Distinguish between insecure and tis-verify

[mariusbertram]

The insecure option for oras.registry sets the transport protocol. The default behaviour of other projects which interact with registries (ores-cli, podman,....), differenciate between transport protocol and trust for connections to registries.
To avoid breaking changes, the parameter insecure sets the transport protocol ans the new parameter tls_verify sets verification on CA Trust.

[vsoch]

Should this be exposed from the oras/client.py as well? And don't forget to add a note to the CHANGELOG.md and bump the version in oras/version.py

[mariusbertram]

Yes, there is a different between a registry listening with plain http and listening on https with https but not a valid Crt.
I don't append the port for plain http the client try to connect to port 80 and on https on port 443. Best practice configuration for the registry/loadbalancer/webserver is to redirect from port 80 to 443 with a rewrite from http to https.
But if you only expose Port 443 and you want to connect to an insecure registry you will not be able to connect with the current behaviour. I will extend the changelog and bump the Version.

[vsoch]

I think you missed my question about the client - could we please expose the parameter here along with insecure?

oras-py/oras/client.py

Line 32 in 0f331fb

insecure: bool = False,

[mariusbertram]

The docker client will skip the tis verification if tis_verify is set. On Plain http registries tis_verify has no effect.