client: add retryable client with default

[asraa]

Signed-off-by: Asra Ali [email protected]

This adds a retryable http client that has a default retry for use in other libraries. See sigstore/cosign#2198

Summary

Release Note

Documentation

[codecov-commenter]

Codecov Report

Merging #859 (43d6adc) into main (29303cf) will increase coverage by 0.47%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main     #859      +/-   ##
==========================================
+ Coverage   55.29%   55.76%   +0.47%     
==========================================
  Files          38       38              
  Lines        2333     2340       +7     
==========================================
+ Hits         1290     1305      +15     
+ Misses        945      939       -6     
+ Partials       98       96       -2     

Impacted Files	Coverage Δ
pkg/api/client.go	39.65% <100.00%> (+3.87%)	⬆️
pkg/ca/fileca/load.go	68.96% <0.00%> (+10.34%)	⬆️
pkg/ca/fileca/watch.go	100.00% <0.00%> (+50.00%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[haydentherapper]

This is for the legacy client, which I don't want to support.

The hope was most would use auto-generated gRPC clients going forward. I'd also be fine with creating a new client for HTTP connection, and that one can use retriable calls.

[asraa]

This is for the legacy client, which I don't want to support.

Gotcha, right now cosign still consumes it: https://github.com/sigstore/cosign/blob/7ba521444f9fcfdf2e1e5936c05834597674e6c9/cmd/cosign/cli/fulcio/fulcio.go#L210

I'd also be fine with creating a new client for HTTP connection, and that one can use retriable calls.

Do you mean post-grpc? Or was there something else that marked this as legacy?

[haydentherapper]

Correct, there's an open PR (sigstore/cosign#1762) to switch off the legacy client to gRPC.

Do you mean post-grpc? Or was there something else that marked this as legacy?

The current "v2" API supports either gRPC or HTTP. We don't need to maintain a gRPC client. For HTTP, we could maintain one. Legacy was the "v1" API that doesn't support gRPC

[asraa]

For HTTP, we could maintain one. Legacy was the "v1" API that doesn't support gRPC

OOOH got it! Thanks: we can add it in that PR, no need to support an HTTP one