and helm. Auto-detect the MITM on first x509 and retry with the store CA. This also fixes the k3d-checksum failure when it's really TLS inspection.
3. Remove the sigstore live dependency — ship an offline Sigstore bundle with the release and verify --offline (full verification — signature + identity + tlog inclusion — with no live Rekor call). Heads-up: this one needs a signing-workflow change + a new release, so it's cross-repo, not installer-internal — plan it as its own thread. (This is the correct version of Bootstrap cosign fails on networks that block sigstore Rekor (client/Airtel) — add tlog-skip opt-in + clear error #574; the --insecure-ignore-tlog shortcut was proven not to verify our keyless cert.)
4. Registry resilience — private/mirror registry (the chart already allows images.*.repository + a pull secret) and an air-gapped image bundle; the installer detects the block and switches to / guides to the mirror or offline mode — cleanly, never a crash.

Honest limit (state it in the epic)

A site that blocks the container registries and offers no reachable mirror and won't accept an offline bundle can't be served — the software isn't reachable by definition. Everything short of that (proxy, TLS-inspection, sigstore block, GitHub block, rate-limits) is handleable. Let's set that expectation explicitly so "any network" doesn't over-promise.

Cross-links / de-dupe

• Link fix(installer): corporate MITM CA never reaches the k3d nodes — in-cluster pulls x509-fail on TLS-inspecting networks #424 here (corporate MITM CA never reaching the k3d nodes — closed, same surface).
• There's related in-flight proxy-CA + toolchain-pinning work on the private tracker — I'll point you at those tickets directly so we don't duplicate effort.

Dependency

Everything here must emit clean, PII-free, internals-free output and never crash — so it sits on top of #576 + #577. Land those first.