From 4b58cf346c054c24a9591f1473951e720d521642 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 00:44:23 +0000 Subject: [PATCH] chore(deps): bump github.com/fairwindsops/pluto/v5 from 5.24.1 to 5.24.3 Bumps [github.com/fairwindsops/pluto/v5](https://github.com/fairwindsops/pluto) from 5.24.1 to 5.24.3. - [Release notes](https://github.com/fairwindsops/pluto/releases) - [Commits](https://github.com/fairwindsops/pluto/compare/v5.24.1...v5.24.3) --- updated-dependencies: - dependency-name: github.com/fairwindsops/pluto/v5 dependency-version: 5.24.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- go.mod | 17 +- go.sum | 34 +- .../github.com/containerd/containerd/LICENSE | 191 -------- .../github.com/containerd/containerd/NOTICE | 16 - .../archive/compression/compression.go | 327 ------------- .../archive/compression/compression_fuzzer.go | 28 -- .../containerd/containerd/content/adaptor.go | 52 -- .../containerd/containerd/content/content.go | 207 -------- .../containerd/containerd/content/helpers.go | 340 -------------- .../containerd/containerd/errdefs/errors.go | 72 --- .../containerd/containerd/errdefs/grpc.go | 147 ------ .../containerd/containerd/filters/adaptor.go | 33 -- .../containerd/containerd/filters/filter.go | 178 ------- .../containerd/containerd/filters/parser.go | 294 ------------ .../containerd/containerd/filters/quote.go | 252 ---------- .../containerd/containerd/filters/scanner.go | 297 ------------ .../containerd/images/annotations.go | 23 - .../containerd/containerd/images/diffid.go | 81 ---- .../containerd/containerd/images/handlers.go | 323 ------------- .../containerd/containerd/images/image.go | 444 ------------------ .../containerd/images/importexport.go | 37 -- .../containerd/containerd/images/labels.go | 21 - .../containerd/images/mediatypes.go | 228 --------- .../containerd/containerd/labels/labels.go | 29 -- .../containerd/containerd/labels/validate.go | 41 -- .../containerd/pkg/randutil/randutil.go | 48 -- .../containerd/containerd/remotes/handlers.go | 416 ---------------- .../containerd/containerd/remotes/resolver.go | 94 ---- .../cyphar/filepath-securejoin/CHANGELOG.md | 11 + .../cyphar/filepath-securejoin/VERSION | 2 +- .../fairwindsops/pluto/v5/Dockerfile | 2 +- .../fairwindsops/pluto/v5/renovate.json | 97 ++++ .../otlploggrpc/internal/transform/log.go | 2 + .../otlplog/otlploggrpc/internal/version.go | 2 +- .../stdout/stdouttrace/internal/version.go | 2 +- .../helm/v3/internal/version/version.go | 2 +- vendor/helm.sh/helm/v3/pkg/action/install.go | 48 +- .../helm/v3/pkg/chartutil/jsonschema.go | 6 +- .../helm/v3/pkg/lint/rules/template.go | 4 +- vendor/helm.sh/helm/v3/pkg/registry/client.go | 48 +- .../helm.sh/helm/v3/pkg/registry/fallback.go | 8 + .../pkg/api/validation/path/name.go | 42 -- vendor/modules.txt | 29 +- 43 files changed, 225 insertions(+), 4350 deletions(-) delete mode 100644 vendor/github.com/containerd/containerd/LICENSE delete mode 100644 vendor/github.com/containerd/containerd/NOTICE delete mode 100644 vendor/github.com/containerd/containerd/archive/compression/compression.go delete mode 100644 vendor/github.com/containerd/containerd/archive/compression/compression_fuzzer.go delete mode 100644 vendor/github.com/containerd/containerd/content/adaptor.go delete mode 100644 vendor/github.com/containerd/containerd/content/content.go delete mode 100644 vendor/github.com/containerd/containerd/content/helpers.go delete mode 100644 vendor/github.com/containerd/containerd/errdefs/errors.go delete mode 100644 vendor/github.com/containerd/containerd/errdefs/grpc.go delete mode 100644 vendor/github.com/containerd/containerd/filters/adaptor.go delete mode 100644 vendor/github.com/containerd/containerd/filters/filter.go delete mode 100644 vendor/github.com/containerd/containerd/filters/parser.go delete mode 100644 vendor/github.com/containerd/containerd/filters/quote.go delete mode 100644 vendor/github.com/containerd/containerd/filters/scanner.go delete mode 100644 vendor/github.com/containerd/containerd/images/annotations.go delete mode 100644 vendor/github.com/containerd/containerd/images/diffid.go delete mode 100644 vendor/github.com/containerd/containerd/images/handlers.go delete mode 100644 vendor/github.com/containerd/containerd/images/image.go delete mode 100644 vendor/github.com/containerd/containerd/images/importexport.go delete mode 100644 vendor/github.com/containerd/containerd/images/labels.go delete mode 100644 vendor/github.com/containerd/containerd/images/mediatypes.go delete mode 100644 vendor/github.com/containerd/containerd/labels/labels.go delete mode 100644 vendor/github.com/containerd/containerd/labels/validate.go delete mode 100644 vendor/github.com/containerd/containerd/pkg/randutil/randutil.go delete mode 100644 vendor/github.com/containerd/containerd/remotes/handlers.go delete mode 100644 vendor/github.com/containerd/containerd/remotes/resolver.go create mode 100644 vendor/github.com/fairwindsops/pluto/v5/renovate.json delete mode 100644 vendor/k8s.io/apimachinery/pkg/api/validation/path/name.go diff --git a/go.mod b/go.mod index 4dae203995..93efa4c6bd 100644 --- a/go.mod +++ b/go.mod @@ -21,7 +21,7 @@ require ( github.com/derailed/k9s v0.51.0 github.com/distribution/distribution/v3 v3.1.1 github.com/distribution/reference v0.6.0 - github.com/fairwindsops/pluto/v5 v5.24.1 + github.com/fairwindsops/pluto/v5 v5.24.3 github.com/fatih/color v1.19.0 github.com/fluxcd/gitkit v0.6.0 github.com/fluxcd/pkg/apis/meta v1.31.0 @@ -227,7 +227,7 @@ require ( go.opentelemetry.io/contrib/bridges/prometheus v0.68.0 // indirect go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect @@ -235,9 +235,9 @@ require ( go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 // indirect go.opentelemetry.io/otel/exporters/prometheus v0.66.0 // indirect - go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0 // indirect + go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 // indirect go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 // indirect - go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 // indirect + go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 // indirect go.opentelemetry.io/otel/log v0.19.0 // indirect go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect @@ -253,7 +253,7 @@ require ( golang.org/x/vuln v1.5.0 // indirect gonum.org/v1/gonum v0.17.0 // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect - helm.sh/helm/v3 v3.20.2 // indirect + helm.sh/helm/v3 v3.21.3 // indirect howett.net/plist v1.0.1 // indirect k8s.io/component-base v0.36.3 // indirect modernc.org/gc/v3 v3.1.4 // indirect @@ -376,7 +376,6 @@ require ( github.com/cockroachdb/apd/v3 v3.2.1 // indirect github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect github.com/containerd/console v1.0.5 // indirect - github.com/containerd/containerd v1.7.32 // indirect github.com/containerd/continuity v0.5.0 // indirect github.com/containerd/fifo v1.1.0 // indirect github.com/containerd/log v0.1.0 // indirect @@ -385,7 +384,7 @@ require ( github.com/coreos/go-oidc/v3 v3.18.0 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect - github.com/cyphar/filepath-securejoin v0.6.1 // indirect + github.com/cyphar/filepath-securejoin v0.7.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/deitch/magic v0.0.0-20240306090643-c67ab88f10cb // indirect github.com/derailed/tcell/v2 v2.3.1-rc.4 // indirect @@ -634,8 +633,8 @@ require ( gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect gorm.io/gorm v1.31.1 // indirect - k8s.io/apiextensions-apiserver v0.36.1 // indirect - k8s.io/apiserver v0.36.1 // indirect + k8s.io/apiextensions-apiserver v0.36.2 // indirect + k8s.io/apiserver v0.36.2 // indirect k8s.io/cli-runtime v0.36.3 k8s.io/component-helpers v0.36.3 k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 // indirect diff --git a/go.sum b/go.sum index a2244ba186..e48c15e1d8 100644 --- a/go.sum +++ b/go.sum @@ -506,8 +506,6 @@ github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U= github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc= github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk= -github.com/containerd/containerd v1.7.32 h1:S54xuVcPxeLaYgaRABtpJ2VyVUVsy0IGf7qHBs+sbY8= -github.com/containerd/containerd v1.7.32/go.mod h1:jdwD6s/BhV4XVJGrvtziNPVA+83n66TwptVaPKprq4E= github.com/containerd/containerd/api v1.11.1 h1:h8nfoDW9+fNsC/9TwiAHj8B1GzXKtR4eFtkhi/X5RLU= github.com/containerd/containerd/api v1.11.1/go.mod h1:CaQFRu+N1MtbgL6JDOJLUB1hCKESU1lD6MuTJhgtdlw= github.com/containerd/containerd/v2 v2.3.3 h1:MUNBVVBTBpPll7KPh5GTvkC3cfG03PQLAHVdsUoue9k= @@ -545,8 +543,8 @@ github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s= github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE= github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q= github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw= -github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE= -github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= +github.com/cyphar/filepath-securejoin v0.7.0 h1:s0Y3ITPy6sQn5xt54DuYvTF8hu134ooYLUb58DX/HjE= +github.com/cyphar/filepath-securejoin v0.7.0/go.mod h1:ymLGms/u3BYaviIiuKFnUx8EkQEZeK6cInNoAPJA3o4= github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ= github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -667,8 +665,8 @@ github.com/extism/go-sdk v1.7.1/go.mod h1:IT+Xdg5AZM9hVtpFUA+uZCJMge/hbvshl8bwzL github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c/go.mod h1:QGzNH9ujQ2ZUr/CjDGZGWeDAVStrWNjHeEcjJL96Nuk= github.com/facebookincubator/nvdtools v0.1.5 h1:jbmDT1nd6+k+rlvKhnkgMokrCAzHoASWE5LtHbX2qFQ= github.com/facebookincubator/nvdtools v0.1.5/go.mod h1:Kh55SAWnjckS96TBSrXI99KrEKH4iB0OJby3N8GRJO4= -github.com/fairwindsops/pluto/v5 v5.24.1 h1:s98xDus4qOpimBk1eNxBRF57ig0UVFWxvznsVxf4NSY= -github.com/fairwindsops/pluto/v5 v5.24.1/go.mod h1:1hz/VRY2QULqe+hqBP2dnOtg+sfE2fooKNUuygvY0WI= +github.com/fairwindsops/pluto/v5 v5.24.3 h1:K59FschlMxb/a45cI/SfY9ooUXqFUVaTeQV1w2DK7LA= +github.com/fairwindsops/pluto/v5 v5.24.3/go.mod h1:kr7gRep7IuTT5i3kUKqaR/HbjkXfFG9ZbwJZ/do70Kk= github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8= github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= @@ -1789,8 +1787,8 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8V go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo= go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 h1:deI9UQMoGFgrg5iLPgzueqFPHevDl+28YKfSpPTI6rY= -go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0/go.mod h1:PFx9NgpNUKXdf7J4Q3agRxMs3Y07QhTCVipKmLsMKnU= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU= go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag= go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0/go.mod h1:ji9vId85hMxqfvICA0Jt8JqEdrXaAkcpkI9HPXya0ro= go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc= @@ -1805,12 +1803,12 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 h1:lgh3P go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0/go.mod h1:5Cnhth3m/AgOeTgE3ex12pPmiu/gGtZit03kSzx9X7s= go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ= go.opentelemetry.io/otel/exporters/prometheus v0.66.0/go.mod h1:V/UB6D3vMF/UBOL5igAsAYnk1nG/bzYYTzvsB16cy7o= -go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0 h1:KJVjPD3rcPb98rIs3HznyJlrfx9ge5oJvxxlGR+P/7s= -go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0/go.mod h1:K3kRa2ckmHWQaTWQdPRHc7qGXASuVuoEQXzrvlA98Ws= +go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 h1:GJkybS+crDMdExT/BUNCEgfrmfboztcS6PhvSo88HKM= +go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0/go.mod h1:NuAyxRYIG2lKX3YQkB+83StTxM7s52PUUkRRiC0wnYI= go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 h1:TC+BewnDpeiAmcscXbGMfxkO+mwYUwE/VySwvw88PfA= go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0/go.mod h1:J/ZyF4vfPwsSr9xJSPyQ4LqtcTPULFR64KwTikGLe+A= -go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 h1:s/1iRkCKDfhlh1JF26knRneorus8aOwVIDhvYx9WoDw= -go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0/go.mod h1:UI3wi0FXg1Pofb8ZBiBLhtMzgoTm1TYkMvn71fAqDzs= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 h1:mS47AX77OtFfKG4vtp+84kuGSFZHTyxtXIN269vChY0= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0/go.mod h1:PJnsC41lAGncJlPUniSwM81gc80GkgWJWr3cu2nKEtU= go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4= go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk= go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= @@ -2402,8 +2400,8 @@ gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg= gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= -helm.sh/helm/v3 v3.20.2 h1:binM4rvPx5DcNsa1sIt7UZi55lRbu3pZUFmQkSoRh48= -helm.sh/helm/v3 v3.20.2/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww= +helm.sh/helm/v3 v3.21.3 h1:wkamdwI3liEkW6wI1l9aGqQZGxcTKyt8kx0qJLPcmCg= +helm.sh/helm/v3 v3.21.3/go.mod h1:iaJ0iNsPoTZl++7h6vzQFyT0VEVtLYJiyRBDkPOOBTs= helm.sh/helm/v4 v4.2.3 h1:JEejtPE04+SvyRomOfgRXVxyJ/lude7eShio30oQr0Y= helm.sh/helm/v4 v4.2.3/go.mod h1:azI2XpxowOGXAgzeXcqyfskUmIfILqIcJxiFw1M6PuM= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= @@ -2417,12 +2415,12 @@ howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM= howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g= k8s.io/api v0.36.3 h1:NxB+05W2UGqXWFXcLO0RB5cnqnUPP5v5sVlaOH0Iz4w= k8s.io/api v0.36.3/go.mod h1:JzLQKqRHC5+I8RVj/lS3lCg0mg6nWI9Fo/Sk3ElxHzg= -k8s.io/apiextensions-apiserver v0.36.1 h1:6JfYmPUsuUIHuN+3QxutXYWj492RqF5fBSx67GYK5Ks= -k8s.io/apiextensions-apiserver v0.36.1/go.mod h1:pLzZin90riwisdzKwv/GoTwENooytoIx5zWJb4Hkby8= +k8s.io/apiextensions-apiserver v0.36.2 h1:3O5gqOj/dt2XWWbpMe+TXWpE9yU6pjM/tXxtHHJT/K4= +k8s.io/apiextensions-apiserver v0.36.2/go.mod h1:cL1tBWe8XSaP1H30iWKGo7hf6iAUUUJPEU70dskmAnA= k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM= k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE= -k8s.io/apiserver v0.36.1 h1:iMS5V+rPUertv5P9RaqJgmHHTuh4quWpoxchvMUY+JY= -k8s.io/apiserver v0.36.1/go.mod h1:Cby1PbLWztu0GDOxoO6iFOyyqIsziHNEW+w9zVQ22Kw= +k8s.io/apiserver v0.36.2 h1:6vMnkmHZPeBloNkHUhmZYq7Ylv8WIB8xjyEl+eSt26E= +k8s.io/apiserver v0.36.2/go.mod h1:9PoQ2ikCytrZyZg11mGhLEF5m8Rgsb5FJmYJ4Wvnl1k= k8s.io/cli-runtime v0.36.3 h1:g+eJ+M1sYpnNYp/q5fzaw2KejIL0Q7DH+xFl6YVoL4U= k8s.io/cli-runtime v0.36.3/go.mod h1:hZpAqK8nSFXvvLaVCbzUPVp8e9TRLSTCfpNzMt7s3tE= k8s.io/client-go v0.36.3 h1:M4JdVzXxYcZk4fGpfDdYnxSwhLKWCFoQsHW6t+z8Hfg= diff --git a/vendor/github.com/containerd/containerd/LICENSE b/vendor/github.com/containerd/containerd/LICENSE deleted file mode 100644 index 584149b6ee..0000000000 --- a/vendor/github.com/containerd/containerd/LICENSE +++ /dev/null @@ -1,191 +0,0 @@ - - Apache License - Version 2.0, January 2004 - https://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - Copyright The containerd Authors - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - https://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. diff --git a/vendor/github.com/containerd/containerd/NOTICE b/vendor/github.com/containerd/containerd/NOTICE deleted file mode 100644 index 8915f02773..0000000000 --- a/vendor/github.com/containerd/containerd/NOTICE +++ /dev/null @@ -1,16 +0,0 @@ -Docker -Copyright 2012-2015 Docker, Inc. - -This product includes software developed at Docker, Inc. (https://www.docker.com). - -The following is courtesy of our legal counsel: - - -Use and transfer of Docker may be subject to certain restrictions by the -United States and other governments. -It is your responsibility to ensure that your use and/or transfer does not -violate applicable laws. - -For more information, please see https://www.bis.doc.gov - -See also https://www.apache.org/dev/crypto.html and/or seek legal counsel. diff --git a/vendor/github.com/containerd/containerd/archive/compression/compression.go b/vendor/github.com/containerd/containerd/archive/compression/compression.go deleted file mode 100644 index 3c152f2815..0000000000 --- a/vendor/github.com/containerd/containerd/archive/compression/compression.go +++ /dev/null @@ -1,327 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package compression - -import ( - "bufio" - "bytes" - "compress/gzip" - "context" - "encoding/binary" - "fmt" - "io" - "os" - "os/exec" - "strconv" - "sync" - - "github.com/containerd/log" - "github.com/klauspost/compress/zstd" -) - -type ( - // Compression is the state represents if compressed or not. - Compression int -) - -const ( - // Uncompressed represents the uncompressed. - Uncompressed Compression = iota - // Gzip is gzip compression algorithm. - Gzip - // Zstd is zstd compression algorithm. - Zstd - // Unknown is used when a plugin handles the algorithm. - Unknown -) - -const disablePigzEnv = "CONTAINERD_DISABLE_PIGZ" - -var ( - initPigz sync.Once - unpigzPath string -) - -var ( - bufioReader32KPool = &sync.Pool{ - New: func() interface{} { return bufio.NewReaderSize(nil, 32*1024) }, - } -) - -// DecompressReadCloser include the stream after decompress and the compress method detected. -type DecompressReadCloser interface { - io.ReadCloser - // GetCompression returns the compress method which is used before decompressing - GetCompression() Compression -} - -type readCloserWrapper struct { - io.Reader - compression Compression - closer func() error -} - -func (r *readCloserWrapper) Close() error { - if r.closer != nil { - return r.closer() - } - return nil -} - -func (r *readCloserWrapper) GetCompression() Compression { - return r.compression -} - -type writeCloserWrapper struct { - io.Writer - closer func() error -} - -func (w *writeCloserWrapper) Close() error { - if w.closer != nil { - w.closer() - } - return nil -} - -type bufferedReader struct { - buf *bufio.Reader -} - -func newBufferedReader(r io.Reader) *bufferedReader { - buf := bufioReader32KPool.Get().