Misleading errors when ca_certs config is incorrect for an image_resource

(moved from concourse/concourse#4576)

Bug Report

When I had an incorrect configuration for the ca_certs key in my image_resource, Concourse returned the following:

resource script '/opt/resource/check []' failed: exit status 1

stderr:
failed to fetch digest for image '<my-registry>/alpine:latest': 503 Service Unavailable
does the image exist?

This is a misleading error, which I unfortunately lost a fair bit of time to trying to figure out.

Steps to Reproduce

• Create a pipeline using an image_resource with a configuration like the following:

image_resource:
  type: docker-image
  source:
    repository: <something>
    ca_certs:
    - cert: <a certificate that does not match the registry>
      domain: <registry domain>

• Set the pipeline
• Try to run the pipeline

Expected Results

I expect to receive an error that says something about failing SSL verification.

Actual Results

resource script '/opt/resource/check []' failed: exit status 1

stderr:
failed to fetch digest for image '<my-registry>/alpine:latest': 503 Service Unavailable
does the image exist?

Version Info

• Concourse version: 5.6.0
• Deployment type (BOSH/Docker/binary): Docker
• Infrastructure/IaaS: Infrastructure
• Did this used to work? Unknown

Start by reproducing the pipeline described with an image_resource containing a mismatched ca_certs certificate, then trace how the docker-image resource reports the registry failure. Done means the malformed certificate produces an SSL-verification error rather than the misleading 503 and “does the image exist?” message.