fix(bundle): gate name.Insecure behind --remote-skip-tls (CWE-319)

[divyansh42]

Changes

tkn bundle push and tkn bundle list unconditionally passed name.Insecure to every name.ParseReference call, enabling plain-HTTP registry connections without user consent (CWE-319 / ASVS V9.1.1). This creates a MitM risk on untrusted networks.

This PR fixes the issue by:

• Adding RemoteOptions.NameOptions() []name.Option in pkg/bundle/flags.go — returns []name.Option{name.Insecure} only when --remote-skip-tls is explicitly set, nil otherwise. Validation mode is left to the caller; bundle push/list prepend name.StrictValidation explicitly to preserve existing strict-reference behaviour. task start is unchanged.
• Replacing the hardcoded name.Insecure arguments in push.go (PreRunE + parseArgsAndFlags) and list.go (PreRunE) with NameOptions() calls.
• Fixing a secondary bug: ToOptions() was mutating http.DefaultTransport in-place. Now uses .Clone() so the global transport is never modified. Uses r.skipTLS instead of literal true for InsecureSkipVerify.
• Updating the --remote-skip-tls flag description to clarify it also enables plain-HTTP connections, not just cert-check bypass.
• Regenerating docs and man pages for bundle push and bundle list.

Fixes: https://redhat.atlassian.net/browse/SRVKP-13805

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Includes tests (if functionality changed/added)
• Run the code checkers with make check
• Regenerate the manpages, docs and go formatting with make generated
• Commit messages follow commit message best practices

See the contribution guide
for more details.

Release Notes

action required: tkn bundle push/list no longer allow plain-HTTP registry connections by default. Pass --remote-skip-tls to opt in to insecure (HTTP) registry access.

[Copilot]

🟡 Changes recommended

Plain HTTP remains implicitly enabled for local/private registries, task image parsing regresses, and security-focused tests are missing.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Hardens registry handling by gating insecure connections behind --remote-skip-tls.

Changes:

• Adds centralized registry-name options and clones the default transport.
• Updates bundle and task reference parsing.
• Clarifies generated flag documentation.

File summaries

File	Description
pkg/bundle/flags.go	Adds registry parsing options and transport cloning.
pkg/cmd/bundle/push.go	Applies secure parsing to bundle pushes.
pkg/cmd/bundle/list.go	Applies secure parsing to bundle listing.
pkg/cmd/task/start.go	Applies remote options to OCI task bundles.
docs/cmd/tkn_bundle_push.md	Updates push flag documentation.
docs/cmd/tkn_bundle_list.md	Updates list flag documentation.
docs/cmd/tkn_task_start.md	Updates task-start flag documentation.
docs/man/man1/tkn-bundle-push.1	Updates generated push man page.
docs/man/man1/tkn-bundle-list.1	Updates generated list man page.
docs/man/man1/tkn-task-start.1	Updates generated task-start man page.

Review details

Suppressed comments (1)

pkg/bundle/flags.go:60

• The new security boundary has no accompanying test changes. Please add coverage for both flag states using non-local and RFC1918/loopback references, asserting the resulting scheme/connection policy; the existing loopback registry tests cannot prove the advertised secure default because go-containerregistry automatically treats loopback as HTTP.

func (r *RemoteOptions) NameOptions() []name.Option {
	opts := []name.Option{name.StrictValidation}
	if r.skipTLS {
		opts = append(opts, name.Insecure)
	}
	return opts

• Files reviewed: 10/10 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Cleartext remains enabled by default for local/private registries, while task image TLS bypass now forces HTTP.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 2
• Review effort level: Balanced

[divyansh42]

/hold

[divyansh42]

/retest

[divyansh42]

/hold cancel

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment