refactor: break --insecure into --http-only and --tls-skip-verify

Fixes #2860

Signed-off-by: Joonas Bergius <[email protected]>

src/cmd/common/viper.go

@@ -20,14 +20,16 @@ const (
 
 	// Root config keys
 
-	VLogLevel     = "log_level"
-	VArchitecture = "architecture"
-	VNoLogFile    = "no_log_file"
-	VNoProgress   = "no_progress"
-	VNoColor      = "no_color"
-	VZarfCache    = "zarf_cache"
-	VTmpDir       = "tmp_dir"
-	VInsecure     = "insecure"
+	VLogLevel      = "log_level"
+	VArchitecture  = "architecture"
+	VNoLogFile     = "no_log_file"
+	VNoProgress    = "no_progress"
+	VNoColor       = "no_color"
+	VZarfCache     = "zarf_cache"
+	VTmpDir        = "tmp_dir"
+	VInsecure      = "insecure"
+	VHttpOnly      = "http_only"
+	VSkipVerifyTLS = "tls_skip_verify"
 
 	// Init config keys
 

src/cmd/root.go

@@ -121,4 +121,7 @@ func init() {
 	rootCmd.PersistentFlags().StringVar(&config.CommonOptions.CachePath, "zarf-cache", v.GetString(common.VZarfCache), lang.RootCmdFlagCachePath)
 	rootCmd.PersistentFlags().StringVar(&config.CommonOptions.TempDirectory, "tmpdir", v.GetString(common.VTmpDir), lang.RootCmdFlagTempDir)
 	rootCmd.PersistentFlags().BoolVar(&config.CommonOptions.Insecure, "insecure", v.GetBool(common.VInsecure), lang.RootCmdFlagInsecure)
+	rootCmd.PersistentFlags().MarkHidden("insecure")
+	rootCmd.PersistentFlags().BoolVar(&config.CommonOptions.HttpOnly, "http-only", v.GetBool(common.VHttpOnly), lang.RootCmdFlagHttpOnly)
+	rootCmd.PersistentFlags().BoolVar(&config.CommonOptions.SkipVerifyTLS, "tls-skip-verify", v.GetBool(common.VSkipVerifyTLS), lang.RootCmdFlagSkipVerifyTLS)
 }

src/config/config.go

@@ -110,3 +110,13 @@ func GetAbsHomePath(path string) string {
 	}
 	return path
 }
+
+// HttpOnly is a convenience method that consolidates --http-only and --insecure flags into single boolean.
+func HttpOnly() bool {
+	return CommonOptions.HttpOnly || CommonOptions.Insecure
+}
+
+// SkipVerifyTLS is a convenience method that consolidates --tls-skip-verify and --insecure flags into single boolean.
+func SkipVerifyTLS() bool {
+	return CommonOptions.SkipVerifyTLS || CommonOptions.Insecure
+}

src/config/lang/english.go

@@ -45,14 +45,16 @@ const (
 	RootCmdLong  = "Zarf eliminates the complexity of air gap software delivery for Kubernetes clusters and cloud native workloads\n" +
 		"using a declarative packaging strategy to support DevSecOps in offline and semi-connected environments."
 
-	RootCmdFlagLogLevel    = "Log level when running Zarf. Valid options are: warn, info, debug, trace"
-	RootCmdFlagArch        = "Architecture for OCI images and Zarf packages"
-	RootCmdFlagSkipLogFile = "Disable log file creation"
-	RootCmdFlagNoProgress  = "Disable fancy UI progress bars, spinners, logos, etc"
-	RootCmdFlagNoColor     = "Disable colors in output"
-	RootCmdFlagCachePath   = "Specify the location of the Zarf cache directory"
-	RootCmdFlagTempDir     = "Specify the temporary directory to use for intermediate files"
-	RootCmdFlagInsecure    = "Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture."
+	RootCmdFlagLogLevel      = "Log level when running Zarf. Valid options are: warn, info, debug, trace"
+	RootCmdFlagArch          = "Architecture for OCI images and Zarf packages"
+	RootCmdFlagSkipLogFile   = "Disable log file creation"
+	RootCmdFlagNoProgress    = "Disable fancy UI progress bars, spinners, logos, etc"
+	RootCmdFlagNoColor       = "Disable colors in output"
+	RootCmdFlagCachePath     = "Specify the location of the Zarf cache directory"
+	RootCmdFlagTempDir       = "Specify the temporary directory to use for intermediate files"
+	RootCmdFlagInsecure      = "Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture."
+	RootCmdFlagHttpOnly      = "Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture."
+	RootCmdFlagSkipVerifyTLS = "Skip checking server's certificate for validity. This flag should only be used if you have a specific reason and accept the reduced security posture."
 
