Fix pollution of http.Transport TLSConfigs for OCI tests

Natation signing was previously relying on the
TLSConfig being added to the http.DefaultTransport
as a side-effect

Messing with the http.DefaultTransport was causing
TLS verification failures for internet requests to
the TUF repo.

Signed-off-by: leigh capili <leigh@null.net>

Author: stealthybox

internal/controller/ocirepository_controller_test.go

@@ -861,7 +861,7 @@ func TestOCIRepository_CertSecret(t *testing.T) {
 	clientTLSCert, err := tls.X509KeyPair(clientPublicKey, clientPrivateKey)
 	g.Expect(err).ToNot(HaveOccurred())
 
-	transport := http.DefaultTransport.(*http.Transport)
+	transport := http.DefaultTransport.(*http.Transport).Clone()
 	transport.TLSClientConfig = &tls.Config{
 		RootCAs:      pool,
 		Certificates: []tls.Certificate{clientTLSCert},
@@ -1591,6 +1591,19 @@ func TestOCIRepository_reconcileSource_verifyOCISourceSignatureNotation(t *testi
 					remoteRepo.PlainHTTP = true
 				}
 
+				// Configure transport to trust the local registry CA
+				transport := http.DefaultTransport.(*http.Transport).Clone()
+				if !tt.insecure {
+					pool := x509.NewCertPool()
+					pool.AppendCertsFromPEM(tlsCA)
+					transport.TLSClientConfig = &tls.Config{
+						RootCAs: pool,
+					}
+				}
+				remoteRepo.Client = &http.Client{
+					Transport: transport,
+				}
+
 				repo := registry.NewRepository(remoteRepo)
 
 				signatureMediaType := cose.MediaTypeEnvelope
@@ -3550,7 +3563,7 @@ func pushMultiplePodinfoImages(serverURL string, insecure bool, versions ...stri
 	if insecure {
 		opts = append(opts, crane.Insecure)
 	} else {
-		transport := http.DefaultTransport.(*http.Transport)
+		transport := http.DefaultTransport.(*http.Transport).Clone()
 		pool := x509.NewCertPool()
 		pool.AppendCertsFromPEM(tlsCA)
 		transport.TLSClientConfig = &tls.Config{