Repository: containerd/containerd
File: core/remotes/docker/config/hosts.go (Go)

Code before:

		defaultTransport := docker.DefaultHTTPTransport(defaultTLSConfig)

		client := &http.Client{
			Transport: defaultTransport,
		}
		if options.UpdateClient != nil {
			if err := options.UpdateClient(client); err != nil {
				return nil, err
			}
		}

		authOpts := []docker.AuthorizerOpt{docker.WithAuthClient(client)}
		if options.Credentials != nil {
			authOpts = append(authOpts, docker.WithAuthCreds(options.Credentials))
		}
		authOpts = append(authOpts, options.AuthorizerOpts...)
		authorizer := docker.NewDockerAuthorizer(authOpts...)

		rhosts := make([]docker.RegistryHost, len(hosts))
		for i, host := range hosts {
			// Allow setting for each host as well
			explicitTLS := tlsConfigured

			if host.caCerts != nil || host.clientPairs != nil || host.skipVerify != nil || host.dialTimeout != nil {
				explicitTLS = true
				tr := defaultTransport.Clone()
				tlsConfig := tr.TLSClientConfig
				if host.skipVerify != nil {
					tlsConfig.InsecureSkipVerify = *host.skipVerify
				}
				if host.caCerts != nil {
					if tlsConfig.RootCAs == nil {
						rootPool, err := rootSystemPool()
						if err != nil {
							return nil, fmt.Errorf("unable to initialize cert pool: %w", err)
						}
						tlsConfig.RootCAs = rootPool
					}
					for _, f := range host.caCerts {
						data, err := os.ReadFile(f)
						if err != nil {
							return nil, fmt.Errorf("unable to read CA cert %q: %w", f, err)
						}
						if !tlsConfig.RootCAs.AppendCertsFromPEM(data) {
							return nil, fmt.Errorf("unable to load CA cert %q", f)
						}
					}
				}

				for _, pair := range host.clientPairs {

Review comment (bug):
this is the bug fix; below is refactor with no logic change.

Code after:

		defaultTransport := docker.DefaultHTTPTransport(defaultTLSConfig)

		client := &http.Client{
			Transport: defaultTransport,
		}
		if options.UpdateClient != nil {
			if err := options.UpdateClient(client); err != nil {
				return nil, err
			}
		}

		authOpts := []docker.AuthorizerOpt{docker.WithAuthClient(client)}
		if options.Credentials != nil {
			authOpts = append(authOpts, docker.WithAuthCreds(options.Credentials))
		}
		authOpts = append(authOpts, options.AuthorizerOpts...)
		authorizer := docker.NewDockerAuthorizer(authOpts...)

		rhosts := make([]docker.RegistryHost, len(hosts))
		for i, host := range hosts {
			// Allow setting for each host as well
			explicitTLSFromHost := host.caCerts != nil || host.clientPairs != nil || host.skipVerify != nil
			explicitTLS := tlsConfigured || explicitTLSFromHost

			if explicitTLSFromHost || host.dialTimeout != nil {
				tr := defaultTransport.Clone()

				if explicitTLSFromHost {
					if err := updateTLSConfigFromHost(tr.TLSClientConfig, &host); err != nil {
						return nil, err
					}
				}

				if host.dialTimeout != nil {
					tr.DialContext = (&net.Dialer{
						Timeout:       *host.dialTimeout,
						KeepAlive:     30 * time.Second,
						FallbackDelay: 300 * time.Millisecond,
					}).DialContext
				}

				c := *client
				c.Transport = tr
				if options.UpdateClient != nil {
					if err := options.UpdateClient(&c); err != nil {
						return nil, err
					}
				}

				rhosts[i].Client = &c