build-support/docker: pass tlsVerify to support http registries

This commit is contained in:
Edward Tjörnhammar 2021-05-05 10:40:08 +02:00
parent 7a47055a0f
commit ab4649e9d1
No known key found for this signature in database
GPG key ID: 577898458385603E

View file

@ -86,6 +86,8 @@ rec {
, finalImageName ? imageName
# This used to set a tag to the pulled image
, finalImageTag ? "latest"
# This is used to disable TLS certificate verification, allowing access to http registries on (hopefully) trusted networks
, tlsVerify ? true
, name ? fixName "docker-image-${finalImageName}-${finalImageTag}.tar"
}:
@ -105,7 +107,13 @@ rec {
sourceURL = "docker://${imageName}@${imageDigest}";
destNameTag = "${finalImageName}:${finalImageTag}";
} ''
skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceURL" "docker-archive://$out:$destNameTag"
skopeo \
--src-tls-verify=${lib.boolToString tlsVerify} \
--insecure-policy \
--tmpdir=$TMPDIR \
--override-os ${os} \
--override-arch ${arch} \
copy "$sourceURL" "docker-archive://$out:$destNameTag"
'';
# We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.