[BUG] Buildpacks BuildStrategy does not follow `shp-output-insecure` properly

[sgaist]

Is there an existing issue for this?

• I have searched the existing issues

Kubernetes Version

1.34.1

Shipwright Version

0.19.2

Current Behavior

The current implementation of the buildpacks-v3 BuildStrategy have one flaw: they create the CNB_INSECURE_REGISTRIES environment variable in all cases which should not happen when shp-output-insecure is set to false.

After discussion on #2238: it was a miscomprehension between what shp-output-insecure represent and what CNB_INSECURE_REGISTRIES provides.

But it has anyway shown some issues:

• insecure-regisitries shall not contain the registry target for the insecure output as if the value is set to false. It would push the image anyway. The BuildStrategy logic takes care of adding it to CNB_INSECURE_REGISTRIES if needed.
• Empty list of insecure-registries are not properly handled and will trigger the creation CNB_INSECURE_REGISTRIES with ,

Expected Behavior

Does not create CNB_INSECURE_REGISTRIES when shp-output-insecure is false.

• When insecure-registries contains the insecure output image registry get a warning
• If insecure output is disabled, do not push the resulting image and return an error
• When insecure-registries is empty, CNB_INSECURE_REGISTRIES shall not be exported (unless shp-output-insecure is set to true)

Steps To Reproduce

1. Create a BuildRun:

• using buildpacks-v3
• with output.insecure set to false
• with params.insecure-registries set to ["myregistry.xyz"]

2. Check logs
3. You will see something along the line of Using insecure registries: myregistry.xyz,

Anything else?

No response