 	RootCmdDeprecatedDeploy = "Deprecated: Please use \"zarf package deploy %s\" to deploy this package.  This warning will be removed in Zarf v1.0.0."
 	RootCmdDeprecatedCreate = "Deprecated: Please use \"zarf package create\" to create this package.  This warning will be removed in Zarf v1.0.0."

src/internal/packager/helm/chart.go

@@ -143,7 +143,7 @@ func (h *Helm) TemplateChart(ctx context.Context) (manifest string, chartValues
 	client.IncludeCRDs = true
 	// TODO: Further research this with regular/OCI charts
 	client.Verify = false
-	client.InsecureSkipTLSverify = config.CommonOptions.Insecure
+	client.InsecureSkipTLSverify = config.SkipVerifyTLS()
 	if h.kubeVersion != "" {
 		parsedKubeVersion, err := chartutil.ParseKubeVersion(h.kubeVersion)
 		if err != nil {

src/internal/packager/helm/repo.go

@@ -197,7 +197,7 @@ func (h *Helm) DownloadPublishedChart(ctx context.Context, cosignKeyPath string)
 		Verify:  downloader.VerifyNever,
 		Getters: getter.All(pull.Settings),
 		Options: []getter.Option{
-			getter.WithInsecureSkipVerifyTLS(config.CommonOptions.Insecure),
+			getter.WithInsecureSkipVerifyTLS(config.SkipVerifyTLS()),
 			getter.WithBasicAuth(username, password),
 		},
 	}

src/internal/packager/images/common.go

@@ -50,9 +50,9 @@ type PushConfig struct {
 func NoopOpt(*crane.Options) {}
 
 // WithGlobalInsecureFlag returns an option for crane that configures insecure
-// based upon Zarf's global --insecure flag.
+// based upon Zarf's global --tls-skip-verify (and --insecure) flags.
 func WithGlobalInsecureFlag() []crane.Option {
-	if config.CommonOptions.Insecure {
+	if config.SkipVerifyTLS() {
 		return []crane.Option{crane.Insecure}
 	}
 	// passing a nil option will cause panic
@@ -103,7 +103,7 @@ func createPushOpts(cfg PushConfig, pb *message.ProgressBar) []crane.Option {
 	opts = append(opts, WithPushAuth(cfg.RegInfo))
 
 	transport := http.DefaultTransport.(*http.Transport).Clone()
-	transport.TLSClientConfig.InsecureSkipVerify = config.CommonOptions.Insecure
+	transport.TLSClientConfig.InsecureSkipVerify = config.SkipVerifyTLS()
 	// TODO (@WSTARR) This is set to match the TLSHandshakeTimeout to potentially mitigate effects of https://github.com/zarf-dev/zarf/issues/1444
 	transport.ResponseHeaderTimeout = 10 * time.Second
 

src/pkg/packager/creator/normal.go

@@ -281,14 +281,17 @@ func (pc *PackageCreator) Output(ctx context.Context, dst *layout.PackagePaths,
 			return fmt.Errorf("unable to publish package: %w", err)
 		}
 		message.HorizontalRule()
-		flags := ""
-		if config.CommonOptions.Insecure {
-			flags = "--insecure"
+		flags := []string{}
+		if config.HttpOnly() {
+			flags = append(flags, "--http-only")
+		}
+		if config.SkipVerifyTLS() {
+			flags = append(flags, "--tls-skip-verify")
 		}
 		message.Title("To inspect/deploy/pull:", "")
-		message.ZarfCommand("package inspect %s %s", helpers.OCIURLPrefix+remote.Repo().Reference.String(), flags)
-		message.ZarfCommand("package deploy %s %s", helpers.OCIURLPrefix+remote.Repo().Reference.String(), flags)
-		message.ZarfCommand("package pull %s %s", helpers.OCIURLPrefix+remote.Repo().Reference.String(), flags)
+		message.ZarfCommand("package inspect %s %s", helpers.OCIURLPrefix+remote.Repo().Reference.String(), strings.Join(flags, " "))
+		message.ZarfCommand("package deploy %s %s", helpers.OCIURLPrefix+remote.Repo().Reference.String(), strings.Join(flags, " "))
+		message.ZarfCommand("package pull %s %s", helpers.OCIURLPrefix+remote.Repo().Reference.String(), strings.Join(flags, " "))
 	} else {
 		// Use the output path if the user specified it.
 		packageName := fmt.Sprintf("%s%s", sources.NameFromMetadata(pkg, pc.createOpts.IsSkeleton), sources.PkgSuffix(pkg.Metadata.Uncompressed))

src/pkg/zoci/common.go

@@ -32,8 +32,8 @@ type Remote struct {
 func NewRemote(url string, platform ocispec.Platform, mods ...oci.Modifier) (*Remote, error) {
 	logger := slog.New(message.ZarfHandler{})
 	modifiers := append([]oci.Modifier{
-		oci.WithPlainHTTP(config.CommonOptions.Insecure),
-		oci.WithInsecureSkipVerify(config.CommonOptions.Insecure),
+		oci.WithPlainHTTP(config.HttpOnly()),
+		oci.WithInsecureSkipVerify(config.SkipVerifyTLS()),
 		oci.WithLogger(logger),
 		oci.WithUserAgent("zarf/" + config.CLIVersion),
 	}, mods...)

src/types/runtime.go

@@ -12,12 +12,16 @@ import (
 type ZarfCommonOptions struct {
 	// Verify that Zarf should perform an action
 	Confirm bool
+	// Force connections to be over http instead of https
+	HttpOnly bool
 	// Allow insecure connections for remote packages
 	Insecure bool
 	// Path to use to cache images and git repos on package create
 	CachePath string
 	// Location Zarf should use as a staging ground when managing files and images for package creation and deployment
 	TempDirectory string
+	// Disable checking the server TLS certificate for validity.
+	SkipVerifyTLS bool
 	// Number of concurrent layer operations to perform when interacting with a remote package
 	OCIConcurrency int
 }