fix: cert pool changes requiring pebble restart

internals/httputil/doc.go

@@ -0,0 +1,19 @@
+// Copyright (c) 2026 Canonical Ltd
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License version 3 as
+// published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Package httputil provides a lazy-loading, refreshable HTTP transport
+// that reloads the system TLS root cert pool on demand. The cert pool
+// discovery logic is generated from the Go standard library by the
+// tools/conformcertloader tool.
+package httputil

internals/httputil/export_test.go

@@ -0,0 +1,28 @@
+// Copyright (c) 2026 Canonical Ltd
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License version 3 as
+// published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build linux
+
+package httputil
+
+// LoadSystemRoots exposes loadSystemRoots for conformance testing.
+var LoadSystemRoots = loadSystemRoots
+
+// Initialised reports whether the Transport's underlying http.Transport
+// has been created yet (i.e. whether lazyInit has run).
+func (t *Transport) Initialised() bool {
+	t.mu.RLock()
+	defer t.mu.RUnlock()
+	return t.transport != nil
+}

internals/httputil/generate.go

@@ -0,0 +1,17 @@
+// Copyright (c) 2026 Canonical Ltd
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License version 3 as
+// published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package httputil
+
+//go:generate go run github.com/canonical/pebble/tools/gencertloader -output .