From 8fa7a81cb26469b3f33344c1e47efcae37df4a11 Mon Sep 17 00:00:00 2001
From: Milos Gajdos <milosthegajdos@gmail.com>
Date: Fri, 15 Dec 2023 09:34:06 +0000
Subject: [PATCH 1/2] fix: use http.DefaultTransport in S3 client

Unfortunately one of the changes we merged in broken the support for
http.ProxyFromEnvironment https://pkg.go.dev/net/http#ProxyFromEnvironment

This commit attempts to fix that by cloning the http.DefaultTransport
and updating it accordingly.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
---
 registry/storage/driver/s3-aws/s3.go | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/registry/storage/driver/s3-aws/s3.go b/registry/storage/driver/s3-aws/s3.go
index 7dde1f72..2d51ddf7 100644
--- a/registry/storage/driver/s3-aws/s3.go
+++ b/registry/storage/driver/s3-aws/s3.go
@@ -560,9 +560,8 @@ func New(ctx context.Context, params DriverParameters) (*Driver, error) {
 	}
 
 	if params.SkipVerify {
-		httpTransport := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		}
+		httpTransport := http.DefaultTransport.(*http.Transport).Clone()
+		httpTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
 		awsConfig.WithHTTPClient(&http.Client{
 			Transport: httpTransport,
 		})

From def497a8aa5fc11b3eedd04ecf98e132c5342bce Mon Sep 17 00:00:00 2001
From: Milos Gajdos <milosthegajdos@gmail.com>
Date: Sat, 16 Dec 2023 12:48:55 +0000
Subject: [PATCH 2/2] update: add tests for S3 driver client SkipVerify
 settings

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
---
 registry/storage/driver/s3-aws/s3_test.go | 50 +++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/registry/storage/driver/s3-aws/s3_test.go b/registry/storage/driver/s3-aws/s3_test.go
index ea11f872..3d334854 100644
--- a/registry/storage/driver/s3-aws/s3_test.go
+++ b/registry/storage/driver/s3-aws/s3_test.go
@@ -6,6 +6,7 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
+	"net/http"
 	"os"
 	"path"
 	"reflect"
@@ -211,6 +212,55 @@ func TestEmptyRootList(t *testing.T) {
 	}
 }
 
+func TestClientTransport(t *testing.T) {
+	testCases := []struct {
+		skipverify bool
+	}{
+		{true},
+		{false},
+	}
+
+	for _, tc := range testCases {
+		// NOTE(milosgajdos): we cannot simply reuse s3DriverConstructor
+		// because s3DriverConstructor is initialized in init() using the process
+		// env vars: we can not override S3_SKIP_VERIFY env var with t.Setenv
+		params := map[string]interface{}{
+			"region":     os.Getenv("AWS_REGION"),
+			"bucket":     os.Getenv("S3_BUCKET"),
+			"skipverify": tc.skipverify,
+		}
+		t.Run(fmt.Sprintf("SkipVerify %v", tc.skipverify), func(t *testing.T) {
+			drv, err := FromParameters(context.TODO(), params)
+			if err != nil {
+				t.Fatalf("failed to create driver: %v", err)
+			}
+
+			s3drv := drv.baseEmbed.Base.StorageDriver.(*driver)
+			if tc.skipverify {
+				tr, ok := s3drv.S3.Client.Config.HTTPClient.Transport.(*http.Transport)
+				if !ok {
+					t.Fatal("unexpected driver transport")
+				}
+				if !tr.TLSClientConfig.InsecureSkipVerify {
+					t.Errorf("unexpected TLS Config. Expected InsecureSkipVerify: %v, got %v",
+						tc.skipverify,
+						tr.TLSClientConfig.InsecureSkipVerify)
+				}
+				// make sure the proxy is always set
+				if tr.Proxy == nil {
+					t.Fatal("missing HTTP transport proxy config")
+				}
+				return
+			}
+			// if tc.skipverify is false we do not override the driver
+			// HTTP clien transport and leave it to the AWS SDK.
+			if s3drv.S3.Client.Config.HTTPClient.Transport != nil {
+				t.Errorf("unexpected S3 driver client transport")
+			}
+		})
+	}
+}
+
 func TestStorageClass(t *testing.T) {
 	skipCheck(t)