diff --git a/Gopkg.lock b/Gopkg.lock
index 9b4df9ee0..efec4475f 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -212,38 +212,34 @@
   version = "v0.1.0"
 
 [[projects]]
-  digest = "1:b5f139796b532342966b835fb26fe41b6b488e94b914f1af1aba4cd3a9fee6dc"
+  digest = "1:9d535dbb6316d0227c1335649d12161b0832f6fa60d5754c559a9ba82859fc1e"
   name = "github.com/containerd/containerd"
   packages = [
+    "archive/compression",
     "content",
     "content/local",
     "errdefs",
     "filters",
     "images",
+    "labels",
     "log",
     "platforms",
     "reference",
     "remotes",
     "remotes/docker",
+    "remotes/docker/schema1",
     "sys",
+    "version",
   ]
   pruneopts = "T"
-  revision = "894b81a4b802e4eb2a91d1ce216b8817763c29fb"
-  version = "v1.2.6"
+  revision = "640860a042b93c26c0a33081ee02230def486f81"
+  version = "v1.3.0-beta.2"
 
 [[projects]]
   branch = "master"
   digest = "1:1271f7f8cc5f5b2eb0c683f92c7adf8fca1813b9da5218d6df1c9cf4bdc3f8d5"
   name = "github.com/containerd/continuity"
-  packages = [
-    ".",
-    "devices",
-    "driver",
-    "pathdriver",
-    "proto",
-    "syscallx",
-    "sysx",
-  ]
+  packages = ["pathdriver"]
   pruneopts = "T"
   revision = "004b46473808b3e7a4a3049c20e4376c91eb966d"
 
@@ -264,7 +260,7 @@
   version = "v1.1.1"
 
 [[projects]]
-  digest = "1:543d5301a51341bbdaba9ddf14ae52ffcc8302fc5e79b01f1954c31f02a4aac5"
+  digest = "1:8b5f943c7eec36fe9341e1bd9de2b2c0f0bee16374fe461ed0837b4dcdcea711"
   name = "github.com/deislabs/oras"
   packages = [
     "pkg/auth",
@@ -274,8 +270,8 @@
     "pkg/oras",
   ]
   pruneopts = "T"
-  revision = "b285197778e05cd348abb8ff50faf0ef7e3554a2"
-  version = "v0.6.0"
+  revision = "7467008b2683c5eff5fb13fe91c5b17b2eec75a3"
+  version = "v0.7.0"
 
 [[projects]]
   digest = "1:6b014c67cb522566c30ef02116f9acb50cd60954708cf92c6654e2985696db18"
@@ -923,12 +919,12 @@
   version = "v1.5.2"
 
 [[projects]]
-  digest = "1:c3498d1186a4f84897812aa2dccfbd5d805955846f2cd020aa384bf0b218e9e9"
+  digest = "1:425d221445ea27aaad740ed99e2be7cb463528526e63f6c599ad7d28f7ecea45"
   name = "github.com/sirupsen/logrus"
   packages = ["."]
   pruneopts = "T"
-  revision = "8bdbc7bcc01dcbb8ec23dc8a28e332258d25251f"
-  version = "v1.4.1"
+  revision = "839c75faf7f98a33d445d181f3018b5c3409a45e"
+  version = "v1.4.2"
 
 [[projects]]
   digest = "1:674fedb5641490b913f0f01e4f97f3f578f7a1c5f106cd47cfd5394eca8155db"
@@ -1821,7 +1817,6 @@
     "github.com/asaskevich/govalidator",
     "github.com/containerd/containerd/content",
     "github.com/containerd/containerd/errdefs",
-    "github.com/containerd/containerd/reference",
     "github.com/containerd/containerd/remotes",
     "github.com/deislabs/oras/pkg/auth",
     "github.com/deislabs/oras/pkg/auth/docker",
@@ -1837,7 +1832,6 @@
     "github.com/evanphx/json-patch",
     "github.com/gobwas/glob",
     "github.com/gosuri/uitable",
-    "github.com/gosuri/uitable/util/strutil",
     "github.com/mattn/go-shellwords",
     "github.com/opencontainers/go-digest",
     "github.com/opencontainers/image-spec/specs-go",
diff --git a/Gopkg.toml b/Gopkg.toml
index 0c9e76978..4620a9150 100644
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -44,11 +44,15 @@
 
