How to manage TLS certificates for registries

[trisberg]

Any thoughts on how to provide self-signed certificates for a registry that is targeted for builds?

This applies both to pack and to the knative buildtemplate AFAICT.

So far I have been getting x509: certificate signed by unknown authority errors when building against a registry that is using self-signed certificates.

[izaakschroeder]

^ In the same boat 😄

For generating the builder I've pretty much resorted to using --no-pull and manually invoking docker pull on the stack run and build images.

[jonjohnsonjr]

Dropping some breadcrumbs in case I ever fix this: google/go-containerregistry#211

tl;dr go-containerregistry doesn't respect docker's self-signed certificate configuration, but you can workaround that by adding certs to your system or by using go's environment variables for adding certs.

[natalieparellano]

Perhaps an outcome could be that we document the workaround in some easily discoverable place?

[dfreilich]

There is an open RFC for this issue here: buildpacks/rfcs#69, and this seems pretty related to #170. I'll close it in favor of that issue.