(*bufio.Reader) - buf.Reset(r) - return &bufferedReader{buf} -} - -func (r *bufferedReader) Read(p []byte) (n int, err error) { - if r.buf == nil { - return 0, io.EOF - } - n, err = r.buf.Read(p) - if err == io.EOF { - r.buf.Reset(nil) - bufioReader32KPool.Put(r.buf) - r.buf = nil - } - return -} - -func (r *bufferedReader) Peek(n int) ([]byte, error) { - if r.buf == nil { - return nil, io.EOF - } - return r.buf.Peek(n) -} - -const ( - zstdMagicSkippableStart = 0x184D2A50 - zstdMagicSkippableMask = 0xFFFFFFF0 -) - -var ( - gzipMagic = []byte{0x1F, 0x8B, 0x08} - zstdMagic = []byte{0x28, 0xb5, 0x2f, 0xfd} -) - -type matcher = func([]byte) bool - -func magicNumberMatcher(m []byte) matcher { - return func(source []byte) bool { - return bytes.HasPrefix(source, m) - } -} - -// zstdMatcher detects zstd compression algorithm. -// There are two frame formats defined by Zstandard: Zstandard frames and Skippable frames. -// See https://tools.ietf.org/id/draft-kucherawy-dispatch-zstd-00.html#rfc.section.2 for more details. -func zstdMatcher() matcher { - return func(source []byte) bool { - if bytes.HasPrefix(source, zstdMagic) { - // Zstandard frame - return true - } - // skippable frame - if len(source) < 8 { - return false - } - // magic number from 0x184D2A50 to 0x184D2A5F. - if binary.LittleEndian.Uint32(source[:4])&zstdMagicSkippableMask == zstdMagicSkippableStart { - return true - } - return false - } -} - -// DetectCompression detects the compression algorithm of the source. -func DetectCompression(source []byte) Compression { - for compression, fn := range map[Compression]matcher{ - Gzip: magicNumberMatcher(gzipMagic), - Zstd: zstdMatcher(), - } { - if fn(source) { - return compression - } - } - return Uncompressed -} - -// DecompressStream decompresses the archive and returns a ReaderCloser with the decompressed archive. -func DecompressStream(archive io.Reader) (DecompressReadCloser, error) { - buf := newBufferedReader(archive) - bs, err := buf.Peek(10) - if err != nil && err != io.EOF { - // Note: we'll ignore any io.EOF error because there are some odd - // cases where the layer.tar file will be empty (zero bytes) and - // that results in an io.EOF from the Peek() call. So, in those - // cases we'll just treat it as a non-compressed stream and - // that means just create an empty layer. - // See Issue docker/docker#18170 - return nil, err - } - - switch compression := DetectCompression(bs); compression { - case Uncompressed: - return &readCloserWrapper{ - Reader: buf, - compression: compression, - }, nil - case Gzip: - ctx, cancel := context.WithCancel(context.Background()) - gzReader, err := gzipDecompress(ctx, buf) - if err != nil { - cancel() - return nil, err - } - - return &readCloserWrapper{ - Reader: gzReader, - compression: compression, - closer: func() error { - cancel() - return gzReader.Close() - }, - }, nil - case Zstd: - zstdReader, err := zstd.NewReader(buf) - if err != nil { - return nil, err - } - return &readCloserWrapper{ - Reader: zstdReader, - compression: compression, - closer: func() error { - zstdReader.Close() - return nil - }, - }, nil - - default: - return nil, fmt.Errorf("unsupported compression format %s", (&compression).Extension()) - } -} - -// CompressStream compresses the dest with specified compression algorithm. -func CompressStream(dest io.Writer, compression Compression) (io.WriteCloser, error) { - switch compression { - case Uncompressed: - return &writeCloserWrapper{dest, nil}, nil - case Gzip: - return gzip.NewWriter(dest), nil - case Zstd: - return zstd.NewWriter(dest) - default: - return nil, fmt.Errorf("unsupported compression format %s", (&compression).Extension()) - } -} - -// Extension returns the extension of a file that uses the specified compression algorithm. -func (compression *Compression) Extension() string { - switch *compression { - case Gzip: - return "gz" - case Zstd: - return "zst" - case Unknown: - return "unknown" - } - return "" -} - -func gzipDecompress(ctx context.Context, buf io.Reader) (io.ReadCloser, error) { - initPigz.Do(func() { - if unpigzPath = detectPigz(); unpigzPath != "" { - log.L.Debug("using pigz for decompression") - } - }) - - if unpigzPath == "" { - return gzip.NewReader(buf) - } - - return cmdStream(exec.CommandContext(ctx, unpigzPath, "-d", "-c"), buf) -} - -func cmdStream(cmd *exec.Cmd, in io.Reader) (io.ReadCloser, error) { - reader, writer := io.Pipe() - - cmd.Stdin = in - cmd.Stdout = writer - - var errBuf bytes.Buffer - cmd.Stderr = &errBuf - - if err := cmd.Start(); err != nil { - return nil, err - } - - go func() { - if err := cmd.Wait(); err != nil { - writer.CloseWithError(fmt.Errorf("%s: %s", err, errBuf.String())) - } else { - writer.Close() - } - }() - - return reader, nil -} - -func detectPigz() string { - path, err := exec.LookPath("unpigz") - if err != nil { - log.L.WithError(err).Debug("unpigz not found, falling back to go gzip") - return "" - } - - // Check if pigz disabled via CONTAINERD_DISABLE_PIGZ env variable - value := os.Getenv(disablePigzEnv) - if value == "" { - return path - } - - disable, err := strconv.ParseBool(value) - if err != nil { - log.L.WithError(err).Warnf("could not parse %s: %s", disablePigzEnv, value) - return path - } - - if disable { - return "" - } - - return path -} diff --git a/vendor/github.com/containerd/containerd/archive/compression/compression_fuzzer.go b/vendor/github.com/containerd/containerd/archive/compression/compression_fuzzer.go deleted file mode 100644 index 3516494ac0..0000000000 --- a/vendor/github.com/containerd/containerd/archive/compression/compression_fuzzer.go +++ /dev/null @@ -1,28 +0,0 @@ -//go:build gofuzz - -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package compression - -import ( - "bytes" -) - -func FuzzDecompressStream(data []byte) int { - _, _ = DecompressStream(bytes.NewReader(data)) - return 1 -} diff --git a/vendor/github.com/containerd/containerd/content/adaptor.go b/vendor/github.com/containerd/containerd/content/adaptor.go deleted file mode 100644 index 88bad2610e..0000000000 --- a/vendor/github.com/containerd/containerd/content/adaptor.go +++ /dev/null @@ -1,52 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package content - -import ( - "strings" - - "github.com/containerd/containerd/filters" -) - -// AdaptInfo returns `filters.Adaptor` that handles `content.Info`. -func AdaptInfo(info Info) filters.Adaptor { - return filters.AdapterFunc(func(fieldpath []string) (string, bool) { - if len(fieldpath) == 0 { - return "", false - } - - switch fieldpath[0] { - case "digest": - return info.Digest.String(), true - case "size": - // TODO: support size based filtering - case "labels": - return checkMap(fieldpath[1:], info.Labels) - } - - return "", false - }) -} - -func checkMap(fieldpath []string, m map[string]string) (string, bool) { - if len(m) == 0 { - return "", false - } - - value, ok := m[strings.Join(fieldpath, ".")] - return value, ok -} diff --git a/vendor/github.com/containerd/containerd/content/content.go b/vendor/github.com/containerd/containerd/content/content.go deleted file mode 100644 index 2dc7bf8b52..0000000000 --- a/vendor/github.com/containerd/containerd/content/content.go +++ /dev/null @@ -1,207 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package content - -import ( - "context" - "io" - "time" - - "github.com/opencontainers/go-digest" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" -) - -// Store combines the methods of content-oriented interfaces into a set that -// are commonly provided by complete implementations. -// -// Overall content lifecycle: -// - Ingester is used to initiate a write operation (aka ingestion) -// - IngestManager is used to manage (e.g. list, abort) active ingestions -// - Once an ingestion is complete (see Writer.Commit), Provider is used to -// query a single piece of content by its digest -// - Manager is used to manage (e.g. list, delete) previously committed content -// -// Note that until ingestion is complete, its content is not visible through -// Provider or Manager. Once ingestion is complete, it is no longer exposed -// through IngestManager. -type Store interface { - Manager - Provider - IngestManager - Ingester -} - -// ReaderAt extends the standard io.ReaderAt interface with reporting of Size and io.Closer -type ReaderAt interface { - io.ReaderAt - io.Closer - Size() int64 -} - -// Provider provides a reader interface for specific content -type Provider interface { - // ReaderAt only requires desc.Digest to be set. - // Other fields in the descriptor may be used internally for resolving - // the location of the actual data. - ReaderAt(ctx context.Context, desc ocispec.Descriptor) (ReaderAt, error) -} - -// Ingester writes content -type Ingester interface { - // Writer initiates a writing operation (aka ingestion). A single ingestion - // is uniquely identified by its ref, provided using a WithRef option. - // Writer can be called multiple times with the same ref to access the same - // ingestion. - // Once all the data is written, use Writer.Commit to complete the ingestion. - Writer(ctx context.Context, opts ...WriterOpt) (Writer, error) -} - -// IngestManager provides methods for managing ingestions. An ingestion is a -// not-yet-complete writing operation initiated using Ingester and identified -// by a ref string. -type IngestManager interface { - // Status returns the status of the provided ref. - Status(ctx context.Context, ref string) (Status, error) - - // ListStatuses returns the status of any active ingestions whose ref match - // the provided regular expression. If empty, all active ingestions will be - // returned. - ListStatuses(ctx context.Context, filters ...string) ([]Status, error) - - // Abort completely cancels the ingest operation targeted by ref. - Abort(ctx context.Context, ref string) error -} - -// Info holds content specific information -type Info struct { - Digest digest.Digest - Size int64 - CreatedAt time.Time - UpdatedAt time.Time - Labels map[string]string -} - -// Status of a content operation (i.e. an ingestion) -type Status struct { - Ref string - Offset int64 - Total int64 - Expected digest.Digest - StartedAt time.Time - UpdatedAt time.Time -} - -// WalkFunc defines the callback for a blob walk. -type WalkFunc func(Info) error - -// InfoReaderProvider provides both info and reader for the specific content. -type InfoReaderProvider interface { - InfoProvider - Provider -} - -// InfoProvider provides info for content inspection. -type InfoProvider interface { - // Info will return metadata about content available in the content store. - // - // If the content is not present, ErrNotFound will be returned. - Info(ctx context.Context, dgst digest.Digest) (Info, error) -} - -// Manager provides methods for inspecting, listing and removing content. -type Manager interface { - InfoProvider - - // Update updates mutable information related to content. - // If one or more fieldpaths are provided, only those - // fields will be updated. - // Mutable fields: - // labels.* - Update(ctx context.Context, info Info, fieldpaths ...string) (Info, error) - - // Walk will call fn for each item in the content store which - // match the provided filters. If no filters are given all - // items will be walked. - Walk(ctx context.Context, fn WalkFunc, filters ...string) error - - // Delete removes the content from the store. - Delete(ctx context.Context, dgst digest.Digest) error -} - -// Writer handles writing of content into a content store -type Writer interface { - // Close closes the writer, if the writer has not been - // committed this allows resuming or aborting. - // Calling Close on a closed writer will not error. - io.WriteCloser - - // Digest may return empty digest or panics until committed. - Digest() digest.Digest - - // Commit commits the blob (but no roll-back is guaranteed on an error). - // size and expected can be zero-value when unknown. - // Commit always closes the writer, even on error. - // ErrAlreadyExists aborts the writer. - Commit(ctx context.Context, size int64, expected digest.Digest, opts ...Opt) error - - // Status returns the current state of write - Status() (Status, error) - - // Truncate updates the size of the target blob - Truncate(size int64) error -} - -// Opt is used to alter the mutable properties of content -type Opt func(*Info) error - -// WithLabels allows labels to be set on content -func WithLabels(labels map[string]string) Opt { - return func(info *Info) error { - info.Labels = labels - return nil - } -} - -// WriterOpts is internally used by WriterOpt. -type WriterOpts struct { - Ref string - Desc ocispec.Descriptor -} - -// WriterOpt is used for passing options to Ingester.Writer. -type WriterOpt func(*WriterOpts) error - -// WithDescriptor specifies an OCI descriptor. -// Writer may optionally use the descriptor internally for resolving -// the location of the actual data. -// Write does not require any field of desc to be set. -// If the data size is unknown, desc.Size should be set to 0. -// Some implementations may also accept negative values as "unknown". -func WithDescriptor(desc ocispec.Descriptor) WriterOpt { - return func(opts *WriterOpts) error { - opts.Desc = desc - return nil - } -} - -// WithRef specifies a ref string. -func WithRef(ref string) WriterOpt { - return func(opts *WriterOpts) error { - opts.Ref = ref - return nil - } -} diff --git a/vendor/github.com/containerd/containerd/content/helpers.go b/vendor/github.com/containerd/containerd/content/helpers.go deleted file mode 100644 index 93bcdde106..0000000000 --- a/vendor/github.com/containerd/containerd/content/helpers.go +++ /dev/null @@ -1,340 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package content - -import ( - "context" - "errors" - "fmt" - "io" - "sync" - "time" - - "github.com/containerd/log" - "github.com/opencontainers/go-digest" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" - - "github.com/containerd/containerd/errdefs" - "github.com/containerd/containerd/pkg/randutil" -) - -var ErrReset = errors.New("writer has been reset") - -var bufPool = sync.Pool{ - New: func() interface{} { - buffer := make([]byte, 1<<20) - return &buffer - }, -} - -type reader interface { - Reader() io.Reader -} - -// NewReader returns a io.Reader from a ReaderAt -func NewReader(ra ReaderAt) io.Reader { - if rd, ok := ra.(reader); ok { - return rd.Reader() - } - return io.NewSectionReader(ra, 0, ra.Size()) -} - -// ReadBlob retrieves the entire contents of the blob from the provider. -// -// Avoid using this for large blobs, such as layers. -func ReadBlob(ctx context.Context, provider Provider, desc ocispec.Descriptor) ([]byte, error) { - if int64(len(desc.Data)) == desc.Size && digest.FromBytes(desc.Data) == desc.Digest { - return desc.Data, nil - } - - ra, err := provider.ReaderAt(ctx, desc) - if err != nil { - return nil, err - } - defer ra.Close() - - p := make([]byte, ra.Size()) - - n, err := ra.ReadAt(p, 0) - if err == io.EOF { - if int64(n) != ra.Size() { - err = io.ErrUnexpectedEOF - } else { - err = nil - } - } - return p, err -} - -// WriteBlob writes data with the expected digest into the content store. If -// expected already exists, the method returns immediately and the reader will -// not be consumed. -// -// This is useful when the digest and size are known beforehand. -// -// Copy is buffered, so no need to wrap reader in buffered io. -func WriteBlob(ctx context.Context, cs Ingester, ref string, r io.Reader, desc ocispec.Descriptor, opts ...Opt) error { - cw, err := OpenWriter(ctx, cs, WithRef(ref), WithDescriptor(desc)) - if err != nil { - if !errdefs.IsAlreadyExists(err) { - return fmt.Errorf("failed to open writer: %w", err) - } - - return nil // already present - } - defer cw.Close() - - return Copy(ctx, cw, r, desc.Size, desc.Digest, opts...) -} - -// OpenWriter opens a new writer for the given reference, retrying if the writer -// is locked until the reference is available or returns an error. -func OpenWriter(ctx context.Context, cs Ingester, opts ...WriterOpt) (Writer, error) { - var ( - cw Writer - err error - retry = 16 - ) - for { - cw, err = cs.Writer(ctx, opts...) - if err != nil { - if !errdefs.IsUnavailable(err) { - return nil, err - } - - // TODO: Check status to determine if the writer is active, - // continue waiting while active, otherwise return lock - // error or abort. Requires asserting for an ingest manager - - select { - case <-time.After(time.Millisecond * time.Duration(randutil.Intn(retry))): - if retry < 2048 { - retry = retry << 1 - } - continue - case <-ctx.Done(): - // Propagate lock error - return nil, err - } - - } - break - } - - return cw, err -} - -// Copy copies data with the expected digest from the reader into the -// provided content store writer. This copy commits the writer. -// -// This is useful when the digest and size are known beforehand. When -// the size or digest is unknown, these values may be empty. -// -// Copy is buffered, so no need to wrap reader in buffered io. -func Copy(ctx context.Context, cw Writer, or io.Reader, size int64, expected digest.Digest, opts ...Opt) error { - ws, err := cw.Status() - if err != nil { - return fmt.Errorf("failed to get status: %w", err) - } - r := or - if ws.Offset > 0 { - r, err = seekReader(or, ws.Offset, size) - if err != nil { - return fmt.Errorf("unable to resume write to %v: %w", ws.Ref, err) - } - } - - for i := 0; ; i++ { - if i >= 1 { - log.G(ctx).WithField("digest", expected).Debugf("retrying copy due to reset") - } - copied, err := copyWithBuffer(cw, r) - if errors.Is(err, ErrReset) { - ws, err := cw.Status() - if err != nil { - return fmt.Errorf("failed to get status: %w", err) - } - r, err = seekReader(or, ws.Offset, size) - if err != nil { - return fmt.Errorf("unable to resume write to %v: %w", ws.Ref, err) - } - continue - } - if err != nil { - return fmt.Errorf("failed to copy: %w", err) - } - if size != 0 && copied < size-ws.Offset { - // Short writes would return its own error, this indicates a read failure - return fmt.Errorf("failed to read expected number of bytes: %w", io.ErrUnexpectedEOF) - } - if err := cw.Commit(ctx, size, expected, opts...); err != nil { - if errors.Is(err, ErrReset) { - ws, err := cw.Status() - if err != nil { - return fmt.Errorf("failed to get status: %w", err) - } - r, err = seekReader(or, ws.Offset, size) - if err != nil { - return fmt.Errorf("unable to resume write to %v: %w", ws.Ref, err) - } - continue - } - if !errdefs.IsAlreadyExists(err) { - return fmt.Errorf("failed commit on ref %q: %w", ws.Ref, err) - } - } - return nil - } -} - -// CopyReaderAt copies to a writer from a given reader at for the given -// number of bytes. This copy does not commit the writer. -func CopyReaderAt(cw Writer, ra ReaderAt, n int64) error { - ws, err := cw.Status() - if err != nil { - return err - } - - copied, err := copyWithBuffer(cw, io.NewSectionReader(ra, ws.Offset, n)) - if err != nil { - return fmt.Errorf("failed to copy: %w", err) - } - if copied < n { - // Short writes would return its own error, this indicates a read failure - return fmt.Errorf("failed to read expected number of bytes: %w", io.ErrUnexpectedEOF) - } - return nil -} - -// CopyReader copies to a writer from a given reader, returning -// the number of bytes copied. -// Note: if the writer has a non-zero offset, the total number -// of bytes read may be greater than those copied if the reader -// is not an io.Seeker. -// This copy does not commit the writer. -func CopyReader(cw Writer, r io.Reader) (int64, error) { - ws, err := cw.Status() - if err != nil { - return 0, fmt.Errorf("failed to get status: %w", err) - } - - if ws.Offset > 0 { - r, err = seekReader(r, ws.Offset, 0) - if err != nil { - return 0, fmt.Errorf("unable to resume write to %v: %w", ws.Ref, err) - } - } - - return copyWithBuffer(cw, r) -} - -// seekReader attempts to seek the reader to the given offset, either by -// resolving `io.Seeker`, by detecting `io.ReaderAt`, or discarding -// up to the given offset. -func seekReader(r io.Reader, offset, size int64) (io.Reader, error) { - // attempt to resolve r as a seeker and setup the offset. - seeker, ok := r.