Merge pull request #2789 from TomSweeneyRedHat/dev/tsweeney/logrus-release-1.11

[release-1.11] CVE-2025-65637 Logrus

.cirrus.yml

@@ -20,8 +20,13 @@ env:
     # Save a little typing (path relative to $CIRRUS_WORKING_DIR)
     SCRIPT_BASE: "./contrib/cirrus"
 
+    ####
+    #### Cache-image names to test with (double-quotes around names are critical)
+    ####
+    FEDORA_NAME: "fedora-37"
+
     # Google-cloud VM Images
-    IMAGE_SUFFIX: "c20250422t130822z-f42f41d13"
+    IMAGE_SUFFIX: "c6300530360713216"
     FEDORA_CACHE_IMAGE_NAME: "fedora-${IMAGE_SUFFIX}"
 
     # Container FQIN's
@@ -47,9 +52,7 @@ validate_task:
         image: '${SKOPEO_CIDEV_CONTAINER_FQIN}'
         cpu: 4
         memory: 8
-    setup_script: |
-        make tools
-    test_script: |
+    script: |
         make validate-local
         make vendor && hack/tree_status.sh
 
@@ -62,58 +65,47 @@ doccheck_task:
         cpu: 4
         memory: 8
     env:
-        BUILDTAGS: &withopengpg 'containers_image_openpgp'
+        BUILDTAGS: &withopengpg 'btrfs_noversion libdm_no_deferred_remove containers_image_openpgp'
     script: |
       # TODO: Can't use 'runner.sh setup' inside container.  However,
       # removing the pre-installed package is the only necessary step
       # at the time of this comment.
-      dnf remove -y skopeo  # Guarantee non-interference
+      dnf erase -y skopeo  # Guarantee non-interference
       "${SKOPEO_PATH}/${SCRIPT_BASE}/runner.sh" build
       "${SKOPEO_PATH}/${SCRIPT_BASE}/runner.sh" doccheck
 
 osx_task:
-    # Don't run for docs-only builds.
+    # Don't run for docs-only or multi-arch image builds.
     # Also don't run on release-branches or their PRs,
     # since base container-image is not version-constrained.
     only_if: &not_docs_or_release_branch >-
         ($CIRRUS_BASE_BRANCH == $CIRRUS_DEFAULT_BRANCH ||
          $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH ) &&
-        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'
+        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*' &&
+        $CIRRUS_CRON != 'multiarch'
     depends_on:
         - validate
-    persistent_worker: &mac_pw
-        labels:
-            os: darwin
-            arch: arm64
-            purpose: prod
-    env:
-        CIRRUS_WORKING_DIR: "$HOME/ci/task-${CIRRUS_TASK_ID}"
-        # Prevent cache-pollution fron one task to the next.
-        GOPATH: "$CIRRUS_WORKING_DIR/.go"
-        GOCACHE: "$CIRRUS_WORKING_DIR/.go/cache"
-        GOENV: "$CIRRUS_WORKING_DIR/.go/support"
-        GOSRC: "$HOME/ci/task-${CIRRUS_TASK_ID}"
-        TMPDIR: "/private/tmp/ci"
-    # This host is/was shared with potentially many other CI tasks.
-    # The previous task may have been canceled or aborted.
-    prep_script: &mac_cleanup "contrib/cirrus/mac_cleanup.sh"
-    test_script:
-        - export PATH=$GOPATH/bin:$PATH
-        - go version
-        - go env
-        - make tools
-        - make validate-local test-unit-local bin/skopeo
-        - bin/skopeo -v
-    # This host is/was shared with potentially many other CI tasks.
-    # Ensure nothing is left running while waiting for the next task.
-    always:
-        task_cleanup_script: *mac_cleanup
+    macos_instance:
+        image: ghcr.io/cirruslabs/macos-ventura-base:latest
+    setup_script: |
+        export PATH=$GOPATH/bin:$PATH
+        brew update
+        brew install gpgme go go-md2man
+        go install golang.org/x/lint/golint@latest
+    test_script: |
+        export PATH=$GOPATH/bin:$PATH
+        go version
+        go env
+        make validate-local test-unit-local bin/skopeo
+        sudo make install
+        /usr/local/bin/skopeo -v
 
 
 cross_task:
     alias: cross
     only_if: >-
-        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'
+        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*' &&
+        $CIRRUS_CRON != 'multiarch'
     depends_on:
         - validate
     gce_instance: &standardvm
@@ -151,7 +143,7 @@ ostree-rs-ext_task:
         dockerfile: contrib/cirrus/ostree_ext.dockerfile
         docker_arguments:  # required build-args
             BASE_FQIN: quay.io/coreos-assembler/fcos-buildroot:testing-devel
-            CIRRUS_IMAGE_VERSION: 3
+            CIRRUS_IMAGE_VERSION: 1
     env:
         EXT_REPO_NAME: ostree-rs-ext
         EXT_REPO_HOME: $CIRRUS_WORKING_DIR/../$EXT_REPO_NAME
@@ -176,10 +168,11 @@ ostree-rs-ext_task:
 #####
 test_skopeo_task:
     alias: test_skopeo
-    # Don't test for [CI:DOCS], [CI:BUILD].
+    # Don't test for [CI:DOCS], [CI:BUILD], or 'multiarch' cron.
     only_if: >-
         $CIRRUS_CHANGE_TITLE !=~ '.*CI:BUILD.*' &&
-        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'
+        $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*' &&
+        $CIRRUS_CRON != 'multiarch'
     depends_on:
         - validate
     gce_instance:
@@ -194,7 +187,7 @@ test_skopeo_task:
     matrix:
         - name: "Skopeo Test"  # N/B: Name ref. by hack/get_fqin.sh
           env:
-              BUILDTAGS: ''
+              BUILDTAGS: 'btrfs_noversion libdm_no_deferred_remove'
         - name: "Skopeo Test w/ opengpg"
           env:
               BUILDTAGS: *withopengpg
@@ -212,6 +205,49 @@ test_skopeo_task:
         "${SKOPEO_PATH}/${SCRIPT_BASE}/runner.sh" system
 
 
+image_build_task: &image-build
+    name: "Build multi-arch $CTXDIR"
+    alias: image_build
+    # Some of these container images take > 1h to build, limit
+    # this task to a specific Cirrus-Cron entry with this name.
+    only_if: $CIRRUS_CRON == 'multiarch'
+    timeout_in: 120m  # emulation is sssllllooooowwww
+    gce_instance:
+        <<: *standardvm
+        image_name: build-push-${IMAGE_SUFFIX}
+        # More muscle required for parallel multi-arch build
+        type: "n2-standard-4"
+    matrix:
+        - env:
+            CTXDIR: contrib/skopeoimage/upstream
+        - env:
+            CTXDIR: contrib/skopeoimage/testing
+        - env:
+            CTXDIR: contrib/skopeoimage/stable
+    env:
+        SKOPEO_USERNAME: ENCRYPTED[4195884d23b154553f2ddb26a63fc9fbca50ba77b3e447e4da685d8639ed9bc94b9a86a9c77272c8c80d32ead9ca48da]
+        SKOPEO_PASSWORD: ENCRYPTED[36e06f9befd17e5da2d60260edb9ef0d40e6312e2bba4cf881d383f1b8b5a18c8e5a553aea2fdebf39cebc6bd3b3f9de]
+        CONTAINERS_USERNAME: ENCRYPTED[dd722c734641f103b394a3a834d51ca5415347e378637cf98ee1f99e64aad2ec3dbd4664c0d94cb0e06b83d89e9bbe91]
+        CONTAINERS_PASSWORD: ENCRYPTED[d8b0fac87fe251cedd26c864ba800480f9e0570440b9eb264265b67411b253a626fb69d519e188e6c9a7f525860ddb26]
+    main_script:
+        - source /etc/automation_environment
+        - main.sh $CIRRUS_REPO_CLONE_URL $CTXDIR
+
+
+test_image_build_task:
+    <<: *image-build
+    alias: test_image_build
+    # Allow this to run inside a PR w/ [CI:BUILD] only.
+    only_if: $CIRRUS_PR != '' && $CIRRUS_CHANGE_TITLE =~ '.*CI:BUILD.*'
+    # This takes a LONG time, only run when requested.  N/B: Any task
+    # made to depend on this one will block FOREVER unless triggered.
+    # DO NOT ADD THIS TASK AS DEPENDENCY FOR `success_task`.
+    trigger_type: manual
+    # Overwrite all 'env', don't push anything, just do the build.
+    env:
+        DRYRUN: 1
+
+
 # This task is critical.  It updates the "last-used by" timestamp stored
 # in metadata for all VM images.  This mechanism functions in tandem with
 # an out-of-band pruning operation to remove disused VM images.
@@ -250,6 +286,7 @@ success_task:
         - cross
         - proxy_ostree_ext
         - test_skopeo
+        - image_build
         - meta
     container: *smallcontainer
     env:

.fmf/version

@@ -1 +0,0 @@
-1

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+- package-ecosystem: gomod
+  directory: "/"
+  schedule:
+    interval: daily
+    time: "10:00"
+    timezone: Europe/Berlin
+  open-pull-requests-limit: 10
+

.github/renovate.json5

@@ -49,4 +49,26 @@
   /*************************************************
    *** Repository-specific configuration options ***
    *************************************************/
+
+  // Don't leave dep. update. PRs "hanging", assign them to people.
+  "assignees": ["containers/image-maintainers"],  // same for skopeo
+
+  /*************************************************
+   ***** Golang-specific configuration options *****
+   *************************************************/
+
+  "golang": {
+    // N/B: LAST MATCHING RULE WINS
+    // https://docs.renovatebot.com/configuration-options/#packagerules
+    "packageRules": [
+      // Package version retraction (https://go.dev/ref/mod#go-mod-file-retract)
+      // is broken in Renovate
+      // ref: https://github.com/renovatebot/renovate/issues/13012
+      {
+        "matchPackageNames": ["github.com/containers/common"],
+        // Both v1.0.0 and v1.0.1 should be ignored.
+        "allowedVersions": "!/v((1.0.0)|(1.0.1))$/"
+      },
+    ],
+  },
 }

.github/workflows/check_cirrus_cron.yml

@@ -17,9 +17,4 @@ jobs:
   # Ref: https://docs.github.com/en/actions/using-workflows/reusing-workflows
   call_cron_failures:
     uses: containers/podman/.github/workflows/check_cirrus_cron.yml@main
-    secrets:
-      SECRET_CIRRUS_API_KEY: ${{secrets.SECRET_CIRRUS_API_KEY}}
-      ACTION_MAIL_SERVER: ${{secrets.ACTION_MAIL_SERVER}}
-      ACTION_MAIL_USERNAME: ${{secrets.ACTION_MAIL_USERNAME}}
-      ACTION_MAIL_PASSWORD: ${{secrets.ACTION_MAIL_PASSWORD}}
-      ACTION_MAIL_SENDER: ${{secrets.ACTION_MAIL_SENDER}}
+    secrets: inherit

.github/workflows/issue_pr_lock.yml

@@ -1,20 +0,0 @@
----
-
-# See also:
-# https://github.com/containers/podman/blob/main/.github/workflows/issue_pr_lock.yml
-
-on:
-  schedule:
-    - cron:  '0 0 * * *'
-  # Debug: Allow triggering job manually in github-actions WebUI
-  workflow_dispatch: {}
-
-jobs:
-  # Ref: https://docs.github.com/en/actions/using-workflows/reusing-workflows
-  closed_issue_discussion_lock:
-    uses: containers/podman/.github/workflows/issue_pr_lock.yml@main
-    secrets: inherit
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: write

.github/workflows/rerun_cirrus_cron.yml

@@ -0,0 +1,19 @@
+---
+
+# See also: https://github.com/containers/podman/blob/main/.github/workflows/rerun_cirrus_cron.yml
+
+on:
+  # Note: This only applies to the default branch.
+  schedule:
+    # N/B: This should correspond to a period slightly after
+    # the last job finishes running.  See job defs. at:
+    # https://cirrus-ci.com/settings/repository/6706677464432640
+    - cron:  '01 01 * * 1-5'
+  # Debug: Allow triggering job manually in github-actions WebUI
+  workflow_dispatch: {}
+
+jobs:
+  # Ref: https://docs.github.com/en/actions/using-workflows/reusing-workflows
+  call_cron_rerun:
+    uses: containers/podman/.github/workflows/rerun_cirrus_cron.yml@main
+    secrets: inherit

.github/workflows/stale.yml

@@ -17,7 +17,7 @@ jobs:
       pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v9
+    - uses: actions/stale@v7
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'A friendly reminder that this issue had no activity for 30 days.'

.golangci.yml

@@ -1,13 +0,0 @@
-version: "2"
-linters:
-  settings:
-    staticcheck:
-      checks:
-        # Compared to golangci-lint v2.0.2 defaults, we don’t exclude
-        # ST1003, ST1016, ST1020, ST1021, ST1022 as we don't hit those.
-        - all
-        - -ST1000 # Incorrect or missing package comment.
-        - -ST1005 # Incorrectly formatted error string.
-  exclusions:
-    presets:
-      - std-error-handling

.packit.yaml

@@ -1,149 +0,0 @@
----
-# See the documentation for more information:
-# https://packit.dev/docs/configuration/
-
-# NOTE: The Packit copr_build tasks help to check if every commit builds on
-# supported Fedora and CentOS Stream arches.
-# They do not block the current Cirrus-based workflow.
-
-downstream_package_name: skopeo
-upstream_tag_template: v{version}
-
-# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
-# propose-downstream job. This is done so tests maintained upstream can be run
-# downstream in Zuul CI and Bodhi.
-# Ref: https://packit.dev/docs/configuration#files_to_sync
-files_to_sync:
-  - src: rpm/gating.yaml
-    dest: gating.yaml
-    delete: true
-  - src: plans/
-    dest: plans/
-    delete: true
-    mkpath: true
-  - src: systemtest/tmt/
-    dest: test/tmt/
-    delete: true
-    mkpath: true
-  - src: .fmf/
-    dest: .fmf/
-    delete: true
-  - .packit.yaml
-
-packages:
-  skopeo-fedora:
-    pkg_tool: fedpkg
-    specfile_path: rpm/skopeo.spec
-  skopeo-centos:
-    pkg_tool: centpkg
-    specfile_path: rpm/skopeo.spec
-  skopeo-eln:
-    specfile_path: rpm/skopeo.spec
-
-srpm_build_deps:
-  - make
-
-jobs:
-  - job: copr_build
-    trigger: pull_request
-    packages: [skopeo-fedora]
-    notifications: &copr_build_failure_notification
-      failure_comment:
-        message: "Ephemeral COPR build failed. @containers/packit-build please check."
-    targets: &fedora_copr_targets
-      - fedora-all-x86_64
-      - fedora-all-aarch64
-    enable_net: true
-
-  # Ignore until golang is updated in distro buildroot to go 1.23.3+
-  - job: copr_build
-    trigger: ignore
-    packages: [skopeo-eln]
-    notifications: *copr_build_failure_notification
-    targets:
-      fedora-eln-x86_64:
-        additional_repos:
-          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/x86_64/"
-      fedora-eln-aarch64:
-        additional_repos:
-          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/"
-    enable_net: true
-
-  # Ignore until golang is updated in distro buildroot to go 1.23.3+
-  - job: copr_build
-    trigger: ignore
-    packages: [skopeo-centos]
-    notifications: *copr_build_failure_notification
-    targets: &centos_copr_targets
-      - centos-stream-9-x86_64
-      - centos-stream-9-aarch64
-      - centos-stream-10-x86_64
-      - centos-stream-10-aarch64
-    enable_net: true
-
-  # Run on commit to main branch
-  - job: copr_build
-    trigger: commit
-    packages: [skopeo-fedora]
-    notifications:
-      failure_comment:
-        message: "podman-next COPR build failed. @containers/packit-build please check."
-    branch: main
-    owner: rhcontainerbot
-    project: podman-next
-    enable_net: true
-
-  # Tests on Fedora for main branch
-  - job: tests
-    trigger: pull_request
-    packages: [skopeo-fedora]
-    notifications: &test_failure_notification
-      failure_comment:
-        message: "Tests failed. @containers/packit-build please check."
-    targets: *fedora_copr_targets
-    tf_extra_params:
-      environments:
-        - artifacts:
-          - type: repository-file
-            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
-
-  # Tests on CentOS Stream for main branch
-  # Ignore until golang is updated in distro buildroot to go 1.23.3+
-  - job: tests
-    trigger: ignore
-    packages: [skopeo-centos]
-    notifications: *test_failure_notification
-    targets: *centos_copr_targets
-    tf_extra_params:
-      environments:
-        - artifacts:
-          - type: repository-file
-            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo
-
-  # Sync to Fedora
-  - job: propose_downstream
-    trigger: release
-    packages: [skopeo-fedora]
-    update_release: false
-    dist_git_branches: &fedora_targets
-      - fedora-all
-
-  # Sync to CentOS Stream
-  - job: propose_downstream
-    trigger: release
-    packages: [skopeo-centos]
-    update_release: false
-    dist_git_branches:
-      - c10s
-
-  # Fedora Koji build
-  - job: koji_build
-    trigger: commit
-    packages: [skopeo-fedora]
-    sidetag_group: podman-releases
-    # Dependents are not rpm dependencies, but the package whose bodhi update
-    # should include this package.
-    # Ref: https://packit.dev/docs/fedora-releases-guide/releasing-multiple-packages
-    dependents:
-      - podman
-    dist_git_branches: *fedora_targets

CODE-OF-CONDUCT.md

@@ -1,3 +1,3 @@
 ## The skopeo Project Community Code of Conduct
 
-The skopeo project, as part of Podman Container Tools, follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).
+The skopeo project follows the [Containers Community Code of Conduct](https://github.com/containers/common/blob/main/CODE-OF-CONDUCT.md).

CONTRIBUTING.md

@@ -148,13 +148,9 @@ When new PRs for [containers/image](https://github.com/containers/image) break `
 
 ## Communications
 
-For general questions, or discussions, please use the
-[#podman](https://app.slack.com/client/T08PSQ7BQ/C08MXJLCFCN) channel on the [CNCF
-Slack](https://cloud-native.slack.com).
-
-For development related discussions, please use the
-[#podman-dev](https://app.slack.com/client/T08PSQ7BQ/C08NTKCDC1W) channel on the CNCF
-Slack.
+For general questions, or discussions, please use the 
+IRC channel on `irc.libera.chat` called `#container-projects`
+that has been setup.
 
 For discussions around issues/bugs and features, you can use the github
 [issues](https://github.com/containers/skopeo/issues)

GOVERNANCE.md

@@ -1,3 +0,0 @@
-## The Skopeo Project Community Governance
-
-The Skopeo project, as part of Podman Container Tools, follows the [Podman Project Governance](https://github.com/containers/podman/blob/main/GOVERNANCE.md).

MAINTAINERS.md

@@ -1,29 +0,0 @@
-# Skopeo Maintainers
-
-[GOVERNANCE.md](https://github.com/containers/podman/blob/main/GOVERNANCE.md)
-describes the project's governance and the Project Roles used below.
-
-## Maintainers
-
-| Maintainer        | GitHub ID                                                | Project Roles                    | Affiliation                                  |
-|-------------------|----------------------------------------------------------|----------------------------------|----------------------------------------------|
-| Brent Baude       | [baude](https://github.com/baude)                        | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
-| Nalin Dahyabhai   | [nalind](https://github.com/nalind)                      | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
-| Matthew Heon      | [mheon](https://github.com/mheon)                        | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
-| Paul Holzinger    | [Luap99](https://github.com/Luap99)                      | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
-| Giuseppe Scrivano | [giuseppe](https://github.com/giuseppe)                  | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
-| Miloslav Trmač    | [mtrmac](https://github.com/mtrmac)                      | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
-| Neil Smith        | [Neil-Smith](https://github.com/Neil-Smith)              | Community Manager                | [Red Hat](https://github.com/RedHatOfficial) |
-| Tom Sweeney       | [TomSweeneyRedHat](https://github.com/TomSweeneyRedHat/) | Maintainer and Community Manager | [Red Hat](https://github.com/RedHatOfficial) |
-| Lokesh Mandvekar  | [lsm5](https://github.com/lsm5)                          | Maintainer                       | [Red Hat](https://github.com/RedHatOfficial) |
-| Dan Walsh         | [rhatdan](https://github.com/rhatdan)                    | Maintainer                       | [Red Hat](https://github.com/RedHatOfficial) |
-| Ashley Cui        | [ashley-cui](https://github.com/ashley-cui)              | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
-| Valentin Rothberg | [vrothberg](https://github.com/vrothberg)                | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
-
-## Alumni
-
-None at present
-
-## Credits
-
-The structure of this document was based off of the equivalent one in the [CRI-O Project](https://github.com/cri-o/cri-o/blob/main/MAINTAINERS.md).