 [[constraint]]
   name = "github.com/deislabs/oras"
-  version = "0.6.0"
+  version = "0.7.0"
+
+[[constraint]]
+  name = "github.com/containerd/containerd"
+  version = "1.3.0-beta.2"
 
 [[constraint]]
   name = "github.com/sirupsen/logrus"
-  version = "1.3.0"
+  version = "1.4.2"
 
 [[constraint]]
   name = "github.com/docker/go-units"
diff --git a/cmd/helm/registry_login.go b/cmd/helm/registry_login.go
index d3c0c5b6e..c40df0f35 100644
--- a/cmd/helm/registry_login.go
+++ b/cmd/helm/registry_login.go
@@ -38,7 +38,7 @@ Authenticate to a remote registry.
 
 func newRegistryLoginCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	var usernameOpt, passwordOpt string
-	var passwordFromStdinOpt bool
+	var passwordFromStdinOpt, insecureOpt bool
 
 	cmd := &cobra.Command{
 		Use:    "login [host]",
@@ -54,7 +54,7 @@ func newRegistryLoginCmd(cfg *action.Configuration, out io.Writer) *cobra.Comman
 				return err
 			}
 
-			return action.NewRegistryLogin(cfg).Run(out, hostname, username, password)
+			return action.NewRegistryLogin(cfg).Run(out, hostname, username, password, insecureOpt)
 		},
 	}
 
@@ -62,6 +62,7 @@ func newRegistryLoginCmd(cfg *action.Configuration, out io.Writer) *cobra.Comman
 	f.StringVarP(&usernameOpt, "username", "u", "", "registry username")
 	f.StringVarP(&passwordOpt, "password", "p", "", "registry password or identity token")
 	f.BoolVarP(&passwordFromStdinOpt, "password-stdin", "", false, "read password or identity token from stdin")
+	f.BoolVarP(&insecureOpt, "insecure", "", false, "allow connections to TLS registry without certs")
 
 	return cmd
 }
diff --git a/internal/experimental/registry/client.go b/internal/experimental/registry/client.go
index ba413a830..8a668739a 100644
--- a/internal/experimental/registry/client.go
+++ b/internal/experimental/registry/client.go
@@ -93,8 +93,8 @@ func NewClient(opts ...ClientOption) (*Client, error) {
 }
 
 // Login logs into a registry
-func (c *Client) Login(hostname string, username string, password string) error {
-	err := c.authorizer.Login(ctx(c.out, c.debug), hostname, username, password)
+func (c *Client) Login(hostname string, username string, password string, insecure bool) error {
+	err := c.authorizer.Login(ctx(c.out, c.debug), hostname, username, password, insecure)
 	if err != nil {
 		return err
 	}
diff --git a/internal/experimental/registry/client_test.go b/internal/experimental/registry/client_test.go
index fcfb54a9d..d2cc1abaa 100644
--- a/internal/experimental/registry/client_test.go
+++ b/internal/experimental/registry/client_test.go
@@ -124,11 +124,17 @@ func (suite *RegistryClientTestSuite) TearDownSuite() {
 }
 
 func (suite *RegistryClientTestSuite) Test_0_Login() {
-	err := suite.RegistryClient.Login(suite.DockerRegistryHost, "badverybad", "ohsobad")
+	err := suite.RegistryClient.Login(suite.DockerRegistryHost, "badverybad", "ohsobad", false)
 	suite.NotNil(err, "error logging into registry with bad credentials")
 
-	err = suite.RegistryClient.Login(suite.DockerRegistryHost, testUsername, testPassword)
+	err = suite.RegistryClient.Login(suite.DockerRegistryHost, "badverybad", "ohsobad", true)
+	suite.NotNil(err, "error logging into registry with bad credentials, insecure mode")
+
+	err = suite.RegistryClient.Login(suite.DockerRegistryHost, testUsername, testPassword, false)
 	suite.Nil(err, "no error logging into registry with good credentials")
+
+	err = suite.RegistryClient.Login(suite.DockerRegistryHost, testUsername, testPassword, true)
+	suite.Nil(err, "no error logging into registry with good credentials, insecure mode")
 }
 
 func (suite *RegistryClientTestSuite) Test_1_SaveChart() {
diff --git a/internal/experimental/registry/reference.go b/internal/experimental/registry/reference.go
index 41abab25e..4b394d7a5 100644
--- a/internal/experimental/registry/reference.go
+++ b/internal/experimental/registry/reference.go
@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"net/url"
 	"regexp"
+	"strconv"
 	"strings"
 )
 