(io.Seeker) - if ok { - nn, err := seeker.Seek(offset, io.SeekStart) - if nn != offset { - if err == nil { - err = fmt.Errorf("unexpected seek location without seek error") - } - return nil, fmt.Errorf("failed to seek to offset %v: %w", offset, err) - } - - if err != nil { - return nil, err - } - - return r, nil - } - - // ok, let's try io.ReaderAt! - readerAt, ok := r.(io.ReaderAt) - if ok && size > offset { - sr := io.NewSectionReader(readerAt, offset, size) - return sr, nil - } - - // well then, let's just discard up to the offset - n, err := copyWithBuffer(io.Discard, io.LimitReader(r, offset)) - if err != nil { - return nil, fmt.Errorf("failed to discard to offset: %w", err) - } - if n != offset { - return nil, errors.New("unable to discard to offset") - } - - return r, nil -} - -// copyWithBuffer is very similar to io.CopyBuffer https://golang.org/pkg/io/#CopyBuffer -// but instead of using Read to read from the src, we use ReadAtLeast to make sure we have -// a full buffer before we do a write operation to dst to reduce overheads associated -// with the write operations of small buffers. -func copyWithBuffer(dst io.Writer, src io.Reader) (written int64, err error) { - // If the reader has a WriteTo method, use it to do the copy. - // Avoids an allocation and a copy. - if wt, ok := src.(io.WriterTo); ok { - return wt.WriteTo(dst) - } - // Similarly, if the writer has a ReadFrom method, use it to do the copy. - if rt, ok := dst.(io.ReaderFrom); ok { - return rt.ReadFrom(src) - } - bufRef := bufPool.Get().(*[]byte) - defer bufPool.Put(bufRef) - buf := *bufRef - for { - nr, er := io.ReadAtLeast(src, buf, len(buf)) - if nr > 0 { - nw, ew := dst.Write(buf[0:nr]) - if nw > 0 { - written += int64(nw) - } - if ew != nil { - err = ew - break - } - if nr != nw { - err = io.ErrShortWrite - break - } - } - if er != nil { - // If an EOF happens after reading fewer than the requested bytes, - // ReadAtLeast returns ErrUnexpectedEOF. - if er != io.EOF && er != io.ErrUnexpectedEOF { - err = er - } - break - } - } - return -} - -// Exists returns whether an attempt to access the content would not error out -// with an ErrNotFound error. It will return an encountered error if it was -// different than ErrNotFound. -func Exists(ctx context.Context, provider InfoProvider, desc ocispec.Descriptor) (bool, error) { - _, err := provider.Info(ctx, desc.Digest) - if errdefs.IsNotFound(err) { - return false, nil - } - return err == nil, err -} diff --git a/vendor/github.com/containerd/containerd/errdefs/errors.go b/vendor/github.com/containerd/containerd/errdefs/errors.go deleted file mode 100644 index de22cadd41..0000000000 --- a/vendor/github.com/containerd/containerd/errdefs/errors.go +++ /dev/null @@ -1,72 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -// Package errdefs defines the common errors used throughout containerd -// packages. -// -// Use with fmt.Errorf to add context to an error. -// -// To detect an error class, use the IsXXX functions to tell whether an error -// is of a certain type. -package errdefs - -import ( - "github.com/containerd/errdefs" -) - -// Definitions of common error types used throughout containerd. All containerd -// errors returned by most packages will map into one of these errors classes. -// Packages should return errors of these types when they want to instruct a -// client to take a particular action. -// -// These errors map closely to grpc errors. -var ( - ErrUnknown = errdefs.ErrUnknown - ErrInvalidArgument = errdefs.ErrInvalidArgument - ErrNotFound = errdefs.ErrNotFound - ErrAlreadyExists = errdefs.ErrAlreadyExists - ErrPermissionDenied = errdefs.ErrPermissionDenied - ErrResourceExhausted = errdefs.ErrResourceExhausted - ErrFailedPrecondition = errdefs.ErrFailedPrecondition - ErrConflict = errdefs.ErrConflict - ErrNotModified = errdefs.ErrNotModified - ErrAborted = errdefs.ErrAborted - ErrOutOfRange = errdefs.ErrOutOfRange - ErrNotImplemented = errdefs.ErrNotImplemented - ErrInternal = errdefs.ErrInternal - ErrUnavailable = errdefs.ErrUnavailable - ErrDataLoss = errdefs.ErrDataLoss - ErrUnauthenticated = errdefs.ErrUnauthenticated - - IsCanceled = errdefs.IsCanceled - IsUnknown = errdefs.IsUnknown - IsInvalidArgument = errdefs.IsInvalidArgument - IsDeadlineExceeded = errdefs.IsDeadlineExceeded - IsNotFound = errdefs.IsNotFound - IsAlreadyExists = errdefs.IsAlreadyExists - IsPermissionDenied = errdefs.IsPermissionDenied - IsResourceExhausted = errdefs.IsResourceExhausted - IsFailedPrecondition = errdefs.IsFailedPrecondition - IsConflict = errdefs.IsConflict - IsNotModified = errdefs.IsNotModified - IsAborted = errdefs.IsAborted - IsOutOfRange = errdefs.IsOutOfRange - IsNotImplemented = errdefs.IsNotImplemented - IsInternal = errdefs.IsInternal - IsUnavailable = errdefs.IsUnavailable - IsDataLoss = errdefs.IsDataLoss - IsUnauthorized = errdefs.IsUnauthorized -) diff --git a/vendor/github.com/containerd/containerd/errdefs/grpc.go b/vendor/github.com/containerd/containerd/errdefs/grpc.go deleted file mode 100644 index 11091b1db0..0000000000 --- a/vendor/github.com/containerd/containerd/errdefs/grpc.go +++ /dev/null @@ -1,147 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package errdefs - -import ( - "context" - "fmt" - "strings" - - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" -) - -// ToGRPC will attempt to map the backend containerd error into a grpc error, -// using the original error message as a description. -// -// Further information may be extracted from certain errors depending on their -// type. -// -// If the error is unmapped, the original error will be returned to be handled -// by the regular grpc error handling stack. -func ToGRPC(err error) error { - if err == nil { - return nil - } - - if isGRPCError(err) { - // error has already been mapped to grpc - return err - } - - switch { - case IsInvalidArgument(err): - return status.Error(codes.InvalidArgument, err.Error()) - case IsNotFound(err): - return status.Error(codes.NotFound, err.Error()) - case IsAlreadyExists(err): - return status.Error(codes.AlreadyExists, err.Error()) - case IsFailedPrecondition(err): - return status.Error(codes.FailedPrecondition, err.Error()) - case IsUnavailable(err): - return status.Error(codes.Unavailable, err.Error()) - case IsNotImplemented(err): - return status.Error(codes.Unimplemented, err.Error()) - case IsCanceled(err): - return status.Error(codes.Canceled, err.Error()) - case IsDeadlineExceeded(err): - return status.Error(codes.DeadlineExceeded, err.Error()) - } - - return err -} - -// ToGRPCf maps the error to grpc error codes, assembling the formatting string -// and combining it with the target error string. -// -// This is equivalent to errdefs.ToGRPC(fmt.Errorf("%s: %w", fmt.Sprintf(format, args...), err)) -func ToGRPCf(err error, format string, args ...interface{}) error { - return ToGRPC(fmt.Errorf("%s: %w", fmt.Sprintf(format, args...), err)) -} - -// FromGRPC returns the underlying error from a grpc service based on the grpc error code -func FromGRPC(err error) error { - if err == nil { - return nil - } - - var cls error // divide these into error classes, becomes the cause - - switch code(err) { - case codes.InvalidArgument: - cls = ErrInvalidArgument - case codes.AlreadyExists: - cls = ErrAlreadyExists - case codes.NotFound: - cls = ErrNotFound - case codes.Unavailable: - cls = ErrUnavailable - case codes.FailedPrecondition: - cls = ErrFailedPrecondition - case codes.Unimplemented: - cls = ErrNotImplemented - case codes.Canceled: - cls = context.Canceled - case codes.DeadlineExceeded: - cls = context.DeadlineExceeded - default: - cls = ErrUnknown - } - - msg := rebaseMessage(cls, err) - if msg != "" { - err = fmt.Errorf("%s: %w", msg, cls) - } else { - err = cls - } - - return err -} - -// rebaseMessage removes the repeats for an error at the end of an error -// string. This will happen when taking an error over grpc then remapping it. -// -// Effectively, we just remove the string of cls from the end of err if it -// appears there. -func rebaseMessage(cls error, err error) string { - desc := errDesc(err) - clss := cls.Error() - if desc == clss { - return "" - } - - return strings.TrimSuffix(desc, ": "+clss) -} - -func isGRPCError(err error) bool { - _, ok := status.FromError(err) - return ok -} - -func code(err error) codes.Code { - if s, ok := status.FromError(err); ok { - return s.Code() - } - return codes.Unknown -} - -func errDesc(err error) string { - if s, ok := status.FromError(err); ok { - return s.Message() - } - return err.Error() -} diff --git a/vendor/github.com/containerd/containerd/filters/adaptor.go b/vendor/github.com/containerd/containerd/filters/adaptor.go deleted file mode 100644 index 5a9c559c1e..0000000000 --- a/vendor/github.com/containerd/containerd/filters/adaptor.go +++ /dev/null @@ -1,33 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package filters - -// Adaptor specifies the mapping of fieldpaths to a type. For the given field -// path, the value and whether it is present should be returned. The mapping of -// the fieldpath to a field is deferred to the adaptor implementation, but -// should generally follow protobuf field path/mask semantics. -type Adaptor interface { - Field(fieldpath []string) (value string, present bool) -} - -// AdapterFunc allows implementation specific matching of fieldpaths -type AdapterFunc func(fieldpath []string) (string, bool) - -// Field returns the field name and true if it exists -func (fn AdapterFunc) Field(fieldpath []string) (string, bool) { - return fn(fieldpath) -} diff --git a/vendor/github.com/containerd/containerd/filters/filter.go b/vendor/github.com/containerd/containerd/filters/filter.go deleted file mode 100644 index dcc569a4b7..0000000000 --- a/vendor/github.com/containerd/containerd/filters/filter.go +++ /dev/null @@ -1,178 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -// Package filters defines a syntax and parser that can be used for the -// filtration of items across the containerd API. The core is built on the -// concept of protobuf field paths, with quoting. Several operators allow the -// user to flexibly select items based on field presence, equality, inequality -// and regular expressions. Flexible adaptors support working with any type. -// -// The syntax is fairly familiar, if you've used container ecosystem -// projects. At the core, we base it on the concept of protobuf field -// paths, augmenting with the ability to quote portions of the field path -// to match arbitrary labels. These "selectors" come in the following -// syntax: -// -// ``` -// [] -// ``` -// -// A basic example is as follows: -// -// ``` -// name==foo -// ``` -// -// This would match all objects that have a field `name` with the value -// `foo`. If we only want to test if the field is present, we can omit the -// operator. This is most useful for matching labels in containerd. The -// following will match objects that have the field "labels" and have the -// label "foo" defined: -// -// ``` -// labels.foo -// ``` -// -// We also allow for quoting of parts of the field path to allow matching -// of arbitrary items: -// -// ``` -// labels."very complex label"==something -// ``` -// -// We also define `!=` and `~=` as operators. The `!=` will match all -// objects that don't match the value for a field and `~=` will compile the -// target value as a regular expression and match the field value against that. -// -// Selectors can be combined using a comma, such that the resulting -// selector will require all selectors are matched for the object to match. -// The following example will match objects that are named `foo` and have -// the label `bar`: -// -// ``` -// name==foo,labels.bar -// ``` -package filters - -import ( - "regexp" - - "github.com/containerd/log" -) - -// Filter matches specific resources based the provided filter -type Filter interface { - Match(adaptor Adaptor) bool -} - -// FilterFunc is a function that handles matching with an adaptor -type FilterFunc func(Adaptor) bool - -// Match matches the FilterFunc returning true if the object matches the filter -func (fn FilterFunc) Match(adaptor Adaptor) bool { - return fn(adaptor) -} - -// Always is a filter that always returns true for any type of object -var Always FilterFunc = func(adaptor Adaptor) bool { - return true -} - -// Any allows multiple filters to be matched against the object -type Any []Filter - -// Match returns true if any of the provided filters are true -func (m Any) Match(adaptor Adaptor) bool { - for _, m := range m { - if m.Match(adaptor) { - return true - } - } - - return false -} - -// All allows multiple filters to be matched against the object -type All []Filter - -// Match only returns true if all filters match the object -func (m All) Match(adaptor Adaptor) bool { - for _, m := range m { - if !m.Match(adaptor) { - return false - } - } - - return true -} - -type operator int - -const ( - operatorPresent = iota - operatorEqual - operatorNotEqual - operatorMatches -) - -func (op operator) String() string { - switch op { - case operatorPresent: - return "?" - case operatorEqual: - return "==" - case operatorNotEqual: - return "!=" - case operatorMatches: - return "~=" - } - - return "unknown" -} - -type selector struct { - fieldpath []string - operator operator - value string - re *regexp.Regexp -} - -func (m selector) Match(adaptor Adaptor) bool { - value, present := adaptor.Field(m.fieldpath) - - switch m.operator { - case operatorPresent: - return present - case operatorEqual: - return present && value == m.value - case operatorNotEqual: - return value != m.value - case operatorMatches: - if m.re == nil { - r, err := regexp.Compile(m.value) - if err != nil { - log.L.Errorf("error compiling regexp %q", m.value) - return false - } - - m.re = r - } - - return m.re.MatchString(value) - default: - return false - } -} diff --git a/vendor/github.com/containerd/containerd/filters/parser.go b/vendor/github.com/containerd/containerd/filters/parser.go deleted file mode 100644 index 790597aaf2..0000000000 --- a/vendor/github.com/containerd/containerd/filters/parser.go +++ /dev/null @@ -1,294 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package filters - -import ( - "fmt" - "io" - - "github.com/containerd/containerd/errdefs" -) - -/* -Parse the strings into a filter that may be used with an adaptor. - -The filter is made up of zero or more selectors. - -The format is a comma separated list of expressions, in the form of -``, known as selectors. All selectors must match the -target object for the filter to be true. - -We define the operators "==" for equality, "!=" for not equal and "~=" for a -regular expression. If the operator and value are not present, the matcher will -test for the presence of a value, as defined by the target object. - -The formal grammar is as follows: - -selectors := selector ("," selector)* -selector := fieldpath (operator value) -fieldpath := field ('.' field)* -field := quoted | [A-Za-z] [A-Za-z0-9_]+ -operator := "==" | "!=" | "~=" -value := quoted | [^\s,]+ -quoted := -*/ -func Parse(s string) (Filter, error) { - // special case empty to match all - if s == "" { - return Always, nil - } - - p := parser{input: s} - return p.parse() -} - -// ParseAll parses each filter in ss and returns a filter that will return true -// if any filter matches the expression. -// -// If no filters are provided, the filter will match anything. -func ParseAll(ss ...string) (Filter, error) { - if len(ss) == 0 { - return Always, nil - } - - var fs []Filter - for _, s := range ss { - f, err := Parse(s) - if err != nil { - return nil, fmt.Errorf("%s: %w", err.Error(), errdefs.ErrInvalidArgument) - } - - fs = append(fs, f) - } - - return Any(fs), nil -} - -type parser struct { - input string - scanner scanner -} - -func (p *parser) parse() (Filter, error) { - p.scanner.init(p.input) - - ss, err := p.selectors() - if err != nil { - return nil, fmt.Errorf("filters: %w", err) - } - - return ss, nil -} - -func (p *parser) selectors() (Filter, error) { - s, err := p.selector() - if err != nil { - return nil, err - } - - ss := All{s} - -loop: - for { - tok := p.scanner.peek() - switch tok { - case ',': - pos, tok, _ := p.scanner.scan() - if tok != tokenSeparator { - return nil, p.mkerr(pos, "expected a separator") - } - - s, err := p.selector() - if err != nil { - return nil, err - } - - ss = append(ss, s) - case tokenEOF: - break loop - default: - return nil, p.mkerrf(p.scanner.ppos, "unexpected input: %v", string(tok)) - } - } - - return ss, nil -} - -func (p *parser) selector() (selector, error) { - fieldpath, err := p.fieldpath() - if err != nil { - return selector{}, err - } - - switch p.scanner.peek() { - case ',', tokenSeparator, tokenEOF: - return selector{ - fieldpath: fieldpath, - operator: operatorPresent, - }, nil - } - - op, err := p.operator() - if err != nil { - return selector{}, err - } - - var allowAltQuotes bool - if op == operatorMatches { - allowAltQuotes = true - } - - value, err := p.value(allowAltQuotes) - if err != nil { - if err == io.EOF { - return selector{}, io.ErrUnexpectedEOF - } - return selector{}, err - } - - return selector{ - fieldpath: fieldpath, - value: value, - operator: op, - }, nil -} - -func (p *parser) fieldpath() ([]string, error) { - f, err := p.field() - if err != nil { - return nil, err - } - - fs := []string{f} -loop: - for { - tok := p.scanner.peek() // lookahead to consume field separator - - switch tok { - case '.': - pos, tok, _ := p.scanner.scan() // consume separator - if tok != tokenSeparator { - return nil, p.mkerr(pos, "expected a field separator (`.