Makefile

@@ -24,11 +24,6 @@ GOBIN := $(shell $(GO) env GOBIN)
 GOOS ?= $(shell go env GOOS)
 GOARCH ?= $(shell go env GOARCH)
 
-# N/B: This value is managed by Renovate, manual changes are
-# possible, as long as they don't disturb the formatting
-# (i.e. DO NOT ADD A 'v' prefix!)
-GOLANGCI_LINT_VERSION := 2.1.6
-
 ifeq ($(GOBIN),)
 GOBIN := $(GOPATH)/bin
 endif
@@ -43,6 +38,13 @@ endif
 export CONTAINER_RUNTIME ?= $(if $(shell command -v podman ;),podman,docker)
 GOMD2MAN ?= $(if $(shell command -v go-md2man ;),go-md2man,$(GOBIN)/go-md2man)
 
+# Go module support: set `-mod=vendor` to use the vendored sources.
+# See also hack/make.sh.
+ifeq ($(shell go help mod >/dev/null 2>&1 && echo true), true)
+  GO:=GO111MODULE=on $(GO)
+  MOD_VENDOR=-mod=vendor
+endif
+
 ifeq ($(DEBUG), 1)
   override GOGCFLAGS += -N -l
 endif
@@ -54,11 +56,17 @@ ifeq ($(GOOS), linux)
 endif
 
 # If $TESTFLAGS is set, it is passed as extra arguments to 'go test'.
-# You can select certain tests to run, with `-run <regex>` for example:
+# You can increase test output verbosity with the option '-test.vv'.
+# You can select certain tests to run, with `-test.run <regex>` for example:
 #
-#     make test-unit TESTFLAGS='-run ^TestManifestDigest$'
-#     make test-integration TESTFLAGS='-run copySuite.TestCopy.*'
-export TESTFLAGS ?= -timeout=15m
+#     make test-unit TESTFLAGS='-test.run ^TestManifestDigest$'
+#
+# For integration test, we use [gocheck](https://labix.org/gocheck).
+# You can increase test output verbosity with the option '-check.vv'.
+# You can limit test selection with `-check.f <regex>`, for example:
+#
+#     make test-integration TESTFLAGS='-check.f CopySuite.TestCopy.*'
+export TESTFLAGS ?= -v -check.v -test.timeout=15m
 
 # This is assumed to be set non-empty when operating inside a CI/automation environment
 CI ?=
@@ -90,13 +98,14 @@ SKOPEO_LDFLAGS := -ldflags '-X main.gitCommit=${GIT_COMMIT} $(EXTRA_LDFLAGS)'
 MANPAGES_MD = $(wildcard docs/*.md)
 MANPAGES ?= $(MANPAGES_MD:%.md=%)
 
-BTRFS_BUILD_TAG = $(shell hack/btrfs_installed_tag.sh)
+BTRFS_BUILD_TAG = $(shell hack/btrfs_tag.sh) $(shell hack/btrfs_installed_tag.sh)
+LIBDM_BUILD_TAG = $(shell hack/libdm_tag.sh)
 LIBSUBID_BUILD_TAG = $(shell hack/libsubid_tag.sh)
-LOCAL_BUILD_TAGS = $(BTRFS_BUILD_TAG) $(LIBSUBID_BUILD_TAG)
+LOCAL_BUILD_TAGS = $(BTRFS_BUILD_TAG) $(LIBDM_BUILD_TAG) $(LIBSUBID_BUILD_TAG)
 BUILDTAGS += $(LOCAL_BUILD_TAGS)
 
 ifeq ($(DISABLE_CGO), 1)
-	override BUILDTAGS = exclude_graphdriver_btrfs containers_image_openpgp
+	override BUILDTAGS = exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp
 endif
 
 #   make all DEBUG=1
@@ -116,7 +125,6 @@ help:
 	@echo " * 'install' - Install binaries and documents to system locations"
 	@echo " * 'binary' - Build skopeo with a container"
 	@echo " * 'bin/skopeo' - Build skopeo locally"
-	@echo " * 'bin/skopeo.OS.ARCH' - Build skopeo for specific OS and ARCH"
 	@echo " * 'test-unit' - Execute unit tests"
 	@echo " * 'test-integration' - Execute integration tests"
 	@echo " * 'validate' - Verify whether there is no conflict and all Go source files have been formatted, linted and vetted"
@@ -131,9 +139,9 @@ binary: cmd/skopeo
 # Build w/o using containers
 .PHONY: bin/skopeo
 bin/skopeo:
-	$(GO) build ${GO_DYN_FLAGS} ${SKOPEO_LDFLAGS} -gcflags "$(GOGCFLAGS)" -tags "$(BUILDTAGS)" -o $@ ./cmd/skopeo
+	$(GO) build $(MOD_VENDOR) ${GO_DYN_FLAGS} ${SKOPEO_LDFLAGS} -gcflags "$(GOGCFLAGS)" -tags "$(BUILDTAGS)" -o $@ ./cmd/skopeo
 bin/skopeo.%:
-	GOOS=$(word 2,$(subst ., ,$@)) GOARCH=$(word 3,$(subst ., ,$@)) $(GO) build ${SKOPEO_LDFLAGS} -tags "containers_image_openpgp $(BUILDTAGS)" -o $@ ./cmd/skopeo
+	GOOS=$(word 2,$(subst ., ,$@)) GOARCH=$(word 3,$(subst ., ,$@)) $(GO) build $(MOD_VENDOR) ${SKOPEO_LDFLAGS} -tags "containers_image_openpgp $(BUILDTAGS)" -o $@ ./cmd/skopeo
 local-cross: bin/skopeo.darwin.amd64 bin/skopeo.linux.arm bin/skopeo.linux.arm64 bin/skopeo.windows.386.exe bin/skopeo.windows.amd64.exe
 
 $(MANPAGES): %: %.md
@@ -186,11 +194,6 @@ install-completions: completions
 shell:
 	$(CONTAINER_RUN) bash
 
-tools:
-	if [ ! -x "$(GOBIN)/golangci-lint" ]; then \
-		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v$(GOLANGCI_LINT_VERSION) ; \
-	fi
-
 check: validate test-unit test-integration test-system
 
 test-integration:
@@ -203,8 +206,7 @@ test-integration:
 
 # Intended for CI, assumed to be running in quay.io/libpod/skopeo_cidev container.
 test-integration-local: bin/skopeo
-	hack/warn-destructive-tests.sh
-	hack/test-integration.sh
+	hack/make.sh test-integration
 
 # complicated set of options needed to run podman-in-podman
 test-system:
@@ -220,8 +222,7 @@ test-system:
 
 # Intended for CI, assumed to already be running in quay.io/libpod/skopeo_cidev container.
 test-system-local: bin/skopeo
-	hack/warn-destructive-tests.sh
-	hack/test-system.sh
+	hack/make.sh test-system
 
 test-unit:
 	# Just call (make test unit-local) here instead of worrying about environment differences
@@ -235,26 +236,19 @@ test-all-local: validate-local validate-docs test-unit-local
 
 .PHONY: validate-local
 validate-local:
-	hack/validate-git-marks.sh
-	hack/validate-gofmt.sh
-	$(GOBIN)/golangci-lint run --build-tags "${BUILDTAGS}"
-	# An extra run with --tests=false allows detecting code unused outside of tests;
-	# ideally the linter should be able to find this automatically.
-	# Since everything is already cached, this additional run doesn't take much time.
-	$(GOBIN)/golangci-lint run --build-tags "${BUILDTAGS}" --tests=false
-	BUILDTAGS="${BUILDTAGS}" hack/validate-vet.sh
+	BUILDTAGS="${BUILDTAGS}" hack/make.sh validate-git-marks validate-gofmt validate-lint validate-vet
 
 # This invokes bin/skopeo, hence cannot be run as part of validate-local
 .PHONY: validate-docs
-validate-docs: bin/skopeo
+validate-docs:
 	hack/man-page-checker
 	hack/xref-helpmsgs-manpages
 
-test-unit-local:
-	$(GO) test -tags "$(BUILDTAGS)" $$($(GO) list -tags "$(BUILDTAGS)" -e ./... | grep -v '^github\.com/containers/skopeo/\(integration\|vendor/.*\)$$')
+test-unit-local: bin/skopeo
+	$(GO) test $(MOD_VENDOR) -tags "$(BUILDTAGS)" $$($(GO) list $(MOD_VENDOR) -tags "$(BUILDTAGS)" -e ./... | grep -v '^github\.com/containers/skopeo/\(integration\|vendor/.*\)$$')
 
 vendor:
-	$(GO) mod tidy
+	$(GO) mod tidy -compat=1.17
 	$(GO) mod vendor
 	$(GO) mod verify
 

OWNERS

@@ -1,22 +1,17 @@
 approvers:
-  - baude
-  - giuseppe
-  - lsm5
-  - Luap99
-  - mheon
   - mtrmac
-  - nalind
-  - rhatdan
+  - lsm5
   - TomSweeneyRedHat
+  - rhatdan
+  - vrothberg
 reviewers:
   - ashley-cui
-  - baude
   - giuseppe
+  - containers/image-maintainers
   - lsm5
-  - Luap99
-  - mheon
   - mtrmac
-  - nalind
+  - QiWang19
   - rhatdan
+  - runcom
   - TomSweeneyRedHat
   - vrothberg

README.md

@@ -1,12 +1,10 @@
-<p align="center">
-   <img src="https://cdn.rawgit.com/containers/skopeo/main/docs/skopeo.svg" width="250" alt="Skopeo">
-</p>
+<!--- skopeo [![Build Status](https://travis-ci.org/containers/skopeo.svg?branch=main)](https://travis-ci.org/containers/skopeo)
+=
+--->
+
+<img src="https://cdn.rawgit.com/containers/skopeo/main/docs/skopeo.svg" width="250">
 
 ----
-![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)
-![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/containers/skopeo)
-[![Go Report Card](https://goreportcard.com/badge/github.com/containers/skopeo)](https://goreportcard.com/report/github.com/containers/skopeo)
-[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10516/badge)](https://www.bestpractices.dev/projects/10516)
 
 `skopeo` is a command line utility that performs various operations on container images and image repositories.
 
@@ -45,14 +43,6 @@ Skopeo works with API V2 container image registries such as [docker.io](https://
  * oci:path:tag
          An image tag in a directory compliant with "Open Container Image Layout Specification" at path.
 
