Allow passing in an http.RoundTripper

go.mod

@@ -10,6 +10,7 @@ require (
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-containerregistry v0.20.3
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
+	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-retryablehttp v0.7.7
 	github.com/invopop/jsonschema v0.13.0
 	github.com/klauspost/compress v1.17.11
@@ -97,7 +98,6 @@ require (
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect

pkg/apk/apk/implementation.go

@@ -96,6 +96,8 @@ func New(options ...Option) (*APK, error) {
 	}
 
 	client := retryablehttp.NewClient()
+
+	client.HTTPClient = &http.Client{Transport: opt.transport}
 	client.Logger = clog.FromContext(context.Background())
 
 	return &APK{

pkg/apk/apk/options.go

@@ -15,10 +15,13 @@
 package apk
 
 import (
+	"net/http"
 	"os"
 	"path/filepath"
 	"runtime"
 
+	"github.com/hashicorp/go-cleanhttp"
+
 	"chainguard.dev/apko/pkg/apk/auth"
 	apkfs "chainguard.dev/apko/pkg/apk/fs"
 )
@@ -33,6 +36,7 @@ type opts struct {
 	noSignatureIndexes []string
 	auth               auth.Authenticator
 	ignoreSignatures   bool
+	transport          http.RoundTripper
 }
 
 type Option func(*opts) error
@@ -130,10 +134,21 @@ func WithAuthenticator(a auth.Authenticator) Option {
 	}
 }
 
+// WithTransport allows explicitly setting the inner HTTP transport.
+func WithTransport(t http.RoundTripper) Option {
+	return func(o *opts) error {
+		if t != nil {
+			o.transport = t
+		}
+		return nil
+	}
+}
+
 func defaultOpts() *opts {
 	return &opts{
 		arch:              ArchToAPK(runtime.GOARCH),
 		ignoreMknodErrors: false,
 		auth:              auth.DefaultAuthenticators,
+		transport:         cleanhttp.DefaultPooledTransport(),
 	}
 }

pkg/build/build.go

@@ -246,6 +246,7 @@ func New(ctx context.Context, fs apkfs.FullFS, opts ...Option) (*Context, error)
 		apk.WithIgnoreMknodErrors(true),
 		apk.WithIgnoreIndexSignatures(bc.o.IgnoreSignatures),
 		apk.WithAuthenticator(bc.o.Auth),
+		apk.WithTransport(bc.o.Transport),
 	}
 	// only try to pass the cache dir if one of the following is true:
 	// - the user has explicitly set a cache dir

pkg/build/options.go

@@ -19,6 +19,7 @@ import (
 	sha2562 "crypto/sha256"
 	"encoding/base64"
 	"fmt"
+	"net/http"
 	"time"
 
 	"chainguard.dev/apko/pkg/apk/apk"
@@ -229,3 +230,11 @@ func WithIgnoreSignatures(ignore bool) Option {
 		return nil
 	}
 }
+
+// WithTransport allows explicitly setting the inner HTTP transport.
+func WithTransport(t http.RoundTripper) Option {
+	return func(bc *Context) error {
+		bc.o.Transport = t
+		return nil
+	}
+}

pkg/options/options.go

@@ -17,6 +17,7 @@ package options
 import (
 	"fmt"
 	"log"
+	"net/http"
 	"os"
 	"runtime"
 	"time"
@@ -55,6 +56,7 @@ type Options struct {
 	Auth                    auth.Authenticator `json:"-"`
 	IncludePaths            []string           `json:"includePaths,omitempty"`
 	IgnoreSignatures        bool               `json:"ignoreSignatures,omitempty"`
+	Transport               http.RoundTripper  `json:"-"`
 }
 
 type Auth struct{ User, Pass string }