x509: certificate signed by unknown authority

[gnr1227]

Bug report:

Getting x509 certificate issue, when downloading image from harbor registry.

Pull command:

singularity pull oras://private-harbor-registry.com/image:tag

Error:

---

INFO[0000] trying next host error="failed to do request: Head "https://private-harbor-registry.com/image:tag": x509: certificate signed by unknown authority" host=private-harbor-registry.com
FATAL: While pulling image from oci registry: error fetching image to cache: failed to get checksum for oras://private-harbor-registry.com/image:tag: while resolving reference: failed to do request: Head "https://private-harbor-registry.com/image:tag": x509: certificate signed by unknown authority

2024-12-02T08:16:17.381864852-08:00 INFO handler:https_handler: dragonfly-client/src/proxy/mod.rs:420: handle HTTPS request: Request { method: CONNECT, uri: private-harbor-registry.com:443, version: HTTP/1.1, headers: {"host": "private-harbor-registry.com:443", "user-agent": "Go-http-client/1.1"}, body: Body(Empty) } uri="private-harbor-registry.com:443" method="CONNECT"
2024-12-02T08:16:17.381948271-08:00 INFO upgraded_tunnel: dragonfly-client/src/proxy/mod.rs:478: generate simple self-signed certificate
2024-12-02T08:16:17.391504962-08:00 ERROR dragonfly-client/src/proxy/mod.rs:440: server io error: received fatal alert: BadCertificate

Environment:

• Dragonfly version: 2.1.64
• OS: SLES15

Can we have an option "isecureSkipVerify" from client and seed-client as well. Currently I can see this option for only manager during preheat.

[gaius-qi]

This is the configuration of containerd. You can find whether singularity has this configuration.