| 14 | ) |
| 15 | |
| 16 | func Client(log slog.Logger, extraCertsPath string) (*http.Client, error) { |
| 17 | if extraCertsPath == "" { |
| 18 | return &http.Client{}, nil |
| 19 | } |
| 20 | |
| 21 | log = log.With(slog.F("root_path", extraCertsPath)) |
| 22 | log.Debug(context.Background(), "adding certs to default pool") |
| 23 | pool, err := certPool(log, extraCertsPath) |
| 24 | if err != nil { |
| 25 | return nil, xerrors.Errorf("cert pool: %w", err) |
| 26 | } |
| 27 | |
| 28 | //nolint:forcetypeassert |
| 29 | transport := (http.DefaultTransport.(*http.Transport)).Clone() |
| 30 | |
| 31 | //nolint:gosec |
| 32 | transport.TLSClientConfig = &tls.Config{ |
| 33 | RootCAs: pool, |
| 34 | } |
| 35 | |
| 36 | return &http.Client{ |
| 37 | Transport: transport, |
| 38 | }, nil |
| 39 | } |
| 40 | |
| 41 | func certPool(log slog.Logger, certsPath string) (*x509.CertPool, error) { |
| 42 | pool, err := x509.SystemCertPool() |