-[Obtaining skopeo](./install.md)
--
-
-For a detailed description how to install or build skopeo, see
-[install.md](./install.md).
-
-Skopeo is also available as a Container Image on [quay.io](https://quay.io/skopeo/stable).  For more information, see the [Skopeo Image](https://github.com/containers/image_build/blob/main/skopeo/README.md) page.
-
 ## Inspecting a repository
 `skopeo` is able to _inspect_ a repository on a container registry and fetch images layers.
 The _inspect_ command fetches the repository's manifest and it is able to show you a `docker inspect`-like
@@ -203,6 +193,12 @@ $ skopeo inspect --creds=testuser:testpassword docker://myregistrydomain.com:500
 $ skopeo copy --src-creds=testuser:testpassword docker://myregistrydomain.com:5000/private oci:local_oci_image
 ```
 
+[Obtaining skopeo](./install.md)
+-
+
+For a detailed description how to install or build skopeo, see
+[install.md](./install.md).
+
 Contributing
 -
 
@@ -219,8 +215,8 @@ Please read the [contribution guide](CONTRIBUTING.md) if you want to collaborate
 | [skopeo-login(1)](/docs/skopeo-login.1.md)         | Login to a container registry.                                                               |
 | [skopeo-logout(1)](/docs/skopeo-logout.1.md)       | Logout of a container registry.                                                              |
 | [skopeo-manifest-digest(1)](/docs/skopeo-manifest-digest.1.md)    | Compute a manifest digest for a manifest-file and write it to standard output.   |
-| [skopeo-standalone-sign(1)](/docs/skopeo-standalone-sign.1.md)    | Debugging tool - Sign an image locally without uploading.                     |
-| [skopeo-standalone-verify(1)](/docs/skopeo-standalone-verify.1.md)| Debugging tool - Verify an image signature from local files.                  |
+| [skopeo-standalone-sign(1)](/docs/skopeo-standalone-sign.1.md)    | Debugging tool - Publish and sign an image in one step.                                                         |
+| [skopeo-standalone-verify(1)](/docs/skopeo-standalone-verify.1.md)| Verify an image signature.                                                    |
 | [skopeo-sync(1)](/docs/skopeo-sync.1.md)           | Synchronize images between registry repositories and local directories.                      |
 
 License

ROADMAP.md

@@ -1,12 +0,0 @@
-# Skopeo Roadmap
-
-Skopeo intends to mostly continue to be a very thin CLI wrapper over the [https://github.com/containers/image](containers/image) library, with most features being added there, not to this repo. A typical new Skopeo feature would only add a CLI for a recent containers/image feature.
-
-## Future feature focus (most of the work must be done in the containers/image library)
-
-* OCI artifact support.
-* Integration of composefs.
-* Partial pull support (zstd:chunked).
-* Performance and stability improvements.
-* Reductions to the size of the Skopeo binary.
-* `skopeo sync` exists, and bugs in it should be fixed, but we don’t have much of an ambition to compete with much larger projects like [https://github.com/openshift/oc-mirror](oc-mirror).

cmd/skopeo/completions.go

@@ -1,59 +1,16 @@
 package main
 
 import (
-	"github.com/containers/image/v5/directory"
-	"github.com/containers/image/v5/docker"
-	dockerArchive "github.com/containers/image/v5/docker/archive"
-	ociArchive "github.com/containers/image/v5/oci/archive"
-	oci "github.com/containers/image/v5/oci/layout"
-	"github.com/containers/image/v5/sif"
-	"github.com/containers/image/v5/tarball"
 	"github.com/containers/image/v5/transports"
 	"github.com/spf13/cobra"
-	"strings"
 )
 
-func autocompleteImageNames(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
-	transport, details, haveTransport := strings.Cut(toComplete, ":")
-	if !haveTransport {
-		transports := supportedTransportSuggestions()
-		return transports, cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp
-	}
-	switch transport {
-	case ociArchive.Transport.Name(), dockerArchive.Transport.Name():
-		// Can have [:{*reference|@source-index}]
-		// FIXME: `oci-archive:/path/to/a.oci:<TAB>` completes paths
-		return nil, cobra.ShellCompDirectiveNoSpace
-	case sif.Transport.Name():
-		return nil, cobra.ShellCompDirectiveDefault
-
-	// Both directory and oci should have ShellCompDirectiveFilterDirs to complete only directories, but it doesn't currently work in bash: https://github.com/spf13/cobra/issues/2242
-	case oci.Transport.Name():
-		// Can have '[:{reference|@source-index}]'
-		// FIXME: `oci:/path/to/dir/:<TAB>` completes paths
-		return nil, cobra.ShellCompDirectiveDefault | cobra.ShellCompDirectiveNoSpace
-	case directory.Transport.Name():
-		return nil, cobra.ShellCompDirectiveDefault
-
-	case docker.Transport.Name():
-		if details == "" {
-			return []cobra.Completion{transport + "://"}, cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp
-		}
-	}
-	return nil, cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp
-}
-
-// supportedTransportSuggestions list all supported transports with the colon suffix.
-func supportedTransportSuggestions() []string {
+// autocompleteSupportedTransports list all supported transports with the colon suffix.
+func autocompleteSupportedTransports(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 	tps := transports.ListNames()
-	suggestions := make([]cobra.Completion, 0, len(tps))
+	suggestions := make([]string, 0, len(tps))
 	for _, tp := range tps {
-		// ListNames is generally expected to filter out deprecated transports.
-		// tarball: is not deprecated, but it is only usable from a Go caller (using tarball.ConfigUpdater),
-		// so don’t offer it on the CLI.
-		if tp != tarball.Transport.Name() {
-			suggestions = append(suggestions, tp+":")
-		}
+		suggestions = append(suggestions, tp+":")
 	}
-	return suggestions
+	return suggestions, cobra.ShellCompDirectiveNoFileComp
 }

cmd/skopeo/copy.go

@@ -44,7 +44,6 @@ type copyOptions struct {
 	encryptLayer             []int                     // The list of layers to encrypt
 	encryptionKeys           []string                  // Keys needed to encrypt the image
 	decryptionKeys           []string                  // Keys needed to decrypt the image
-	imageParallelCopies      uint                      // Maximum number of parallel requests when copying images
 }
 
 func copyCmd(global *globalOptions) *cobra.Command {
@@ -71,7 +70,7 @@ See skopeo(1) section "IMAGE NAMES" for the expected format
 `, strings.Join(transports.ListNames(), ", ")),
 		RunE:              commandAction(opts.run),
 		Example:           `skopeo copy docker://quay.io/skopeo/stable:latest docker://registry.example.com/skopeo:latest`,
-		ValidArgsFunction: autocompleteImageNames,
+		ValidArgsFunction: autocompleteSupportedTransports,
 	}
 	adjustUsage(cmd)
 	flags := cmd.Flags()
@@ -96,7 +95,6 @@ See skopeo(1) section "IMAGE NAMES" for the expected format
 	flags.StringSliceVar(&opts.encryptionKeys, "encryption-key", []string{}, "*Experimental* key with the encryption protocol to use needed to encrypt the image (e.g. jwe:/path/to/key.pem)")
 	flags.IntSliceVar(&opts.encryptLayer, "encrypt-layer", []int{}, "*Experimental* the 0-indexed layer indices, with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer)")
 	flags.StringSliceVar(&opts.decryptionKeys, "decryption-key", []string{}, "*Experimental* key needed to decrypt the image")
-	flags.UintVar(&opts.imageParallelCopies, "image-parallel-copies", 0, "Maximum number of image layers to be copied (pulled/pushed) simultaneously. Not setting this field will fall back to containers/image defaults.")
 	return cmd
 }
 
@@ -302,7 +300,6 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 			OciDecryptConfig:                 decConfig,
 			OciEncryptLayers:                 encLayers,
 			OciEncryptConfig:                 encConfig,
-			MaxParallelDownloads:             opts.imageParallelCopies,
 		})
 		if err != nil {
 			return err

cmd/skopeo/copy_test.go

@@ -1,18 +0,0 @@
-package main
-
-import "testing"
-
-func TestCopy(t *testing.T) {
-	// Invalid command-line arguments
-	for _, args := range [][]string{
-		{},
-		{"a1"},
-		{"a1", "a2", "a3"},
-	} {
-		out, err := runSkopeo(append([]string{"--insecure-policy", "copy"}, args...)...)
-		assertTestFailed(t, out, err, "Exactly two arguments expected")
-	}
-
-	// FIXME: Much more test coverage
-	// Actual feature tests exist in integration and systemtest
-}

cmd/skopeo/delete.go

@@ -37,7 +37,7 @@ See skopeo(1) section "IMAGE NAMES" for the expected format
 `, strings.Join(transports.ListNames(), ", ")),
 		RunE:              commandAction(opts.run),
 		Example:           `skopeo delete docker://registry.example.com/example/pause:latest`,
-		ValidArgsFunction: autocompleteImageNames,
+		ValidArgsFunction: autocompleteSupportedTransports,
 	}
 	adjustUsage(cmd)
 	flags := cmd.Flags()

cmd/skopeo/generate_sigstore_key_test.go

@@ -62,7 +62,7 @@ func TestGenerateSigstoreKey(t *testing.T) {
 	// we have to trigger a write failure.
 
 	// Success
-	// Just a smoke-test, usability of the keys is tested in the generate implementation.
+	// Just a smoke-test, useability of the keys is tested in the generate implementation.
 	dir := t.TempDir()
 	prefix := filepath.Join(dir, "prefix")
 	passphraseFile := filepath.Join(dir, "passphrase")

cmd/skopeo/inspect.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"text/tabwriter"
+	"text/template"
 
 	"github.com/containers/common/pkg/report"
 	"github.com/containers/common/pkg/retry"
@@ -51,9 +53,9 @@ See skopeo(1) section "IMAGE NAMES" for the expected format
 `, strings.Join(transports.ListNames(), ", ")),
 		RunE: commandAction(opts.run),
 		Example: `skopeo inspect docker://registry.fedoraproject.org/fedora
-skopeo inspect --config docker://docker.io/alpine
-skopeo inspect --format "Name: {{.Name}} Digest: {{.Digest}}" docker://registry.access.redhat.com/ubi8`,
-		ValidArgsFunction: autocompleteImageNames,
+  skopeo inspect --config docker://docker.io/alpine
+  skopeo inspect  --format "Name: {{.Name}} Digest: {{.Digest}}" docker://registry.access.redhat.com/ubi8`,
+		ValidArgsFunction: autocompleteSupportedTransports,
 	}
 	adjustUsage(cmd)
 	flags := cmd.Flags()
@@ -72,6 +74,7 @@ func (opts *inspectOptions) run(args []string, stdout io.Writer) (retErr error)
 		rawManifest []byte
 		src         types.ImageSource
 		imgInspect  *types.ImageInspectInfo
+		data        []interface{}
 	)
 	ctx, cancel := opts.global.commandTimeoutContext()
 	defer cancel()
@@ -106,9 +109,8 @@ func (opts *inspectOptions) run(args []string, stdout io.Writer) (retErr error)
 		}
 	}()
 
-	unparsedInstance := image.UnparsedInstance(src, nil)
 	if err := retry.IfNecessary(ctx, func() error {
-		rawManifest, _, err = unparsedInstance.Manifest(ctx)
+		rawManifest, _, err = src.GetManifest(ctx, nil)
 		return err
 	}, opts.retryOpts); err != nil {
 		return fmt.Errorf("Error retrieving manifest for image: %w", err)
@@ -123,7 +125,7 @@ func (opts *inspectOptions) run(args []string, stdout io.Writer) (retErr error)
 		return nil
 	}
 
-	img, err := image.FromUnparsedImage(ctx, sys, unparsedInstance)
+	img, err := image.FromUnparsedImage(ctx, sys, image.UnparsedInstance(src, nil))
 	if err != nil {
 		return fmt.Errorf("Error parsing manifest for image: %w", err)
 	}
@@ -149,7 +151,18 @@ func (opts *inspectOptions) run(args []string, stdout io.Writer) (retErr error)
 		}, opts.retryOpts); err != nil {
 			return fmt.Errorf("Error reading OCI-formatted configuration data: %w", err)
 		}
-		if err := opts.writeOutput(stdout, config); err != nil {
+		if report.IsJSON(opts.format) || opts.format == "" {
+			var out []byte
+			out, err = json.MarshalIndent(config, "", "    ")
+			if err == nil {
+				fmt.Fprintf(stdout, "%s\n", string(out))
+			}
+		} else {
+			row := "{{range . }}" + report.NormalizeFormat(opts.format) + "{{end}}"
+			data = append(data, config)
+			err = printTmpl(stdout, row, data)
+		}
+		if err != nil {
 			return fmt.Errorf("Error writing OCI-formatted configuration data to standard output: %w", err)
 		}
 		return nil
@@ -215,23 +228,23 @@ func (opts *inspectOptions) run(args []string, stdout io.Writer) (retErr error)
 			logrus.Warnf("Registry disallows tag list retrieval; skipping")
 		}
 	}
-	return opts.writeOutput(stdout, outputData)
-}
-
-// writeOutput writes data depending on opts.format to stdout
-func (opts *inspectOptions) writeOutput(stdout io.Writer, data any) error {
 	if report.IsJSON(opts.format) || opts.format == "" {
-		out, err := json.MarshalIndent(data, "", "    ")
+		out, err := json.MarshalIndent(outputData, "", "    ")
 		if err == nil {
 			fmt.Fprintf(stdout, "%s\n", string(out))
 		}
 		return err
 	}
+	row := "{{range . }}" + report.NormalizeFormat(opts.format) + "{{end}}"
+	data = append(data, outputData)
+	return printTmpl(stdout, row, data)
+}
 
-	rpt, err := report.New(stdout, "skopeo inspect").Parse(report.OriginUser, opts.format)
+func printTmpl(stdout io.Writer, row string, data []interface{}) error {
+	t, err := template.New("skopeo inspect").Parse(row)
 	if err != nil {
 		return err
 	}
-	defer rpt.Flush()
-	return rpt.Execute([]any{data})
+	w := tabwriter.NewWriter(stdout, 8, 2, 2, ' ', 0)
+	return t.Execute(w, data)
 }

cmd/skopeo/layers.go

@@ -151,22 +151,12 @@ func (opts *layersOptions) run(args []string, stdout io.Writer) (retErr error) {
 		}, opts.retryOpts); err != nil {
 			return err
 		}
-		defer func() {
-			if err := r.Close(); err != nil {
-				retErr = noteCloseFailure(retErr, fmt.Sprintf("closing blob %q", bd.digest.String()), err)
+		if _, err := dest.PutBlob(ctx, r, types.BlobInfo{Digest: bd.digest, Size: blobSize}, cache, bd.isConfig); err != nil {
+			if closeErr := r.Close(); closeErr != nil {
+				return fmt.Errorf("%w (close error: %v)", err, closeErr)
 			}
-		}()
-		verifier := bd.digest.Verifier()
-		tr := io.TeeReader(r, verifier)
-		if _, err := dest.PutBlob(ctx, tr, types.BlobInfo{Digest: bd.digest, Size: blobSize}, cache, bd.isConfig); err != nil {
 			return err
 		}
-		if _, err := io.Copy(io.Discard, tr); err != nil { // Ensure we process all of tr, so that we can validate the digest.
-			return err
-		}
-		if !verifier.Verified() {
-			return fmt.Errorf("corrupt blob %q", bd.digest.String())
-		}
 	}
 
 	var manifest []byte

cmd/skopeo/list_tags.go

@@ -6,8 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"maps"
-	"slices"
+	"sort"
 	"strings"
 
 	"github.com/containers/common/pkg/retry"
@@ -38,7 +37,11 @@ var transportHandlers = map[string]func(ctx context.Context, sys *types.SystemCo
 
 // supportedTransports returns all the supported transports
 func supportedTransports(joinStr string) string {
-	res := slices.Sorted(maps.Keys(transportHandlers))
+	res := make([]string, 0, len(transportHandlers))
+	for handlerName := range transportHandlers {
+		res = append(res, handlerName)
+	}
+	sort.Strings(res)
 	return strings.Join(res, joinStr)
 }
 
@@ -77,12 +80,16 @@ See skopeo-list-tags(1) section "REPOSITORY NAMES" for the expected format
 // Customized version of the alltransports.ParseImageName and docker.ParseReference that does not place a default tag in the reference
 // Would really love to not have this, but needed to enforce tag-less and digest-less names
 func parseDockerRepositoryReference(refString string) (types.ImageReference, error) {
-	dockerRefString, ok := strings.CutPrefix(refString, docker.Transport.Name()+"://")
-	if !ok {
+	if !strings.HasPrefix(refString, docker.Transport.Name()+"://") {
 		return nil, fmt.Errorf("docker: image reference %s does not start with %s://", refString, docker.Transport.Name())
 	}
 
-	ref, err := reference.ParseNormalizedNamed(dockerRefString)
+	parts := strings.SplitN(refString, ":", 2)
+	if len(parts) != 2 {
+		return nil, fmt.Errorf(`Invalid image name "%s", expected colon-separated transport:reference`, refString)
+	}
+
+	ref, err := reference.ParseNormalizedNamed(strings.TrimPrefix(parts[1], "//"))
 	if err != nil {
 		return nil, err
 	}
@@ -123,7 +130,7 @@ func listDockerRepoTags(ctx context.Context, sys *types.SystemContext, opts *tag
 }
 
 // return the tagLists from a docker archive file
-func listDockerArchiveTags(_ context.Context, sys *types.SystemContext, _ *tagsOptions, userInput string) (repositoryName string, tagListing []string, err error) {
+func listDockerArchiveTags(ctx context.Context, sys *types.SystemContext, opts *tagsOptions, userInput string) (repositoryName string, tagListing []string, err error) {
 	ref, err := alltransports.ParseImageName(userInput)
 	if err != nil {
 		return

cmd/skopeo/list_tags_test.go

@@ -16,6 +16,7 @@ func TestDockerRepositoryReferenceParser(t *testing.T) {
 		{"docker://somehost.com"},          // Valid default expansion
 		{"docker://nginx"},                 // Valid default expansion
 	} {
+
 		ref, err := parseDockerRepositoryReference(test[0])
 		require.NoError(t, err)
 		expected, err := alltransports.ParseImageName(test[0])
@@ -46,6 +47,7 @@ func TestDockerRepositoryReferenceParserDrift(t *testing.T) {
 		{"docker://somehost.com", "docker.io/library/somehost.com"}, // Valid default expansion
 		{"docker://nginx", "docker.io/library/nginx"},               // Valid default expansion
 	} {
+
 		ref, err := parseDockerRepositoryReference(test[0])
 		ref2, err2 := alltransports.ParseImageName(test[0])
 
@@ -54,17 +56,3 @@ func TestDockerRepositoryReferenceParserDrift(t *testing.T) {
 		}
 	}
 }
-
-func TestListTags(t *testing.T) {
-	// Invalid command-line arguments
-	for _, args := range [][]string{
-		{},
-		{"a1", "a2"},
-	} {
-		out, err := runSkopeo(append([]string{"list-tags"}, args...)...)
-		assertTestFailed(t, out, err, "Exactly one non-option argument expected")
-	}
-
-	// FIXME: Much more test coverage
-	// Actual feature tests exist in systemtest
-}

cmd/skopeo/login_test.go

@@ -1,18 +0,0 @@
-package main
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-func TestLogin(t *testing.T) {
-	dir := t.TempDir()
-	authFile := filepath.Join(dir, "auth.json")
-	compatAuthFile := filepath.Join(dir, "config.json")
-
-	// Just a trivial smoke-test exercising one error-handling path.
-	// We can’t test full operation without a registry, unit tests should mostly
-	// exist in c/common/pkg/auth, not here.
-	out, err := runSkopeo("login", "--authfile", authFile, "--compat-auth-file", compatAuthFile, "example.com")
-	assertTestFailed(t, out, err, "options for paths to the credential file and to the Docker-compatible credential file can not be set simultaneously")
-}

cmd/skopeo/logout_test.go

@@ -1,25 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestLogout(t *testing.T) {
-	dir := t.TempDir()
-	authFile := filepath.Join(dir, "auth.json")
-	compatAuthFile := filepath.Join(dir, "config.json")
-
-	// Just a trivial smoke-test exercising one error-handling path.
-	// We can’t test full operation without a registry, unit tests should mostly
-	// exist in c/common/pkg/auth, not here.
-	err := os.WriteFile(authFile, []byte("{}"), 0o700)
-	require.NoError(t, err)
-	err = os.WriteFile(compatAuthFile, []byte("{}"), 0o700)
-	require.NoError(t, err)
-	out, err := runSkopeo("logout", "--authfile", authFile, "--compat-auth-file", compatAuthFile, "example.com")
-	assertTestFailed(t, out, err, "options for paths to the credential file and to the Docker-compatible credential file can not be set simultaneously")
-}

cmd/skopeo/main.go

@@ -55,12 +55,14 @@ func createApp() (*cobra.Command, *globalOptions) {
 	opts := globalOptions{}
 
 	rootCommand := &cobra.Command{
-		Use:               "skopeo",
-		Long:              "Various operations with container images and container image registries",
-		RunE:              requireSubcommand,
-		PersistentPreRunE: opts.before,
-		SilenceUsage:      true,
-		SilenceErrors:     true,
+		Use:  "skopeo",
+		Long: "Various operations with container images and container image registries",
+		RunE: requireSubcommand,
+		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+			return opts.before(cmd)
+		},
+		SilenceUsage:  true,
+		SilenceErrors: true,
 		// Hide the completion command which is provided by cobra
 		CompletionOptions: cobra.CompletionOptions{HiddenDefaultCmd: true},
 		// This is documented to parse "local" (non-PersistentFlags) flags of parent commands before
@@ -113,7 +115,7 @@ func createApp() (*cobra.Command, *globalOptions) {
 }
 
 // before is run by the cli package for any command, before running the command-specific handler.
-func (opts *globalOptions) before(cmd *cobra.Command, args []string) error {
+func (opts *globalOptions) before(cmd *cobra.Command) error {
 	if opts.debug {
 		logrus.SetLevel(logrus.DebugLevel)
 	}
@@ -129,10 +131,6 @@ func main() {
 	}
 	rootCmd, _ := createApp()
 	if err := rootCmd.Execute(); err != nil {
-		if isNotFoundImageError(err) {
-			logrus.StandardLogger().Log(logrus.FatalLevel, err)
-			logrus.Exit(2)
-		}
 		logrus.Fatal(err)
 	}
 }

cmd/skopeo/proxy.go

@@ -1,4 +1,5 @@
 //go:build !windows
+// +build !windows
 
 package main
 
@@ -70,13 +71,15 @@ import (
 	"sync"
 	"syscall"
 
-	"github.com/containers/common/pkg/retry"
 	"github.com/containers/image/v5/image"
 	"github.com/containers/image/v5/manifest"
+	ocilayout "github.com/containers/image/v5/oci/layout"
 	"github.com/containers/image/v5/pkg/blobinfocache"
 	"github.com/containers/image/v5/transports"
 	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/containers/image/v5/types"
+	dockerdistributionerrcode "github.com/docker/distribution/registry/api/errcode"
+	dockerdistributionapi "github.com/docker/distribution/registry/api/v2"
 	"github.com/opencontainers/go-digest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
@@ -92,10 +95,7 @@ import (
 // 0.2.3: Added GetFullConfig
 // 0.2.4: Added OpenImageOptional
 // 0.2.5: Added LayerInfoJSON
-// 0.2.6: Policy Verification before pulling OCI
-// 0.2.7: Added GetLayerInfoPiped
-// 0.2.8: Added GetRawBlob and reply.error_code
-const protocolVersion = "0.2.8"
+const protocolVersion = "0.2.5"
 
 // maxMsgSize is the current limit on a packet size.
 // Note that all non-metadata (i.e. payload data) is sent over a pipe.
@@ -115,24 +115,7 @@ type request struct {
 	// Method is the name of the function
 	Method string `json:"method"`
 	// Args is the arguments (parsed inside the function)
-	Args []any `json:"args"`
-}
-
-type proxyErrorCode string
-
-const (
-	// proxyErrPipe means we got EPIPE writing to a pipe owned by the client
-	proxyErrPipe proxyErrorCode = "EPIPE"
-	// proxyErrRetryable can be used by clients to automatically retry operations
-	proxyErrRetryable proxyErrorCode = "retryable"
-	// All other errors
-	proxyErrOther proxyErrorCode = "other"
-)
-
-// proxyError is serialized over the errfd channel for GetRawBlob
-type proxyError struct {
-	Code    proxyErrorCode `json:"code"`
-	Message string         `json:"message"`
+	Args []interface{} `json:"args"`
 }
 
 // reply is serialized to JSON as the return value from a function call.
@@ -140,11 +123,9 @@ type reply struct {
 	// Success is true if and only if the call succeeded.
 	Success bool `json:"success"`
 	// Value is an arbitrary value (or values, as array/map) returned from the call.
-	Value any `json:"value"`
+	Value interface{} `json:"value"`
 	// PipeID is an index into open pipes, and should be passed to FinishPipe
 	PipeID uint32 `json:"pipeid"`
-	// ErrorCode will be non-empty if error is set (new in 0.2.8)
-	ErrorCode proxyErrorCode `json:"error_code"`
 	// Error should be non-empty if Success == false
 	Error string `json:"error"`
 }
@@ -152,12 +133,9 @@ type reply struct {
 // replyBuf is our internal deserialization of reply plus optional fd
 type replyBuf struct {
 	// value will be converted to a reply Value
-	value any
-	// fd is the read half of a pipe, passed back to the client for additional data
+	value interface{}
+	// fd is the read half of a pipe, passed back to the client
 	fd *os.File
-	// errfd will be a serialization of error state. This is optional and is currently
-	// only used by GetRawBlob.
-	errfd *os.File
 	// pipeid will be provided to the client as PipeID, an index into our open pipes
 	pipeid uint32
 }
@@ -176,7 +154,7 @@ type activePipe struct {
 // openImage is an opened image reference
 type openImage struct {
 	// id is an opaque integer handle
-	id        uint64
+	id        uint32
 	src       types.ImageSource
 	cachedimg types.Image
 }
@@ -191,9 +169,9 @@ type proxyHandler struct {
 	cache  types.BlobInfoCache
 
 	// imageSerial is a counter for open images
-	imageSerial uint64
+	imageSerial uint32
 	// images holds our opened images
-	images map[uint64]*openImage
+	images map[uint32]*openImage
 	// activePipes maps from "pipeid" to a pipe + goroutine pair
 	activePipes map[uint32]*activePipe
 }
@@ -206,32 +184,8 @@ type convertedLayerInfo struct {
 	MediaType string        `json:"media_type"`
 }
 
-// mapProxyErrorCode turns an error into a known string value.
-func mapProxyErrorCode(err error) proxyErrorCode {
-	switch {
-	case err == nil:
-		return ""
-	case errors.Is(err, syscall.EPIPE):
-		return proxyErrPipe
-	case retry.IsErrorRetryable(err):
-		return proxyErrRetryable
-	default:
-		return proxyErrOther
-	}
-}
-
-// newProxyError creates a serializable structure for
-// the client containing a mapped error code based
-// on the error type, plus its value as a string.
-func newProxyError(err error) proxyError {
-	return proxyError{
-		Code:    mapProxyErrorCode(err),
-		Message: fmt.Sprintf("%v", err),
-	}
-}
-
 // Initialize performs one-time initialization, and returns the protocol version
-func (h *proxyHandler) Initialize(args []any) (replyBuf, error) {
+func (h *proxyHandler) Initialize(args []interface{}) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 
@@ -260,11 +214,30 @@ func (h *proxyHandler) Initialize(args []any) (replyBuf, error) {
 
 // OpenImage accepts a string image reference i.e. TRANSPORT:REF - like `skopeo copy`.
 // The return value is an opaque integer handle.
-func (h *proxyHandler) OpenImage(args []any) (replyBuf, error) {
+func (h *proxyHandler) OpenImage(args []interface{}) (replyBuf, error) {
 	return h.openImageImpl(args, false)
 }
 
-func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (retReplyBuf replyBuf, retErr error) {
+// isDockerManifestUnknownError is a copy of code from containers/image,
+// please update there first.
+func isDockerManifestUnknownError(err error) bool {
+	var ec dockerdistributionerrcode.ErrorCoder
+	if !errors.As(err, &ec) {
+		return false
+	}
+	return ec.ErrorCode() == dockerdistributionapi.ErrorCodeManifestUnknown
+}
+
+// isNotFoundImageError heuristically attempts to determine whether an error
+// is saying the remote source couldn't find the image (as opposed to an
+// authentication error, an I/O error etc.)
+// TODO drive this into containers/image properly
+func isNotFoundImageError(err error) bool {
+	return isDockerManifestUnknownError(err) ||
+		errors.Is(err, ocilayout.ImageNotFoundError{})
+}
+
+func (h *proxyHandler) openImageImpl(args []interface{}, allowNotFound bool) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 	var ret replyBuf
@@ -293,25 +266,6 @@ func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (retReplyBu
 		return ret, err
 	}
 
-	policyContext, err := h.opts.global.getPolicyContext()
-	if err != nil {
-		return ret, err
-	}
-	defer func() {
-		if err := policyContext.Destroy(); err != nil {
-			retErr = noteCloseFailure(retErr, "tearing down policy context", err)
-		}
-	}()
-
-	unparsedTopLevel := image.UnparsedInstance(imgsrc, nil)
-	allowed, err := policyContext.IsRunningImageAllowed(context.Background(), unparsedTopLevel)
-	if err != nil {
-		return ret, err
-	}
-	if !allowed {
-		return ret, fmt.Errorf("internal inconsistency: policy verification failed without returning an error")
-	}
-
 	// Note that we never return zero as an imageid; this code doesn't yet
 	// handle overflow though.
 	h.imageSerial++
@@ -325,14 +279,14 @@ func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (retReplyBu
 	return ret, nil
 }
 
-// OpenImageOptional accepts a string image reference i.e. TRANSPORT:REF - like `skopeo copy`.
+// OpenImage accepts a string image reference i.e. TRANSPORT:REF - like `skopeo copy`.
 // The return value is an opaque integer handle.  If the image does not exist, zero
 // is returned.
-func (h *proxyHandler) OpenImageOptional(args []any) (replyBuf, error) {
+func (h *proxyHandler) OpenImageOptional(args []interface{}) (replyBuf, error) {
 	return h.openImageImpl(args, true)
 }
 
-func (h *proxyHandler) CloseImage(args []any) (replyBuf, error) {
+func (h *proxyHandler) CloseImage(args []interface{}) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 	var ret replyBuf
@@ -353,8 +307,16 @@ func (h *proxyHandler) CloseImage(args []any) (replyBuf, error) {
 	return ret, nil
 }
 
+func parseImageID(v interface{}) (uint32, error) {
+	imgidf, ok := v.(float64)
+	if !ok {
+		return 0, fmt.Errorf("expecting integer imageid, not %T", v)
+	}
+	return uint32(imgidf), nil
+}
+
 // parseUint64 validates that a number fits inside a JavaScript safe integer
-func parseUint64(v any) (uint64, error) {
+func parseUint64(v interface{}) (uint64, error) {
 	f, ok := v.(float64)
 	if !ok {
 		return 0, fmt.Errorf("expecting numeric, not %T", v)
@@ -365,8 +327,8 @@ func parseUint64(v any) (uint64, error) {
 	return uint64(f), nil
 }
 
-func (h *proxyHandler) parseImageFromID(v any) (*openImage, error) {
-	imgid, err := parseUint64(v)
+func (h *proxyHandler) parseImageFromID(v interface{}) (*openImage, error) {
+	imgid, err := parseImageID(v)
 	if err != nil {
 		return nil, err
 	}
@@ -395,7 +357,7 @@ func (h *proxyHandler) allocPipe() (*os.File, *activePipe, error) {
 
 // returnBytes generates a return pipe() from a byte array
 // In the future it might be nicer to return this via memfd_create()
-func (h *proxyHandler) returnBytes(retval any, buf []byte) (replyBuf, error) {
+func (h *proxyHandler) returnBytes(retval interface{}, buf []byte) (replyBuf, error) {
 	var ret replyBuf
 	piper, f, err := h.allocPipe()
 	if err != nil {
@@ -457,7 +419,7 @@ func (h *proxyHandler) cacheTargetManifest(img *openImage) error {
 
 // GetManifest returns a copy of the manifest, converted to OCI format, along with the original digest.
 // Manifest lists are resolved to the current operating system and architecture.
-func (h *proxyHandler) GetManifest(args []any) (replyBuf, error) {
+func (h *proxyHandler) GetManifest(args []interface{}) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 
