Switch to avast/retry-go for HTTP retry

The hashicorp dependencies are MPL licensed and therefore not allowed in
the CNCF. This means we now use the `avast/retry-go` implementation to
achieve the same goal.

Signed-off-by: Sascha Grunert <[email protected]>

Author: saschagrunert

cmd/rekor-cli/app/get.go

@@ -82,6 +82,7 @@ var getCmd = &cobra.Command{
 	},
 	Run: format.WrapCmd(func(_ []string) (interface{}, error) {
 		ctx := context.Background()
+		//nolint:staticcheck
 		rekorClient, err := client.GetRekorClient(viper.GetString("rekor_server"), client.WithUserAgent(UserAgent()), client.WithRetryCount(viper.GetUint("retry")), client.WithLogger(log.CliLogger))
 		if err != nil {
 			return nil, err

cmd/rekor-cli/app/log_info.go

@@ -66,6 +66,7 @@ var logInfoCmd = &cobra.Command{
 	Run: format.WrapCmd(func(_ []string) (interface{}, error) {
 		serverURL := viper.GetString("rekor_server")
 		ctx := context.Background()
+		//nolint:staticcheck
 		rekorClient, err := client.GetRekorClient(serverURL, client.WithUserAgent(UserAgent()), client.WithRetryCount(viper.GetUint("retry")), client.WithLogger(log.CliLogger))
 		if err != nil {
 			return nil, err

cmd/rekor-cli/app/log_proof.go

@@ -73,6 +73,7 @@ var logProofCmd = &cobra.Command{
 		return nil
 	},
 	Run: format.WrapCmd(func(_ []string) (interface{}, error) {
+		//nolint:staticcheck
 		rekorClient, err := client.GetRekorClient(viper.GetString("rekor_server"), client.WithUserAgent(UserAgent()), client.WithRetryCount(viper.GetUint("retry")), client.WithLogger(log.CliLogger))
 		if err != nil {
 			return nil, err

cmd/rekor-cli/app/search.go

@@ -98,6 +98,7 @@ var searchCmd = &cobra.Command{
 	},
 	Run: format.WrapCmd(func(_ []string) (interface{}, error) {
 		log := log.CliLogger
+		//nolint:staticcheck
 		rekorClient, err := client.GetRekorClient(viper.GetString("rekor_server"), client.WithUserAgent(UserAgent()), client.WithRetryCount(viper.GetUint("retry")), client.WithLogger(log))
 		if err != nil {
 			return nil, err

cmd/rekor-cli/app/upload.go

@@ -68,6 +68,7 @@ var uploadCmd = &cobra.Command{
 	Long: `This command takes the public key, signature and URL of the release artifact and uploads it to the rekor server.`,
 	Run: format.WrapCmd(func(_ []string) (interface{}, error) {
 		ctx := context.Background()
+		//nolint:staticcheck
 		rekorClient, err := client.GetRekorClient(viper.GetString("rekor_server"), client.WithUserAgent(UserAgent()), client.WithRetryCount(viper.GetUint("retry")), client.WithLogger(log.CliLogger))
 		if err != nil {
 			return nil, err

cmd/rekor-cli/app/verify.go

@@ -93,6 +93,7 @@ var verifyCmd = &cobra.Command{
 	},
 	Run: format.WrapCmd(func(_ []string) (interface{}, error) {
 		ctx := context.Background()
+		//nolint:staticcheck
 		rekorClient, err := client.GetRekorClient(viper.GetString("rekor_server"), client.WithUserAgent(UserAgent()), client.WithRetryCount(viper.GetUint("retry")), client.WithLogger(log.CliLogger))
 		if err != nil {
 			return nil, err

go.mod

@@ -56,12 +56,11 @@ require (
 	cloud.google.com/go/pubsub v1.45.3
 	github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d
 	github.com/DATA-DOG/go-sqlmock v1.5.2
+	github.com/avast/retry-go/v4 v4.6.0
 	github.com/cyberphone/json-canonicalization v0.0.0-20220623050100-57a0ce2678a7
 	github.com/go-redis/redismock/v9 v9.2.0
 	github.com/go-sql-driver/mysql v1.8.1
 	github.com/golang/mock v1.6.0
-	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-retryablehttp v0.7.7
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/redis/go-redis/v9 v9.7.0
 	github.com/sassoftware/relic/v7 v7.6.2
@@ -132,7 +131,9 @@ require (
 	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect

go.sum

@@ -64,6 +64,8 @@ github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPp
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/avast/retry-go/v4 v4.6.0 h1:K9xNA+KeB8HHc2aWFuLb25Offp+0iVRXEvFx8IinRJA=
+github.com/avast/retry-go/v4 v4.6.0/go.mod h1:gvWlPhBVsvBbLkVGDg/KwvBv0bEkCOLRRSHKIr2PyOE=
 github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
 github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v1.32.8 h1:cZV+NUS/eGxKXMtmyhtYPJ7Z4YLoI/V8bkTdRZfYhGo=

pkg/client/options.go

@@ -15,10 +15,11 @@
 package client
 
 import (
+	"fmt"
 	"net/http"
 	"time"
 
