Migrate from http:// Prefixes

Goal

Drop the scheme prefix (http:// or https://) from OCI repository base URLs and references, and mark hosts without TLS as plainHTTP in the HTTP configuration.

A scheme prefix is deprecated, and OCM logs a warning whenever it sees one. The prefix no longer selects the connection: only plainHTTP in the HTTP configuration does. An http:// prefix on a host that is not plainHTTP is an error, because the request would silently go over HTTPS when the URL asked for cleartext.

Why Migrate?

The prefix was deprecated for security. A scheme in a descriptor, a reference, or a CLI argument could switch a host to cleartext and send credentials unencrypted without the operator’s consent. Now only the operator’s HTTP configuration can turn on plain HTTP.

Prerequisites

  • OCM CLI installed
  • A repository spec, a reference, or a configuration that uses an http:// or https:// prefix for an OCI registry

Steps

1. Mark the host as plain HTTP

Skip this step if the registry has TLS. Otherwise add the host to the HTTP configuration:

type: generic.config.ocm.software/v1
configurations:
  - type: http.config.ocm.software/v1alpha1
    hosts:
      "registry.local:5000":
        plainHTTP: true

See Use plain HTTP for a local registry for what the setting covers.

2. Drop the prefix from repository base URLs

type: OCIRepository/v1
baseUrl: http://registry.local:5000/ocm
type: OCIRepository/v1
baseUrl: registry.local:5000/ocm

3. Drop the prefix from references

Do the same for references, for example on the command line.

http://registry.local:5000/ocm
registry.local:5000/ocm
Prev
Download SBOMs
Next
Sign with GPG