@@ -528,7 +490,7 @@ func (h *proxyHandler) GetManifest(args []any) (replyBuf, error) {
 
 // GetFullConfig returns a copy of the image configuration, converted to OCI format.
 // https://github.com/opencontainers/image-spec/blob/main/config.md
-func (h *proxyHandler) GetFullConfig(args []any) (replyBuf, error) {
+func (h *proxyHandler) GetFullConfig(args []interface{}) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 
@@ -565,7 +527,7 @@ func (h *proxyHandler) GetFullConfig(args []any) (replyBuf, error) {
 // GetConfig returns a copy of the container runtime configuration, converted to OCI format.
 // Note that due to a historical mistake, this returns not the full image configuration,
 // but just the container runtime configuration.  You should use GetFullConfig instead.
-func (h *proxyHandler) GetConfig(args []any) (replyBuf, error) {
+func (h *proxyHandler) GetConfig(args []interface{}) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 
@@ -600,7 +562,7 @@ func (h *proxyHandler) GetConfig(args []any) (replyBuf, error) {
 }
 
 // GetBlob fetches a blob, performing digest verification.
-func (h *proxyHandler) GetBlob(args []any) (replyBuf, error) {
+func (h *proxyHandler) GetBlob(args []interface{}) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 
@@ -665,98 +627,12 @@ func (h *proxyHandler) GetBlob(args []any) (replyBuf, error) {
 	return ret, nil
 }
 
-// GetRawBlob can be viewed as a more general purpose successor
-// to GetBlob. First, it does not verify the digest, which in
-// some cases is unnecessary as the client would prefer to do it.
-//
-// It also does not use the "FinishPipe" API call, but instead
-// returns *two* file descriptors, one for errors and one for data.
-//
-// On (initial) success, the return value provided to the client is the size of the blob.
-func (h *proxyHandler) GetRawBlob(args []any) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	var ret replyBuf
-
-	if h.sysctx == nil {
-		return ret, fmt.Errorf("client error: must invoke Initialize")
-	}
-	if len(args) != 2 {
-		return ret, fmt.Errorf("found %d args, expecting (imgid, digest)", len(args))
-	}
-	imgref, err := h.parseImageFromID(args[0])
-	if err != nil {
-		return ret, err
-	}
-	digestStr, ok := args[1].(string)
-	if !ok {
-		return ret, fmt.Errorf("expecting string blobid")
-	}
-
-	ctx := context.TODO()
-	d, err := digest.Parse(digestStr)
-	if err != nil {
-		return ret, err
-	}
-	blobr, blobSize, err := imgref.src.GetBlob(ctx, types.BlobInfo{Digest: d, Size: int64(-1)}, h.cache)
-	if err != nil {
-		return ret, err
-	}
-
-	// Note this doesn't call allocPipe; we're not using the FinishPipe infrastructure.
-	piper, pipew, err := os.Pipe()
-	if err != nil {
-		blobr.Close()
-		return ret, err
-	}
-	errpipeR, errpipeW, err := os.Pipe()
-	if err != nil {
-		piper.Close()
-		pipew.Close()
-		blobr.Close()
-		return ret, err
-	}
-	// Asynchronous worker doing a copy
-	go func() {
-		// We own the read from registry, and write pipe objects
-		defer blobr.Close()
-		defer pipew.Close()
-		defer errpipeW.Close()
-		logrus.Debugf("Copying blob to client: %d bytes", blobSize)
-		_, err := io.Copy(pipew, blobr)
-		// Handle errors here by serializing a JSON error back over
-		// the error channel. In either case, both file descriptors
-		// will be closed, signaling the completion of the operation.
-		if err != nil {
-			logrus.Debugf("Sending error to client: %v", err)
-			serializedErr := newProxyError(err)
-			buf, err := json.Marshal(serializedErr)
-			if err != nil {
-				// Should never happen
-				panic(err)
-			}
-			_, writeErr := errpipeW.Write(buf)
-			if writeErr != nil && !errors.Is(err, syscall.EPIPE) {
-				logrus.Debugf("Writing to client: %v", err)
-			}
-		}
-		logrus.Debugf("Completed GetRawBlob operation")
-	}()
-
-	ret.value = blobSize
-	ret.fd = piper
-	ret.errfd = errpipeR
-	return ret, nil
-}
-
 // GetLayerInfo returns data about the layers of an image, useful for reading the layer contents.
 //
-// This is the same as GetLayerInfoPiped, but returns its contents inline. This is subject to
-// failure for large images (because we use SOCK_SEQPACKET which has a maximum buffer size)
-// and is hence only retained for backwards compatibility. Callers are expected to use
-// the semver to know whether they can call the new API.
-func (h *proxyHandler) GetLayerInfo(args []any) (replyBuf, error) {
+// This needs to be called since the data returned by GetManifest() does not allow to correctly
+// calling GetBlob() for the containers-storage: transport (which doesn’t store the original compressed
+// representations referenced in the manifest).
+func (h *proxyHandler) GetLayerInfo(args []interface{}) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 
@@ -792,7 +668,7 @@ func (h *proxyHandler) GetLayerInfo(args []any) (replyBuf, error) {
 		layerInfos = img.LayerInfos()
 	}
 
-	layers := make([]convertedLayerInfo, 0, len(layerInfos))
+	var layers []convertedLayerInfo
 	for _, layer := range layerInfos {
 		layers = append(layers, convertedLayerInfo{layer.Digest, layer.Size, layer.MediaType})
 	}
@@ -801,61 +677,8 @@ func (h *proxyHandler) GetLayerInfo(args []any) (replyBuf, error) {
 	return ret, nil
 }
 
-// GetLayerInfoPiped returns data about the layers of an image, useful for reading the layer contents.
-//
-// This needs to be called since the data returned by GetManifest() does not allow to correctly
-// calling GetBlob() for the containers-storage: transport (which doesn’t store the original compressed
-// representations referenced in the manifest).
-func (h *proxyHandler) GetLayerInfoPiped(args []any) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	var ret replyBuf
-
-	if h.sysctx == nil {
-		return ret, fmt.Errorf("client error: must invoke Initialize")
-	}
-
-	if len(args) != 1 {
-		return ret, fmt.Errorf("found %d args, expecting (imgid)", len(args))
-	}
-
-	imgref, err := h.parseImageFromID(args[0])
-	if err != nil {
-		return ret, err
-	}
-
-	ctx := context.TODO()
-
-	err = h.cacheTargetManifest(imgref)
-	if err != nil {
-		return ret, err
-	}
-	img := imgref.cachedimg
-
-	layerInfos, err := img.LayerInfosForCopy(ctx)
-	if err != nil {
-		return ret, err
-	}
-
-	if layerInfos == nil {
-		layerInfos = img.LayerInfos()
-	}
-
-	layers := make([]convertedLayerInfo, 0, len(layerInfos))
-	for _, layer := range layerInfos {
-		layers = append(layers, convertedLayerInfo{layer.Digest, layer.Size, layer.MediaType})
-	}
-
-	serialized, err := json.Marshal(&layers)
-	if err != nil {
-		return ret, err
-	}
-	return h.returnBytes(nil, serialized)
-}
-
 // FinishPipe waits for the worker goroutine to finish, and closes the write side of the pipe.
-func (h *proxyHandler) FinishPipe(args []any) (replyBuf, error) {
+func (h *proxyHandler) FinishPipe(args []interface{}) (replyBuf, error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()
 
@@ -874,7 +697,6 @@ func (h *proxyHandler) FinishPipe(args []any) (replyBuf, error) {
 
 	// Wait for the goroutine to complete
 	f.wg.Wait()
-	logrus.Debug("Completed pipe goroutine")
 	// And only now do we close the write half; this forces the client to call this API
 	f.w.Close()
 	// Propagate any errors from the goroutine worker
@@ -896,37 +718,29 @@ func (h *proxyHandler) close() {
 
 // send writes a reply buffer to the socket
 func (buf replyBuf) send(conn *net.UnixConn, err error) error {
-	logrus.Debugf("Sending reply: err=%v value=%v pipeid=%v datafd=%v errfd=%v", err, buf.value, buf.pipeid, buf.fd, buf.errfd)
-	// We took ownership of these FDs, so close when we're done sending them or on error
-	defer func() {
-		if buf.fd != nil {
-			buf.fd.Close()
-		}
-		if buf.errfd != nil {
-			buf.errfd.Close()
-		}
-	}()
 	replyToSerialize := reply{
 		Success: err == nil,
 		Value:   buf.value,
 		PipeID:  buf.pipeid,
 	}
 	if err != nil {
-		replyToSerialize.ErrorCode = mapProxyErrorCode(err)
 		replyToSerialize.Error = err.Error()
 	}
 	serializedReply, err := json.Marshal(&replyToSerialize)
 	if err != nil {
 		return err
 	}
-	// Copy the FD number(s) to the socket ancillary buffer
+	// We took ownership of the FD - close it when we're done.
+	defer func() {
+		if buf.fd != nil {
+			buf.fd.Close()
+		}
+	}()
+	// Copy the FD number to the socket ancillary buffer
 	fds := make([]int, 0)
 	if buf.fd != nil {
 		fds = append(fds, int(buf.fd.Fd()))
 	}
-	if buf.errfd != nil {
-		fds = append(fds, int(buf.errfd.Fd()))
-	}
 	oob := syscall.UnixRights(fds...)
 	n, oobn, err := conn.WriteMsgUnix(serializedReply, oob, nil)
 	if err != nil {
@@ -978,8 +792,6 @@ func (h *proxyHandler) processRequest(readBytes []byte) (rb replyBuf, terminate
 		err = fmt.Errorf("invalid request: %v", err)
 		return
 	}
-	logrus.Debugf("Executing method %s", req.Method)
-
 	// Dispatch on the method
 	switch req.Method {
 	case "Initialize":
@@ -998,12 +810,8 @@ func (h *proxyHandler) processRequest(readBytes []byte) (rb replyBuf, terminate
 		rb, err = h.GetFullConfig(req.Args)
 	case "GetBlob":
 		rb, err = h.GetBlob(req.Args)
-	case "GetRawBlob":
-		rb, err = h.GetRawBlob(req.Args)
 	case "GetLayerInfo":
 		rb, err = h.GetLayerInfo(req.Args)
-	case "GetLayerInfoPiped":
-		rb, err = h.GetLayerInfoPiped(req.Args)
 	case "FinishPipe":
 		rb, err = h.FinishPipe(req.Args)
 	case "Shutdown":
@@ -1020,7 +828,7 @@ func (h *proxyHandler) processRequest(readBytes []byte) (rb replyBuf, terminate
 func (opts *proxyOptions) run(args []string, stdout io.Writer) error {
 	handler := &proxyHandler{
 		opts:        opts,
-		images:      make(map[uint64]*openImage),
+		images:      make(map[uint32]*openImage),
 		activePipes: make(map[uint32]*activePipe),
 	}
 	defer handler.close()
@@ -1047,7 +855,6 @@ func (opts *proxyOptions) run(args []string, stdout io.Writer) error {
 
 		rb, terminate, err := handler.processRequest(readbuf)
 		if terminate {
-			logrus.Debug("terminating")
 			return nil
 		}
 

cmd/skopeo/proxy_windows.go

@@ -1,4 +1,5 @@
 //go:build windows
+// +build windows
 
 package main
 

cmd/skopeo/signing.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"strings"
 
 	"github.com/containers/image/v5/pkg/cli"
 	"github.com/containers/image/v5/signature"
@@ -42,12 +41,12 @@ func (opts *standaloneSignOptions) run(args []string, stdout io.Writer) error {
 
 	manifest, err := os.ReadFile(manifestPath)
 	if err != nil {
-		return fmt.Errorf("Error reading %s: %w", manifestPath, err)
+		return fmt.Errorf("Error reading %s: %v", manifestPath, err)
 	}
 
 	mech, err := signature.NewGPGSigningMechanism()
 	if err != nil {
-		return fmt.Errorf("Error initializing GPG: %w", err)
+		return fmt.Errorf("Error initializing GPG: %v", err)
 	}
 	defer mech.Close()
 
@@ -58,31 +57,25 @@ func (opts *standaloneSignOptions) run(args []string, stdout io.Writer) error {
 
 	signature, err := signature.SignDockerManifestWithOptions(manifest, dockerReference, mech, fingerprint, &signature.SignOptions{Passphrase: passphrase})
 	if err != nil {
-		return fmt.Errorf("Error creating signature: %w", err)
+		return fmt.Errorf("Error creating signature: %v", err)
 	}
 
 	if err := os.WriteFile(opts.output, signature, 0644); err != nil {
-		return fmt.Errorf("Error writing signature to %s: %w", opts.output, err)
+		return fmt.Errorf("Error writing signature to %s: %v", opts.output, err)
 	}
 	return nil
 }
 
 type standaloneVerifyOptions struct {
-	publicKeyFile string
 }
 
 func standaloneVerifyCmd() *cobra.Command {
 	opts := standaloneVerifyOptions{}
 	cmd := &cobra.Command{
-		Use:   "standalone-verify MANIFEST DOCKER-REFERENCE KEY-FINGERPRINTS SIGNATURE",
+		Use:   "standalone-verify MANIFEST DOCKER-REFERENCE KEY-FINGERPRINT SIGNATURE",
 		Short: "Verify a signature using local files",
-		Long: `Verify a signature using local files
-
-KEY-FINGERPRINTS can be a comma separated list of fingerprints, or "any" if you trust all the keys in the public key file.`,
-		RunE: commandAction(opts.run),
+		RunE:  commandAction(opts.run),
 	}
-	flags := cmd.Flags()
-	flags.StringVar(&opts.publicKeyFile, "public-key-file", "", `File containing public keys. If not specified, will use local GPG keys.`)
 	adjustUsage(cmd)
 	return cmd
 }
@@ -93,51 +86,29 @@ func (opts *standaloneVerifyOptions) run(args []string, stdout io.Writer) error
 	}
 	manifestPath := args[0]
 	expectedDockerReference := args[1]
-	expectedFingerprints := strings.Split(args[2], ",")
+	expectedFingerprint := args[2]
 	signaturePath := args[3]
 
-	if opts.publicKeyFile == "" && len(expectedFingerprints) == 1 && expectedFingerprints[0] == "any" {
-		return fmt.Errorf("Cannot use any fingerprint without a public key file")
-	}
 	unverifiedManifest, err := os.ReadFile(manifestPath)
 	if err != nil {
-		return fmt.Errorf("Error reading manifest from %s: %w", manifestPath, err)
+		return fmt.Errorf("Error reading manifest from %s: %v", manifestPath, err)
 	}
 	unverifiedSignature, err := os.ReadFile(signaturePath)
 	if err != nil {
-		return fmt.Errorf("Error reading signature from %s: %w", signaturePath, err)
+		return fmt.Errorf("Error reading signature from %s: %v", signaturePath, err)
 	}
 
-	var mech signature.SigningMechanism
-	var publicKeyfingerprints []string
-	if opts.publicKeyFile != "" {
-		publicKeys, err := os.ReadFile(opts.publicKeyFile)
-		if err != nil {
-			return fmt.Errorf("Error reading public keys from %s: %w", opts.publicKeyFile, err)
-		}
-		mech, publicKeyfingerprints, err = signature.NewEphemeralGPGSigningMechanism(publicKeys)
-		if err != nil {
-			return fmt.Errorf("Error initializing GPG: %w", err)
-
-		}
-	} else {
-		mech, err = signature.NewGPGSigningMechanism()
-		if err != nil {
-			return fmt.Errorf("Error initializing GPG: %w", err)
-		}
+	mech, err := signature.NewGPGSigningMechanism()
+	if err != nil {
+		return fmt.Errorf("Error initializing GPG: %v", err)
 	}
 	defer mech.Close()
-
-	if len(expectedFingerprints) == 1 && expectedFingerprints[0] == "any" {
-		expectedFingerprints = publicKeyfingerprints
-	}
-
-	sig, verificationFingerprint, err := signature.VerifyImageManifestSignatureUsingKeyIdentityList(unverifiedSignature, unverifiedManifest, expectedDockerReference, mech, expectedFingerprints)
+	sig, err := signature.VerifyDockerManifestSignature(unverifiedSignature, unverifiedManifest, expectedDockerReference, mech, expectedFingerprint)
 	if err != nil {
-		return fmt.Errorf("Error verifying signature: %w", err)
+		return fmt.Errorf("Error verifying signature: %v", err)
 	}
 
-	fmt.Fprintf(stdout, "Signature verified using fingerprint %s, digest %s\n", verificationFingerprint, sig.DockerManifestDigest)
+	fmt.Fprintf(stdout, "Signature verified, digest %s\n", sig.DockerManifestDigest)
 	return nil
 }
 
@@ -170,7 +141,7 @@ func (opts *untrustedSignatureDumpOptions) run(args []string, stdout io.Writer)
 
 	untrustedSignature, err := os.ReadFile(untrustedSignaturePath)
 	if err != nil {
-		return fmt.Errorf("Error reading untrusted signature from %s: %w", untrustedSignaturePath, err)
+		return fmt.Errorf("Error reading untrusted signature from %s: %v", untrustedSignaturePath, err)
 	}
 
 	untrustedInfo, err := signature.GetUntrustedSignatureInformationWithoutVerifying(untrustedSignature)

cmd/skopeo/signing_test.go

@@ -127,36 +127,11 @@ func TestStandaloneVerify(t *testing.T) {
 		dockerReference, fixturesTestKeyFingerprint, "fixtures/corrupt.signature")
 	assertTestFailed(t, out, err, "Error verifying signature")
 
-	// Error using any without a public key file
-	out, err = runSkopeo("standalone-verify", manifestPath,
-		dockerReference, "any", signaturePath)
-	assertTestFailed(t, out, err, "Cannot use any fingerprint without a public key file")
-
 	// Success
 	out, err = runSkopeo("standalone-verify", manifestPath,
 		dockerReference, fixturesTestKeyFingerprint, signaturePath)
 	assert.NoError(t, err)
-	assert.Equal(t, "Signature verified using fingerprint "+fixturesTestKeyFingerprint+", digest "+fixturesTestImageManifestDigest.String()+"\n", out)
-
-	// Using multiple fingerprints
-	out, err = runSkopeo("standalone-verify", manifestPath,
-		dockerReference, "0123456789ABCDEF0123456789ABCDEF01234567,"+fixturesTestKeyFingerprint+",DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF", signaturePath)
-	assert.NoError(t, err)
-	assert.Equal(t, "Signature verified using fingerprint "+fixturesTestKeyFingerprint+", digest "+fixturesTestImageManifestDigest.String()+"\n", out)
-
-	// Using a public key file
-	t.Setenv("GNUPGHOME", "")
-	out, err = runSkopeo("standalone-verify", "--public-key-file", "fixtures/pubring.gpg", manifestPath,
-		dockerReference, fixturesTestKeyFingerprint, signaturePath)
-	assert.NoError(t, err)
-	assert.Equal(t, "Signature verified using fingerprint "+fixturesTestKeyFingerprint+", digest "+fixturesTestImageManifestDigest.String()+"\n", out)
-
-	// Using a public key file matching any public key
-	t.Setenv("GNUPGHOME", "")
-	out, err = runSkopeo("standalone-verify", "--public-key-file", "fixtures/pubring.gpg", manifestPath,
-		dockerReference, "any", signaturePath)
-	assert.NoError(t, err)
-	assert.Equal(t, "Signature verified using fingerprint "+fixturesTestKeyFingerprint+", digest "+fixturesTestImageManifestDigest.String()+"\n", out)
+	assert.Equal(t, "Signature verified, digest "+fixturesTestImageManifestDigest.String()+"\n", out)
 }
 
 func TestUntrustedSignatureDump(t *testing.T) {

cmd/skopeo/sync.go

@@ -10,17 +10,14 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
-	"slices"
 	"strings"
 
-	"github.com/Masterminds/semver/v3"
 	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/common/pkg/retry"
 	"github.com/containers/image/v5/copy"
 	"github.com/containers/image/v5/directory"
 	"github.com/containers/image/v5/docker"
 	"github.com/containers/image/v5/docker/reference"
-	"github.com/containers/image/v5/manifest"
 	"github.com/containers/image/v5/pkg/cli"
 	"github.com/containers/image/v5/pkg/cli/sigstore"
 	"github.com/containers/image/v5/signature/signer"
@@ -29,7 +26,7 @@ import (
 	"github.com/opencontainers/go-digest"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	"gopkg.in/yaml.v3"
+	"gopkg.in/yaml.v2"
 )
 
 // syncOptions contains information retrieved from the skopeo sync command line.
@@ -47,7 +44,6 @@ type syncOptions struct {
 	format                   commonFlag.OptionalString // Force conversion of the image to a specified format
 	source                   string                    // Source repository name
 	destination              string                    // Destination registry name
-	digestFile               string                    // Write digest to this file
 	scoped                   bool                      // When true, namespace copied images at destination using the source repository name
 	all                      bool                      // Copy all of the images if an image in the source is a list
 	dryRun                   bool                      // Don't actually copy anything, just output what it would have done
@@ -74,7 +70,6 @@ type tlsVerifyConfig struct {
 type registrySyncConfig struct {
 	Images           map[string][]string    // Images map images name to slices with the images' references (tags, digests)
 	ImagesByTagRegex map[string]string      `yaml:"images-by-tag-regex"` // Images map images name to regular expression with the images' tags
-	ImagesBySemver   map[string]string      `yaml:"images-by-semver"`    // ImagesBySemver maps a repository to a semver constraint (e.g. '>=3.14') to match images' tags to
 	Credentials      types.DockerAuthConfig // Username and password used to authenticate with the registry
 	TLSVerify        tlsVerifyConfig        `yaml:"tls-verify"` // TLS verification mode (enabled by default)
 	CertDir          string                 `yaml:"cert-dir"`   // Path to the TLS certificates of the registry
@@ -123,7 +118,6 @@ See skopeo-sync(1) for details.
 	flags.StringVarP(&opts.destination, "dest", "d", "", "DESTINATION transport type")
 	flags.BoolVar(&opts.scoped, "scoped", false, "Images at DESTINATION are prefix using the full source image path as scope")
 	flags.StringVar(&opts.appendSuffix, "append-suffix", "", "String to append to DESTINATION tags")
-	flags.StringVar(&opts.digestFile, "digestfile", "", "Write the digests and Image References of the resulting images to the specified file, separated by newlines")
 	flags.BoolVarP(&opts.all, "all", "a", false, "Copy all images if SOURCE-IMAGE is a list")
 	flags.BoolVar(&opts.dryRun, "dry-run", false, "Run without actually copying data")
 	flags.BoolVar(&opts.preserveDigests, "preserve-digests", false, "Preserve digests of images and lists")
@@ -137,12 +131,12 @@ See skopeo-sync(1) for details.
 }
 
 // UnmarshalYAML is the implementation of the Unmarshaler interface method
-// for the tlsVerifyConfig type.
+// method for the tlsVerifyConfig type.
 // It unmarshals the 'tls-verify' YAML key so that, when they key is not
 // specified, tls verification is enforced.
-func (tls *tlsVerifyConfig) UnmarshalYAML(value *yaml.Node) error {
+func (tls *tlsVerifyConfig) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	var verify bool
-	if err := value.Decode(&verify); err != nil {
+	if err := unmarshal(&verify); err != nil {
 		return err
 	}
 
@@ -309,14 +303,6 @@ func imagesToCopyFromRegistry(registryName string, cfg registrySyncConfig, sourc
 		serverCtx.DockerAuthConfig = &cfg.Credentials
 	}
 	var repoDescList []repoDescriptor
-
-	if len(cfg.Images) == 0 && len(cfg.ImagesByTagRegex) == 0 && len(cfg.ImagesBySemver) == 0 {
-		logrus.WithFields(logrus.Fields{
-			"registry": registryName,
-		}).Warn("No images specified for registry")
-		return repoDescList, nil
-	}
-
 	for imageName, refs := range cfg.Images {
 		repoLogger := logrus.WithFields(logrus.Fields{
 			"repo":     imageName,
@@ -381,144 +367,61 @@ func imagesToCopyFromRegistry(registryName string, cfg registrySyncConfig, sourc
 			Context:   serverCtx})
 	}
 
-	// include repository descriptors for cfg.ImagesByTagRegex
-	{
-		filterCollection, err := tagRegexFilterCollection(cfg.ImagesByTagRegex)
-		if err != nil {
-			logrus.Error(err)
-		} else {
-			additionalRepoDescList := filterSourceReferences(serverCtx, registryName, filterCollection)
-			repoDescList = append(repoDescList, additionalRepoDescList...)
-		}
-	}
-
-	// include repository descriptors for cfg.ImagesBySemver
-	{
-		filterCollection, err := semverFilterCollection(cfg.ImagesBySemver)
-		if err != nil {
-			logrus.Error(err)
-		} else {
-			additionalRepoDescList := filterSourceReferences(serverCtx, registryName, filterCollection)
-			repoDescList = append(repoDescList, additionalRepoDescList...)
-		}
-	}
-
-	return repoDescList, nil
-}
-
-// filterFunc is a function used to limit the initial set of image references
-// using tags, patterns, semver, etc.
-type filterFunc func(*logrus.Entry, types.ImageReference) bool
-
-// filterCollection is a map of repository names to filter functions.
-type filterCollection map[string]filterFunc
-
-// filterSourceReferences lists tags for images specified in the collection and
-// filters them using assigned filter functions.
-// It returns a list of repoDescriptors.
-func filterSourceReferences(sys *types.SystemContext, registryName string, collection filterCollection) []repoDescriptor {
-	var repoDescList []repoDescriptor
-	for repoName, filter := range collection {
-		logger := logrus.WithFields(logrus.Fields{
-			"repo":     repoName,
+	for imageName, tagRegex := range cfg.ImagesByTagRegex {
+		repoLogger := logrus.WithFields(logrus.Fields{
+			"repo":     imageName,
 			"registry": registryName,
 		})
-
-		repoRef, err := parseRepositoryReference(fmt.Sprintf("%s/%s", registryName, repoName))
+		repoRef, err := parseRepositoryReference(fmt.Sprintf("%s/%s", registryName, imageName))
 		if err != nil {
-			logger.Error("Error parsing repository name, skipping")
+			repoLogger.Error("Error parsing repository name, skipping")
 			logrus.Error(err)
 			continue
 		}
 
-		logger.Info("Processing repo")
+		repoLogger.Info("Processing repo")
 
 		var sourceReferences []types.ImageReference
 
-		logger.Info("Querying registry for image tags")
-		sourceReferences, err = imagesToCopyFromRepo(sys, repoRef)
+		tagReg, err := regexp.Compile(tagRegex)
 		if err != nil {
-			logger.Error("Error processing repo, skipping")
+			repoLogger.WithFields(logrus.Fields{
+				"regex": tagRegex,
+			}).Error("Error parsing regex, skipping")
 			logrus.Error(err)
 			continue
 		}
 
-		var filteredSourceReferences []types.ImageReference
-		for _, ref := range sourceReferences {
-			if filter(logger, ref) {
-				filteredSourceReferences = append(filteredSourceReferences, ref)
-			}
-		}
-
-		if len(filteredSourceReferences) == 0 {
-			logger.Warnf("No refs to sync found")
+		repoLogger.Info("Querying registry for image tags")
+		allSourceReferences, err := imagesToCopyFromRepo(serverCtx, repoRef)
+		if err != nil {
+			repoLogger.Error("Error processing repo, skipping")
+			logrus.Error(err)
 			continue
 		}
 
+		repoLogger.Infof("Start filtering using the regular expression: %v", tagRegex)
+		for _, sReference := range allSourceReferences {
+			tagged, isTagged := sReference.DockerReference().(reference.Tagged)
+			if !isTagged {
+				repoLogger.Errorf("Internal error, reference %s does not have a tag, skipping", sReference.DockerReference())
+				continue
+			}
+			if tagReg.MatchString(tagged.Tag()) {
+				sourceReferences = append(sourceReferences, sReference)
+			}
+		}
+
+		if len(sourceReferences) == 0 {
+			repoLogger.Warnf("No refs to sync found")
+			continue
+		}
 		repoDescList = append(repoDescList, repoDescriptor{
-			ImageRefs: filteredSourceReferences,
-			Context:   sys,
-		})
-	}
-	return repoDescList
-}
-
-// tagRegexFilterCollection converts a map of (repository name, tag regex) pairs
-// into a filterCollection, which is a map of (repository name, filter function)
-// pairs.
-func tagRegexFilterCollection(collection map[string]string) (filterCollection, error) {
-	filters := filterCollection{}
-
-	for repoName, tagRegex := range collection {
-		pattern, err := regexp.Compile(tagRegex)
-		if err != nil {
-			return nil, err
-		}
-
-		f := func(logger *logrus.Entry, sourceReference types.ImageReference) bool {
-			tagged, isTagged := sourceReference.DockerReference().(reference.Tagged)
-			if !isTagged {
-				logger.Errorf("Internal error, reference %s does not have a tag, skipping", sourceReference.DockerReference())
-				return false
-			}
-			return pattern.MatchString(tagged.Tag())
-		}
-		filters[repoName] = f
+			ImageRefs: sourceReferences,
+			Context:   serverCtx})
 	}
 
-	return filters, nil
-}
-
-// semverFilterCollection converts a map of (repository name, array of semver constraints) pairs
-// into a filterCollection, which is a map of (repository name, filter function)
-// pairs.
-func semverFilterCollection(collection map[string]string) (filterCollection, error) {
-	filters := filterCollection{}
-
-	for repoName, constraintString := range collection {
-		constraint, err := semver.NewConstraint(constraintString)
-		if err != nil {
-			return nil, err
-		}
-
-		f := func(logger *logrus.Entry, sourceReference types.ImageReference) bool {
-			tagged, isTagged := sourceReference.DockerReference().(reference.Tagged)
-			if !isTagged {
-				logger.Errorf("Internal error, reference %s does not have a tag, skipping", sourceReference.DockerReference())
-				return false
-			}
-			tagVersion, err := semver.NewVersion(tagged.Tag())
-			if err != nil {
-				logger.Tracef("Tag %q cannot be parsed as semver, skipping", tagged.Tag())
-				return false
-			}
-			return constraint.Check(tagVersion)
-		}
-
-		filters[repoName] = f
-	}
-
-	return filters, nil
+	return repoDescList, nil
 }
 
 // imagesToCopy retrieves all the images to copy from a specified sync source
@@ -585,6 +488,13 @@ func imagesToCopy(source string, transport string, sourceCtx *types.SystemContex
 			return descriptors, err
 		}
 		for registryName, registryConfig := range cfg {
+			if len(registryConfig.Images) == 0 && len(registryConfig.ImagesByTagRegex) == 0 {
+				logrus.WithFields(logrus.Fields{
+					"registry": registryName,
+				}).Warn("No images specified for registry")
+				continue
+			}
+
 			descs, err := imagesToCopyFromRegistry(registryName, registryConfig, *sourceCtx)
 			if err != nil {
 				return descriptors, fmt.Errorf("Failed to retrieve list of images from registry %q: %w", registryName, err)
@@ -613,17 +523,26 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
 	}()
 
 	// validate source and destination options
+	contains := func(val string, list []string) (_ bool) {
+		for _, l := range list {
+			if l == val {
+				return true
+			}
+		}
+		return
+	}
+
 	if len(opts.source) == 0 {
 		return errors.New("A source transport must be specified")
 	}
-	if !slices.Contains([]string{docker.Transport.Name(), directory.Transport.Name(), "yaml"}, opts.source) {
+	if !contains(opts.source, []string{docker.Transport.Name(), directory.Transport.Name(), "yaml"}) {
 		return fmt.Errorf("%q is not a valid source transport", opts.source)
 	}
 
 	if len(opts.destination) == 0 {
 		return errors.New("A destination transport must be specified")
 	}
-	if !slices.Contains([]string{docker.Transport.Name(), directory.Transport.Name()}, opts.destination) {
+	if !contains(opts.destination, []string{docker.Transport.Name(), directory.Transport.Name()}) {
 		return fmt.Errorf("%q is not a valid destination transport", opts.destination)
 	}
 
@@ -726,24 +645,10 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
 		logrus.Warn("Running in dry-run mode")
 	}
 
-	var digestFile *os.File
-	if opts.digestFile != "" && !opts.dryRun {
-		digestFile, err = os.OpenFile(opts.digestFile, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0644)
-		if err != nil {
-			return fmt.Errorf("Error creating digest file: %w", err)
-		}
-		defer func() {
-			if err := digestFile.Close(); err != nil {
-				retErr = noteCloseFailure(retErr, "closing digest file", err)
-			}
-		}()
-	}
-
 	for _, srcRepo := range srcRepoList {
 		options.SourceCtx = srcRepo.Context
 		for counter, ref := range srcRepo.ImageRefs {
 			var destSuffix string
-			var manifestBytes []byte
 			switch ref.Transport() {
 			case docker.Transport:
 				// docker -> dir or docker -> docker
@@ -775,7 +680,7 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
 			} else {
 				logrus.WithFields(fromToFields).Infof("Copying image ref %d/%d", counter+1, len(srcRepo.ImageRefs))
 				if err = retry.IfNecessary(ctx, func() error {
-					manifestBytes, err = copy.Image(ctx, policyContext, destRef, ref, &options)
