storage: can't use service account credentials with custom http client

[mockturtl]

I'm cross-compiling for Linux on ARM.

I want to use a service account file to authenticate.

I think I need to provide my own TLSClientConfig.RootCAs to work around "x509: failed to load system roots and no roots provided."

storage.NewClient(ctx, option.WithHTTPClient(buildWith(ctx)))
...
func buildwith(ctx context.Context) *http.Client {
	caCert, _ := ioutil.ReadFile("/path/to/my/ca-bundle.crt")  // error handling elided
	caCertPool := x509.NewCertPool()
	_ := caCertPool.AppendCertsFromPEM(caCert)
	tlsConfig := &tls.Config{RootCAs: caCertPool}
	transport := &http.Transport{TLSClientConfig: tlsConfig}
	return &http.Client{Transport: transport}
}

This makes my TLS config happy; requests correctly give Error 401: Anonymous users does not have access to bucket.

When I add option.WithServiceAccountFile("my-project-1234567.json"), it seems to be ignored (per option.WithHTTPClient docs).

How can I provide both a ca-bundle file and a service account credentials file?

I took a stab, but this puts me back to "x509: failed to load system roots and no roots provided":

data, _ := ioutil.ReadFile("my-project-1234567.json")
cfg, _  := google.JWTConfigFromJSON(data)  // takes vararg 'scopes'
ts, _   := cfg.TokenSource(ctx)

transport := &oauth2.Transport{
	Source: ts,
	Base:   &http.Transport{TLSClientConfig: tlsConfig},
}
return &http.Client{Transport: transport}

[jba]

Your last snippet looks almost right. Try providing the right scopes. (Although the error message suggests something else, error messages have been known to be misleading.)

[mockturtl]

No joy with the following change (scope string per Cloud Storage docs, do I have it right?) --

- cfg, _  := google.JWTConfigFromJSON(data)  // takes vararg 'scopes'
+ cfg, _  := google.JWTConfigFromJSON(data, "https://www.googleapis.com/auth/devstorage.read_only")
// x509: failed to load system roots and no roots provided

[mockturtl]

Workaround: copy or symlink ca-bundle.crt to where Go expects to find it. This avoids using option.WithHTTPClient altogether.

https://golang.org/src/crypto/x509/root_linux.go