From b6ff0901fa16aa31132c96b91fc353850a4f4fac Mon Sep 17 00:00:00 2001
From: Paul Holzinger <pholzing@redhat.com>
Date: Tue, 10 Jun 2025 14:16:46 +0200
Subject: [PATCH 12/12] machine init: fix tls check

Ensure we verify the TLS connection when pulling the OCI image.

Fixes: CVE-2025-6032
Fixes: https://issues.redhat.com/browse/RHEL-96710
Fixes: https://issues.redhat.com/browse/RHEL-96702

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 726b506acc8a00d99f1a3a1357ecf619a1f798c3)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
---
 pkg/machine/ocipull/pull.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkg/machine/ocipull/pull.go b/pkg/machine/ocipull/pull.go
index 1f0b97a562..d2c36b4d40 100644
--- a/pkg/machine/ocipull/pull.go
+++ b/pkg/machine/ocipull/pull.go
@@ -18,8 +18,8 @@ import (
 // PullOptions includes data to alter certain knobs when pulling a source
 // image.
 type PullOptions struct {
-	// Require HTTPS and verify certificates when accessing the registry.
-	TLSVerify bool
+	// Skip TLS verification when accessing the registry.
+	SkipTLSVerify types.OptionalBool
 	// [username[:password] to use when connecting to the registry.
 	Credentials string
 	// Quiet the progress bars when pushing.
@@ -42,7 +42,7 @@ func Pull(ctx context.Context, imageInput string, sourcePath string, options Pul
 	}
 
 	sysCtx := &types.SystemContext{
-		DockerInsecureSkipTLSVerify: types.NewOptionalBool(!options.TLSVerify),
+		DockerInsecureSkipTLSVerify: options.SkipTLSVerify,
 	}
 	if options.Credentials != "" {
 		authConf, err := parse.AuthConfig(options.Credentials)
-- 
2.43.7