+					_, err = copy.Image(ctx, policyContext, destRef, ref, &options)
 					return err
 				}, opts.retryOpts); err != nil {
 					if !opts.keepGoing {
@@ -787,19 +692,7 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
 					logrus.WithError(err).Errorf("Error copying ref %q", transports.ImageName(ref))
 					continue
 				}
-				// Ensure that we log the manifest digest to a file only if the copy operation was successful
-				if opts.digestFile != "" {
-					manifestDigest, err := manifest.Digest(manifestBytes)
-					if err != nil {
-						return err
-					}
-					outputStr := fmt.Sprintf("%s %s", manifestDigest.String(), transports.ImageName(destRef))
-					if _, err = digestFile.WriteString(outputStr + "\n"); err != nil {
-						return fmt.Errorf("Failed to write digest to file %q: %w", opts.digestFile, err)
-					}
-				}
 			}
-
 			imagesNumber++
 		}
 	}

cmd/skopeo/sync_test.go

@@ -1,61 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/containers/image/v5/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
-)
-
-var _ yaml.Unmarshaler = (*tlsVerifyConfig)(nil)
-
-func TestTLSVerifyConfig(t *testing.T) {
-	type container struct { // An example of a larger config file
-		TLSVerify tlsVerifyConfig `yaml:"tls-verify"`
-	}
-
-	for _, c := range []struct {
-		input    string
-		expected tlsVerifyConfig
-	}{
-		{
-			input:    `tls-verify: true`,
-			expected: tlsVerifyConfig{skip: types.OptionalBoolFalse},
-		},
-		{
-			input:    `tls-verify: false`,
-			expected: tlsVerifyConfig{skip: types.OptionalBoolTrue},
-		},
-		{
-			input:    ``, // No value
-			expected: tlsVerifyConfig{skip: types.OptionalBoolUndefined},
-		},
-	} {
-		config := container{}
-		err := yaml.Unmarshal([]byte(c.input), &config)
-		require.NoError(t, err, c.input)
-		assert.Equal(t, c.expected, config.TLSVerify, c.input)
-	}
-
-	// Invalid input
-	config := container{}
-	err := yaml.Unmarshal([]byte(`tls-verify: "not a valid bool"`), &config)
-	assert.Error(t, err)
-}
-
-func TestSync(t *testing.T) {
-	// Invalid command-line arguments
-	for _, args := range [][]string{
-		{},
-		{"a1"},
-		{"a1", "a2", "a3"},
-	} {
-		out, err := runSkopeo(append([]string{"sync"}, args...)...)
-		assertTestFailed(t, out, err, "Exactly two arguments expected")
-	}
-
-	// FIXME: Much more test coverage
-	// Actual feature tests exist in integration and systemtest
-}

cmd/skopeo/unshare.go

@@ -1,7 +1,8 @@
 //go:build !linux
+// +build !linux
 
 package main
 
-func reexecIfNecessaryForImages(_ ...string) error {
+func reexecIfNecessaryForImages(inputImageNames ...string) error {
 	return nil
 }

cmd/skopeo/unshare_linux.go

@@ -2,11 +2,10 @@ package main
 
 import (
 	"fmt"
-	"slices"
 
 	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/containers/storage/pkg/unshare"
-	"github.com/moby/sys/capability"
+	"github.com/syndtr/gocapability/capability"
 )
 
 var neededCapabilities = []capability.Cap{
@@ -22,32 +21,29 @@ func maybeReexec() error {
 	// With Skopeo we need only the subset of the root capabilities necessary
 	// for pulling an image to the storage.  Do not attempt to create a namespace
 	// if we already have the capabilities we need.
-	capabilities, err := capability.NewPid2(0)
+	capabilities, err := capability.NewPid(0)
 	if err != nil {
 		return fmt.Errorf("error reading the current capabilities sets: %w", err)
 	}
-	if err := capabilities.Load(); err != nil {
-		return fmt.Errorf("error loading the current capabilities sets: %w", err)
-	}
-	if slices.ContainsFunc(neededCapabilities, func(cap capability.Cap) bool {
-		return !capabilities.Get(capability.EFFECTIVE, cap)
-	}) {
-		// We miss a capability we need, create a user namespaces
-		unshare.MaybeReexecUsingUserNamespace(true)
-		return nil
+	for _, cap := range neededCapabilities {
+		if !capabilities.Get(capability.EFFECTIVE, cap) {
+			// We miss a capability we need, create a user namespaces
+			unshare.MaybeReexecUsingUserNamespace(true)
+			return nil
+		}
 	}
 	return nil
 }
 
 func reexecIfNecessaryForImages(imageNames ...string) error {
 	// Check if container-storage is used before doing unshare
-	if slices.ContainsFunc(imageNames, func(imageName string) bool {
+	for _, imageName := range imageNames {
 		transport := alltransports.TransportFromImageName(imageName)
 		// Hard-code the storage name to avoid a reference on c/image/storage.
 		// See https://github.com/containers/skopeo/issues/771#issuecomment-563125006.
-		return transport != nil && transport.Name() == "containers-storage"
-	}) {
-		return maybeReexec()
+		if transport != nil && transport.Name() == "containers-storage" {
+			return maybeReexec()
+		}
 	}
 	return nil
 }

cmd/skopeo/utils.go

@@ -7,19 +7,14 @@ import (
 	"io"
 	"os"
 	"strings"
-	"time"
 
 	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/common/pkg/retry"
 	"github.com/containers/image/v5/directory"
 	"github.com/containers/image/v5/manifest"
-	ocilayout "github.com/containers/image/v5/oci/layout"
 	"github.com/containers/image/v5/pkg/compression"
-	"github.com/containers/image/v5/storage"
 	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/containers/image/v5/types"
-	dockerdistributionerrcode "github.com/docker/distribution/registry/api/errcode"
-	dockerdistributionapi "github.com/docker/distribution/registry/api/v2"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -27,7 +22,7 @@ import (
 	"golang.org/x/term"
 )
 
-// errorShouldDisplayUsage is a subtype of error used by command handlers to indicate that the command’s help should be included.
+// errorShouldDisplayUsage is a subtype of error used by command handlers to indicate that cli.ShowSubcommandHelp should be called.
 type errorShouldDisplayUsage struct {
 	error
 }
@@ -49,7 +44,7 @@ func noteCloseFailure(err error, description string, closeErr error) error {
 	if err == nil {
 		return fmt.Errorf("%s: %w", description, closeErr)
 	}
-	// In this case we prioritize the primary error for use with %w; closeErr is usually less relevant, or might be a consequence of the primary error.
+	// In this case we prioritize the primary error for use with %w; closeErr is usually less relevant, or might be a consequence of the primary erorr.
 	return fmt.Errorf("%w (%s: %v)", err, description, closeErr)
 }
 
@@ -63,8 +58,7 @@ func commandAction(handler func(args []string, stdout io.Writer) error) func(cmd
 		err := handler(args, c.OutOrStdout())
 		var shouldDisplayUsage errorShouldDisplayUsage
 		if errors.As(err, &shouldDisplayUsage) {
-			c.SetOut(c.ErrOrStderr()) // This mutates c, but we are failing anyway.
-			_ = c.Help()              // Even if this failed, we prefer to report the original error
+			return c.Help()
 		}
 		return err
 	}
@@ -185,7 +179,6 @@ func retryFlags() (pflag.FlagSet, *retry.Options) {
 	opts := retry.Options{}
 	fs := pflag.FlagSet{}
 	fs.IntVar(&opts.MaxRetry, "retry-times", 0, "the number of times to possibly retry")
-	fs.DurationVar(&opts.Delay, "retry-delay", 0*time.Second, "Fixed delay between retries. If not set, retry uses an exponential backoff delay.")
 	return fs, &opts
 }
 
@@ -200,8 +193,8 @@ func (opts *imageOptions) newSystemContext() (*types.SystemContext, error) {
 	ctx.AuthFilePath = opts.shared.authFilePath
 	ctx.DockerDaemonHost = opts.dockerDaemonHost
 	ctx.DockerDaemonCertPath = opts.dockerCertPath
-	if opts.authFilePath.Present() {
-		ctx.AuthFilePath = opts.authFilePath.Value()
+	if opts.dockerImageOptions.authFilePath.Present() {
+		ctx.AuthFilePath = opts.dockerImageOptions.authFilePath.Value()
 	}
 	if opts.deprecatedTLSVerify != nil && opts.deprecatedTLSVerify.tlsVerify.Present() {
 		// If both this deprecated option and a non-deprecated option is present, we use the latter value.
@@ -322,11 +315,14 @@ func parseCreds(creds string) (string, string, error) {
 	if creds == "" {
 		return "", "", errors.New("credentials can't be empty")
 	}
-	username, password, _ := strings.Cut(creds, ":") // Sets password to "" if there is no ":"
-	if username == "" {
+	up := strings.SplitN(creds, ":", 2)
+	if len(up) == 1 {
+		return up[0], "", nil
+	}
+	if up[0] == "" {
 		return "", "", errors.New("username can't be empty")
 	}
-	return username, password, nil
+	return up[0], up[1], nil
 }
 
 func getDockerAuth(creds string) (*types.DockerAuthConfig, error) {
@@ -413,23 +409,3 @@ func promptForPassphrase(privateKeyFile string, stdin, stdout *os.File) (string,
 	fmt.Fprintf(stdout, "\n")
 	return string(passphrase), nil
 }
-
-// isNotFoundImageError heuristically attempts to determine whether an error
-// is saying the remote source couldn't find the image (as opposed to an
-// authentication error, an I/O error etc.)
-// TODO drive this into containers/image properly
-func isNotFoundImageError(err error) bool {
-	return isDockerManifestUnknownError(err) ||
-		errors.Is(err, storage.ErrNoSuchImage) ||
-		errors.Is(err, ocilayout.ImageNotFoundError{})
-}
-
-// isDockerManifestUnknownError is a copy of code from containers/image,
-// please update there first.
-func isDockerManifestUnknownError(err error) bool {
-	var ec dockerdistributionerrcode.ErrorCoder
-	if !errors.As(err, &ec) {
-		return false
-	}
-	return ec.ErrorCode() == dockerdistributionapi.ErrorCodeManifestUnknown
-}

cmd/skopeo/utils_test.go

@@ -385,6 +385,7 @@ func TestParseManifestFormat(t *testing.T) {
 // since there is a shared authfile image option and a non-shared (prefixed) one, make sure the override logic
 // works correctly.
 func TestImageOptionsAuthfileOverride(t *testing.T) {
+
 	for _, testCase := range []struct {
 		flagPrefix           string
 		cmdFlags             []string

contrib/cirrus/mac_cleanup.sh

@@ -1,40 +0,0 @@
-#!/bin/bash
-
-# This script is intended to be called by Cirrus-CI on a Mac M1 persistent worker.
-# It performs a best-effort attempt at cleaning up from one task execution to the next.
-# Since it run both before and after tasks, it must exit cleanly if there was a cleanup
-# failure (i.e. file or directory not found).
-
-# Help anybody debugging side-effects, since failures are ignored (by necessity).
-set +e -x
-
-# These are the main processes which could leak out of testing.
-killall podman vfkit gvproxy make go ginkgo
-
-mkdir -p $TMPDIR
-
-# Golang will leave behind lots of read-only bits, ref:
-# https://go.dev/ref/mod#module-cache
-# However other tools/scripts could also set things read-only.
-# At this point in CI, we really want all this stuff gone-gone,
-# so there's actually zero-chance it can interfere.
-chmod -R u+w $TMPDIR/* $TMPDIR/.??*
-
-# This is defined as $TMPDIR during setup.  Name must be kept
-# "short" as sockets may reside here.  Darwin suffers from
-# the same limited socket-pathname character-length restriction
-# as Linux.
-rm -rf $TMPDIR/* $TMPDIR/.??*
-
-# Don't change or clobber anything under $CIRRUS_WORKING_DIR for
-# the currently running task.  But make sure we have write permission
-# (go get sets dependencies ro) for everything else, before removing it.
-# First make everything writeable - see the "Golang will..." comment above.
-# shellcheck disable=SC2154
-find "$HOME/ci" -mindepth 1 -maxdepth 1 \
-    -not -name "*task-${CIRRUS_TASK_ID}*" -prune -exec chmod -R u+w '{}' +
-find "$HOME/ci" -mindepth 1 -maxdepth 1 \
-    -not -name "*task-${CIRRUS_TASK_ID}*" -prune -exec rm -rf '{}' +
-
-# Bash scripts exit with the status of the last command.
-true

contrib/cirrus/ostree_ext.dockerfile

@@ -8,7 +8,7 @@ ARG CIRRUS_IMAGE_VERSION
 ENV CIRRUS_IMAGE_VERSION=$CIRRUS_IMAGE_VERSION
 ADD https://sh.rustup.rs /var/tmp/rustup_installer.sh
 
-RUN dnf remove -y rust && \
+RUN dnf erase -y rust && \
     chmod +x /var/tmp/rustup_installer.sh && \
     /var/tmp/rustup_installer.sh -y --default-toolchain stable --profile minimal
 

contrib/cirrus/runner.sh

@@ -6,6 +6,17 @@
 
 set -e
 
+_EOL=20270501
+if [[ $(date +%Y%m%d) -ge $_EOL ]]; then
+    die "As of $_EOL this branch is probably
+no longer supported in RHEL 9.2/8.8, please
+confirm this with RHEL Program Management.  If so:
+It should be removed from Cirrus-Cron,
+the .cirrus.yml file removed, and
+the VM images (manually) unmarked
+'permanent=true'"
+fi
+
 # BEGIN Global export of all variables
 set -a
 
@@ -53,7 +64,7 @@ _run_setup() {
     fi
 
     # VM's come with the distro. skopeo package pre-installed
-    dnf remove -y skopeo
+    dnf erase -y skopeo
 
     msg "Removing systemd-resolved from nsswitch.conf"
     # /etc/resolv.conf is already set to bypass systemd-resolvd
@@ -128,7 +139,7 @@ _run_system() {
     make test-system-local BUILDTAGS="$BUILDTAGS"
 }
 
-req_env_vars SKOPEO_PATH
+req_env_vars SKOPEO_PATH BUILDTAGS
 
 handler="_run_${1}"
 if [ "$(type -t $handler)" != "function" ]; then

contrib/skopeoimage/README.md

@@ -1,2 +1,70 @@
-The skopeo container image build context and automation have been
-moved to [https://github.com/containers/image_build/tree/main/skopeo](https://github.com/containers/image_build/tree/main/skopeo)
+[comment]: <> (***ATTENTION*** ***WARNING*** ***ALERT*** ***CAUTION*** ***DANGER***)
+[comment]: <> ()
+[comment]: <> (ANY changes made to this file, once commited/merged must)
+[comment]: <> (be manually copy/pasted -in markdown- into the description)
+[comment]: <> (field on Quay at the following locations:)
+[comment]: <> ()
+[comment]: <> (https://quay.io/repository/containers/skopeo)
+[comment]: <> (https://quay.io/repository/skopeo/stable)
+[comment]: <> (https://quay.io/repository/skopeo/testing)
+[comment]: <> (https://quay.io/repository/skopeo/upstream)
+[comment]: <> ()
+[comment]: <> (***ATTENTION*** ***WARNING*** ***ALERT*** ***CAUTION*** ***DANGER***)
+
+<img src="https://cdn.rawgit.com/containers/skopeo/main/docs/skopeo.svg" width="250">
+
+----
+
+# skopeoimage
+
+## Overview
+
+This directory contains the Containerfiles necessary to create the skopeoimage container
+images that are housed on quay.io under the skopeo account.  All repositories where
+the images live are public and can be pulled without credentials.  These container images are secured and the
+resulting containers can run safely with privileges within the container.
+
+The container images are built using the latest Fedora and then Skopeo is installed into them.
+The PATH in the container images is set to the default PATH provided by Fedora.  Also, the
+ENTRYPOINT and the WORKDIR variables are not set within these container images, as such they
+default to `/`.
+
+The container images are:
+
+  * `quay.io/containers/skopeo:v<version>` and `quay.io/skopeo/stable:v<version>` -
+    These images are built daily.  These images are intended contain an unchanging
+    and stable version of skopeo.  For the most recent `<version>` tags (`vX`,
+    `vX.Y`, and `vX.Y.Z`) the image contents will be updated daily to incorporate
+    (especially) security updates.  For build details, please[see the configuration
+    file](stable/Containerfile).
+  * `quay.io/containers/skopeo:latest` and `quay.io/skopeo/stable:latest` -
+    Built daily using the same Containerfile as above.  The skopeo version
+    will remain the "latest" available in Fedora, however the other image
+    contents may vary compared to the version-tagged images.
+  * `quay.io/skopeo/testing:latest` - This image is built daily, using the
+    latest version of Skopeo that was in the Fedora `updates-testing` repository.
+    The image is Built with [the testing Containerfile](testing/Containerfile).
+  * `quay.io/skopeo/upstream:latest` - This image is built daily using the latest
+    code found in this GitHub repository.  Due to the image changing frequently,
+    it's not guaranteed to be stable or even executable.  The image is built with
+    [the upstream Containerfile](upstream/Containerfile).
+
+
+## Sample Usage
+
+Although not required, it is suggested that [Podman](https://github.com/containers/podman) be used with these container images.
+
+```
+# Get Help on Skopeo
+podman run docker://quay.io/skopeo/stable:latest --help
+
+# Get help on the Skopeo Copy command
+podman run docker://quay.io/skopeo/stable:latest copy --help
+
+# Copy the Skopeo container image from quay.io to
+# a private registry
+podman run docker://quay.io/skopeo/stable:latest copy docker://quay.io/skopeo/stable docker://registry.internal.company.com/skopeo
+
+# Inspect the fedora:latest image
+podman run docker://quay.io/skopeo/stable:latest inspect --config docker://registry.fedoraproject.org/fedora:latest  | jq
+```

contrib/skopeoimage/stable/Containerfile

@@ -0,0 +1,47 @@
+# stable/Containerfile
+#
+# Build a Skopeo container image from the latest
+# stable version of Skopeo on the Fedoras Updates System.
+# https://bodhi.fedoraproject.org/updates/?search=skopeo
+# This image can be used to create a secured container
+# that runs safely with privileges within the container.
+#
+FROM registry.fedoraproject.org/fedora:latest
+
+# Don't include container-selinux and remove
+# directories used by dnf that are just taking
+# up space.
+# TODO: rpm --setcaps... needed due to Fedora (base) image builds
+#       being (maybe still?) affected by
+#       https://bugzilla.redhat.com/show_bug.cgi?id=1995337#c3
+RUN dnf -y update && \
+    rpm --setcaps shadow-utils 2>/dev/null && \
+    dnf -y install skopeo fuse-overlayfs \
+        --exclude container-selinux && \
+    dnf clean all && \
+    rm -rf /var/cache /var/log/dnf* /var/log/yum.*
+
+RUN useradd skopeo && \
+    echo skopeo:100000:65536 > /etc/subuid && \
+    echo skopeo:100000:65536 > /etc/subgid
+
+# Copy & modify the defaults to provide reference if runtime changes needed.
+# Changes here are required for running with fuse-overlay storage inside container.
+RUN sed -e 's|^#mount_program|mount_program|g' \
+        -e '/additionalimage.*/a "/var/lib/shared",' \
+        -e 's|^mountopt[[:space:]]*=.*$|mountopt = "nodev,fsync=0"|g' \
+        /usr/share/containers/storage.conf \
+        > /etc/containers/storage.conf
+
+# Setup the ability to use additional stores
+# with this container image.
+RUN mkdir -p /var/lib/shared/overlay-images \
+             /var/lib/shared/overlay-layers && \
+    touch /var/lib/shared/overlay-images/images.lock && \
+    touch /var/lib/shared/overlay-layers/layers.lock
+
+# Point to the Authorization file
+ENV REGISTRY_AUTH_FILE=/tmp/auth.json
+
+# Set the entrypoint
+ENTRYPOINT ["/usr/bin/skopeo"]

contrib/skopeoimage/testing/Containerfile

@@ -0,0 +1,49 @@
+# testing/Containerfile
+#
+# Build a Skopeo container image from the latest
+# version of Skopeo that is in updates-testing
+# on the Fedoras Updates System.
+# https://bodhi.fedoraproject.org/updates/?search=skopeo
+# This image can be used to create a secured container
+# that runs safely with privileges within the container.
+#
+FROM registry.fedoraproject.org/fedora:latest
+
+# Don't include container-selinux and remove
+# directories used by dnf that are just taking
+# up space.
+# TODO: rpm --setcaps... needed due to Fedora (base) image builds
+#       being (maybe still?) affected by
+#       https://bugzilla.redhat.com/show_bug.cgi?id=1995337#c3
+RUN dnf -y update && \
+    rpm --setcaps shadow-utils 2>/dev/null && \
+    dnf -y install skopeo fuse-overlayfs \
+        --exclude container-selinux \
+        --enablerepo updates-testing && \
+    dnf clean all && \
+    rm -rf /var/cache /var/log/dnf* /var/log/yum.*
+
+RUN useradd skopeo && \
+    echo skopeo:100000:65536 > /etc/subuid && \
+    echo skopeo:100000:65536 > /etc/subgid
+
+# Copy & modify the defaults to provide reference if runtime changes needed.
+# Changes here are required for running with fuse-overlay storage inside container.
+RUN sed -e 's|^#mount_program|mount_program|g' \
+        -e '/additionalimage.*/a "/var/lib/shared",' \
+        -e 's|^mountopt[[:space:]]*=.*$|mountopt = "nodev,fsync=0"|g' \
+        /usr/share/containers/storage.conf \
+        > /etc/containers/storage.conf
+
+# Setup the ability to use additional stores
+# with this container image.
+RUN mkdir -p /var/lib/shared/overlay-images \
+             /var/lib/shared/overlay-layers && \
+    touch /var/lib/shared/overlay-images/images.lock && \
+    touch /var/lib/shared/overlay-layers/layers.lock
+
+# Point to the Authorization file
+ENV REGISTRY_AUTH_FILE=/tmp/auth.json
+
+# Set the entrypoint
+ENTRYPOINT ["/usr/bin/skopeo"]

contrib/skopeoimage/upstream/Containerfile

@@ -0,0 +1,50 @@
+# upstream/Containerfile
+#
+# Build a Skopeo container image from the latest
+# upstream version of Skopeo on GitHub.
+# https://github.com/containers/skopeo
+# This image can be used to create a secured container
+# that runs safely with privileges within the container.
+#
+FROM registry.fedoraproject.org/fedora:latest
+
+# Don't include container-selinux and remove
+# directories used by dnf that are just taking
+# up space.
+# TODO: rpm --setcaps... needed due to Fedora (base) image builds
+#       being (maybe still?) affected by
+#       https://bugzilla.redhat.com/show_bug.cgi?id=1995337#c3
+RUN dnf -y update && \
+    rpm --setcaps shadow-utils 2>/dev/null && \
+    dnf -y install 'dnf-command(copr)' --enablerepo=updates-testing && \
+    dnf -y copr enable rhcontainerbot/podman-next && \
+    dnf -y install skopeo \
+        --exclude container-selinux \
+        --enablerepo=updates-testing && \
+    dnf clean all && \
+    rm -rf /var/cache /var/log/dnf* /var/log/yum.*
+
+RUN useradd skopeo && \
+    echo skopeo:100000:65536 > /etc/subuid && \
+    echo skopeo:100000:65536 > /etc/subgid
+
+# Copy & modify the defaults to provide reference if runtime changes needed.
+# Changes here are required for running with fuse-overlay storage inside container.
+RUN sed -e 's|^#mount_program|mount_program|g' \
+        -e '/additionalimage.*/a "/var/lib/shared",' \
+        -e 's|^mountopt[[:space:]]*=.*$|mountopt = "nodev,fsync=0"|g' \
+        /usr/share/containers/storage.conf \
+        > /etc/containers/storage.conf
+
+# Setup the ability to use additional stores
+# with this container image.
+RUN mkdir -p /var/lib/shared/overlay-images \
+             /var/lib/shared/overlay-layers && \
+    touch /var/lib/shared/overlay-images/images.lock && \
+    touch /var/lib/shared/overlay-layers/layers.lock
+
+# Point to the Authorization file
+ENV REGISTRY_AUTH_FILE=/tmp/auth.json
+
+# Set the entrypoint
+ENTRYPOINT ["/usr/bin/skopeo"]

docs/skopeo-copy.1.md

@@ -20,8 +20,6 @@ automatically inherit any parts of the source name.
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--additional-tag**=_strings_
 
 Additional tags (supports docker-archive).
@@ -58,9 +56,7 @@ After copying the image, write the digest of the resulting image to the file.
 
 **--preserve-digests**
 
-Preserve the digests during copying. Fail if the digest cannot be preserved.
-
-This option does not change what will be copied; consider using `--all` at the same time.
+Preserve the digests during copying. Fail if the digest cannot be preserved. Consider using `--all` at the same time.
 
 **--encrypt-layer** _ints_
 
@@ -182,9 +178,7 @@ Existing signatures, if any, are preserved as well.
 
 **--dest-compress-format** _format_
 
-Specifies the compression format to use.  Supported values are: `gzip`, `zstd` and `zstd:chunked`.
-`zstd:chunked` is incompatible with encrypting images,
-and will be treated as `zstd` with a warning in that case.
+Specifies the compression format to use.  Supported values are: `gzip` and `zstd`.
 
 **--dest-compress-level** _format_
 
@@ -204,11 +198,7 @@ Precompute digests to ensure layers are not uploaded that already exist on the d
 
 **--retry-times**
 
-The number of times to retry.
-
-**--retry-delay**
-
-Fixed delay between retries. If not set (or set to 0s), retry wait time will be exponentially increased based on the number of failed attempts.
+The number of times to retry. Retry wait time will be exponentially increased based on the number of failed attempts.
 
 **--src-username**
 
@@ -226,10 +216,6 @@ The username to access the destination registry.
 
 The password to access the destination registry.
 
-**--image-parallel-copies** _n_
-
-Maximum number of image layers to be copied (pulled/pushed) simultaneously. Not setting this field will fall back to containers/image defaults.
-
 ## EXAMPLES
 
 To just copy an image from one registry to another:

docs/skopeo-delete.1.md

@@ -31,8 +31,6 @@ $ docker exec -it registry /usr/bin/registry garbage-collect /etc/docker-distrib
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--authfile** _path_
 
 Path of the authentication file. Default is ${XDG_RUNTIME\_DIR}/containers/auth.json, which is set using `skopeo login`.
@@ -66,11 +64,7 @@ Bearer token for accessing the registry.
 
 **--retry-times**
 
-The number of times to retry.
-
-**--retry-delay**
-
-Fixed delay between retries. If not set (or set to 0s), retry wait time will be exponentially increased based on the number of failed attempts.
+The number of times to retry. Retry wait time will be exponentially increased based on the number of failed attempts.
 
 **--shared-blob-dir** _directory_
 

docs/skopeo-generate-sigstore-key.1.md

@@ -13,12 +13,10 @@ The private key is encrypted with a passphrase;
 if one is not provided using an option, this command prompts for it interactively.
 
 The private key is written to _prefix_**.private** .
-The public key is written to _prefix_**.pub** .
+The private key is written to _prefix_**.pub** .
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--help**, **-h**
 
 Print usage statement

docs/skopeo-inspect.1.md

@@ -17,8 +17,6 @@ To see values for a different architecture/OS, use the **--override-os** / **--o
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--authfile** _path_
 
 Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json, which is set using `skopeo login`.
@@ -44,7 +42,6 @@ Use docker daemon host at _host_ (`docker-daemon:` transport only)
 
 Format the output using the given Go template.
 The keys of the returned JSON can be used as the values for the --format flag (see examples below).
-Supports the Go templating functions available at https://pkg.go.dev/github.com/containers/common/pkg/report#hdr-Template_Functions
 
 **--help**, **-h**
 
@@ -65,11 +62,7 @@ Registry token for accessing the registry.
 
 **--retry-times**
 
-The number of times to retry.
-
-**--retry-delay**
-
-Fixed delay between retries. If not set (or set to 0s), retry wait time will be exponentially increased based on the number of failed attempts.
+The number of times to retry; retry wait time will be exponentially increased based on the number of failed attempts.
 
 **--shared-blob-dir** _directory_
 

docs/skopeo-list-tags.1.md

@@ -12,8 +12,6 @@ Return a list of tags from _source-image_ in a registry or a local docker-archiv
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--authfile** _path_
 
 Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json, which is set using `skopeo login`.
@@ -39,11 +37,7 @@ Bearer token for accessing the registry.
 
 **--retry-times**
 
-The number of times to retry.
-
-**--retry-delay**
-
-Fixed delay between retries. If not set (or set to 0s), retry wait time will be exponentially increased based on the number of failed attempts.
+The number of times to retry. Retry wait time will be exponentially increased based on the number of failed attempts.
 
 **--tls-verify**=_bool_
 

docs/skopeo-login.1.md

@@ -15,8 +15,6 @@ flag. The default path used is **${XDG\_RUNTIME\_DIR}/containers/auth.json**.
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--password**, **-p**=*password*
 
 Password for registry
@@ -36,10 +34,6 @@ Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth
 Note: You can also override the default path of the authentication file by setting the REGISTRY\_AUTH\_FILE
 environment variable. `export REGISTRY_AUTH_FILE=path`
 
-**--compat-auth-file**=*path*
-
-Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format.
-
 **--get-login**
 
 Return the logged-in user for the registry. Return error if no login is found.

docs/skopeo-logout.1.md

@@ -14,8 +14,6 @@ All the cached credentials can be removed by setting the **all** flag.
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--authfile**=*path*
 
 Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json
@@ -23,10 +21,6 @@ Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth
 Note: You can also override the default path of the authentication file by setting the REGISTRY\_AUTH\_FILE
 environment variable. `export REGISTRY_AUTH_FILE=path`
 
-**--compat-auth-file**=*path*
-
-Instead of updating the default credentials file, update the one at *path*, and use a Docker-compatible format.
-
 **--all**, **-a**
 
 Remove the cached credentials for all registries in the auth file

docs/skopeo-standalone-sign.1.md

@@ -1,7 +1,7 @@
 % skopeo-standalone-sign(1)
 
 ## NAME
-skopeo\-standalone-sign - Debugging tool - Sign an image locally without uploading.
+skopeo\-standalone-sign - Debugging tool - Publish and sign an image in one step.
 
 ## SYNOPSIS
 **skopeo standalone-sign** [*options*] _manifest_ _docker-reference_ _key-fingerprint_ **--output**|**-o** _signature_
@@ -17,8 +17,6 @@ This is primarily a debugging tool, useful for special cases, and usually should
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--help**, **-h**
 
 Print usage statement

docs/skopeo-standalone-verify.1.md

@@ -1,10 +1,10 @@
 % skopeo-standalone-verify(1)
 
 ## NAME
-skopeo\-standalone\-verify - Debugging tool - Verify an image signature from local files.
+skopeo\-standalone\-verify - Verify an image signature.
 
 ## SYNOPSIS
-**skopeo standalone-verify** _manifest_ _docker-reference_ _key-fingerprints_ _signature_
+**skopeo standalone-verify** _manifest_ _docker-reference_ _key-fingerprint_ _signature_
 
 ## DESCRIPTION
 
@@ -16,7 +16,7 @@ as per containers-policy.json(5).
 
   _docker-reference_ A docker reference expected to identify the image in the signature
 
-  _key-fingerprints_ Identities of trusted signing keys (comma separated), or "any" to trust any known key when using a public key file
+  _key-fingerprint_ Expected identity of the signing key
 
   _signature_ Path to signature file
 
@@ -24,16 +24,10 @@ as per containers-policy.json(5).
 
 ## OPTIONS
 
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--help**, **-h**
 
 Print usage statement
 
-**--public-key-file** _public key file_
-
-File containing the public keys to use when verifying signatures. If this is not specified, keys from the GPG homedir are used.
-
 ## EXAMPLES
 
