Repository: containerd/containerd
File: core/remotes/docker/config/hosts.go (Go)

Code before:
			// also catches TLS errors early enough in the request to avoid sending
			// the request twice or consuming the request body.
			if host.scheme == "http" && explicitTLS {
				_, port, _ := net.SplitHostPort(host.host)
				if port != "80" {
					log.G(ctx).WithField("host", host.host).Info("host will try HTTPS first since it is configured for HTTP with a TLS configuration, consider changing host to HTTPS or removing unused TLS configuration")
					host.scheme = "https"
					rhosts[i].Client.Transport = docker.NewHTTPFallback(rhosts[i].Client.Transport)
				}
			}

			rhosts[i].Scheme = host.scheme
			rhosts[i].Host = host.host
			rhosts[i].Path = host.path
			rhosts[i].Capabilities = host.capabilities
			rhosts[i].Header = host.header
		}

		return rhosts, nil
	}
}

// tlsConfigFromHost updates `tlsConfig` with the TLS configuration from `host`.
// Use `host` as a pointer to avoid struct copy.
func tlsConfigFromHost(tlsConfig *tls.Config, host *hostConfig) error {
	if host.skipVerify != nil {
		tlsConfig.InsecureSkipVerify = *host.skipVerify
	}
	if host.caCerts != nil {
		if tlsConfig.RootCAs == nil {
			rootPool, err := rootSystemPool()
			if err != nil {
				return fmt.Errorf("unable to initialize cert pool: %w", err)
			}
			tlsConfig.RootCAs = rootPool
		}
		for _, f := range host.caCerts {
			data, err := os.ReadFile(f)
			if err != nil {
				return fmt.Errorf("unable to read CA cert %q: %w", f, err)
			}
			if !tlsConfig.RootCAs.AppendCertsFromPEM(data) {
				return fmt.Errorf("unable to load CA cert %q", f)
			}
		}
	}

	for _, pair := range host.clientPairs {
		certPEMBlock, err := os.ReadFile(pair[0])
		if err != nil {
			return fmt.Errorf("unable to read CERT file %q: %w", pair[0], err)

Review comment (refactor):
This is moved from old line 182-229. The `ConfigureHosts` func is a bit too long IMO. I feel moving this out of it makes its main logic more clear.

Code after:
			// also catches TLS errors early enough in the request to avoid sending
			// the request twice or consuming the request body.
			if host.scheme == "http" && explicitTLS {
				_, port, _ := net.SplitHostPort(host.host)
				if port != "80" {
					log.G(ctx).WithField("host", host.host).Info("host will try HTTPS first since it is configured for HTTP with a TLS configuration, consider changing host to HTTPS or removing unused TLS configuration")
					host.scheme = "https"
					rhosts[i].Client.Transport = docker.NewHTTPFallback(rhosts[i].Client.Transport)
				}
			}

			rhosts[i].Scheme = host.scheme
			rhosts[i].Host = host.host
			rhosts[i].Path = host.path
			rhosts[i].Capabilities = host.capabilities
			rhosts[i].Header = host.header
		}

		return rhosts, nil
	}

}

func updateTLSConfigFromHost(tlsConfig *tls.Config, host *hostConfig) error {
	if host.skipVerify != nil {
		tlsConfig.InsecureSkipVerify = *host.skipVerify
	}

	if host.caCerts != nil {
		if tlsConfig.RootCAs == nil {
			rootPool, err := rootSystemPool()
			if err != nil {
				return fmt.Errorf("unable to initialize cert pool: %w", err)
			}
			tlsConfig.RootCAs = rootPool
		}
		for _, f := range host.caCerts {
			data, err := os.ReadFile(f)
			if err != nil {
				return fmt.Errorf("unable to read CA cert %q: %w", f, err)
			}
			if !tlsConfig.RootCAs.AppendCertsFromPEM(data) {
				return fmt.Errorf("unable to load CA cert %q", f)
			}
		}
	}

	for _, pair := range host.clientPairs {
		certPEMBlock, err := os.ReadFile(pair[0])
		if err != nil {
			return fmt.Errorf("unable to read CERT file %q: %w", pair[0], err)