Make allowInsecureRegistries follow Docker semantics for use-insecure-registries

[chanseokoh]

Just ignore the certification error and proceed with HTTPS.

https://docs.docker.com/registry/insecure/#deploy-a-plain-http-registry

With insecure registries enabled, Docker goes through the following steps:

• First, try using HTTPS.
  • If HTTPS is available but the certificate is invalid, ignore the error about the certificate.
  • If HTTPS is not available, fall back to HTTP.

When implemented, cases like #543 will be supported naturally and we will be able to remove the workaround doc: https://github.com/GoogleContainerTools/jib/blob/master/docs/configure-gcp-credentials.md

Should update docs once fixed.

[chanseokoh]

Just documenting here the security implication of allowInsecureRepositories that I am aware of, once this is fixed.

Jib will proceed with HTTPS when the server certificate (including a self-signed one) cannot be verified. The user may mistype the server URL and accidentally connect to a malicious server whose URL is set up to resemble the original server URL. TLS can't verify the server, but since allowInsecureRepositories is set, Jib proceeds and sends the password to the malicious server.

Not just that, it opens up the main in the middle (MITM) attack for anyone sitting at any of the routers or proxies the request passes though. Or somebody could exploit some DNS attacks.

[chanseokoh]

Fortunately, ApacheHttpTransport already provides a helper method to skip the validation.

    Builder transportBuilder = new ApacheHttpTransport.Builder();
    if (!turnOffCertificateValidation) {
      transportBuilder.doNotValidateCertificate();
    }
    requestFactory = transportBuilder.build().createRequestFactory();

[chanseokoh]

Should also update the docs, once this is fixed.