Update pkg/osv to allow overriding the http client / transport.

Signed-off-by: Jeff Mendoza <[email protected]>

pkg/osv/osv.go

@@ -28,6 +28,8 @@ const (
 	maxConcurrentRequests = 25
 )
 
+var HttpClient = http.DefaultClient
+
 // Package represents a package identifier for OSV.
 type Package struct {
 	PURL      string `json:"purl,omitempty"`
@@ -140,7 +142,7 @@ func MakeRequest(request BatchedQuery) (*BatchedResponse, error) {
 		resp, err := makeRetryRequest(func() (*http.Response, error) {
 			// We do not need a specific context
 			//nolint:noctx
-			return http.Post(QueryEndpoint, "application/json", requestBuf)
+			return HttpClient.Post(QueryEndpoint, "application/json", requestBuf)
 		})
 		if err != nil {
 			return nil, err
@@ -168,7 +170,7 @@ func MakeRequest(request BatchedQuery) (*BatchedResponse, error) {
 func Get(id string) (*models.Vulnerability, error) {
 	resp, err := makeRetryRequest(func() (*http.Response, error) {
 		//nolint:noctx
-		return http.Get(GetEndpoint + "/" + id)
+		return HttpClient.Get(GetEndpoint + "/" + id)
 	})
 	if err != nil {
 		return nil, err