-	"github.com/hashicorp/go-retryablehttp"
+	"github.com/avast/retry-go/v4"
 )
 
 // Option is a functional option for customizing static signatures.
@@ -30,7 +31,6 @@ type options struct {
 	RetryWaitMin        time.Duration
 	RetryWaitMax        time.Duration
 	InsecureTLS         bool
-	Logger              interface{}
 	NoDisableKeepalives bool
 	Headers             map[string][]string
 }
@@ -81,14 +81,9 @@ func WithRetryWaitMax(t time.Duration) Option {
 	}
 }
 
-// WithLogger sets the logger; it must implement either retryablehttp.Logger or retryablehttp.LeveledLogger; if not, this will not take effect.
-func WithLogger(logger interface{}) Option {
-	return func(o *options) {
-		switch logger.(type) {
-		case retryablehttp.Logger, retryablehttp.LeveledLogger:
-			o.Logger = logger
-		}
-	}
+// Deprecated: WithLogger sets the logger; this will have no effect and be removed in future versions.
+func WithLogger(interface{}) Option {
+	return func(*options) {}
 }
 
 // WithInsecureTLS disables TLS verification.
@@ -113,33 +108,43 @@ func WithHeaders(h map[string][]string) Option {
 }
 
 type roundTripper struct {
-	http.RoundTripper
-	UserAgent string
-	Headers   map[string][]string
+	inner http.RoundTripper
+	*options
 }
 
 // RoundTrip implements `http.RoundTripper`
-func (rt *roundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	req.Header.Set("User-Agent", rt.UserAgent)
-	for k, v := range rt.Headers {
+func (rt *roundTripper) RoundTrip(req *http.Request) (res *http.Response, err error) {
+	req.Header.Set("User-Agent", rt.options.UserAgent)
+	for k, v := range rt.options.Headers {
 		for _, h := range v {
 			req.Header.Add(k, h)
 		}
 	}
-	return rt.RoundTripper.RoundTrip(req)
+
+	err = retry.Do(func() (err error) {
+		res, err = rt.inner.RoundTrip(req)
+		if err != nil {
+			return err
+		}
+		if res.StatusCode != 200 {
+			return fmt.Errorf("%d: %s", res.StatusCode, res.Status)
+		}
+		return nil
+	},
+		retry.Attempts(rt.options.RetryCount),
+		retry.Delay(rt.options.RetryWaitMin),
+		retry.MaxDelay(rt.options.RetryWaitMax),
+	)
+
+	return res, err
 }
 
-func createRoundTripper(inner http.RoundTripper, o *options) http.RoundTripper {
+func wrapRoundTripper(inner http.RoundTripper, o *options) http.RoundTripper {
 	if inner == nil {
 		inner = http.DefaultTransport
 	}
-	if o.UserAgent == "" && o.Headers == nil {
-		// There's nothing to do...
-		return inner
-	}
 	return &roundTripper{
-		RoundTripper: inner,
-		UserAgent:    o.UserAgent,
-		Headers:      o.Headers,
+		inner:   inner,
+		options: o,
 	}
 }

pkg/client/options_test.go

@@ -17,15 +17,12 @@ package client
 import (
 	"log"
 	"net/http"
-	"os"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
 )
 
 func TestMakeOptions(t *testing.T) {
-	customLogger := log.New(os.Stdout, "", log.LstdFlags)
-
 	tests := []struct {
 		desc string
 
@@ -42,10 +39,6 @@ func TestMakeOptions(t *testing.T) {
 		desc: "WithRetryCount",
 		opts: []Option{WithRetryCount(2)},
 		want: &options{UserAgent: "", RetryCount: 2},
-	}, {
-		desc: "WithLogger",
-		opts: []Option{WithLogger(customLogger)},
-		want: &options{UserAgent: "", RetryCount: DefaultRetryCount, Logger: customLogger},
 	}, {
 		desc: "WithLoggerNil",
 		opts: []Option{WithLogger(nil)},
@@ -82,11 +75,11 @@ func (m *mockRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 	return m.resp, m.err
 }
 
-func TestCreateRoundTripper(t *testing.T) {
+func TestWrapRoundTripper(t *testing.T) {
 	t.Run("always returns non-nil", func(t *testing.T) {
-		got := createRoundTripper(nil, &options{})
+		got := wrapRoundTripper(nil, &options{})
 		if got == nil {
-			t.Errorf("createRoundTripper() should never return a nil `http.RoundTripper`")
+			t.Errorf("wrapRoundTripper() should never return a nil `http.RoundTripper`")
 		}
 	})
 
@@ -104,7 +97,7 @@ func TestCreateRoundTripper(t *testing.T) {
 	expectedUserAgent := "test UserAgent"
 
 	m := &mockRoundTripper{}
-	rt := createRoundTripper(m, &options{
+	rt := wrapRoundTripper(m, &options{
 		UserAgent: expectedUserAgent,
 	})
 	m.resp = testResp