 ```console

docs/skopeo-sync.1.md

@@ -8,7 +8,10 @@ skopeo\-sync - Synchronize images between registry repositories and local direct
 **skopeo sync** [*options*] --src _transport_ --dest _transport_ _source_ _destination_
 
 ## DESCRIPTION
-Synchronize images between registry repositories and local directories. Synchronization is achieved by copying all the images found at _source_ to _destination_ - useful when synchronizing a local container registry mirror or for populating registries running inside of air-gapped environments.
+Synchronize images between registry repoositories and local directories.
+The synchronization is achieved by copying all the images found at _source_ to _destination_.
+
+Useful to synchronize a local container registry mirror, and to to populate registries running inside of air-gapped environments.
 
 Differently from other skopeo commands, skopeo sync requires both source and destination transports to be specified separately from _source_ and _destination_.
 One of the problems of prefixing a destination with its transport is that, the registry `docker://hostname:port` would be wrongly interpreted as an image reference at a non-fully qualified registry, with `hostname` and `port` the image name and tag.
@@ -29,9 +32,6 @@ When the `--scoped` option is specified, images are prefixed with the source ima
 name can be stored at _destination_.
 
 ## OPTIONS
-
-See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
-
 **--all**, **-a**
 If one of the images in __src__ refers to a list of images, instead of copying just the image which matches the current OS and
 architecture (subject to the use of the global --override-os, --override-arch and --override-variant options), attempt to copy all of
@@ -68,21 +68,7 @@ Print usage statement.
 
 **--append-suffix** _tag-suffix_ String to append to destination tags.
 
-**--digestfile** _path_
-
-After copying the images from source, write the digest of the resulting images along with Image Reference.
-
-```
-sha256:bf91f90823248017a4f920fb541727fa8368dc6cf377a7debbd271cf6a31c8a7 docker://myhost.com/alpine:edge
-sha256:31603596830fc7e56753139f9c2c6bd3759e48a850659506ebfb885d1cf3aef5 docker://myhost.com/postgres:14.3
-
-```
-
-**--preserve-digests**
-
-Preserve the digests during copying. Fail if the digest cannot be preserved.
-
-This option does not change what will be copied; consider using `--all` at the same time.
+**--preserve-digests** Preserve the digests during copying. Fail if the digest cannot be preserved. Consider using `--all` at the same time.
 
