Infinite loop in NewClient() if system certificates are not installed

[garrmcnu]

As described in restic/restic#2355, if the ca_root_nss package is not installed on FreeBSD the restic command hangs indefinitely

pkg remove ca_root_nss
restic -r b2:<repo> init

Can reproduce on Linux by using a self-signed certificate for the root certificates

restic --cacert ~/certs/self-signed.crt -r b2:<repo> snapshots

This example code also shows the issue by using an empty certificate pool for the RootCAs in the TLS client configuration

package main

import (
        "context"
        "crypto/tls"
        "crypto/x509"
        "fmt"
        "net/http"
        "os"

        "github.com/kurin/blazer/b2"
)

func main() {
        id := os.Getenv("B2_ACCOUNT_ID")
        key := os.Getenv("B2_ACCOUNT_KEY")
        if id == "" || key == "" {
                fmt.Println("B2_ACCOUNT_ID or B2_ACCOUNT_KEY not set")
                return
        }

        ctx := context.Background()

        tr := &http.Transport{
                TLSClientConfig: &tls.Config{RootCAs: x509.NewCertPool()},
        }

        client, err := b2.NewClient(ctx, id, key, b2.Transport(tr))
        if err != nil {
                fmt.Println(err)
                return
        }

        fmt.Println("b2 client", client)
}

As far as I can see, the issue is the b2_authorize_account request fails with error "x509: certificate signed by unknown authority", this error is wrapped in a b2err type which is treated as a transient error and the request retries indefinitely.

One option to avoid the retries would be to check for this "unknown authority" error and return it directly to the application?

[garrmcnu]

Added a check on the error type for a request failure and if it is an x509.UnknownAuthorityError return the error directly to the application rather than wrapping it in a b2err type, this avoids the retries.

Tested with restic and the command fails with error message "Fatal: create repository at b2:***** failed: b2.NewClient: x509: certificate signed by unknown authority".