`)") - } - - f, err := p.field() - if err != nil { - return nil, err - } - - fs = append(fs, f) - default: - // let the layer above handle the other bad cases. - break loop - } - } - - return fs, nil -} - -func (p *parser) field() (string, error) { - pos, tok, s := p.scanner.scan() - switch tok { - case tokenField: - return s, nil - case tokenQuoted: - return p.unquote(pos, s, false) - case tokenIllegal: - return "", p.mkerr(pos, p.scanner.err) - } - - return "", p.mkerr(pos, "expected field or quoted") -} - -func (p *parser) operator() (operator, error) { - pos, tok, s := p.scanner.scan() - switch tok { - case tokenOperator: - switch s { - case "==": - return operatorEqual, nil - case "!=": - return operatorNotEqual, nil - case "~=": - return operatorMatches, nil - default: - return 0, p.mkerrf(pos, "unsupported operator %q", s) - } - case tokenIllegal: - return 0, p.mkerr(pos, p.scanner.err) - } - - return 0, p.mkerr(pos, `expected an operator ("=="|"!="|"~=")`) -} - -func (p *parser) value(allowAltQuotes bool) (string, error) { - pos, tok, s := p.scanner.scan() - - switch tok { - case tokenValue, tokenField: - return s, nil - case tokenQuoted: - return p.unquote(pos, s, allowAltQuotes) - case tokenIllegal: - return "", p.mkerr(pos, p.scanner.err) - } - - return "", p.mkerr(pos, "expected value or quoted") -} - -func (p *parser) unquote(pos int, s string, allowAlts bool) (string, error) { - if !allowAlts && s[0] != '\'' && s[0] != '"' { - return "", p.mkerr(pos, "invalid quote encountered") - } - - uq, err := unquote(s) - if err != nil { - return "", p.mkerrf(pos, "unquoting failed: %v", err) - } - - return uq, nil -} - -type parseError struct { - input string - pos int - msg string -} - -func (pe parseError) Error() string { - if pe.pos < len(pe.input) { - before := pe.input[:pe.pos] - location := pe.input[pe.pos : pe.pos+1] // need to handle end - after := pe.input[pe.pos+1:] - - return fmt.Sprintf("[%s >|%s|< %s]: %v", before, location, after, pe.msg) - } - - return fmt.Sprintf("[%s]: %v", pe.input, pe.msg) -} - -func (p *parser) mkerrf(pos int, format string, args ...interface{}) error { - return p.mkerr(pos, fmt.Sprintf(format, args...)) -} - -func (p *parser) mkerr(pos int, msg string) error { - return fmt.Errorf("parse error: %w", parseError{ - input: p.input, - pos: pos, - msg: msg, - }) -} diff --git a/vendor/github.com/containerd/containerd/filters/quote.go b/vendor/github.com/containerd/containerd/filters/quote.go deleted file mode 100644 index 5c800ef846..0000000000 --- a/vendor/github.com/containerd/containerd/filters/quote.go +++ /dev/null @@ -1,252 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package filters - -import ( - "errors" - "unicode/utf8" -) - -// NOTE(stevvooe): Most of this code in this file is copied from the stdlib -// strconv package and modified to be able to handle quoting with `/` and `|` -// as delimiters. The copyright is held by the Go authors. - -var errQuoteSyntax = errors.New("quote syntax error") - -// UnquoteChar decodes the first character or byte in the escaped string -// or character literal represented by the string s. -// It returns four values: -// -// 1. value, the decoded Unicode code point or byte value; -// 2. multibyte, a boolean indicating whether the decoded character requires a multibyte UTF-8 representation; -// 3. tail, the remainder of the string after the character; and -// 4. an error that will be nil if the character is syntactically valid. -// -// The second argument, quote, specifies the type of literal being parsed -// and therefore which escaped quote character is permitted. -// If set to a single quote, it permits the sequence \' and disallows unescaped '. -// If set to a double quote, it permits \" and disallows unescaped ". -// If set to zero, it does not permit either escape and allows both quote characters to appear unescaped. -// -// This is from Go strconv package, modified to support `|` and `/` as double -// quotes for use with regular expressions. -func unquoteChar(s string, quote byte) (value rune, multibyte bool, tail string, err error) { - // easy cases - switch c := s[0]; { - case c == quote && (quote == '\'' || quote == '"' || quote == '/' || quote == '|'): - err = errQuoteSyntax - return - case c >= utf8.RuneSelf: - r, size := utf8.DecodeRuneInString(s) - return r, true, s[size:], nil - case c != '\\': - return rune(s[0]), false, s[1:], nil - } - - // hard case: c is backslash - if len(s) <= 1 { - err = errQuoteSyntax - return - } - c := s[1] - s = s[2:] - - switch c { - case 'a': - value = '\a' - case 'b': - value = '\b' - case 'f': - value = '\f' - case 'n': - value = '\n' - case 'r': - value = '\r' - case 't': - value = '\t' - case 'v': - value = '\v' - case 'x', 'u', 'U': - n := 0 - switch c { - case 'x': - n = 2 - case 'u': - n = 4 - case 'U': - n = 8 - } - var v rune - if len(s) < n { - err = errQuoteSyntax - return - } - for j := 0; j < n; j++ { - x, ok := unhex(s[j]) - if !ok { - err = errQuoteSyntax - return - } - v = v<<4 | x - } - s = s[n:] - if c == 'x' { - // single-byte string, possibly not UTF-8 - value = v - break - } - if v > utf8.MaxRune { - err = errQuoteSyntax - return - } - value = v - multibyte = true - case '0', '1', '2', '3', '4', '5', '6', '7': - v := rune(c) - '0' - if len(s) < 2 { - err = errQuoteSyntax - return - } - for j := 0; j < 2; j++ { // one digit already; two more - x := rune(s[j]) - '0' - if x < 0 || x > 7 { - err = errQuoteSyntax - return - } - v = (v << 3) | x - } - s = s[2:] - if v > 255 { - err = errQuoteSyntax - return - } - value = v - case '\\': - value = '\\' - case '\'', '"', '|', '/': - if c != quote { - err = errQuoteSyntax - return - } - value = rune(c) - default: - err = errQuoteSyntax - return - } - tail = s - return -} - -// unquote interprets s as a single-quoted, double-quoted, -// or backquoted Go string literal, returning the string value -// that s quotes. (If s is single-quoted, it would be a Go -// character literal; Unquote returns the corresponding -// one-character string.) -// -// This is modified from the standard library to support `|` and `/` as quote -// characters for use with regular expressions. -func unquote(s string) (string, error) { - n := len(s) - if n < 2 { - return "", errQuoteSyntax - } - quote := s[0] - if quote != s[n-1] { - return "", errQuoteSyntax - } - s = s[1 : n-1] - - if quote == '`' { - if contains(s, '`') { - return "", errQuoteSyntax - } - if contains(s, '\r') { - // -1 because we know there is at least one \r to remove. - buf := make([]byte, 0, len(s)-1) - for i := 0; i < len(s); i++ { - if s[i] != '\r' { - buf = append(buf, s[i]) - } - } - return string(buf), nil - } - return s, nil - } - if quote != '"' && quote != '\'' && quote != '|' && quote != '/' { - return "", errQuoteSyntax - } - if contains(s, '\n') { - return "", errQuoteSyntax - } - - // Is it trivial? Avoid allocation. - if !contains(s, '\\') && !contains(s, quote) { - switch quote { - case '"', '/', '|': // pipe and slash are treated like double quote - return s, nil - case '\'': - r, size := utf8.DecodeRuneInString(s) - if size == len(s) && (r != utf8.RuneError || size != 1) { - return s, nil - } - } - } - - var runeTmp [utf8.UTFMax]byte - buf := make([]byte, 0, 3*len(s)/2) // Try to avoid more allocations. - for len(s) > 0 { - c, multibyte, ss, err := unquoteChar(s, quote) - if err != nil { - return "", err - } - s = ss - if c < utf8.RuneSelf || !multibyte { - buf = append(buf, byte(c)) - } else { - n := utf8.EncodeRune(runeTmp[:], c) - buf = append(buf, runeTmp[:n]...) - } - if quote == '\'' && len(s) != 0 { - // single-quoted must be single character - return "", errQuoteSyntax - } - } - return string(buf), nil -} - -// contains reports whether the string contains the byte c. -func contains(s string, c byte) bool { - for i := 0; i < len(s); i++ { - if s[i] == c { - return true - } - } - return false -} - -func unhex(b byte) (v rune, ok bool) { - c := rune(b) - switch { - case '0' <= c && c <= '9': - return c - '0', true - case 'a' <= c && c <= 'f': - return c - 'a' + 10, true - case 'A' <= c && c <= 'F': - return c - 'A' + 10, true - } - return -} diff --git a/vendor/github.com/containerd/containerd/filters/scanner.go b/vendor/github.com/containerd/containerd/filters/scanner.go deleted file mode 100644 index 6a485467b8..0000000000 --- a/vendor/github.com/containerd/containerd/filters/scanner.go +++ /dev/null @@ -1,297 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package filters - -import ( - "unicode" - "unicode/utf8" -) - -const ( - tokenEOF = -(iota + 1) - tokenQuoted - tokenValue - tokenField - tokenSeparator - tokenOperator - tokenIllegal -) - -type token rune - -func (t token) String() string { - switch t { - case tokenEOF: - return "EOF" - case tokenQuoted: - return "Quoted" - case tokenValue: - return "Value" - case tokenField: - return "Field" - case tokenSeparator: - return "Separator" - case tokenOperator: - return "Operator" - case tokenIllegal: - return "Illegal" - } - - return string(t) -} - -func (t token) GoString() string { - return "token" + t.String() -} - -type scanner struct { - input string - pos int - ppos int // bounds the current rune in the string - value bool - err string -} - -func (s *scanner) init(input string) { - s.input = input - s.pos = 0 - s.ppos = 0 -} - -func (s *scanner) next() rune { - if s.pos >= len(s.input) { - return tokenEOF - } - s.pos = s.ppos - - r, w := utf8.DecodeRuneInString(s.input[s.ppos:]) - s.ppos += w - if r == utf8.RuneError { - if w > 0 { - s.error("rune error") - return tokenIllegal - } - return tokenEOF - } - - if r == 0 { - s.error("unexpected null") - return tokenIllegal - } - - return r -} - -func (s *scanner) peek() rune { - pos := s.pos - ppos := s.ppos - ch := s.next() - s.pos = pos - s.ppos = ppos - return ch -} - -func (s *scanner) scan() (nextp int, tk token, text string) { - var ( - ch = s.next() - pos = s.pos - ) - -chomp: - switch { - case ch == tokenEOF: - case ch == tokenIllegal: - case isQuoteRune(ch): - if !s.scanQuoted(ch) { - return pos, tokenIllegal, s.input[pos:s.ppos] - } - return pos, tokenQuoted, s.input[pos:s.ppos] - case isSeparatorRune(ch): - s.value = false - return pos, tokenSeparator, s.input[pos:s.ppos] - case isOperatorRune(ch): - s.scanOperator() - s.value = true - return pos, tokenOperator, s.input[pos:s.ppos] - case unicode.IsSpace(ch): - // chomp - ch = s.next() - pos = s.pos - goto chomp - case s.value: - s.scanValue() - s.value = false - return pos, tokenValue, s.input[pos:s.ppos] - case isFieldRune(ch): - s.scanField() - return pos, tokenField, s.input[pos:s.ppos] - } - - return s.pos, token(ch), "" -} - -func (s *scanner) scanField() { - for { - ch := s.peek() - if !isFieldRune(ch) { - break - } - s.next() - } -} - -func (s *scanner) scanOperator() { - for { - ch := s.peek() - switch ch { - case '=', '!', '~': - s.next() - default: - return - } - } -} - -func (s *scanner) scanValue() { - for { - ch := s.peek() - if !isValueRune(ch) { - break - } - s.next() - } -} - -func (s *scanner) scanQuoted(quote rune) bool { - var illegal bool - ch := s.next() // read character after quote - for ch != quote { - if ch == '\n' || ch < 0 { - s.error("quoted literal not terminated") - return false - } - if ch == '\\' { - var legal bool - ch, legal = s.scanEscape(quote) - if !legal { - illegal = true - } - } else { - ch = s.next() - } - } - return !illegal -} - -func (s *scanner) scanEscape(quote rune) (ch rune, legal bool) { - ch = s.next() // read character after '/' - switch ch { - case 'a', 'b', 'f', 'n', 'r', 't', 'v', '\\', quote: - // nothing to do - ch = s.next() - legal = true - case '0', '1', '2', '3', '4', '5', '6', '7': - ch, legal = s.scanDigits(ch, 8, 3) - case 'x': - ch, legal = s.scanDigits(s.next(), 16, 2) - case 'u': - ch, legal = s.scanDigits(s.next(), 16, 4) - case 'U': - ch, legal = s.scanDigits(s.next(), 16, 8) - default: - s.error("illegal escape sequence") - } - return -} - -func (s *scanner) scanDigits(ch rune, base, n int) (rune, bool) { - for n > 0 && digitVal(ch) < base { - ch = s.next() - n-- - } - if n > 0 { - s.error("illegal numeric escape sequence") - return ch, false - } - return ch, true -} - -func (s *scanner) error(msg string) { - if s.err == "" { - s.err = msg - } -} - -func digitVal(ch rune) int { - switch { - case '0' <= ch && ch <= '9': - return int(ch - '0') - case 'a' <= ch && ch <= 'f': - return int(ch - 'a' + 10) - case 'A' <= ch && ch <= 'F': - return int(ch - 'A' + 10) - } - return 16 // larger than any legal digit val -} - -func isFieldRune(r rune) bool { - return (r == '_' || isAlphaRune(r) || isDigitRune(r)) -} - -func isAlphaRune(r rune) bool { - return r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z' -} - -func isDigitRune(r rune) bool { - return r >= '0' && r <= '9' -} - -func isOperatorRune(r rune) bool { - switch r { - case '=', '!', '~': - return true - } - - return false -} - -func isQuoteRune(r rune) bool { - switch r { - case '/', '|', '"': // maybe add single quoting? - return true - } - - return false -} - -func isSeparatorRune(r rune) bool { - switch r { - case ',', '.': - return true - } - - return false -} - -func isValueRune(r rune) bool { - return r != ',' && !unicode.IsSpace(r) && - (unicode.IsLetter(r) || - unicode.IsDigit(r) || - unicode.IsNumber(r) || - unicode.IsGraphic(r) || - unicode.IsPunct(r)) -} diff --git a/vendor/github.com/containerd/containerd/images/annotations.go b/vendor/github.com/containerd/containerd/images/annotations.go deleted file mode 100644 index 47d92104cd..0000000000 --- a/vendor/github.com/containerd/containerd/images/annotations.go +++ /dev/null @@ -1,23 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package images - -const ( - // AnnotationImageName is an annotation on a Descriptor in an index.json - // containing the `Name` value as used by an `Image` struct - AnnotationImageName = "io.containerd.image.name" -) diff --git a/vendor/github.com/containerd/containerd/images/diffid.go b/vendor/github.com/containerd/containerd/images/diffid.go deleted file mode 100644 index 85577eedee..0000000000 --- a/vendor/github.com/containerd/containerd/images/diffid.go +++ /dev/null @@ -1,81 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package images - -import ( - "context" - "io" - - "github.com/containerd/containerd/archive/compression" - "github.com/containerd/containerd/content" - "github.com/containerd/containerd/labels" - "github.com/opencontainers/go-digest" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" - "github.com/sirupsen/logrus" -) - -// GetDiffID gets the diff ID of the layer blob descriptor. -func GetDiffID(ctx context.Context, cs content.Store, desc ocispec.Descriptor) (digest.Digest, error) { - switch desc.MediaType { - case - // If the layer is already uncompressed, we can just return its digest - MediaTypeDockerSchema2Layer, - ocispec.MediaTypeImageLayer, - MediaTypeDockerSchema2LayerForeign, - ocispec.MediaTypeImageLayerNonDistributable: //nolint:staticcheck // deprecated - return desc.Digest, nil - } - info, err := cs.Info(ctx, desc.Digest) - if err != nil { - return "", err - } - v, ok := info.Labels[labels.LabelUncompressed] - if ok { - // Fast path: if the image is already unpacked, we can use the label value - return digest.Parse(v) - } - // if the image is not unpacked, we may not have the label - ra, err := cs.ReaderAt(ctx, desc) - if err != nil { - return "", err - } - defer ra.Close() - r := content.NewReader(ra) - uR, err := compression.DecompressStream(r) - if err != nil { - return "", err - } - defer uR.Close() - digester := digest.Canonical.Digester() - hashW := digester.Hash() - if _, err := io.Copy(hashW, uR); err != nil { - return "", err - } - if err := ra.Close(); err != nil { - return "", err - } - digest := digester.Digest() - // memorize the computed value - if info.Labels == nil { - info.Labels = make(map[string]string) - } - info.Labels[labels.LabelUncompressed] = digest.String() - if _, err := cs.Update(ctx, info, "labels"); err != nil { - logrus.WithError(err).Warnf("failed to set %s label for %s", labels.LabelUncompressed, desc.Digest) - } - return digest, nil -} diff --git a/vendor/github.com/containerd/containerd/images/handlers.go b/vendor/github.com/containerd/containerd/images/handlers.go deleted file mode 100644 index a685092e2c..0000000000 --- a/vendor/github.com/containerd/containerd/images/handlers.go +++ /dev/null @@ -1,323 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package images - -import ( - "context" - "errors" - "fmt" - "sort" - - "github.com/containerd/platforms" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" - "golang.org/x/sync/errgroup" - "golang.org/x/sync/semaphore" - - "github.com/containerd/containerd/content" - "github.com/containerd/containerd/errdefs" -) - -var ( - // ErrSkipDesc is used to