Extract internal/httpclient package from config and tlsct

Move HTTP client utilities (WrapLogging, WrapCounting, RetryTransport,
NewHTTPClient, NewHTTPClientWithTransport, NewAttestationClient) into a
dedicated httpclient package. The config package now contains only
configuration constants and loading logic — no HTTP client construction.
The tlsct package retains only Certificate Transparency verification.

Add httpclient.Do() which wraps client.Do() and annotates errors with
the configured Client.Timeout value, ensuring timeout errors always
show the configured limit even when http.Client.Timeout fires above
the transport chain.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 13rac1

internal/attestation/nvidia.go

@@ -16,7 +16,7 @@ import (
 
 	"golang.org/x/sync/singleflight"
 
-	"github.com/13rac1/teep/internal/tlsct"
+	"github.com/13rac1/teep/internal/httpclient"
 	"github.com/MicahParks/keyfunc/v3"
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -150,7 +150,7 @@ func (v *NVIDIAVerifier) Shutdown() {
 // Reference Integrity Manifest values.
 func (v *NVIDIAVerifier) VerifyNRAS(ctx context.Context, eatPayload string, client *http.Client, opts ...jwt.ParserOption) *NvidiaVerifyResult {
 	if client == nil {
-		client = tlsct.NewHTTPClient(30 * time.Second)
+		client = httpclient.NewHTTPClient(30 * time.Second)
 	}
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, v.nrasURL, strings.NewReader(eatPayload))
@@ -163,7 +163,7 @@ func (v *NVIDIAVerifier) VerifyNRAS(ctx context.Context, eatPayload string, clie
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Accept", "application/json")
 
-	resp, err := client.Do(req)
+	resp, err := httpclient.Do(client, req)
 	if err != nil {
 		return &NvidiaVerifyResult{
 			Format:       "JWT",
@@ -260,13 +260,13 @@ func (v *NVIDIAVerifier) fetchAndCacheJWKS(ctx context.Context, jwksURL string,
 	v.mu.RUnlock()
 
 	if client == nil {
-		client = tlsct.NewHTTPClient(30 * time.Second)
+		client = httpclient.NewHTTPClient(30 * time.Second)
 	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, jwksURL, http.NoBody)
 	if err != nil {
 		return nil, fmt.Errorf("build JWKS request for %s: %w", jwksURL, err)
 	}
-	resp, err := client.Do(req)
+	resp, err := httpclient.Do(client, req)
 	if err != nil {
 		return nil, fmt.Errorf("fetch JWKS from %s: %w", jwksURL, err)
 	}

internal/attestation/poc.go

@@ -17,6 +17,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/13rac1/teep/internal/httpclient"
 	"github.com/13rac1/teep/internal/jsonstrict"
 )
 
@@ -400,7 +401,7 @@ func (c *PoCClient) postJSON(ctx context.Context, baseURL, path string, payload
 	}
 	req.Header.Set("Content-Type", "application/json")
 
-	resp, err := c.client.Do(req)
+	resp, err := httpclient.Do(c.client, req)
 	if err != nil {
 		return nil, err
 	}

internal/attestation/rekor.go

@@ -19,6 +19,7 @@ import (
 	"sync"
 	"unicode/utf8"
 
+	"github.com/13rac1/teep/internal/httpclient"
 	"github.com/cyberphone/json-canonicalization/go/src/webpki.org/jsoncanonicalizer"
 	"github.com/transparency-dev/merkle/proof"
 	"github.com/transparency-dev/merkle/rfc6962"
@@ -289,7 +290,7 @@ func (rc *RekorClient) fetchRekorUUIDs(ctx context.Context, digest string) ([]st
 	}
 	req.Header.Set("Content-Type", "application/json")
 
-	resp, err := rc.httpClient.Do(req)
+	resp, err := httpclient.Do(rc.httpClient, req)
 	if err != nil {
 		return nil, err
 	}
@@ -324,7 +325,7 @@ func (rc *RekorClient) fetchRekorEntry(ctx context.Context, uuid string) (*rekor
 	}
 	req.Header.Set("Content-Type", "application/json")
 
