Disallow configuring a custom root CA with a custom RoundTripper

client.go

@@ -32,7 +32,8 @@ const (
 	APIHost = "api.linode.com"
 	// APIHostVar environment var to check for alternate API URL
 	APIHostVar = "LINODE_URL"
-	// APIHostCert environment var containing path to CA cert to validate against
+	// APIHostCert environment var containing path to CA cert to validate against.
+	// Note that the custom CA cannot be configured together with a custom HTTP Transport.
 	APIHostCert = "LINODE_CA"
 	// APIVersion Linode API version
 	APIVersion = "v4"
@@ -737,7 +738,7 @@ func NewClient(hc *http.Client) (client Client) {
 
 	certPath, certPathExists := os.LookupEnv(APIHostCert)
 
-	if certPathExists {
+	if certPathExists && !isCustomTransport(hc.Transport) {
 		cert, err := os.ReadFile(filepath.Clean(certPath))
 		if err != nil {
 			log.Fatalf("[ERROR] Error when reading cert at %s: %s\n", certPath, err.Error())
@@ -879,3 +880,11 @@ func generateListCacheURL(endpoint string, opts *ListOptions) (string, error) {
 
 	return fmt.Sprintf("%s:%s", endpoint, hashedOpts), nil
 }
+
+func isCustomTransport(transport http.RoundTripper) bool {
+	if transport != http.DefaultTransport.(*http.Transport) {
+		log.Println("[WARN] Custom transport is not allowed with a custom root CA.")
+		return true
+	}
+	return false
+}

client_test.go

@@ -5,8 +5,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"reflect"
 	"strings"
 	"testing"
@@ -537,3 +539,40 @@ func (t *testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 	}
 	return resp, err
 }
+
+func TestClient_CustomRootCAWithCustomRoundTripper(t *testing.T) {
+	caFile, err := os.CreateTemp(t.TempDir(), "linodego_test_ca_*")
+	if err != nil {
+		t.Fatalf("Failed to create temp ca file: %s", err)
+	}
+	defer os.Remove(caFile.Name())
+
+	t.Setenv(APIHostCert, caFile.Name())
+
+	handler := func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"message":"success"}`))
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(handler))
+	defer server.Close()
+
+	// Create a custom RoundTripper
+	tr := &testRoundTripper{
+		Transport: server.Client().Transport,
+	}
+
+	buf := new(strings.Builder)
+	log.SetOutput(buf)
+
+	NewClient(&http.Client{Transport: tr})
+
+	expectedLog := "Custom transport is not allowed with a custom root CA"
+
+	if !strings.Contains(buf.String(), expectedLog) {
+		t.Fatalf("expected log %q not found in logs", expectedLog)
+	}
+
+	log.SetOutput(os.Stderr)
+}