skip processing of a descriptor and - // its descendants. - ErrSkipDesc = errors.New("skip descriptor") - - // ErrStopHandler is used to signify that the descriptor - // has been handled and should not be handled further. - // This applies only to a single descriptor in a handler - // chain and does not apply to descendant descriptors. - ErrStopHandler = errors.New("stop handler") - - // ErrEmptyWalk is used when the WalkNotEmpty handlers return no - // children (e.g.: they were filtered out). - ErrEmptyWalk = errors.New("image might be filtered out") -) - -// Handler handles image manifests -type Handler interface { - Handle(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error) -} - -// HandlerFunc function implementing the Handler interface -type HandlerFunc func(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error) - -// Handle image manifests -func (fn HandlerFunc) Handle(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error) { - return fn(ctx, desc) -} - -// Handlers returns a handler that will run the handlers in sequence. -// -// A handler may return `ErrStopHandler` to stop calling additional handlers -func Handlers(handlers ...Handler) HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error) { - var children []ocispec.Descriptor - for _, handler := range handlers { - ch, err := handler.Handle(ctx, desc) - if err != nil { - if errors.Is(err, ErrStopHandler) { - break - } - return nil, err - } - - children = append(children, ch...) - } - - return children, nil - } -} - -// Walk the resources of an image and call the handler for each. If the handler -// decodes the sub-resources for each image, -// -// This differs from dispatch in that each sibling resource is considered -// synchronously. -func Walk(ctx context.Context, handler Handler, descs ...ocispec.Descriptor) error { - for _, desc := range descs { - - children, err := handler.Handle(ctx, desc) - if err != nil { - if errors.Is(err, ErrSkipDesc) { - continue // don't traverse the children. - } - return err - } - - if len(children) > 0 { - if err := Walk(ctx, handler, children...); err != nil { - return err - } - } - } - return nil -} - -// WalkNotEmpty works the same way Walk does, with the exception that it ensures that -// some children are still found by Walking the descriptors (for example, not all of -// them have been filtered out by one of the handlers). If there are no children, -// then an ErrEmptyWalk error is returned. -func WalkNotEmpty(ctx context.Context, handler Handler, descs ...ocispec.Descriptor) error { - isEmpty := true - var notEmptyHandler HandlerFunc = func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - children, err := handler.Handle(ctx, desc) - if err != nil { - return children, err - } - - if len(children) > 0 { - isEmpty = false - } - - return children, nil - } - - err := Walk(ctx, notEmptyHandler, descs...) - if err != nil { - return err - } - - if isEmpty { - return ErrEmptyWalk - } - - return nil -} - -// Dispatch runs the provided handler for content specified by the descriptors. -// If the handler decode subresources, they will be visited, as well. -// -// Handlers for siblings are run in parallel on the provided descriptors. A -// handler may return `ErrSkipDesc` to signal to the dispatcher to not traverse -// any children. -// -// A concurrency limiter can be passed in to limit the number of concurrent -// handlers running. When limiter is nil, there is no limit. -// -// Typically, this function will be used with `FetchHandler`, often composed -// with other handlers. -// -// If any handler returns an error, the dispatch session will be canceled. -func Dispatch(ctx context.Context, handler Handler, limiter *semaphore.Weighted, descs ...ocispec.Descriptor) error { - eg, ctx2 := errgroup.WithContext(ctx) - for _, desc := range descs { - desc := desc - - if limiter != nil { - if err := limiter.Acquire(ctx, 1); err != nil { - return err - } - } - - eg.Go(func() error { - desc := desc - - children, err := handler.Handle(ctx2, desc) - if limiter != nil { - limiter.Release(1) - } - if err != nil { - if errors.Is(err, ErrSkipDesc) { - return nil // don't traverse the children. - } - return err - } - - if len(children) > 0 { - return Dispatch(ctx2, handler, limiter, children...) - } - - return nil - }) - } - - return eg.Wait() -} - -// ChildrenHandler decodes well-known manifest types and returns their children. -// -// This is useful for supporting recursive fetch and other use cases where you -// want to do a full walk of resources. -// -// One can also replace this with another implementation to allow descending of -// arbitrary types. -func ChildrenHandler(provider content.Provider) HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - return Children(ctx, provider, desc) - } -} - -// SetChildrenLabels is a handler wrapper which sets labels for the content on -// the children returned by the handler and passes through the children. -// Must follow a handler that returns the children to be labeled. -func SetChildrenLabels(manager content.Manager, f HandlerFunc) HandlerFunc { - return SetChildrenMappedLabels(manager, f, nil) -} - -// SetChildrenMappedLabels is a handler wrapper which sets labels for the content on -// the children returned by the handler and passes through the children. -// Must follow a handler that returns the children to be labeled. -// The label map allows the caller to control the labels per child descriptor. -// For returned labels, the index of the child will be appended to the end -// except for the first index when the returned label does not end with '.'. -func SetChildrenMappedLabels(manager content.Manager, f HandlerFunc, labelMap func(ocispec.Descriptor) []string) HandlerFunc { - if labelMap == nil { - labelMap = ChildGCLabels - } - return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - children, err := f(ctx, desc) - if err != nil { - return children, err - } - - if len(children) > 0 { - var ( - info = content.Info{ - Digest: desc.Digest, - Labels: map[string]string{}, - } - fields = []string{} - keys = map[string]uint{} - ) - for _, ch := range children { - labelKeys := labelMap(ch) - for _, key := range labelKeys { - idx := keys[key] - keys[key] = idx + 1 - if idx > 0 || key[len(key)-1] == '.' { - key = fmt.Sprintf("%s%d", key, idx) - } - - info.Labels[key] = ch.Digest.String() - fields = append(fields, "labels."+key) - } - } - - _, err := manager.Update(ctx, info, fields...) - if err != nil { - return nil, err - } - } - - return children, err - } -} - -// FilterPlatforms is a handler wrapper which limits the descriptors returned -// based on matching the specified platform matcher. -func FilterPlatforms(f HandlerFunc, m platforms.Matcher) HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - children, err := f(ctx, desc) - if err != nil { - return children, err - } - - var descs []ocispec.Descriptor - - if m == nil { - descs = children - } else { - for _, d := range children { - if d.Platform == nil || m.Match(*d.Platform) { - descs = append(descs, d) - } - } - } - - return descs, nil - } -} - -// LimitManifests is a handler wrapper which filters the manifest descriptors -// returned using the provided platform. -// The results will be ordered according to the comparison operator and -// use the ordering in the manifests for equal matches. -// A limit of 0 or less is considered no limit. -// A not found error is returned if no manifest is matched. -func LimitManifests(f HandlerFunc, m platforms.MatchComparer, n int) HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - children, err := f(ctx, desc) - if err != nil { - return children, err - } - - switch desc.MediaType { - case ocispec.MediaTypeImageIndex, MediaTypeDockerSchema2ManifestList: - sort.SliceStable(children, func(i, j int) bool { - if children[i].Platform == nil { - return false - } - if children[j].Platform == nil { - return true - } - return m.Less(*children[i].Platform, *children[j].Platform) - }) - - if n > 0 { - if len(children) == 0 { - return children, fmt.Errorf("no match for platform in manifest: %w", errdefs.ErrNotFound) - } - if len(children) > n { - children = children[:n] - } - } - default: - // only limit manifests from an index - } - return children, nil - } -} diff --git a/vendor/github.com/containerd/containerd/images/image.go b/vendor/github.com/containerd/containerd/images/image.go deleted file mode 100644 index 8bebae19b3..0000000000 --- a/vendor/github.com/containerd/containerd/images/image.go +++ /dev/null @@ -1,444 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package images - -import ( - "context" - "encoding/json" - "fmt" - "sort" - "time" - - "github.com/containerd/log" - "github.com/containerd/platforms" - digest "github.com/opencontainers/go-digest" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" - - "github.com/containerd/containerd/content" - "github.com/containerd/containerd/errdefs" -) - -// Image provides the model for how containerd views container images. -type Image struct { - // Name of the image. - // - // To be pulled, it must be a reference compatible with resolvers. - // - // This field is required. - Name string - - // Labels provide runtime decoration for the image record. - // - // There is no default behavior for how these labels are propagated. They - // only decorate the static metadata object. - // - // This field is optional. - Labels map[string]string - - // Target describes the root content for this image. Typically, this is - // a manifest, index or manifest list. - Target ocispec.Descriptor - - CreatedAt, UpdatedAt time.Time -} - -// DeleteOptions provide options on image delete -type DeleteOptions struct { - Synchronous bool -} - -// DeleteOpt allows configuring a delete operation -type DeleteOpt func(context.Context, *DeleteOptions) error - -// SynchronousDelete is used to indicate that an image deletion and removal of -// the image resources should occur synchronously before returning a result. -func SynchronousDelete() DeleteOpt { - return func(ctx context.Context, o *DeleteOptions) error { - o.Synchronous = true - return nil - } -} - -// Store and interact with images -type Store interface { - Get(ctx context.Context, name string) (Image, error) - List(ctx context.Context, filters ...string) ([]Image, error) - Create(ctx context.Context, image Image) (Image, error) - - // Update will replace the data in the store with the provided image. If - // one or more fieldpaths are provided, only those fields will be updated. - Update(ctx context.Context, image Image, fieldpaths ...string) (Image, error) - - Delete(ctx context.Context, name string, opts ...DeleteOpt) error -} - -// TODO(stevvooe): Many of these functions make strong platform assumptions, -// which are untrue in a lot of cases. More refactoring must be done here to -// make this work in all cases. - -// Config resolves the image configuration descriptor. -// -// The caller can then use the descriptor to resolve and process the -// configuration of the image. -func (image *Image) Config(ctx context.Context, provider content.Provider, platform platforms.MatchComparer) (ocispec.Descriptor, error) { - return Config(ctx, provider, image.Target, platform) -} - -// RootFS returns the unpacked diffids that make up and images rootfs. -// -// These are used to verify that a set of layers unpacked to the expected -// values. -func (image *Image) RootFS(ctx context.Context, provider content.Provider, platform platforms.MatchComparer) ([]digest.Digest, error) { - desc, err := image.Config(ctx, provider, platform) - if err != nil { - return nil, err - } - return RootFS(ctx, provider, desc) -} - -// Size returns the total size of an image's packed resources. -func (image *Image) Size(ctx context.Context, provider content.Provider, platform platforms.MatchComparer) (int64, error) { - var size int64 - return size, Walk(ctx, Handlers(HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - if desc.Size < 0 { - return nil, fmt.Errorf("invalid size %v in %v (%v)", desc.Size, desc.Digest, desc.MediaType) - } - size += desc.Size - return nil, nil - }), LimitManifests(FilterPlatforms(ChildrenHandler(provider), platform), platform, 1)), image.Target) -} - -type platformManifest struct { - p *ocispec.Platform - m *ocispec.Manifest -} - -// Manifest resolves a manifest from the image for the given platform. -// -// When a manifest descriptor inside of a manifest index does not have -// a platform defined, the platform from the image config is considered. -// -// If the descriptor points to a non-index manifest, then the manifest is -// unmarshalled and returned without considering the platform inside of the -// config. -// -// TODO(stevvooe): This violates the current platform agnostic approach to this -// package by returning a specific manifest type. We'll need to refactor this -// to return a manifest descriptor or decide that we want to bring the API in -// this direction because this abstraction is not needed. -func Manifest(ctx context.Context, provider content.Provider, image ocispec.Descriptor, platform platforms.MatchComparer) (ocispec.Manifest, error) { - var ( - limit = 1 - m []platformManifest - wasIndex bool - ) - - if err := Walk(ctx, HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - switch desc.MediaType { - case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest: - p, err := content.ReadBlob(ctx, provider, desc) - if err != nil { - return nil, err - } - - if err := validateMediaType(p, desc.MediaType); err != nil { - return nil, fmt.Errorf("manifest: invalid desc %s: %w", desc.Digest, err) - } - - var manifest ocispec.Manifest - if err := json.Unmarshal(p, &manifest); err != nil { - return nil, err - } - - if desc.Digest != image.Digest && platform != nil { - if desc.Platform != nil && !platform.Match(*desc.Platform) { - return nil, nil - } - - if desc.Platform == nil { - p, err := content.ReadBlob(ctx, provider, manifest.Config) - if err != nil { - return nil, err - } - - var image ocispec.Image - if err := json.Unmarshal(p, &image); err != nil { - return nil, err - } - - if !platform.Match(platforms.Normalize(ocispec.Platform{OS: image.OS, Architecture: image.Architecture})) { - return nil, nil - } - - } - } - - m = append(m, platformManifest{ - p: desc.Platform, - m: &manifest, - }) - - return nil, nil - case MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex: - p, err := content.ReadBlob(ctx, provider, desc) - if err != nil { - return nil, err - } - - if err := validateMediaType(p, desc.MediaType); err != nil { - return nil, fmt.Errorf("manifest: invalid desc %s: %w", desc.Digest, err) - } - - var idx ocispec.Index - if err := json.Unmarshal(p, &idx); err != nil { - return nil, err - } - - if platform == nil { - return idx.Manifests, nil - } - - var descs []ocispec.Descriptor - for _, d := range idx.Manifests { - if d.Platform == nil || platform.Match(*d.Platform) { - descs = append(descs, d) - } - } - - sort.SliceStable(descs, func(i, j int) bool { - if descs[i].Platform == nil { - return false - } - if descs[j].Platform == nil { - return true - } - return platform.Less(*descs[i].Platform, *descs[j].Platform) - }) - - wasIndex = true - - if len(descs) > limit { - return descs[:limit], nil - } - return descs, nil - } - return nil, fmt.Errorf("unexpected media type %v for %v: %w", desc.MediaType, desc.Digest, errdefs.ErrNotFound) - }), image); err != nil { - return ocispec.Manifest{}, err - } - - if len(m) == 0 { - err := fmt.Errorf("manifest %v: %w", image.Digest, errdefs.ErrNotFound) - if wasIndex { - err = fmt.Errorf("no match for platform in manifest %v: %w", image.Digest, errdefs.ErrNotFound) - } - return ocispec.Manifest{}, err - } - return *m[0].m, nil -} - -// Config resolves the image configuration descriptor using a content provided -// to resolve child resources on the image. -// -// The caller can then use the descriptor to resolve and process the -// configuration of the image. -func Config(ctx context.Context, provider content.Provider, image ocispec.Descriptor, platform platforms.MatchComparer) (ocispec.Descriptor, error) { - manifest, err := Manifest(ctx, provider, image, platform) - if err != nil { - return ocispec.Descriptor{}, err - } - return manifest.Config, err -} - -// Platforms returns one or more platforms supported by the image. -func Platforms(ctx context.Context, provider content.Provider, image ocispec.Descriptor) ([]ocispec.Platform, error) { - var platformSpecs []ocispec.Platform - return platformSpecs, Walk(ctx, Handlers(HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - if desc.Platform != nil { - if desc.Platform.OS == "unknown" || desc.Platform.Architecture == "unknown" { - return nil, ErrSkipDesc - } - platformSpecs = append(platformSpecs, *desc.Platform) - return nil, ErrSkipDesc - } - - switch desc.MediaType { - case MediaTypeDockerSchema2Config, ocispec.MediaTypeImageConfig: - p, err := content.ReadBlob(ctx, provider, desc) - if err != nil { - return nil, err - } - - var image ocispec.Image - if err := json.Unmarshal(p, &image); err != nil { - return nil, err - } - - platformSpecs = append(platformSpecs, - platforms.Normalize(ocispec.Platform{OS: image.OS, Architecture: image.Architecture})) - } - return nil, nil - }), ChildrenHandler(provider)), image) -} - -// Check returns nil if the all components of an image are available in the -// provider for the specified platform. -// -// If available is true, the caller can assume that required represents the -// complete set of content required for the image. -// -// missing will have the components that are part of required but not available -// in the provider. -// -// If there is a problem resolving content, an error will be returned. -func Check(ctx context.Context, provider content.Provider, image ocispec.Descriptor, platform platforms.MatchComparer) (available bool, required, present, missing []ocispec.Descriptor, err error) { - mfst, err := Manifest(ctx, provider, image, platform) - if err != nil { - if errdefs.IsNotFound(err) { - return false, []ocispec.Descriptor{image}, nil, []ocispec.Descriptor{image}, nil - } - - return false, nil, nil, nil, fmt.Errorf("failed to check image %v: %w", image.Digest, err) - } - - // TODO(stevvooe): It is possible that referenced components could have - // children, but this is rare. For now, we ignore this and only verify - // that manifest components are present. - required = append([]ocispec.Descriptor{mfst.Config}, mfst.Layers...) - - for _, desc := range required { - ra, err := provider.ReaderAt(ctx, desc) - if err != nil { - if errdefs.IsNotFound(err) { - missing = append(missing, desc) - continue - } else { - return false, nil, nil, nil, fmt.Errorf("failed to check image %v: %w", desc.Digest, err) - } - } - ra.Close() - present = append(present, desc) - - } - - return true, required, present, missing, nil -} - -// Children returns the immediate children of content described by the descriptor. -func Children(ctx context.Context, provider content.Provider, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - var descs []ocispec.Descriptor - switch desc.MediaType { - case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest: - p, err := content.ReadBlob(ctx, provider, desc) - if err != nil { - return nil, err - } - - if err := validateMediaType(p, desc.MediaType); err != nil { - return nil, fmt.Errorf("children: invalid desc %s: %w", desc.Digest, err) - } - - // TODO(stevvooe): We just assume oci manifest, for now. There may be - // subtle differences from the docker version. - var manifest ocispec.Manifest - if err := json.Unmarshal(p, &manifest); err != nil { - return nil, err - } - - descs = append(descs, manifest.Config) - descs = append(descs, manifest.Layers...) - case MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex: - p, err := content.ReadBlob(ctx, provider, desc) - if err != nil { - return nil, err - } - - if err := validateMediaType(p, desc.MediaType); err != nil { - return nil, fmt.Errorf("children: invalid desc %s: %w", desc.Digest, err) - } - - var index ocispec.Index - if err := json.Unmarshal(p, &index); err != nil { - return nil, err - } - - descs = append(descs, index.Manifests...) - default: - if IsLayerType(desc.MediaType) || IsKnownConfig(desc.MediaType) || IsAttestationType(desc.MediaType) { - // childless data types. - return nil, nil - } - log.G(ctx).Debugf("encountered unknown type %v; children may not be fetched", desc.MediaType) - } - - return descs, nil -} - -// unknownDocument represents a manifest, manifest list, or index that has not -// yet been validated. -type unknownDocument struct { - MediaType string `json:"mediaType,omitempty"` - Config json.RawMessage `json:"config,omitempty"` - Layers json.RawMessage `json:"layers,omitempty"` - Manifests json.RawMessage `json:"manifests,omitempty"` - FSLayers json.RawMessage `json:"fsLayers,omitempty"` // schema 1 -} - -// validateMediaType returns an error if the byte slice is invalid JSON or if -// the media type identifies the blob as one format but it contains elements of -// another format. -func validateMediaType(b []byte, mt string) error { - var doc unknownDocument - if err := json.Unmarshal(b, &doc); err != nil { - return err - } - if len(doc.FSLayers) != 0 { - return fmt.Errorf("media-type: schema 1 not supported") - } - switch mt { - case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest: - if len(doc.Manifests) != 0 || - doc.MediaType == MediaTypeDockerSchema2ManifestList || - doc.MediaType == ocispec.MediaTypeImageIndex { - return fmt.Errorf("media-type: expected manifest but found index (%s)", mt) - } - case MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex: - if len(doc.Config) != 0 || len(doc.Layers) != 0 || - doc.MediaType == MediaTypeDockerSchema2Manifest || - doc.MediaType == ocispec.MediaTypeImageManifest { - return fmt.Errorf("media-type: expected index but found manifest (%s)", mt) - } - } - return nil -} - -// RootFS returns the unpacked diffids that make up and images rootfs. -// -// These are used to verify that a set of layers unpacked to the expected -// values. -func RootFS(ctx context.Context, provider content.Provider, configDesc ocispec.Descriptor) ([]digest.Digest, error) { - p, err := content.ReadBlob(ctx, provider, configDesc) - if err != nil { - return nil, err - } - - var config ocispec.Image - if err := json.Unmarshal(p, &config); err != nil { - return nil, err - } - return config.RootFS.DiffIDs, nil -} diff --git a/vendor/github.com/containerd/containerd/images/importexport.go b/vendor/github.com/containerd/containerd/images/importexport.go deleted file mode 100644 index 843adcadc7..0000000000 --- a/vendor/github.com/containerd/containerd/images/importexport.go +++ /dev/null @@ -1,37 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package images - -import ( - "context" - "io" - - "github.com/containerd/containerd/content" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" -) - -// Importer is the interface for image importer. -type Importer interface { - // Import imports an image from a tar stream. - Import(ctx context.Context, store content.Store, reader io.Reader) (ocispec.Descriptor, error) -} - -// Exporter is the interface for image exporter. -type Exporter interface { - // Export exports an image to a tar stream. - Export(ctx context.Context, store content.Provider, desc ocispec.Descriptor, writer io.Writer) error -} diff --git a/vendor/github.com/containerd/containerd/images/labels.go b/vendor/github.com/containerd/containerd/images/labels.go deleted file mode 100644 index 06dfed572d..0000000000 --- a/vendor/github.com/containerd/containerd/images/labels.go +++ /dev/null @@ -1,21 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package images - -const ( - ConvertedDockerSchema1LabelKey = "io.containerd.image/converted-docker-schema1" -) diff --git a/vendor/github.com/containerd/containerd/images/mediatypes.go b/vendor/github.com/containerd/containerd/images/mediatypes.go deleted file mode 100644 index 49d2a5b1c5..0000000000 --- a/vendor/github.com/containerd/containerd/images/mediatypes.go +++ /dev/null @@ -1,228 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package images - -import ( - "context" - "fmt" - "sort" - "strings" - - "github.com/containerd/containerd/errdefs" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" -) - -// mediatype definitions for image components handled in containerd. -// -// oci components are generally referenced directly, although we may centralize -// here for clarity. -const ( - MediaTypeDockerSchema2Layer = "application/vnd.docker.image.rootfs.diff.tar" - MediaTypeDockerSchema2LayerForeign = "application/vnd.docker.image.rootfs.foreign.diff.tar" - MediaTypeDockerSchema2LayerGzip = "application/vnd.docker.image.rootfs.diff.tar.gzip" - MediaTypeDockerSchema2LayerForeignGzip = "application/vnd.docker.image.rootfs.foreign.diff.tar.gzip" - MediaTypeDockerSchema2Config = "application/vnd.docker.container.image.v1+json" - MediaTypeDockerSchema2Manifest = "application/vnd.docker.distribution.manifest.v2+json" - MediaTypeDockerSchema2ManifestList = "application/vnd.docker.distribution.manifest.list.v2+json" - - // Checkpoint/Restore Media Types - - MediaTypeContainerd1Checkpoint = "application/vnd.containerd.container.criu.checkpoint.criu.tar" - MediaTypeContainerd1CheckpointPreDump = "application/vnd.containerd.container.criu.checkpoint.predump.tar" - MediaTypeContainerd1Resource = "application/vnd.containerd.container.resource.tar" - MediaTypeContainerd1RW = "application/vnd.containerd.container.rw.tar" - MediaTypeContainerd1CheckpointConfig = "application/vnd.containerd.container.checkpoint.config.v1+proto" - MediaTypeContainerd1CheckpointOptions = "application/vnd.containerd.container.checkpoint.options.v1+proto" - MediaTypeContainerd1CheckpointRuntimeName = "application/vnd.containerd.container.checkpoint.runtime.name" - MediaTypeContainerd1CheckpointRuntimeOptions = "application/vnd.containerd.container.checkpoint.runtime.options+proto" - - // MediaTypeDockerSchema1Manifest is the legacy Docker schema1 manifest - MediaTypeDockerSchema1Manifest = "application/vnd.docker.distribution.manifest.v1+prettyjws" - - // Encrypted media types - - MediaTypeImageLayerEncrypted = ocispec.MediaTypeImageLayer + "+encrypted" - MediaTypeImageLayerGzipEncrypted = ocispec.MediaTypeImageLayerGzip + "+encrypted" - - // In-toto attestation - MediaTypeInToto = "application/vnd.in-toto+json" -) - -// DiffCompression returns the compression as defined by the layer diff media -// type. For Docker media types without compression, "unknown" is returned to -// indicate that the media type may be compressed. If the media type is not -// recognized as a layer diff, then it returns errdefs.ErrNotImplemented -func DiffCompression(ctx context.Context, mediaType string) (string, error) { - base, ext := parseMediaTypes(mediaType) - switch base { - case MediaTypeDockerSchema2Layer, MediaTypeDockerSchema2LayerForeign: - if len(ext) > 0 { - // Type is wrapped - return "", nil - } - // These media types may have been compressed but failed to - // use the correct media type. The decompression function - // should detect and handle this case. - return "unknown", nil - case MediaTypeDockerSchema2LayerGzip, MediaTypeDockerSchema2LayerForeignGzip: - if len(ext) > 0 { - // Type is wrapped - return "", nil - } - return "gzip", nil - case ocispec.MediaTypeImageLayer, ocispec.MediaTypeImageLayerNonDistributable: //nolint:staticcheck // Non-distributable layers are deprecated - if len(ext) > 0 { - switch ext[len(ext)-1] { - case "gzip": - return "gzip", nil - case "zstd": - return "zstd", nil - } - } - return "", nil - default: - return "", fmt.Errorf("unrecognised mediatype %s: %w", mediaType, errdefs.ErrNotImplemented) - } -} - -// parseMediaTypes splits the media type into the base type and -// an array of sorted extensions -func parseMediaTypes(mt string) (mediaType string, suffixes []string) { - if mt == "" { - return "", []string{} - } - mediaType, ext, ok := strings.Cut(mt, "+") - if !ok { - return mediaType, []string{} - } - - // Splitting the extensions following the mediatype "(+)gzip+encrypted". - // We expect this to be a limited list, so add an arbitrary limit (50). - // - // Note that DiffCompression is only using the last element, so perhaps we - // should split on the last "+" only. - suffixes = strings.SplitN(ext, "+", 50) - sort.Strings(suffixes) - return mediaType, suffixes -} - -// IsNonDistributable returns true if the media type is non-distributable. -func IsNonDistributable(mt string) bool { - return strings.HasPrefix(mt, "application/vnd.oci.image.layer.nondistributable.") || - strings.HasPrefix(mt, "application/vnd.docker.image.rootfs.foreign.") -} - -// IsLayerType returns true if the media type is a layer -func IsLayerType(mt string) bool { - if strings.HasPrefix(mt, "application/vnd.oci.image.layer.") { - return true - } - - // Parse Docker media types, strip off any + suffixes first - switch base, _ := parseMediaTypes(mt); base { - case MediaTypeDockerSchema2Layer, MediaTypeDockerSchema2LayerGzip, - MediaTypeDockerSchema2LayerForeign, MediaTypeDockerSchema2LayerForeignGzip: - return true - } - return false -} - -// IsDockerType returns true if the media type has "application/vnd.docker." prefix -func IsDockerType(mt string) bool { - return strings.HasPrefix(mt, "application/vnd.docker.") -} - -// IsManifestType returns true if the media type is an OCI-compatible manifest. -// No support for schema1 manifest. -func IsManifestType(mt string) bool { - switch mt { - case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest: - return true - default: - return false - } -} - -// IsIndexType returns true if the media type is an OCI-compatible index. -func IsIndexType(mt string) bool { - switch mt { - case ocispec.MediaTypeImageIndex, MediaTypeDockerSchema2ManifestList: - return true - default: - return false - } -} - -// IsConfigType returns true if the media type is an OCI-compatible image config. -// No support for containerd checkpoint configs. -func IsConfigType(mt string) bool { - switch mt { - case MediaTypeDockerSchema2Config, ocispec.MediaTypeImageConfig: - return true - default: - return false - } -} - -// IsKnownConfig returns true if the media type is a known config type, -// including containerd checkpoint configs -func IsKnownConfig(mt string) bool { - switch mt { - case MediaTypeDockerSchema2Config, ocispec.MediaTypeImageConfig, - MediaTypeContainerd1Checkpoint, MediaTypeContainerd1CheckpointConfig: - return true - } - return false -} - -// IsAttestationType returns true if the media type is an attestation type -func IsAttestationType(mt string) bool { - switch mt { - case MediaTypeInToto: - return true - default: - return false - } -} - -// ChildGCLabels returns the label for a given descriptor to reference it -func ChildGCLabels(desc ocispec.Descriptor) []string { - mt := desc.MediaType - if IsKnownConfig(mt) { - return []string{"containerd.io/gc.ref.content.config"} - } - - switch mt { - case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest: - return []string{"containerd.io/gc.ref.content.m."} - } - - if IsLayerType(mt) { - return []string{"containerd.io/gc.ref.content.l."} - } - - return []string{"containerd.io/gc.ref.content."} -} - -// ChildGCLabelsFilterLayers returns the labels for a given descriptor to -// reference it, skipping layer media types -func ChildGCLabelsFilterLayers(desc ocispec.Descriptor) []string { - if IsLayerType(desc.MediaType) { - return nil - } - return ChildGCLabels(desc) -} diff --git a/vendor/github.com/containerd/containerd/labels/labels.go b/vendor/github.com/containerd/containerd/labels/labels.go deleted file mode 100644 index 0f9bab5c5d..0000000000 --- a/vendor/github.com/containerd/containerd/labels/labels.go +++ /dev/null @@ -1,29 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package labels - -// LabelUncompressed is added to compressed layer contents. -// The value is digest of the uncompressed content. -const LabelUncompressed = "containerd.io/uncompressed" - -// LabelSharedNamespace is added to a namespace to allow that namespaces -// contents to be shared. -const LabelSharedNamespace = "containerd.io/namespace.shareable" - -// LabelDistributionSource is added to content to indicate its origin. -// e.g., "containerd.io/distribution.source.docker.io=library/redis" -const LabelDistributionSource = "containerd.io/distribution.source" diff --git a/vendor/github.com/containerd/containerd/labels/validate.go b/vendor/github.com/containerd/containerd/labels/validate.go deleted file mode 100644 index f83b5dde29..0000000000 --- a/vendor/github.com/containerd/containerd/labels/validate.go +++ /dev/null @@ -1,41 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package labels - -import ( - "fmt" - - "github.com/containerd/containerd/errdefs" -) - -const ( - maxSize = 4096 - // maximum length of key portion of error message if len of key + len of value > maxSize - keyMaxLen = 64 -) - -// Validate a label's key and value are under 4096 bytes -func Validate(k, v string) error { - total := len(k) + len(v) - if total > maxSize { - if len(k) > keyMaxLen { - k = k[:keyMaxLen] - } - return fmt.Errorf("label key and value length (%d bytes) greater than maximum size (%d bytes), key: %s: %w", total, maxSize, k, errdefs.ErrInvalidArgument) - } - return nil -} diff --git a/vendor/github.com/containerd/containerd/pkg/randutil/randutil.go b/vendor/github.com/containerd/containerd/pkg/randutil/randutil.go deleted file mode 100644 index f4b657d7dd..0000000000 --- a/vendor/github.com/containerd/containerd/pkg/randutil/randutil.go +++ /dev/null @@ -1,48 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -// Package randutil provides utilities for [cyrpto/rand]. -package randutil - -import ( - "crypto/rand" - "math" - "math/big" -) - -// Int63n is similar to [math/rand.Int63n] but uses [crypto/rand.Reader] under the hood. -func Int63n(n int64) int64 { - b, err := rand.Int(rand.Reader, big.NewInt(n)) - if err != nil { - panic(err) - } - return b.Int64() -} - -// Int63 is similar to [math/rand.Int63] but uses [crypto/rand.Reader] under the hood. -func Int63() int64 { - return Int63n(math.MaxInt64) -} - -// Intn is similar to [math/rand.Intn] but uses [crypto/rand.Reader] under the hood. -func Intn(n int) int { - return int(Int63n(int64(n))) -} - -// Int is similar to [math/rand.Int] but uses [crypto/rand.Reader] under the hood. -func Int() int { - return int(Int63()) -} diff --git a/vendor/github.com/containerd/containerd/remotes/handlers.go b/vendor/github.com/containerd/containerd/remotes/handlers.go deleted file mode 100644 index 14af02769c..0000000000 --- a/vendor/github.com/containerd/containerd/remotes/handlers.go +++ /dev/null @@ -1,416 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package remotes - -import ( - "bytes" - "context" - "errors" - "fmt" - "io" - "strings" - "sync" - - "github.com/containerd/log" - "github.com/containerd/platforms" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" - "golang.org/x/sync/semaphore" - - "github.com/containerd/containerd/content" - "github.com/containerd/containerd/errdefs" - "github.com/containerd/containerd/images" - "github.com/containerd/containerd/labels" -) - -type refKeyPrefix struct{} - -// WithMediaTypeKeyPrefix adds a custom key prefix for a media type which is used when storing -// data in the content store from the FetchHandler. -// -// Used in `MakeRefKey` to determine what the key prefix should be. -func WithMediaTypeKeyPrefix(ctx context.Context, mediaType, prefix string) context.Context { - var values map[string]string - if v := ctx.Value(refKeyPrefix{}); v != nil { - values = v.(map[string]string) - } else { - values = make(map[string]string) - } - - values[mediaType] = prefix - return context.WithValue(ctx, refKeyPrefix{}, values) -} - -// MakeRefKey returns a unique reference for the descriptor. This reference can be -// used to lookup ongoing processes related to the descriptor. This function -// may look to the context to namespace the reference appropriately. -func MakeRefKey(ctx context.Context, desc ocispec.Descriptor) string { - key := desc.Digest.String() - if desc.Annotations != nil { - if name, ok := desc.Annotations[ocispec.AnnotationRefName]; ok { - key = fmt.Sprintf("%s@%s", name, desc.Digest.String()) - } - } - - if v := ctx.Value(refKeyPrefix{}); v != nil { - values := v.