avoid policy.json check? about skopeo HOT 9 CLOSED

I would like to implement that --policy-insecure-allow-anything option if that is okay with you all.

from skopeo.

(I'm not totally sure about this proposal because if you happen to compile from source then you probably know you have to cp default-policy.json /etc/containers/policy.json and if you install from distros, probably the distro is taking care of installing /etc/containers/policy.json for you)

from skopeo.

Yeah, this was highlighted in #157 .

The default absolutely must be to use the config file (instead of security being opt-in), and then it IMHO only makes sense to fail if that file unexpectedly disappears.

I wouldn’t be philosophically opposed to something like --policy-insecure-allow-anything instead of requiring the users to keep a permissive policy file around, but I also won’t work on it this month, and I’m not sure that it is all that more convenient than --policy $insecure-policy.json.

For development, yeah, run make install. Or there could be a make debug-build which uses -ldflags "-X github.com/containers/image/signature.systemDefaultPolicyPath=$(pwd)/default-policy.json", but then I would be rather worried about such a build getting to a released package somewhere.

from skopeo.

For development, yeah, run make install. Or there could be a make debug-build which uses -ldflags "-X github.com/containers/image/signature.systemDefaultPolicyPath=$(pwd)/default-policy.json", but then I would be rather worried about such a build getting to a released package somewhere.

right, it will be hard to enforce this, though debug-build or dev-build makes a lot of sense to me

from skopeo.

I have a small patch with skopeo --policy-insecure-allow-anything copy docker://busybox oci:busybox working. But as this is my first day here, I would love to know if there is a better way (read any API call) to create an insecurepolicy than using a space-stripped JSON string as a variable?

from skopeo.

Can we just call it --insecure?

from skopeo.

Can we just call it --insecure?

same for me

from skopeo.

Will modify the flag, and update the PR.

from skopeo.

I would love to know if there is a better way (read any API call) to create an insecurepolicy than using a space-stripped JSON string as a variable?

https://github.com/projectatomic/skopeo/pull/203/files#r78563547 this is hopefully a stable API.

from skopeo.