fix(registry): warn when insecure transport is configured#3396
Open
Dashtid wants to merge 1 commit intoanchore:mainfrom
Open
fix(registry): warn when insecure transport is configured#3396Dashtid wants to merge 1 commit intoanchore:mainfrom
Dashtid wants to merge 1 commit intoanchore:mainfrom
Conversation
Emit a one-time warning during config load when either `insecure-skip-tls-verify` or `insecure-use-http` is enabled. These flags can be set silently via a config file or environment variable and produce no indication in normal CLI output that registry traffic is unprotected. The warning is built from a pure helper, `insecureTransportWarning`, so the logic can be unit-tested without hooking the logger singleton. PostLoad continues to return nil for any flag combination since the warning is observability only and must not block config loading. Fixes anchore#3101 (grype CLI half; stereoscope debug log to follow as a separate PR per the issue's two-part scope) Signed-off-by: David Dashti <david.dashti@hermesmedical.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
insecure-skip-tls-verifyorinsecure-use-httpis setFixes #3101 (grype CLI half — see scope note below).
Details
The warning is emitted from the existing
PostLoad()hook on the registry config struct, which is the natural single point where merged config (flag + env + YAML) is available exactly once per invocation. There is precedent forlog.Warnffrom insidePostLoad()in the same package (see database_search_packages.go lines 43, 62).Implementation:
insecureTransportWarning() stringis a pure helper that returns the message, or empty if neither flag is set. Splitting message construction from the log call lets the branching logic be unit-tested deterministically without touching the logger singleton.PostLoad()calls the helper and emitslog.Warn(msg)only when non-empty.Sample output when both flags are set:
Scope note
#3101 outlined two changes: (1) a debug log inside stereoscope at the actual TLS/HTTP application sites, and (2) a warning at the grype CLI level. This PR addresses only (2), which @Tanish-26 indicated was the higher priority ("If I had to choose only one, I'd prioritize the grype CLI warning"). The stereoscope debug log can follow as a separate, smaller PR to anchore/stereoscope.
Test plan
Test_registry_insecureTransportWarning: 5 cases covering neither set, each alone, both set, and credentials-without-insecure-flags (regression guard)Test_registry_PostLoad_returnsNoError: verifies all 4 flag combinations don't return an error from PostLoad (warning is observability, must never block config load)cmd/grype/cli/options/...test suite passes — no regressions