(map[string]string) - if prefix := values[desc.MediaType]; prefix != "" { - return prefix + "-" + key - } - } - - switch mt := desc.MediaType; { - case mt == images.MediaTypeDockerSchema2Manifest || mt == ocispec.MediaTypeImageManifest: - return "manifest-" + key - case mt == images.MediaTypeDockerSchema2ManifestList || mt == ocispec.MediaTypeImageIndex: - return "index-" + key - case images.IsLayerType(mt): - return "layer-" + key - case images.IsKnownConfig(mt): - return "config-" + key - case images.IsAttestationType(desc.MediaType): - return "attestation-" + key - default: - log.G(ctx).Warnf("reference for unknown type: %s", mt) - return "unknown-" + key - } -} - -// FetchHandler returns a handler that will fetch all content into the ingester -// discovered in a call to Dispatch. Use with ChildrenHandler to do a full -// recursive fetch. -func FetchHandler(ingester content.Ingester, fetcher Fetcher) images.HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error) { - ctx = log.WithLogger(ctx, log.G(ctx).WithFields(log.Fields{ - "digest": desc.Digest, - "mediatype": desc.MediaType, - "size": desc.Size, - })) - - switch desc.MediaType { - case images.MediaTypeDockerSchema1Manifest: - return nil, fmt.Errorf("%v not supported", desc.MediaType) - default: - err := Fetch(ctx, ingester, fetcher, desc) - if errdefs.IsAlreadyExists(err) { - return nil, nil - } - return nil, err - } - } -} - -// Fetch fetches the given digest into the provided ingester -func Fetch(ctx context.Context, ingester content.Ingester, fetcher Fetcher, desc ocispec.Descriptor) error { - log.G(ctx).Debug("fetch") - - cw, err := content.OpenWriter(ctx, ingester, content.WithRef(MakeRefKey(ctx, desc)), content.WithDescriptor(desc)) - if err != nil { - return err - } - defer cw.Close() - - ws, err := cw.Status() - if err != nil { - return err - } - - if desc.Size == 0 { - // most likely a poorly configured registry/web front end which responded with no - // Content-Length header; unable (not to mention useless) to commit a 0-length entry - // into the content store. Error out here otherwise the error sent back is confusing - return fmt.Errorf("unable to fetch descriptor (%s) which reports content size of zero: %w", desc.Digest, errdefs.ErrInvalidArgument) - } - if ws.Offset == desc.Size { - // If writer is already complete, commit and return - err := cw.Commit(ctx, desc.Size, desc.Digest) - if err != nil && !errdefs.IsAlreadyExists(err) { - return fmt.Errorf("failed commit on ref %q: %w", ws.Ref, err) - } - return err - } - - if desc.Size == int64(len(desc.Data)) { - return content.Copy(ctx, cw, bytes.NewReader(desc.Data), desc.Size, desc.Digest) - } - - rc, err := fetcher.Fetch(ctx, desc) - if err != nil { - return err - } - defer rc.Close() - - return content.Copy(ctx, cw, rc, desc.Size, desc.Digest) -} - -// PushHandler returns a handler that will push all content from the provider -// using a writer from the pusher. -func PushHandler(pusher Pusher, provider content.Provider) images.HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - ctx = log.WithLogger(ctx, log.G(ctx).WithFields(log.Fields{ - "digest": desc.Digest, - "mediatype": desc.MediaType, - "size": desc.Size, - })) - - err := push(ctx, provider, pusher, desc) - return nil, err - } -} - -func push(ctx context.Context, provider content.Provider, pusher Pusher, desc ocispec.Descriptor) error { - log.G(ctx).Debug("push") - - var ( - cw content.Writer - err error - ) - if cs, ok := pusher.(content.Ingester); ok { - cw, err = content.OpenWriter(ctx, cs, content.WithRef(MakeRefKey(ctx, desc)), content.WithDescriptor(desc)) - } else { - cw, err = pusher.Push(ctx, desc) - } - if err != nil { - if !errdefs.IsAlreadyExists(err) { - return err - } - - return nil - } - defer cw.Close() - - ra, err := provider.ReaderAt(ctx, desc) - if err != nil { - return err - } - defer ra.Close() - - rd := io.NewSectionReader(ra, 0, desc.Size) - return content.Copy(ctx, cw, rd, desc.Size, desc.Digest) -} - -// PushContent pushes content specified by the descriptor from the provider. -// -// Base handlers can be provided which will be called before any push specific -// handlers. -// -// If the passed in content.Provider is also a content.InfoProvider (such as -// content.Manager) then this will also annotate the distribution sources using -// labels prefixed with "containerd.io/distribution.source". -func PushContent(ctx context.Context, pusher Pusher, desc ocispec.Descriptor, store content.Provider, limiter *semaphore.Weighted, platform platforms.MatchComparer, wrapper func(h images.Handler) images.Handler) error { - - var m sync.Mutex - manifests := []ocispec.Descriptor{} - indexStack := []ocispec.Descriptor{} - - filterHandler := images.HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - switch desc.MediaType { - case images.MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest: - m.Lock() - manifests = append(manifests, desc) - m.Unlock() - return nil, images.ErrStopHandler - case images.MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex: - m.Lock() - indexStack = append(indexStack, desc) - m.Unlock() - return nil, images.ErrStopHandler - default: - return nil, nil - } - }) - - pushHandler := PushHandler(pusher, store) - - platformFilterhandler := images.FilterPlatforms(images.ChildrenHandler(store), platform) - - var handler images.Handler - if m, ok := store.(content.InfoProvider); ok { - annotateHandler := annotateDistributionSourceHandler(platformFilterhandler, m) - handler = images.Handlers(annotateHandler, filterHandler, pushHandler) - } else { - handler = images.Handlers(platformFilterhandler, filterHandler, pushHandler) - } - - if wrapper != nil { - handler = wrapper(handler) - } - - if err := images.Dispatch(ctx, handler, limiter, desc); err != nil { - return err - } - - if err := images.Dispatch(ctx, pushHandler, limiter, manifests...); err != nil { - return err - } - - // Iterate in reverse order as seen, parent always uploaded after child - for i := len(indexStack) - 1; i >= 0; i-- { - err := images.Dispatch(ctx, pushHandler, limiter, indexStack[i]) - if err != nil { - // TODO(estesp): until we have a more complete method for index push, we need to report - // missing dependencies in an index/manifest list by sensing the "400 Bad Request" - // as a marker for this problem - if errors.Unwrap(err) != nil && strings.Contains(errors.Unwrap(err).Error(), "400 Bad Request") { - return fmt.Errorf("manifest list/index references to blobs and/or manifests are missing in your target registry: %w", err) - } - return err - } - } - - return nil -} - -// SkipNonDistributableBlobs returns a handler that skips blobs that have a media type that is "non-distributeable". -// An example of this kind of content would be a Windows base layer, which is not supposed to be redistributed. -// -// This is based on the media type of the content: -// - application/vnd.oci.image.layer.nondistributable -// - application/vnd.docker.image.rootfs.foreign -func SkipNonDistributableBlobs(f images.HandlerFunc) images.HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - if images.IsNonDistributable(desc.MediaType) { - log.G(ctx).WithField("digest", desc.Digest).WithField("mediatype", desc.MediaType).Debug("Skipping non-distributable blob") - return nil, images.ErrSkipDesc - } - - if images.IsLayerType(desc.MediaType) { - return nil, nil - } - - children, err := f(ctx, desc) - if err != nil { - return nil, err - } - if len(children) == 0 { - return nil, nil - } - - out := make([]ocispec.Descriptor, 0, len(children)) - for _, child := range children { - if !images.IsNonDistributable(child.MediaType) { - out = append(out, child) - } else { - log.G(ctx).WithField("digest", child.Digest).WithField("mediatype", child.MediaType).Debug("Skipping non-distributable blob") - } - } - return out, nil - } -} - -// FilterManifestByPlatformHandler allows Handler to handle non-target -// platform's manifest and configuration data. -func FilterManifestByPlatformHandler(f images.HandlerFunc, m platforms.Matcher) images.HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - children, err := f(ctx, desc) - if err != nil { - return nil, err - } - - // no platform information - if desc.Platform == nil || m == nil { - return children, nil - } - - var descs []ocispec.Descriptor - switch desc.MediaType { - case images.MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest: - if m.Match(*desc.Platform) { - descs = children - } else { - for _, child := range children { - if child.MediaType == images.MediaTypeDockerSchema2Config || - child.MediaType == ocispec.MediaTypeImageConfig { - - descs = append(descs, child) - } - } - } - default: - descs = children - } - return descs, nil - } -} - -// annotateDistributionSourceHandler add distribution source label into -// annotation of config or blob descriptor. -func annotateDistributionSourceHandler(f images.HandlerFunc, provider content.InfoProvider) images.HandlerFunc { - return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) { - children, err := f(ctx, desc) - if err != nil { - return nil, err - } - - // Distribution source is only used for config or blob but may be inherited from - // a manifest or manifest list - switch desc.MediaType { - case images.MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest, - images.MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex: - default: - return children, nil - } - - parentSourceAnnotations := desc.Annotations - var parentLabels map[string]string - if pi, err := provider.Info(ctx, desc.Digest); err != nil { - if !errdefs.IsNotFound(err) { - return nil, err - } - } else { - parentLabels = pi.Labels - } - - for i := range children { - child := children[i] - - info, err := provider.Info(ctx, child.Digest) - if err != nil { - if !errdefs.IsNotFound(err) { - return nil, err - } - } - copyDistributionSourceLabels(info.Labels, &child) - - // Annotate with parent labels for cross repo mount or fetch. - // Parent sources may apply to all children since most registries - // enforce that children exist before the manifests. - copyDistributionSourceLabels(parentSourceAnnotations, &child) - copyDistributionSourceLabels(parentLabels, &child) - - children[i] = child - } - return children, nil - } -} - -func copyDistributionSourceLabels(from map[string]string, to *ocispec.Descriptor) { - for k, v := range from { - if !strings.HasPrefix(k, labels.LabelDistributionSource+".") { - continue - } - - if to.Annotations == nil { - to.Annotations = make(map[string]string) - } else { - // Only propagate the parent label if the child doesn't already have it. - if _, has := to.Annotations[k]; has { - continue - } - } - to.Annotations[k] = v - } -} diff --git a/vendor/github.com/containerd/containerd/remotes/resolver.go b/vendor/github.com/containerd/containerd/remotes/resolver.go deleted file mode 100644 index f200c84bc7..0000000000 --- a/vendor/github.com/containerd/containerd/remotes/resolver.go +++ /dev/null @@ -1,94 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package remotes - -import ( - "context" - "io" - - "github.com/containerd/containerd/content" - "github.com/opencontainers/go-digest" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" -) - -// Resolver provides remotes based on a locator. -type Resolver interface { - // Resolve attempts to resolve the reference into a name and descriptor. - // - // The argument `ref` should be a scheme-less URI representing the remote. - // Structurally, it has a host and path. The "host" can be used to directly - // reference a specific host or be matched against a specific handler. - // - // The returned name should be used to identify the referenced entity. - // Depending on the remote namespace, this may be immutable or mutable. - // While the name may differ from ref, it should itself be a valid ref. - // - // If the resolution fails, an error will be returned. - Resolve(ctx context.Context, ref string) (name string, desc ocispec.Descriptor, err error) - - // Fetcher returns a new fetcher for the provided reference. - // All content fetched from the returned fetcher will be - // from the namespace referred to by ref. - Fetcher(ctx context.Context, ref string) (Fetcher, error) - - // Pusher returns a new pusher for the provided reference - // The returned Pusher should satisfy content.Ingester and concurrent attempts - // to push the same blob using the Ingester API should result in ErrUnavailable. - Pusher(ctx context.Context, ref string) (Pusher, error) -} - -// Fetcher fetches content. -// A fetcher implementation may implement the FetcherByDigest interface too. -type Fetcher interface { - // Fetch the resource identified by the descriptor. - Fetch(ctx context.Context, desc ocispec.Descriptor) (io.ReadCloser, error) -} - -// FetcherByDigest fetches content by the digest. -type FetcherByDigest interface { - // FetchByDigest fetches the resource identified by the digest. - // - // FetcherByDigest usually returns an incomplete descriptor. - // Typically, the media type is always set to "application/octet-stream", - // and the annotations are unset. - FetchByDigest(ctx context.Context, dgst digest.Digest) (io.ReadCloser, ocispec.Descriptor, error) -} - -// Pusher pushes content -type Pusher interface { - // Push returns a content writer for the given resource identified - // by the descriptor. - Push(ctx context.Context, d ocispec.Descriptor) (content.Writer, error) -} - -// FetcherFunc allows package users to implement a Fetcher with just a -// function. -type FetcherFunc func(ctx context.Context, desc ocispec.Descriptor) (io.ReadCloser, error) - -// Fetch content -func (fn FetcherFunc) Fetch(ctx context.Context, desc ocispec.Descriptor) (io.ReadCloser, error) { - return fn(ctx, desc) -} - -// PusherFunc allows package users to implement a Pusher with just a -// function. -type PusherFunc func(ctx context.Context, desc ocispec.Descriptor) (content.Writer, error) - -// Push content -func (fn PusherFunc) Push(ctx context.Context, desc ocispec.Descriptor) (content.Writer, error) { - return fn(ctx, desc) -} diff --git a/vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md b/vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md index 6d016d05c0..f8fbb6b62f 100644 --- a/vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md +++ b/vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md @@ -6,6 +6,17 @@ and this project adheres to [Semantic Versioning](http://semver.org/). ## [Unreleased] ## +## [0.7.0] - 2025-06-17 ## + +> You talk of times of peace for all, and then prepare for war. + +### Changed ### +- Update to `cyphar.com/go-pathrs@0.2.5`, which included a build-time API + breakage that we needed to work around. The API of this library is unchanged + by this, but users should make sure to update to `v0.7.0` of + `filepath-securejoin` if they use the `libpathrs` built tag and have update + to `libpathrs` `v0.2.5`. + ## [0.6.1] - 2025-11-19 ## > At last up jumped the cunning spider, and fiercely held her fast. diff --git a/vendor/github.com/cyphar/filepath-securejoin/VERSION b/vendor/github.com/cyphar/filepath-securejoin/VERSION index ee6cdce3c2..faef31a435 100644 --- a/vendor/github.com/cyphar/filepath-securejoin/VERSION +++ b/vendor/github.com/cyphar/filepath-securejoin/VERSION @@ -1 +1 @@ -0.6.1 +0.7.0 diff --git a/vendor/github.com/fairwindsops/pluto/v5/Dockerfile b/vendor/github.com/fairwindsops/pluto/v5/Dockerfile index 01e18e04e9..0469e5f1a0 100644 --- a/vendor/github.com/fairwindsops/pluto/v5/Dockerfile +++ b/vendor/github.com/fairwindsops/pluto/v5/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23.4 +FROM alpine:3.24.1 LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \ org.opencontainers.image.vendor="FairwindsOps, Inc." \ diff --git a/vendor/github.com/fairwindsops/pluto/v5/renovate.json b/vendor/github.com/fairwindsops/pluto/v5/renovate.json new file mode 100644 index 0000000000..bd532ff426 --- /dev/null +++ b/vendor/github.com/fairwindsops/pluto/v5/renovate.json @@ -0,0 +1,97 @@ +// DO NOT EDIT - Managed by Terraform +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended", + ":dependencyDashboard" + ], + "labels": ["dependencies"], + "prConcurrentLimit": 10, + "branchConcurrentLimit": 10, + "minimumReleaseAge": "7 days", + "enabledManagers": [ + "gomod", + "dockerfile", + "circleci", + "custom.regex" + ], + "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"], + "customManagers": [ + { + "description": "HashiCorp Vault download URL in CircleCI", + "customType": "regex", + "managerFilePatterns": ["/(^|/)\\.circleci/config\\.yml$/"], + "matchStrings": [ + "https://releases\\.hashicorp\\.com/vault/(?[\\d.]+)/vault_[\\d.]+_linux_amd64\\.zip" + ], + "depNameTemplate": "hashicorp/vault", + "datasourceTemplate": "hashicorp-releases", + "autoReplaceStringTemplate": "https://releases.hashicorp.com/vault/{{{newValue}}}/vault_{{{newValue}}}_linux_amd64.zip" + }, + { + "description": "HashiCorp Vault archive name in CircleCI (sha256 line must be updated manually)", + "customType": "regex", + "managerFilePatterns": ["/(^|/)\\.circleci/config\\.yml$/"], + "matchStrings": [ + "vault_(?[\\d.]+)_linux_amd64\\.zip" + ], + "depNameTemplate": "hashicorp/vault", + "datasourceTemplate": "hashicorp-releases", + "autoReplaceStringTemplate": "vault_{{{newValue}}}_linux_amd64.zip" + }, + { + "description": "golangci-lint install.sh pin in CircleCI", + "customType": "regex", + "managerFilePatterns": ["/(^|/)\\.circleci/config\\.yml$/"], + "matchStrings": [ + "golangci/golangci-lint/HEAD/install.sh \\| sh -s -- -b /usr/local/bin v(?[0-9.]+)" + ], + "depNameTemplate": "golangci/golangci-lint", + "datasourceTemplate": "github-releases", + "extractVersionTemplate": "^v?(?.