Method httpClient

pkg/getter/httpgetter.go:118–166

(opts getterOptions)

}

func (g *HTTPGetter) httpClient(opts getterOptions) (*http.Client, error) {
	if opts.transport != nil {
		return &http.Client{
			Transport: opts.transport,
			Timeout:   opts.timeout,
		}, nil
	}

	// Check if we need custom TLS configuration
	needsCustomTLS := (opts.certFile != "" && opts.keyFile != "") || opts.caFile != "" || opts.insecureSkipVerifyTLS

	if needsCustomTLS {
		// Create a new transport for custom TLS to avoid race conditions
		transport := &http.Transport{
			DisableCompression: true,
			Proxy:              http.ProxyFromEnvironment,
		}

		tlsConf, err := tlsutil.NewTLSConfig(
			tlsutil.WithInsecureSkipVerify(opts.insecureSkipVerifyTLS),
			tlsutil.WithCertKeyPairFiles(opts.certFile, opts.keyFile),
			tlsutil.WithCAFile(opts.caFile),
		)
		if err != nil {
			return nil, fmt.Errorf("can't create TLS config for client: %w", err)
		}

		transport.TLSClientConfig = tlsConf

		return &http.Client{
			Transport: transport,
			Timeout:   opts.timeout,
		}, nil
	}

	// Use shared transport for default case (no custom TLS)
	g.once.Do(func() {
		g.transport = &http.Transport{
			DisableCompression: true,
			Proxy:              http.ProxyFromEnvironment,
			TLSClientConfig:    &tls.Config{},
		}
	})

	return &http.Client{
		Transport: g.transport,
		Timeout:   opts.timeout,
	}, nil
}