@@ -51,7 +52,7 @@ func ParseReference(s string) (*Reference, error) {
 	// Split the components of the string on the colon or @, if it is more than 3,
 	// immediately return an error. Other validation will be performed later in
 	// the function
-	splitComponents := referenceDelimiter.Split(s, -1)
+	splitComponents := fixSplitComponents(referenceDelimiter.Split(s, -1))
 	if len(splitComponents) > 3 {
 		return nil, errTooManyColons
 	}
@@ -127,3 +128,18 @@ func (ref *Reference) validateNumColons() error {
 func isValidPort(s string) bool {
 	return validPortRegEx.MatchString(s)
 }
+
+// fixSplitComponents this will modify reference parts based on presence of port
+// Example: {localhost, 5000/x/y/z, 0.1.0} => {localhost:5000/x/y/z, 0.1.0}
+func fixSplitComponents(c []string) []string {
+	if len(c) <= 1 {
+		return c
+	}
+	possiblePortParts := strings.Split(c[1], "/")
+	if _, err := strconv.Atoi(possiblePortParts[0]); err == nil {
+		components := []string{strings.Join(c[:2], ":")}
+		components = append(components, c[2:]...)
+		return components
+	}
+	return c
+}
diff --git a/internal/experimental/registry/reference_test.go b/internal/experimental/registry/reference_test.go
index 86f707fb6..bb53ebab8 100644
--- a/internal/experimental/registry/reference_test.go
+++ b/internal/experimental/registry/reference_test.go
@@ -94,4 +94,26 @@ func TestParseReference(t *testing.T) {
 	is.Equal("my.host.com/my/nested/repo", ref.Repo)
 	is.Equal("1.2.3", ref.Tag)
 	is.Equal("my.host.com/my/nested/repo:1.2.3", ref.FullName())
+
+	s = "localhost:5000/x/y/z"
+	ref, err = ParseReference(s)
+	is.NoError(err)
+	is.Equal("localhost:5000/x/y/z", ref.Repo)
+	is.Equal("", ref.Tag)
+	is.Equal("localhost:5000/x/y/z", ref.FullName())
+
+	s = "localhost:5000/x/y/z:123"
+	ref, err = ParseReference(s)
+	is.NoError(err)
+	is.Equal("localhost:5000/x/y/z", ref.Repo)
+	is.Equal("123", ref.Tag)
+	is.Equal("localhost:5000/x/y/z:123", ref.FullName())
+
+	s = "localhost:5000/x/y/z:123:x"
+	_, err = ParseReference(s)
+	is.Error(err, "ref contains too many colons (3)")
+
+	s = "localhost:5000/x/y/z:123:x:y"
+	_, err = ParseReference(s)
+	is.Error(err, "ref contains too many colons (4)")
 }
diff --git a/pkg/action/chart_save_test.go b/pkg/action/chart_save_test.go
index 697f1ed51..999130b16 100644
--- a/pkg/action/chart_save_test.go
+++ b/pkg/action/chart_save_test.go
@@ -57,6 +57,13 @@ func TestChartSave(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	// TODO: guess latest based on semver?
+	_, err = action.cfg.RegistryClient.LoadChart(ref)
+	if err == nil {
+		t.Error("Expected error parsing ref without tag")
+	}
+
+	ref.Tag = "0.1.0"
 	if _, err := action.cfg.RegistryClient.LoadChart(ref); err != nil {
 		t.Error(err)
 	}
diff --git a/pkg/action/registry_login.go b/pkg/action/registry_login.go
index 2192d49e8..00f6e2644 100644
--- a/pkg/action/registry_login.go
+++ b/pkg/action/registry_login.go
@@ -33,6 +33,6 @@ func NewRegistryLogin(cfg *Configuration) *RegistryLogin {
 }
 
 // Run executes the registry login operation
-func (a *RegistryLogin) Run(out io.Writer, hostname string, username string, password string) error {
-	return a.cfg.RegistryClient.Login(hostname, username, password)
+func (a *RegistryLogin) Run(out io.Writer, hostname string, username string, password string, insecure bool) error {
+	return a.cfg.RegistryClient.Login(hostname, username, password, insecure)
 }