 **--remove-signatures** Do not copy signatures, if any, from _source-image_. This is necessary when copying a signed image to a destination which does not support signatures.
 
@@ -123,13 +109,7 @@ The passphare to use when signing with `--sign-by` or `--sign-by-sigstore-privat
 
 **--dest-registry-token** _Bearer token_ for accessing the destination registry.
 
-**--retry-times**
-
-The number of times to retry.
-
-**--retry-delay**
-
-Fixed delay between retries. If not set (or set to 0s), retry wait time will be exponentially increased based on the number of failed attempts.
+**--retry-times**  the number of times to retry, retry wait time will be exponentially increased based on the number of failed attempts.
 
 **--keep-going**
 If any errors occur during copying of images, those errors are logged and the process continues syncing rest of the images and finally fails at the end.
@@ -235,8 +215,6 @@ registry.example.com:
             - "sha256:0000000000000000000000000000000011111111111111111111111111111111"
     images-by-tag-regex:
         nginx: ^1\.13\.[12]-alpine-perl$
-    images-by-semver:
-        alpine: ">= 3.12.0"
     credentials:
         username: john
         password: this is a secret
@@ -257,14 +235,6 @@ This will copy the following images:
 - Repository `registry.example.com/redis`: images tagged "1.0" and "2.0" along with image with digest "sha256:0000000000000000000000000000000011111111111111111111111111111111".
 - Repository `registry.example.com/nginx`: images tagged "1.13.1-alpine-perl" and "1.13.2-alpine-perl".
 - Repository `quay.io/coreos/etcd`: images tagged "latest".
-- Repository `registry.example.com/alpine`: all images with tags match the semantic version constraint ">= 3.12.0" ("3.12.0, "3.12.1", ... ,"4.0.0", ...)
-
-The full list of possible semantic version comparisons can be found in the
-upstream library's documentation:
-https://github.com/Masterminds/semver/tree/v3.2.0#basic-comparisons.
-
-Version ordering and precedence is understood as defined here:
-https://semver.org/#spec-item-11.
 
 For the registry `registry.example.com`, the "john"/"this is a secret" credentials are used, with server TLS certificates located at `/home/john/certs`.
 

docs/skopeo.1.md

@@ -51,9 +51,6 @@ See [containers-transports(5)](https://github.com/containers/image/blob/main/doc
 
 ## OPTIONS
 
-These options should be placed before the subcommand name.
-Individual subcommands have their own options.
-
 **--command-timeout** _duration_
 
 Timeout for the command execution.
@@ -110,19 +107,10 @@ Print the version number
 | [skopeo-login(1)](skopeo-login.1.md)  | Login to a container registry. |
 | [skopeo-logout(1)](skopeo-logout.1.md)  | Logout of a container registry. |
 | [skopeo-manifest-digest(1)](skopeo-manifest-digest.1.md)    | Compute a manifest digest for a manifest-file and write it to standard output. |
-| [skopeo-standalone-sign(1)](skopeo-standalone-sign.1.md)    | Debugging tool - Sign an image locally without uploading.    |
-| [skopeo-standalone-verify(1)](skopeo-standalone-verify.1.md)| Debugging tool - Verify an image signature from local files. |
+| [skopeo-standalone-sign(1)](skopeo-standalone-sign.1.md)    | Debugging tool - Publish and sign an image in one step.      |
+| [skopeo-standalone-verify(1)](skopeo-standalone-verify.1.md)| Verify an image signature.                                   |
 | [skopeo-sync(1)](skopeo-sync.1.md)| Synchronize images between registry repositories and local directories.                |
 
-## EXIT STATUS
-`skopeo` exits with status 0 on success, non-zero on error.
-
-Details about the exit statuses:
-
-**1** Generic error, details can be found in the error message.
-
-**2** The input image cannot be found. Note that this is best effort and for remote registries the status often cannot be reliably reported.
-
 ## FILES
   **/etc/containers/policy.json**
   Default trust policy file, if **--policy** is not specified.
@@ -130,7 +118,7 @@ Details about the exit statuses:
 
   **/etc/containers/registries.d**
   Default directory containing registry configuration, if **--registries.d** is not specified.
-  The contents of this directory are documented in [containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md).
+  The contents of this directory are documented in [containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md).
 
 ## SEE ALSO
 skopeo-login(1), docker-login(1), containers-auth.json(5), containers-storage.conf(5), containers-policy.json(5), containers-transports(5)

go.mod

@@ -1,137 +1,136 @@
 module github.com/containers/skopeo
 
-// Minimum required golang version
-go 1.23.3
-
-// Warning: Ensure the "go" and "toolchain" versions match exactly to prevent unwanted auto-updates
+go 1.17
 
 require (
-	github.com/Masterminds/semver/v3 v3.3.1
-	github.com/containers/common v0.63.0
-	github.com/containers/image/v5 v5.35.0
-	github.com/containers/ocicrypt v1.2.1
-	github.com/containers/storage v1.58.0
-	github.com/docker/distribution v2.8.3+incompatible
-	github.com/moby/sys/capability v0.4.0
+	github.com/containers/common v0.51.4
+	github.com/containers/image/v5 v5.24.3
+	github.com/containers/ocicrypt v1.1.10
+	github.com/containers/storage v1.45.3
+	github.com/docker/distribution v2.8.1+incompatible
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec v1.1.1
+	github.com/opencontainers/image-spec v1.1.0-rc2
 	github.com/opencontainers/image-tools v1.0.0-rc3
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.6
-	github.com/stretchr/testify v1.10.0
-	golang.org/x/term v0.32.0
-	gopkg.in/yaml.v3 v3.0.1
+	github.com/spf13/cobra v1.6.1
+	github.com/spf13/pflag v1.0.5
+	github.com/stretchr/testify v1.8.1
+	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
+	golang.org/x/term v0.17.0
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
+	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/Microsoft/hcsshim v0.12.9 // indirect
+	github.com/BurntSushi/toml v1.2.1 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
+	github.com/Microsoft/hcsshim v0.9.6 // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/containerd/cgroups/v3 v3.0.5 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
-	github.com/containerd/typeurl/v2 v2.2.3 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
+	github.com/containerd/cgroups v1.0.4 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.13.0 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
-	github.com/coreos/go-oidc/v3 v3.13.0 // indirect
-	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
-	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/docker v28.0.4+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.5.0 // indirect
+	github.com/cyberphone/json-canonicalization v0.0.0-20220623050100-57a0ce2678a7 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.3 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/docker/docker v20.10.23+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.7.0 // indirect
+	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.23.0 // indirect
-	github.com/go-openapi/errors v0.22.1 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/jsonreference v0.21.0 // indirect
-	github.com/go-openapi/loads v0.22.0 // indirect
-	github.com/go-openapi/runtime v0.28.0 // indirect
-	github.com/go-openapi/spec v0.21.0 // indirect
-	github.com/go-openapi/strfmt v0.23.0 // indirect
-	github.com/go-openapi/swag v0.23.1 // indirect
-	github.com/go-openapi/validate v0.24.0 // indirect
+	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
+	github.com/ghodss/yaml v1.0.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
+	github.com/go-openapi/analysis v0.21.4 // indirect
+	github.com/go-openapi/errors v0.20.3 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.20.0 // indirect
+	github.com/go-openapi/loads v0.21.2 // indirect
+	github.com/go-openapi/runtime v0.24.1 // indirect
+	github.com/go-openapi/spec v0.20.7 // indirect
+	github.com/go-openapi/strfmt v0.21.3 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-openapi/validate v0.22.0 // indirect
+	github.com/go-playground/locales v0.14.0 // indirect
+	github.com/go-playground/universal-translator v0.18.0 // indirect
+	github.com/go-playground/validator/v10 v10.11.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/go-containerregistry v0.20.3 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-containerregistry v0.13.0 // indirect
 	github.com/google/go-intervals v0.0.2 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/google/trillian v1.5.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/gorilla/mux v1.8.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-multierror v1.1.2-0.20250313123807-1ee6e1a1957a // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/mattn/go-sqlite3 v1.14.27 // indirect
+	github.com/klauspost/compress v1.15.15 // indirect
+	github.com/klauspost/pgzip v1.2.6-0.20220930104621-17e8dac29df8 // indirect
+	github.com/kr/pretty v0.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/leodido/go-urn v1.2.1 // indirect
+	github.com/letsencrypt/boulder v0.0.0-20230130200452-c091e64aa391 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mattn/go-runewidth v0.0.14 // indirect
+	github.com/mattn/go-shellwords v1.0.12 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
-	github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
+	github.com/mistifyio/go-zfs/v3 v3.0.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/sys/mountinfo v0.7.2 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/mountinfo v0.6.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/opencontainers/runtime-spec v1.2.1 // indirect
-	github.com/opencontainers/selinux v1.12.0 // indirect
+	github.com/opencontainers/runc v1.1.4 // indirect
+	github.com/opencontainers/runtime-spec v1.0.3-0.20220825212826-86290f6a00fb // indirect
+	github.com/opencontainers/selinux v1.10.2 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/proglottis/gpgme v0.1.4 // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/proglottis/gpgme v0.1.3 // indirect
+	github.com/rivo/uniseg v0.4.3 // indirect
+	github.com/rogpeppe/go-internal v1.8.0 // indirect
 	github.com/russross/blackfriday v2.0.0+incompatible // indirect
-	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
-	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
-	github.com/sigstore/fulcio v1.6.6 // indirect
-	github.com/sigstore/protobuf-specs v0.4.1 // indirect
-	github.com/sigstore/rekor v1.3.10 // indirect
-	github.com/sigstore/sigstore v1.9.3 // indirect
+	github.com/sigstore/fulcio v1.0.0 // indirect
+	github.com/sigstore/rekor v1.0.1 // indirect
+	github.com/sigstore/sigstore v1.5.2 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
-	github.com/smallstep/pkcs7 v0.1.1 // indirect
-	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
-	github.com/sylabs/sif/v2 v2.21.1 // indirect
-	github.com/tchap/go-patricia/v2 v2.3.2 // indirect
+	github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980 // indirect
+	github.com/sylabs/sif/v2 v2.9.0 // indirect
+	github.com/tchap/go-patricia v2.3.0+incompatible // indirect
+	github.com/theupdateframework/go-tuf v0.5.2-0.20221207161717-9cb61d6e65f5 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
-	github.com/ulikunitz/xz v0.5.12 // indirect
-	github.com/vbatts/tar-split v0.12.1 // indirect
-	github.com/vbauerster/mpb/v8 v8.9.3 // indirect
-	go.mongodb.org/mongo-driver v1.14.0 // indirect
+	github.com/ulikunitz/xz v0.5.11 // indirect
+	github.com/vbatts/tar-split v0.11.2 // indirect
+	github.com/vbauerster/mpb/v7 v7.5.3 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	go.etcd.io/bbolt v1.3.6 // indirect
+	go.mongodb.org/mongo-driver v1.11.1 // indirect
+	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
-	go.opentelemetry.io/otel v1.34.0 // indirect
-	go.opentelemetry.io/otel/metric v1.34.0 // indirect
-	go.opentelemetry.io/otel/trace v1.34.0 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
-	golang.org/x/mod v0.23.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/oauth2 v0.29.0 // indirect
-	golang.org/x/sync v0.13.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
-	google.golang.org/grpc v1.71.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	golang.org/x/crypto v0.19.0 // indirect
+	golang.org/x/mod v0.8.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/oauth2 v0.7.0 // indirect
+	golang.org/x/sync v0.1.0 // indirect
+	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/tools v0.6.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
+	google.golang.org/grpc v1.56.3 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
+	gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

hack/btrfs_installed_tag.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-${CPP:-${CC:-cc} -E} ${CPPFLAGS} - > /dev/null 2> /dev/null << EOF
+cc -E - > /dev/null 2> /dev/null << EOF
 #include <btrfs/ioctl.h>
 EOF
 if test $? -ne 0 ; then

hack/btrfs_tag.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+cc -E - > /dev/null 2> /dev/null << EOF
+#include <btrfs/version.h>
+EOF
+if test $? -ne 0 ; then
+	echo btrfs_noversion
+fi

hack/get_fqin.sh

@@ -29,6 +29,6 @@ $CONTAINER_RUNTIME run --rm \
     --entrypoint=/usr/share/automation/bin/cirrus-ci_env.py \
     quay.io/libpod/get_ci_vm:latest \
     --envs="Skopeo Test" /src/.cirrus.yml | \
-    grep -E -m1 '^SKOPEO_CIDEV_CONTAINER_FQIN' | \
+    egrep -m1 '^SKOPEO_CIDEV_CONTAINER_FQIN' | \
     awk -F "=" -e '{print $2}' | \
     tr -d \'\"

hack/libdm_tag.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+tmpdir="$PWD/tmp.$RANDOM"
+mkdir -p "$tmpdir"
+trap 'rm -fr "$tmpdir"' EXIT
+cc -c -o "$tmpdir"/libdm_tag.o -x c - > /dev/null 2> /dev/null << EOF
+#include <libdevmapper.h>
+int main() {
+	struct dm_task *task;
+	return 0;
+}
+EOF
+if test $? -ne 0 ; then
+	echo libdm_no_deferred_remove
+fi

hack/libsubid_tag.sh

@@ -5,17 +5,11 @@ fi
 tmpdir="$PWD/tmp.$RANDOM"
 mkdir -p "$tmpdir"
 trap 'rm -fr "$tmpdir"' EXIT
-${CC:-cc} ${CPPFLAGS} ${CFLAGS} -o "$tmpdir"/libsubid_tag -x c - -l subid \
-	  > /dev/null 2> /dev/null << EOF
+cc -o "$tmpdir"/libsubid_tag -l subid -x c - > /dev/null 2> /dev/null << EOF
 #include <shadow/subid.h>
-#include <stdlib.h>
 int main() {
 	struct subid_range *ranges = NULL;
-#if SUBID_ABI_MAJOR >= 4
-	subid_get_uid_ranges("root", &ranges);
-#else
 	get_subuid_ranges("root", &ranges);
-#endif
 	free(ranges);
 	return 0;
 }

hack/make.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+set -e
+
+# This script builds various binary from a checkout of the skopeo
+# source code. DO NOT CALL THIS SCRIPT DIRECTLY.
+#
+# Requirements:
+# - The current directory should be a checkout of the skopeo source code
+#   (https://github.com/containers/skopeo). Whatever version is checked out
+#   will be built.
+# - The script is intended to be run inside the container specified
+#   in the output of hack/get_fqin.sh
+# - The right way to call this script is to invoke "make" from
+#   your checkout of the skopeo repository.
+#   the Makefile will do a "docker build -t skopeo ." and then
+#   "docker run hack/make.sh" in the resulting image.
+#
+
+set -o pipefail
+
+export SKOPEO_PKG='github.com/containers/skopeo'
+export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export MAKEDIR="$SCRIPTDIR/make"
+
+# Set this to 1 to enable installation/modification of environment/services
+export SKOPEO_CONTAINER_TESTS=${SKOPEO_CONTAINER_TESTS:-0}
+
+if [[ "$SKOPEO_CONTAINER_TESTS" == "0" ]] && [[ "$CI" != "true" ]]; then
+    (
+    echo "***************************************************************"
+    echo "WARNING: Executing tests directly on the local development"
+    echo "         host is highly discouraged.  Many important items"
+    echo "         will be skipped.  For manual execution, please utilize"
+    echo "         the Makefile targets WITHOUT the '-local' suffix."
+    echo "***************************************************************"
+    ) > /dev/stderr
+    sleep 5
+fi
+
+echo
+
+# List of bundles to create when no argument is passed
+# TODO(runcom): these are the one left from Docker...for now
+# test-unit
+# validate-dco
+# cover
+DEFAULT_BUNDLES=(
+	validate-gofmt
+	validate-lint
+	validate-vet
+	validate-git-marks
+
+	test-integration
+)
+
+# Go module support: set `-mod=vendor` to use the vendored sources
+# See also the top-level Makefile.
+mod_vendor=
+if go help mod >/dev/null 2>&1; then
+  export GO111MODULE=on
+  mod_vendor='-mod=vendor'
+fi
+
+go_test_dir() {
+	dir=$1
+	(
+		echo '+ go test' $mod_vendor $TESTFLAGS ${BUILDTAGS:+-tags "$BUILDTAGS"} "${SKOPEO_PKG}${dir#.}"
+		cd "$dir"
+		export DEST="$ABS_DEST" # we're in a subshell, so this is safe -- our integration-cli tests need DEST, and "cd" screws it up
+		go test $mod_vendor $TESTFLAGS ${BUILDTAGS:+-tags "$BUILDTAGS"}
+	)
+}
+
+bundle() {
+	local bundle="$1"; shift
+	echo "---> Making bundle: $(basename "$bundle")"
+	source "$SCRIPTDIR/make/$bundle" "$@"
+}
+
+main() {
+	if [ $# -lt 1 ]; then
+		bundles=(${DEFAULT_BUNDLES[@]})
+	else
+		bundles=($@)
+	fi
+	for bundle in ${bundles[@]}; do
+		bundle "$bundle"
+		echo
+	done
+}
+
+main "$@"

hack/make/.validate

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+if [ -z "$VALIDATE_UPSTREAM" ]; then
+	# this is kind of an expensive check, so let's not do this twice if we
+	# are running more than one validate bundlescript
+	
+	VALIDATE_REPO='https://github.com/containers/skopeo.git'
+	VALIDATE_BRANCH='main'
+	
+	if [ "$TRAVIS" = 'true' -a "$TRAVIS_PULL_REQUEST" != 'false' ]; then
+		VALIDATE_REPO="https://github.com/${TRAVIS_REPO_SLUG}.git"
+		VALIDATE_BRANCH="${TRAVIS_BRANCH}"
+	fi
+	
+	VALIDATE_HEAD="$(git rev-parse --verify HEAD)"
+	
+	git fetch -q "$VALIDATE_REPO" "refs/heads/$VALIDATE_BRANCH"
+	VALIDATE_UPSTREAM="$(git rev-parse --verify FETCH_HEAD)"
+	
+	VALIDATE_COMMIT_LOG="$VALIDATE_UPSTREAM..$VALIDATE_HEAD"
+	VALIDATE_COMMIT_DIFF="$VALIDATE_UPSTREAM...$VALIDATE_HEAD"
+	
+	validate_diff() {
+		git diff "$VALIDATE_UPSTREAM" "$@"
+	}
+	validate_log() {
+		if [ "$VALIDATE_UPSTREAM" != "$VALIDATE_HEAD" ]; then
+			git log "$VALIDATE_COMMIT_LOG" "$@"
+		fi
+	}
+fi

hack/make/test-integration

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -e
+
+bundle_test_integration() {
+	go_test_dir ./integration
+}
+
+# subshell so that we can export PATH without breaking other things
+(
+	make PREFIX=/usr install
+	bundle_test_integration
+) 2>&1

hack/make/test-system

@@ -8,7 +8,7 @@ set -e
 #
 # Paradoxically (FIXME: clean this up), SKOPEO_CONTAINER_TESTS is set
 # both inside a container and without a container (in a CI VM); it actually means
-# "it is safe to destructively modify the system for tests".
+# "it is safe to desctructively modify the system for tests".
 #
 # On a CI VM, we can just use Podman as it is already configured; the changes below,
 # to use VFS, are necessary only inside a container, because overlay-inside-overlay

hack/make/validate-git-marks

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+source "$(dirname "$BASH_SOURCE")/.validate"
+
+# folders=$(find * -type d | egrep -v '^Godeps|bundles|.git')
+
+IFS=$'\n'
+files=( $(validate_diff --diff-filter=ACMR --name-only -- '*' | grep -v '^vendor/' || true) )
+unset IFS
+
+badFiles=()
+for f in "${files[@]}"; do
+    if [ $(grep -r "^<<<<<<<" $f) ]; then
+        badFiles+=( "$f" )
+        continue
+    fi
+
+    if [ $(grep -r "^>>>>>>>" $f) ]; then
+        badFiles+=( "$f" )
+        continue
+    fi
+
+    if [ $(grep -r "^=======$" $f) ]; then
+        badFiles+=( "$f" )
+        continue
+    fi
+    set -e
+done
+
+
+if [ ${#badFiles[@]} -eq 0 ]; then
+	echo 'Congratulations!  There is no conflict.'
+else
+	{
+		echo "There is trace of conflict(s) in the following files :"
+		for f in "${badFiles[@]}"; do
+			echo " - $f"
+		done
+		echo
+		echo 'Please fix the conflict(s) commit the result.'
+		echo
+	} >&2
+	false
+fi

hack/make/validate-gofmt

@@ -1,7 +1,9 @@
 #!/bin/bash
 
+source "$(dirname "$BASH_SOURCE")/.validate"
+
 IFS=$'\n'
-files=( $(find . -name '*.go' | grep -v '^./vendor/' | sort || true) )
+files=( $(validate_diff --diff-filter=ACMR --name-only -- '*.go' | grep -v '^vendor/' || true) )
 unset IFS
 
 badFiles=()
@@ -23,5 +25,5 @@ else
 		echo 'Please reformat the above files using "gofmt -s -w" and commit the result.'
 		echo
 	} >&2
-	exit 1
+	false
 fi

hack/make/validate-lint

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+source "$(dirname "$BASH_SOURCE")/.validate"
+
+# We will eventually get to the point where packages should be the complete list
+# of subpackages, vendoring excluded, as given by:
+#
+IFS=$'\n'
+files=( $(validate_diff --diff-filter=ACMR --name-only -- '*.go' | grep -v '^vendor/\|^integration' || true) )
+unset IFS
+
+errors=()
+for f in "${files[@]}"; do
+	failedLint=$(golint "$f")
+	if [ "$failedLint" ]; then
+		errors+=( "$failedLint" )
+	fi
+done
+
+if [ ${#errors[@]} -eq 0 ]; then
+	echo 'Congratulations!  All Go source files have been linted.'
+else
+	{
+		echo "Errors from golint:"
+		for err in "${errors[@]}"; do
+			echo "$err"
+		done
+		echo
+		echo 'Please fix the above errors. You can test via "golint" and commit the result.'
+		echo
+	} >&2
+	false
+fi

hack/make/validate-vet

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-errors=$(go vet -tags="${BUILDTAGS}" ./... 2>&1)
+errors=$(go vet -tags="${BUILDTAGS}" $mod_vendor $(go list $mod_vendor -e ./...))
 