-	resp, err := rc.httpClient.Do(req)
+	resp, err := httpclient.Do(rc.httpClient, req)
 	if err != nil {
 		return nil, err
 	}

internal/attestation/tdx.go

@@ -13,6 +13,7 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/13rac1/teep/internal/httpclient"
 	tdxabi "github.com/google/go-tdx-guest/abi"
 	"github.com/google/go-tdx-guest/pcs"
 	pb "github.com/google/go-tdx-guest/proto/tdx"
@@ -36,7 +37,7 @@ func (g *clientHTTPSGetter) GetContext(ctx context.Context, url string) (header
 	if err != nil {
 		return nil, nil, err
 	}
-	resp, err := g.client.Do(req)
+	resp, err := httpclient.Do(g.client, req)
 	if err != nil {
 		return nil, nil, err
 	}

internal/config/config.go

@@ -15,7 +15,6 @@ import (
 	"fmt"
 	"log/slog"
 	"net"
-	"net/http"
 	"os"
 	"strconv"
 	"strings"
@@ -24,7 +23,6 @@ import (
 	"github.com/BurntSushi/toml"
 
 	"github.com/13rac1/teep/internal/attestation"
-	"github.com/13rac1/teep/internal/tlsct"
 )
 
 const (
@@ -670,87 +668,3 @@ func RedactKey(key string) string {
 	return key[:4] + "****"
 }
 
-// RetryTransport retries requests on 5xx responses and network errors. For
-// requests with a body it requires req.GetBody to be set so the body can be
-// reset between attempts (http.NewRequestWithContext sets GetBody automatically
-// when passed a *bytes.Reader). If a retry is needed and GetBody is nil for a
-// request with a body, the last error is returned immediately rather than
-// sending an empty body. GET requests have no body and are always retried
-// unconditionally.
-//
-// Base must be non-nil.
-//
-// All attestation endpoints retried by this transport are effectively
-// idempotent reads. Do not use for POST endpoints with side effects (nonce
-// consumption, billing) without explicit consideration.
-type RetryTransport struct {
-	Base        http.RoundTripper
-	MaxAttempts int           // 0 → default 3
-	MaxDelay    time.Duration // 0 → default 4s
-}
-
-// RoundTrip executes the request, retrying on 5xx and network errors.
-func (t *RetryTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	maxAttempts := t.MaxAttempts
-	if maxAttempts <= 0 {
-		maxAttempts = 3
-	}
-	maxDelay := t.MaxDelay
-	if maxDelay <= 0 {
-		maxDelay = 4 * time.Second
-	}
-	hasBody := req.Body != nil && req.Body != http.NoBody
-	var lastErr error
-	for attempt := range maxAttempts {
-		if attempt > 0 {
-			if hasBody && req.GetBody == nil {
-				// Body was consumed on the first attempt and cannot be reset.
-				return nil, lastErr
-			}
-			exp := min(attempt-1, 30) // cap to avoid int64 overflow; 2^30s >> any realistic maxDelay
-			timer := time.NewTimer(min(time.Duration(1<<exp)*time.Second, maxDelay))
-			select {
-			case <-req.Context().Done():
-				timer.Stop()
-				return nil, req.Context().Err()
-			case <-timer.C:
-			}
-			slog.WarnContext(req.Context(), "retrying after error",
-				"host", req.URL.Host, "path", req.URL.Path, "attempt", attempt+1, "err", lastErr)
-			if req.GetBody != nil {
-				body, err := req.GetBody()
-				if err != nil {
-					return nil, err
-				}
-				req.Body = body
-			}
-		}
-		resp, err := t.Base.RoundTrip(req)
-		if err != nil {
-			lastErr = err
-			continue
-		}
-		if resp.StatusCode >= 500 {
-			resp.Body.Close()
-			lastErr = fmt.Errorf("HTTP %d from %s", resp.StatusCode, req.URL.Host)
-			continue
-		}
-		return resp, nil
-	}
-	return nil, lastErr
-}
-
-// NewAttestationClient returns an *http.Client with a 30-second timeout and
-// tuned transport, suitable for fetching attestation data from TEE provider
-// endpoints. The default MaxIdleConnsPerHost (2) is too low for providers
-// that serve multiple models from the same host. In offline mode, CT checks
-// are disabled to avoid external CT log list downloads.
-func NewAttestationClient(offline bool) *http.Client {
-	client := tlsct.NewHTTPClientWithTransport(AttestationTimeout, &http.Transport{
-		MaxIdleConnsPerHost: 10,
-		IdleConnTimeout:     90 * time.Second,
-	}, !offline)
-	client.Transport = tlsct.WrapLogging(client.Transport, AttestationTimeout)
-	client.Transport = &RetryTransport{Base: client.Transport}
-	return client
-}