*)$", + "autoReplaceStringTemplate": "golangci/golangci-lint/HEAD/install.sh | sh -s -- -b /usr/local/bin v{{{newValue}}}" + }, + { + "description": "Kind node image for rok8s-scripts kubernetes_e2e_tests", + "customType": "regex", + "managerFilePatterns": ["/(^|/)\\.circleci/config\\.yml$/"], + "matchStrings": [ + "kind_node_image:\\s*\"kindest/node:(?v[^\"\\s]+)\"" + ], + "depNameTemplate": "kindest/node", + "datasourceTemplate": "docker", + "autoReplaceStringTemplate": "kind_node_image: \"kindest/node:{{{newValue}}}\"" + } + ], + "packageRules": [ + { + "description": "Group all non-major (minor + patch) updates into a single PR", + "matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"], + "groupName": "all non-major dependencies", + "groupSlug": "all-non-major", + "minimumReleaseAge": "7 days" + }, + { + "description": "Keep major updates separate and also enforce minimum age", + "matchUpdateTypes": ["major"], + "minimumReleaseAge": "7 days" + }, + { + "description": "Disable replace updates", + "matchManagers": ["gomod"], + "matchDepTypes": ["replace"], + "enabled": false + }, + { + "description": "Every upgrade: upstream release must be at least 7 days old", + "matchManagers": ["gomod", "dockerfile", "circleci", "custom.regex"], + "minimumReleaseAge": "7 days" + }, + { + "description": "Group HashiCorp Vault version bumps (sha256 checksum still needs manual update)", + "groupName": "HashiCorp Vault", + "matchManagers": ["custom.regex"], + "matchDepNames": ["hashicorp/vault"] + } + ] +} diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal/transform/log.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal/transform/log.go index 7bb3967f7f..81c05e6e83 100644 --- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal/transform/log.go +++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal/transform/log.go @@ -201,6 +201,7 @@ func AttrValue(v attribute.Value) *cpb.AnyValue { Values: stringSliceValues(v.AsStringSlice()), }, } + case attribute.EMPTY: default: av.Value = &cpb.AnyValue_StringValue{ StringValue: "INVALID", @@ -327,6 +328,7 @@ func LogAttrValue(v api.Value) *cpb.AnyValue { Values: LogAttrs(v.AsMap()), }, } + case api.KindEmpty: default: av.Value = &cpb.AnyValue_StringValue{ StringValue: "INVALID", diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal/version.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal/version.go index 3cb604f167..96b9022bdc 100644 --- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal/version.go +++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal/version.go @@ -5,4 +5,4 @@ package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlp // Version is the current release version of the OpenTelemetry otlploggrpc // exporter in use. -const Version = "0.18.0" +const Version = "0.19.0" diff --git a/vendor/go.opentelemetry.io/otel/exporters/stdout/stdouttrace/internal/version.go b/vendor/go.opentelemetry.io/otel/exporters/stdout/stdouttrace/internal/version.go index c8c7e46c36..78e618c47f 100644 --- a/vendor/go.opentelemetry.io/otel/exporters/stdout/stdouttrace/internal/version.go +++ b/vendor/go.opentelemetry.io/otel/exporters/stdout/stdouttrace/internal/version.go @@ -5,4 +5,4 @@ package internal // import "go.opentelemetry.io/otel/exporters/stdout/stdouttrac // Version is the current release version of the OpenTelemetry stdouttrace // exporter in use. -const Version = "1.42.0" +const Version = "1.43.0" diff --git a/vendor/helm.sh/helm/v3/internal/version/version.go b/vendor/helm.sh/helm/v3/internal/version/version.go index c704a01491..99f64e1fee 100644 --- a/vendor/helm.sh/helm/v3/internal/version/version.go +++ b/vendor/helm.sh/helm/v3/internal/version/version.go @@ -29,7 +29,7 @@ var ( // // Increment major number for new feature additions and behavioral changes. // Increment minor number for bug fixes and performance enhancements. - version = "v3.20" + version = "v3.21" // metadata is extra build time data metadata = "" diff --git a/vendor/helm.sh/helm/v3/pkg/action/install.go b/vendor/helm.sh/helm/v3/pkg/action/install.go index f8f7400054..8ae84a6991 100644 --- a/vendor/helm.sh/helm/v3/pkg/action/install.go +++ b/vendor/helm.sh/helm/v3/pkg/action/install.go @@ -186,32 +186,34 @@ func (i *Install) installCRDs(crds []chart.CRD) error { return err } - // If we have already gathered the capabilities, we need to invalidate - // the cache so that the new CRDs are recognized. This should only be - // the case when an action configuration is reused for multiple actions, - // as otherwise it is later loaded by ourselves when getCapabilities - // is called later on in the installation process. - if i.cfg.Capabilities != nil { - discoveryClient, err := i.cfg.RESTClientGetter.ToDiscoveryClient() + if i.cfg.RESTClientGetter != nil { + // If we have already gathered the capabilities, we need to invalidate + // the cache so that the new CRDs are recognized. This should only be + // the case when an action configuration is reused for multiple actions, + // as otherwise it is later loaded by ourselves when getCapabilities + // is called later on in the installation process. + if i.cfg.Capabilities != nil { + discoveryClient, err := i.cfg.RESTClientGetter.ToDiscoveryClient() + if err != nil { + return err + } + if discoveryClient != nil { + i.cfg.Log("Clearing discovery cache") + discoveryClient.Invalidate() + _, _ = discoveryClient.ServerGroups() + } + } + + // Invalidate the REST mapper, since it will not have the new CRDs + // present. + restMapper, err := i.cfg.RESTClientGetter.ToRESTMapper() if err != nil { return err } - - i.cfg.Log("Clearing discovery cache") - discoveryClient.Invalidate() - - _, _ = discoveryClient.ServerGroups() - } - - // Invalidate the REST mapper, since it will not have the new CRDs - // present. - restMapper, err := i.cfg.RESTClientGetter.ToRESTMapper() - if err != nil { - return err - } - if resettable, ok := restMapper.(meta.ResettableRESTMapper); ok { - i.cfg.Log("Clearing REST mapper cache") - resettable.Reset() + if resettable, ok := restMapper.(meta.ResettableRESTMapper); ok { + i.cfg.Log("Clearing REST mapper cache") + resettable.Reset() + } } } return nil diff --git a/vendor/helm.sh/helm/v3/pkg/chartutil/jsonschema.go b/vendor/helm.sh/helm/v3/pkg/chartutil/jsonschema.go index 632e6dfd19..3718cf37ad 100644 --- a/vendor/helm.sh/helm/v3/pkg/chartutil/jsonschema.go +++ b/vendor/helm.sh/helm/v3/pkg/chartutil/jsonschema.go @@ -78,7 +78,7 @@ func ValidateAgainstSchema(chrt *chart.Chart, values map[string]interface{}) err err := ValidateAgainstSingleSchema(values, chrt.Schema) if err != nil { - sb.WriteString(fmt.Sprintf("%s:\n", chrt.Name())) + fmt.Fprintf(&sb, "%s:\n", chrt.Name()) sb.WriteString(err.Error()) } } @@ -92,10 +92,10 @@ func ValidateAgainstSchema(chrt *chart.Chart, values map[string]interface{}) err subchartValues, ok := raw.(map[string]any) if !ok { - sb.WriteString(fmt.Sprintf( + fmt.Fprintf(&sb, "%s:\ninvalid type for values: expected object (map), got %T\n", subchart.Name(), raw, - )) + ) continue } if err := ValidateAgainstSchema(subchart, subchartValues); err != nil { diff --git a/vendor/helm.sh/helm/v3/pkg/lint/rules/template.go b/vendor/helm.sh/helm/v3/pkg/lint/rules/template.go index 41d1a1bab2..4ed4e08262 100644 --- a/vendor/helm.sh/helm/v3/pkg/lint/rules/template.go +++ b/vendor/helm.sh/helm/v3/pkg/lint/rules/template.go @@ -28,8 +28,8 @@ import ( "strings" "github.com/pkg/errors" + "k8s.io/apimachinery/pkg/api/validate/content" "k8s.io/apimachinery/pkg/api/validation" - apipath "k8s.io/apimachinery/pkg/api/validation/path" "k8s.io/apimachinery/pkg/util/validation/field" "k8s.io/apimachinery/pkg/util/yaml" @@ -284,7 +284,7 @@ func validateMetadataNameFunc(obj *K8sYamlStruct) validation.ValidateNameFunc { case "role", "clusterrole", "rolebinding", "clusterrolebinding": // https://github.com/kubernetes/kubernetes/blob/v1.20.0/pkg/apis/rbac/validation/validation.go#L32-L34 return func(name string, _ bool) []string { - return apipath.IsValidPathSegmentName(name) + return content.IsPathSegmentName(name) } default: return validation.NameIsDNSSubdomain diff --git a/vendor/helm.sh/helm/v3/pkg/registry/client.go b/vendor/helm.sh/helm/v3/pkg/registry/client.go index b14b767b20..57fb3ef786 100644 --- a/vendor/helm.sh/helm/v3/pkg/registry/client.go +++ b/vendor/helm.sh/helm/v3/pkg/registry/client.go @@ -31,7 +31,6 @@ import ( "sync" "github.com/Masterminds/semver/v3" - "github.com/containerd/containerd/remotes" "github.com/opencontainers/image-spec/specs-go" ocispec "github.com/opencontainers/image-spec/specs-go/v1" "github.com/pkg/errors" @@ -56,7 +55,7 @@ storing semantic versions, Helm adopts the convention of changing plus (+) to an underscore (_) in chart version tags when pushing to a registry and back to a plus (+) when pulling from a registry.` -var errDeprecatedRemote = errors.New("providing github.com/containerd/containerd/remotes.Resolver via ClientOptResolver is no longer suported") +var errDeprecatedRemote = errors.New("providing github.com/containerd/containerd/remotes.Resolver via ClientOptResolver is no longer supported") type ( // RemoteClient shadows the ORAS remote.Client interface @@ -237,7 +236,7 @@ func ClientOptPlainHTTP() ClientOption { } } -func ClientOptResolver(_ remotes.Resolver) ClientOption { +func ClientOptResolver(_ any) ClientOption { return func(c *Client) { c.err = errDeprecatedRemote } @@ -296,15 +295,22 @@ func (c *Client) Login(host string, options ...LoginOption) error { } reg.PlainHTTP = c.plainHTTP cred := auth.Credential{Username: c.username, Password: c.password} - c.authorizer.ForceAttemptOAuth2 = true reg.Client = c.authorizer ctx := context.Background() - if err := reg.Ping(ctx); err != nil { - c.authorizer.ForceAttemptOAuth2 = false - if err := reg.Ping(ctx); err != nil { - return fmt.Errorf("authenticating to %q: %w", host, err) - } + err = c.ping(ctx, reg) + if err != nil && !reg.PlainHTTP && c.forcedHTTP() { + // The registry is plain HTTP: the fallback transport downgraded the + // connection from https to http. ORAS v2.6.1+ refuses to forward + // credentials across that implicit scheme change (GHSA-vh4v-2xq2-g5cg), + // so the credentialed ping above fails. Now that the fallback has been + // detected, set PlainHTTP explicitly and retry so requests are built as + // http from the start and the scheme no longer changes mid-request. + reg.PlainHTTP = true + err = c.ping(ctx, reg) + } + if err != nil { + return fmt.Errorf("authenticating to %q: %w", host, err) } // The credentialsStore loader does not handle empty files. So, there is a workaround. @@ -341,6 +347,30 @@ func (c *Client) Login(host string, options ...LoginOption) error { return nil } +// ping authenticates against the registry, first attempting the OAuth2 token +// flow and falling back to the basic/refresh token flow on failure. +func (c *Client) ping(ctx context.Context, reg *remote.Registry) error { + c.authorizer.ForceAttemptOAuth2 = true + err := reg.Ping(ctx) + if err != nil { + c.authorizer.ForceAttemptOAuth2 = false + err = reg.Ping(ctx) + } + return err +} + +// forcedHTTP reports whether the client's transport has fallen back to plain +// HTTP after a failed HTTPS attempt, indicating the registry is plain HTTP. +func (c *Client) forcedHTTP() bool { + if c.httpClient == nil { + return false + } + if ft, ok := c.httpClient.Transport.(*fallbackTransport); ok { + return ft.forcedHTTP() + } + return false +} + // LoginOptBasicAuth returns a function that sets the username/password settings on login func LoginOptBasicAuth(username string, password string) LoginOption { return func(o *loginOperation) { diff --git a/vendor/helm.sh/helm/v3/pkg/registry/fallback.go b/vendor/helm.sh/helm/v3/pkg/registry/fallback.go index 1db7295764..a5ca6f72c0 100644 --- a/vendor/helm.sh/helm/v3/pkg/registry/fallback.go +++ b/vendor/helm.sh/helm/v3/pkg/registry/fallback.go @@ -38,6 +38,14 @@ func newTransport(debug bool) *fallbackTransport { } } +// forcedHTTP reports whether the transport has fallen back to plain HTTP after +// a failed HTTPS attempt. Once this is true, the registry is known to be plain +// HTTP and callers should set PlainHTTP so requests are built as http from the +// start (see Client.Login). +func (t *fallbackTransport) forcedHTTP() bool { + return t.forceHTTP.Load() +} + // RoundTrip wraps base round trip with conditional insecure retry. func (t *fallbackTransport) RoundTrip(req *http.Request) (*http.Response, error) { if ok := t.forceHTTP.Load(); ok { diff --git a/vendor/k8s.io/apimachinery/pkg/api/validation/path/name.go b/vendor/k8s.io/apimachinery/pkg/api/validation/path/name.go deleted file mode 100644 index c0dee8108a..0000000000 --- a/vendor/k8s.io/apimachinery/pkg/api/validation/path/name.go +++ /dev/null @@ -1,42 +0,0 @@ -/* -Copyright 2015 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package path - -import ( - "k8s.io/apimachinery/pkg/api/validate/content" -) - -// IsValidPathSegmentName validates the name can be safely encoded as a path segment -// -// Deprecated: use content.IsPathSegmentName directly. -var IsValidPathSegmentName = content.IsPathSegmentName - -// IsValidPathSegmentPrefix validates the name can be used as a prefix for a name which will be encoded as a path segment -// It does not check for exact matches with disallowed names, since an arbitrary suffix might make the name valid -// -// Deprecated: use content.IsPathSegmentPrefix directly. -var IsValidPathSegmentPrefix = content.IsPathSegmentPrefix - -// ValidatePathSegmentName validates the name can be safely encoded as a path segment -// -// Deprecated: use a locally defined function. -func ValidatePathSegmentName(name string, prefix bool) []string { - if prefix { - return IsValidPathSegmentPrefix(name) - } - return IsValidPathSegmentName(name) -} diff --git a/vendor/modules.txt b/vendor/modules.txt index cda4b9d662..1db89dff86 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1111,16 +1111,6 @@ github.com/containerd/cgroups/v3/cgroup1/stats # github.com/containerd/console v1.0.5 ## explicit; go 1.13 github.com/containerd/console -# github.com/containerd/containerd v1.7.32 -## explicit; go 1.24.0 -github.com/containerd/containerd/archive/compression -github.com/containerd/containerd/content -github.com/containerd/containerd/errdefs -github.com/containerd/containerd/filters -github.com/containerd/containerd/images -github.com/containerd/containerd/labels -github.com/containerd/containerd/pkg/randutil -github.com/containerd/containerd/remotes # github.com/containerd/containerd/api v1.11.1 ## explicit; go 1.24.0 github.com/containerd/containerd/api/runtime/sandbox/v1 @@ -1251,7 +1241,7 @@ github.com/cpuguy83/go-md2man/v2/md2man # github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 ## explicit github.com/cyberphone/json-canonicalization/go/src/webpki.org/jsoncanonicalizer -# github.com/cyphar/filepath-securejoin v0.6.1 +# github.com/cyphar/filepath-securejoin v0.7.0 ## explicit; go 1.18 github.com/cyphar/filepath-securejoin github.com/cyphar/filepath-securejoin/internal/consts @@ -1543,7 +1533,7 @@ github.com/extism/go-sdk # github.com/facebookincubator/nvdtools v0.1.5 ## explicit; go 1.14 github.com/facebookincubator/nvdtools/wfn -# github.com/fairwindsops/pluto/v5 v5.24.1 +# github.com/fairwindsops/pluto/v5 v5.24.3 ## explicit; go 1.26.2 github.com/fairwindsops/pluto/v5 github.com/fairwindsops/pluto/v5/pkg/api @@ -3337,7 +3327,7 @@ go.opentelemetry.io/otel/semconv/v1.40.0/otelconv go.opentelemetry.io/otel/semconv/v1.40.0/rpcconv go.opentelemetry.io/otel/semconv/v1.41.0 go.opentelemetry.io/otel/semconv/v1.41.0/otelconv -# go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 +# go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 ## explicit; go 1.25.0 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc/internal @@ -3400,7 +3390,7 @@ go.opentelemetry.io/otel/exporters/prometheus/internal go.opentelemetry.io/otel/exporters/prometheus/internal/counter go.opentelemetry.io/otel/exporters/prometheus/internal/observ go.opentelemetry.io/otel/exporters/prometheus/internal/x -# go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0 +# go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 ## explicit; go 1.25.0 go.opentelemetry.io/otel/exporters/stdout/stdoutlog # go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 @@ -3410,7 +3400,7 @@ go.opentelemetry.io/otel/exporters/stdout/stdoutmetric/internal go.opentelemetry.io/otel/exporters/stdout/stdoutmetric/internal/counter go.opentelemetry.io/otel/exporters/stdout/stdoutmetric/internal/observ go.opentelemetry.io/otel/exporters/stdout/stdoutmetric/internal/x -# go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 +# go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 ## explicit; go 1.25.0 go.opentelemetry.io/otel/exporters/stdout/stdouttrace go.opentelemetry.io/otel/exporters/stdout/stdouttrace/internal @@ -3997,8 +3987,8 @@ gorm.io/gorm/logger gorm.io/gorm/migrator gorm.io/gorm/schema gorm.io/gorm/utils -# helm.sh/helm/v3 v3.20.2 -## explicit; go 1.25.0 +# helm.sh/helm/v3 v3.21.3 +## explicit; go 1.26.0 helm.sh/helm/v3/internal/fileutil helm.sh/helm/v3/internal/resolver helm.sh/helm/v3/internal/sympath @@ -4164,7 +4154,7 @@ k8s.io/api/storage/v1 k8s.io/api/storage/v1alpha1 k8s.io/api/storage/v1beta1 k8s.io/api/storagemigration/v1beta1 -# k8s.io/apiextensions-apiserver v0.36.1 +# k8s.io/apiextensions-apiserver v0.36.2 ## explicit; go 1.26.0 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1 @@ -4182,7 +4172,6 @@ k8s.io/apimachinery/pkg/api/validate k8s.io/apimachinery/pkg/api/validate/constraints k8s.io/apimachinery/pkg/api/validate/content k8s.io/apimachinery/pkg/api/validation -k8s.io/apimachinery/pkg/api/validation/path k8s.io/apimachinery/pkg/apis/meta/internalversion k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme k8s.io/apimachinery/pkg/apis/meta/internalversion/validation @@ -4240,7 +4229,7 @@ k8s.io/apimachinery/pkg/watch k8s.io/apimachinery/third_party/forked/golang/json k8s.io/apimachinery/third_party/forked/golang/netutil k8s.io/apimachinery/third_party/forked/golang/reflect -# k8s.io/apiserver v0.36.1 +# k8s.io/apiserver v0.36.2 ## explicit; go 1.26.0 k8s.io/apiserver/pkg/endpoints/deprecation # k8s.io/cli-runtime v0.36.3