 if [ -z "$errors" ]; then
 	echo 'Congratulations!  All Go source files have been vetted.'
@@ -12,5 +12,5 @@ else
 		echo 'Please fix the above errors. You can test via "go vet" and commit the result.'
 		echo
 	} >&2
-	exit 1
+	false
 fi

hack/man-page-checker

@@ -29,7 +29,7 @@ rc=0
 # for a given skopeo-foo.1.md, the NAME should be 'skopeo-foo'
 for md in *.1.md;do
     # Read the first line after '## NAME'
-    name=$(grep -E -A1 '^## NAME' $md|tail -1|awk '{print $1}' | tr -d \\\\)
+    name=$(egrep -A1 '^## NAME' $md|tail -1|awk '{print $1}' | tr -d \\\\)
 
     expect=$(basename $md .1.md)
     if [ "$name" != "$expect" ]; then
@@ -45,7 +45,7 @@ done
 # Make sure the descriptive text in skopeo-foo.1.md matches the one
 # in the table in skopeo.1.md.
 for md in $(ls -1 *-*.1.md);do
-    desc=$(grep -E -A1 '^## NAME' $md|tail -1|sed -E -e 's/^skopeo[^[:space:]]+ - //')
+    desc=$(egrep -A1 '^## NAME' $md|tail -1|sed -E -e 's/^skopeo[^[:space:]]+ - //')
 
     # Find the descriptive text in the main skopeo man page.
     parent=skopeo.1.md
@@ -112,7 +112,7 @@ function compare_usage() {
 #
 # Make sure the SYNOPSIS line in skopeo-foo.1.md reads '**skopeo foo** ...'
 for md in *.1.md;do
-    synopsis=$(grep -E -A1 '^#* SYNOPSIS' $md|tail -1)
+    synopsis=$(egrep -A1 '^#* SYNOPSIS' $md|tail -1)
 
     # Command name must be bracketed by double asterisks; options and
     # arguments are bracketed by single ones.

hack/test-integration.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-set -e
-
-make PREFIX=/usr install
-
-echo "cd ./integration;" go test $TESTFLAGS ${BUILDTAGS:+-tags "$BUILDTAGS"}
-cd ./integration
-go test $TESTFLAGS ${BUILDTAGS:+-tags "$BUILDTAGS"}

hack/validate-git-marks.sh

@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-
-IFS=$'\n'
-files=( $(git ls-tree -r HEAD --name-only | grep -v '^vendor/' || true) )
-unset IFS
-
-badFiles=()
-for f in "${files[@]}"; do
-    if [ $(grep -r "^\(<<<<<<<\|>>>>>>>\|^=======$\)" $f) ]; then
-        badFiles+=( "$f" )
-        continue
-    fi
-    set -e
-done
-
-
-if [ ${#badFiles[@]} -eq 0 ]; then
-	echo 'Congratulations!  There is no conflict.'
-else
-	{
-		echo "There is trace of conflict(s) in the following files :"
-		for f in "${badFiles[@]}"; do
-			echo " - $f"
-		done
-		echo
-		echo 'Please fix the conflict(s) commit the result.'
-		echo
-	} >&2
-	exit 1
-fi

hack/warn-destructive-tests.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-# Set this to 1 to enable installation/modification of environment/services
-export SKOPEO_CONTAINER_TESTS=${SKOPEO_CONTAINER_TESTS:-0}
-
-if [[ "$SKOPEO_CONTAINER_TESTS" == "0" ]] && [[ "$CI" != "true" ]]; then
-    (
-    echo "***************************************************************"
-    echo "WARNING: Executing tests directly on the local development"
-    echo "         host is highly discouraged.  Many important items"
-    echo "         will be skipped.  For manual execution, please utilize"
-    echo "         the Makefile targets WITHOUT the '-local' suffix."
-    echo "***************************************************************"
-    ) > /dev/stderr
-    sleep 5
-fi

install.md

@@ -55,22 +55,6 @@ sudo apk add skopeo
 
 [Package Info](https://pkgs.alpinelinux.org/packages?name=skopeo)
 
-### Gentoo
-
-```sh
-sudo emerge app-containers/skopeo
-```
-
-[Package Info](https://packages.gentoo.org/packages/app-containers/skopeo)
-
-### Arch Linux
-
-```sh
-sudo pacman -S skopeo
-```
-
-[Package Info](https://archlinux.org/packages/extra/x86_64/skopeo/)
-
 ### macOS
 
 ```sh
@@ -122,6 +106,7 @@ Skopeo has not yet been packaged for Windows. There is an [open feature
 request](https://github.com/containers/skopeo/issues/715) and contributions are
 always welcome.
 
+
 ## Container Images
 
 Skopeo container images are available at `quay.io/skopeo/stable:latest`.
@@ -131,15 +116,14 @@ For example,
 podman run docker://quay.io/skopeo/stable:latest copy --help
 ```
 
-The skopeo container image build context and automation are
-located at [https://github.com/containers/image_build/tree/main/skopeo](https://github.com/containers/image_build/tree/main/skopeo)
+[Read more](./contrib/skopeoimage/README.md).
 
 
 ## Building from Source
 
 Otherwise, read on for building and installing it from source:
 
-To build the `skopeo` binary you need at least Go 1.23.
+To build the `skopeo` binary you need at least Go 1.12.
 
 There are two ways to build skopeo: in a container, or locally without a
 container. Choose the one which better matches your needs and environment.
@@ -157,12 +141,12 @@ Install the necessary dependencies:
 
 ```bash
 # Fedora:
-sudo dnf install gpgme-devel libassuan-devel btrfs-progs-devel
+sudo dnf install gpgme-devel libassuan-devel btrfs-progs-devel device-mapper-devel
 ```
 
 ```bash
 # Ubuntu (`libbtrfs-dev` requires Ubuntu 18.10 and above):
-sudo apt install libgpgme-dev libassuan-dev libbtrfs-dev pkg-config
+sudo apt install libgpgme-dev libassuan-dev libbtrfs-dev libdevmapper-dev pkg-config
 ```
 
 ```bash
@@ -172,12 +156,7 @@ brew install gpgme
 
 ```bash
 # openSUSE:
-sudo zypper install libgpgme-devel libbtrfs-devel glib2-devel
-```
-
-```bash
-# Arch Linux:
-sudo pacman -S base-devel gpgme btrfs-progs
+sudo zypper install libgpgme-devel device-mapper-devel libbtrfs-devel glib2-devel
 ```
 
 Make sure to clone this repository in your `GOPATH` - otherwise compilation fails.
@@ -195,22 +174,6 @@ document generation can be skipped by passing `DISABLE_DOCS=1`:
 DISABLE_DOCS=1 make
 ```
 
-#### Additional prerequisites
-
-In order to dynamically link against system libraries and avoid compilation errors the ```CGO_ENABLED='1'``` flag must be enabled. You can easily check by ```go env | grep CGO_ENABLED```.
-
-An alternative would be to set the `BUILDTAGS=containers_image_openpgp` (this removes the dependency on `libgpgme` and its companion libraries).
-
-### Cross-compilation
-
-For cross-building skopeo, use the command `make bin/skopeo.OS.ARCH`, where OS represents
-the target operating system and ARCH stands for the desired architecture. For instance,
-to build skopeo for RISC-V 64-bit Linux, execute:
-
-```bash
-make bin/skopeo.linux.riscv64
-```
-
 ### Building documentation
 
 To build the manual you will need go-md2man.
@@ -267,13 +230,20 @@ sudo make install
 ### Building a static binary
 
 There have been efforts in the past to produce and maintain static builds, but the maintainers prefer to run Skopeo using distro packages or within containers. This is because static builds of Skopeo tend to be unreliable and functionally restricted. Specifically:
-- Some features of Skopeo depend on non-Go libraries like `libgpgme`.
+- Some features of Skopeo depend on non-Go libraries like `libgpgme` and `libdevmapper`.
 - Generating static Go binaries uses native Go libraries, which don't support e.g. `.local` or LDAP-based name resolution.
 
 That being said, if you would like to build Skopeo statically, you might be able to do it by combining all the following steps.
 - Export environment variable `CGO_ENABLED=0` (disabling CGO causes Go to prefer native libraries when possible, instead of dynamically linking against system libraries).
-- Set the `BUILDTAGS=containers_image_openpgp` Make variable (this removes the dependency on `libgpgme` and its companion libraries).
-- Clear the `GO_DYN_FLAGS` Make variable if even a dependency on the ELF interpreter is undesirable.
+- Set the `BUILDTAGS=containers_image_openpgp` Make variable (this remove the dependency on `libgpgme` and its companion libraries).
+- Clear the `GO_DYN_FLAGS` Make variable (which otherwise seems to force the creation of a dynamic executable).
+
+The following command implements these steps to produce a static binary in the `bin` subdirectory of the repository:
+
+```bash
+docker run -v $PWD:/src -w /src -e CGO_ENABLED=0 golang \
+make BUILDTAGS=containers_image_openpgp GO_DYN_FLAGS=
+```
 
 Keep in mind that the resulting binary is unsupported and might crash randomly. Only use if you know what you're doing!
 

integration/blocked_test.go

@@ -1,34 +1,34 @@
 package main
 
+import (
+	"gopkg.in/check.v1"
+)
+
 const blockedRegistriesConf = "./fixtures/blocked-registries.conf"
 const blockedErrorRegex = `.*registry registry-blocked.com is blocked in .*`
 
-func (s *skopeoSuite) TestCopyBlockedSource() {
-	t := s.T()
-	assertSkopeoFails(t, blockedErrorRegex,
+func (s *SkopeoSuite) TestCopyBlockedSource(c *check.C) {
+	assertSkopeoFails(c, blockedErrorRegex,
 		"--registries-conf", blockedRegistriesConf, "copy",
 		"docker://registry-blocked.com/image:test",
 		"docker://registry-unblocked.com/image:test")
 }
 
-func (s *skopeoSuite) TestCopyBlockedDestination() {
-	t := s.T()
-	assertSkopeoFails(t, blockedErrorRegex,
+func (s *SkopeoSuite) TestCopyBlockedDestination(c *check.C) {
+	assertSkopeoFails(c, blockedErrorRegex,
 		"--registries-conf", blockedRegistriesConf, "copy",
 		"docker://registry-unblocked.com/image:test",
 		"docker://registry-blocked.com/image:test")
 }
 
-func (s *skopeoSuite) TestInspectBlocked() {
-	t := s.T()
-	assertSkopeoFails(t, blockedErrorRegex,
+func (s *SkopeoSuite) TestInspectBlocked(c *check.C) {
+	assertSkopeoFails(c, blockedErrorRegex,
 		"--registries-conf", blockedRegistriesConf, "inspect",
 		"docker://registry-blocked.com/image:test")
 }
 
-func (s *skopeoSuite) TestDeleteBlocked() {
-	t := s.T()
-	assertSkopeoFails(t, blockedErrorRegex,
+func (s *SkopeoSuite) TestDeleteBlocked(c *check.C) {
+	assertSkopeoFails(c, blockedErrorRegex,
 		"--registries-conf", blockedRegistriesConf, "delete",
 		"docker://registry-blocked.com/image:test")
 }

integration/check_test.go

@@ -6,9 +6,7 @@ import (
 	"testing"
 
 	"github.com/containers/skopeo/version"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
+	"gopkg.in/check.v1"
 )
 
 const (
@@ -16,104 +14,98 @@ const (
 	privateRegistryURL1 = "127.0.0.1:5001"
 )
 
-func TestSkopeo(t *testing.T) {
-	suite.Run(t, &skopeoSuite{})
+func Test(t *testing.T) {
+	check.TestingT(t)
 }
 
-type skopeoSuite struct {
-	suite.Suite
+func init() {
+	check.Suite(&SkopeoSuite{})
+}
+
+type SkopeoSuite struct {
 	regV2         *testRegistryV2
 	regV2WithAuth *testRegistryV2
 }
 
-var _ = suite.SetupAllSuite(&skopeoSuite{})
-var _ = suite.TearDownAllSuite(&skopeoSuite{})
-
-func (s *skopeoSuite) SetupSuite() {
-	t := s.T()
+func (s *SkopeoSuite) SetUpSuite(c *check.C) {
 	_, err := exec.LookPath(skopeoBinary)
-	require.NoError(t, err)
-	s.regV2 = setupRegistryV2At(t, privateRegistryURL0, false, false)
-	s.regV2WithAuth = setupRegistryV2At(t, privateRegistryURL1, true, false)
+	c.Assert(err, check.IsNil)
+	s.regV2 = setupRegistryV2At(c, privateRegistryURL0, false, false)
+	s.regV2WithAuth = setupRegistryV2At(c, privateRegistryURL1, true, false)
 }
 
-func (s *skopeoSuite) TearDownSuite() {
+func (s *SkopeoSuite) TearDownSuite(c *check.C) {
 	if s.regV2 != nil {
-		s.regV2.tearDown()
+		s.regV2.tearDown(c)
 	}
 	if s.regV2WithAuth != nil {
-		// cmd := exec.Command("docker", "logout", s.regV2WithAuth)
-		// require.Noerror(t, cmd.Run())
-		s.regV2WithAuth.tearDown()
+		//cmd := exec.Command("docker", "logout", s.regV2WithAuth)
+		//c.Assert(cmd.Run(), check.IsNil)
+		s.regV2WithAuth.tearDown(c)
 	}
 }
 
-func (s *skopeoSuite) TestVersion() {
-	t := s.T()
-	assertSkopeoSucceeds(t, fmt.Sprintf(".*%s version %s.*", skopeoBinary, version.Version),
+// TODO like dockerCmd but much easier, just out,err
+//func skopeoCmd()
+
+func (s *SkopeoSuite) TestVersion(c *check.C) {
+	assertSkopeoSucceeds(c, fmt.Sprintf(".*%s version %s.*", skopeoBinary, version.Version),
 		"--version")
 }
 
-func (s *skopeoSuite) TestCanAuthToPrivateRegistryV2WithoutDockerCfg() {
-	t := s.T()
-	assertSkopeoFails(t, ".*manifest unknown.*",
+func (s *SkopeoSuite) TestCanAuthToPrivateRegistryV2WithoutDockerCfg(c *check.C) {
+	assertSkopeoFails(c, ".*manifest unknown.*",
 		"--tls-verify=false", "inspect", "--creds="+s.regV2WithAuth.username+":"+s.regV2WithAuth.password, fmt.Sprintf("docker://%s/busybox:latest", s.regV2WithAuth.url))
 }
 
-func (s *skopeoSuite) TestNeedAuthToPrivateRegistryV2WithoutDockerCfg() {
-	t := s.T()
-	assertSkopeoFails(t, ".*authentication required.*",
+func (s *SkopeoSuite) TestNeedAuthToPrivateRegistryV2WithoutDockerCfg(c *check.C) {
+	assertSkopeoFails(c, ".*authentication required.*",
 		"--tls-verify=false", "inspect", fmt.Sprintf("docker://%s/busybox:latest", s.regV2WithAuth.url))
 }
 
-func (s *skopeoSuite) TestCertDirInsteadOfCertPath() {
-	t := s.T()
-	assertSkopeoFails(t, ".*unknown flag: --cert-path.*",
+func (s *SkopeoSuite) TestCertDirInsteadOfCertPath(c *check.C) {
+	assertSkopeoFails(c, ".*unknown flag: --cert-path.*",
 		"--tls-verify=false", "inspect", fmt.Sprintf("docker://%s/busybox:latest", s.regV2WithAuth.url), "--cert-path=/")
-	assertSkopeoFails(t, ".*authentication required.*",
+	assertSkopeoFails(c, ".*authentication required.*",
 		"--tls-verify=false", "inspect", fmt.Sprintf("docker://%s/busybox:latest", s.regV2WithAuth.url), "--cert-dir=/etc/docker/certs.d/")
 }
 
 // TODO(runcom): as soon as we can push to registries ensure you can inspect here
 // not just get image not found :)
-func (s *skopeoSuite) TestNoNeedAuthToPrivateRegistryV2ImageNotFound() {
-	t := s.T()
+func (s *SkopeoSuite) TestNoNeedAuthToPrivateRegistryV2ImageNotFound(c *check.C) {
 	out, err := exec.Command(skopeoBinary, "--tls-verify=false", "inspect", fmt.Sprintf("docker://%s/busybox:latest", s.regV2.url)).CombinedOutput()
-	assert.Error(t, err, "%s", string(out))
-	assert.Regexp(t, "(?s).*manifest unknown.*", string(out))                         // (?s) : '.' will also match newlines
-	assert.NotRegexp(t, "(?s).*unauthorized: authentication required.*", string(out)) // (?s) : '.' will also match newlines
+	c.Assert(err, check.NotNil, check.Commentf(string(out)))
+	c.Assert(string(out), check.Matches, "(?s).*manifest unknown.*")                                 // (?s) : '.' will also match newlines
+	c.Assert(string(out), check.Not(check.Matches), "(?s).*unauthorized: authentication required.*") // (?s) : '.' will also match newlines
 }
 
-func (s *skopeoSuite) TestInspectFailsWhenReferenceIsInvalid() {
-	t := s.T()
-	assertSkopeoFails(t, `.*Invalid image name.*`, "inspect", "unknown")
+func (s *SkopeoSuite) TestInspectFailsWhenReferenceIsInvalid(c *check.C) {
+	assertSkopeoFails(c, `.*Invalid image name.*`, "inspect", "unknown")
 }
 
-func (s *skopeoSuite) TestLoginLogout() {
-	t := s.T()
-	assertSkopeoSucceeds(t, "^Login Succeeded!\n$",
+func (s *SkopeoSuite) TestLoginLogout(c *check.C) {
+	assertSkopeoSucceeds(c, "^Login Succeeded!\n$",
 		"login", "--tls-verify=false", "--username="+s.regV2WithAuth.username, "--password="+s.regV2WithAuth.password, s.regV2WithAuth.url)
 	// test --get-login returns username
-	assertSkopeoSucceeds(t, fmt.Sprintf("^%s\n$", s.regV2WithAuth.username),
+	assertSkopeoSucceeds(c, fmt.Sprintf("^%s\n$", s.regV2WithAuth.username),
 		"login", "--tls-verify=false", "--get-login", s.regV2WithAuth.url)
 	// test logout
-	assertSkopeoSucceeds(t, fmt.Sprintf("^Removed login credentials for %s\n$", s.regV2WithAuth.url),
+	assertSkopeoSucceeds(c, fmt.Sprintf("^Removed login credentials for %s\n$", s.regV2WithAuth.url),
 		"logout", s.regV2WithAuth.url)
 }
 
-func (s *skopeoSuite) TestCopyWithLocalAuth() {
-	t := s.T()
-	assertSkopeoSucceeds(t, "^Login Succeeded!\n$",
+func (s *SkopeoSuite) TestCopyWithLocalAuth(c *check.C) {
+	assertSkopeoSucceeds(c, "^Login Succeeded!\n$",
 		"login", "--tls-verify=false", "--username="+s.regV2WithAuth.username, "--password="+s.regV2WithAuth.password, s.regV2WithAuth.url)
 	// copy to private registry using local authentication
 	imageName := fmt.Sprintf("docker://%s/busybox:mine", s.regV2WithAuth.url)
-	assertSkopeoSucceeds(t, "", "copy", "--dest-tls-verify=false", testFQIN+":latest", imageName)
+	assertSkopeoSucceeds(c, "", "copy", "--dest-tls-verify=false", testFQIN+":latest", imageName)
 	// inspect from private registry
-	assertSkopeoSucceeds(t, "", "inspect", "--tls-verify=false", imageName)
+	assertSkopeoSucceeds(c, "", "inspect", "--tls-verify=false", imageName)
 	// logout from the registry
-	assertSkopeoSucceeds(t, fmt.Sprintf("^Removed login credentials for %s\n$", s.regV2WithAuth.url),
+	assertSkopeoSucceeds(c, fmt.Sprintf("^Removed login credentials for %s\n$", s.regV2WithAuth.url),
 		"logout", s.regV2WithAuth.url)
 	// inspect from private registry should fail after logout
-	assertSkopeoFails(t, ".*authentication required.*",
+	assertSkopeoFails(c, ".*authentication required.*",
 		"inspect", "--tls-verify=false", imageName)
 }

integration/decompress-dirs.sh

@@ -0,0 +1,23 @@
+#!/bin/bash -e
+# Account for differences between dir: images that are solely due to one being
+# compressed (fresh from a registry) and the other not being compressed (read
+# from storage, which decompressed it and had to reassemble the layer blobs).
+for dir in "$@" ; do
+    # Updating the manifest's blob digests may change the formatting, so
+    # use jq to get them into similar shape.
+    jq -M . "${dir}"/manifest.json > "${dir}"/manifest.json.tmp && mv "${dir}"/manifest.json.tmp "${dir}"/manifest.json
+    for candidate in "${dir}"/???????????????????????????????????????????????????????????????? ; do
+        # If a digest-identified file looks like it was compressed,
+        # decompress it, and replace its hash and size in the manifest
+        # with the values for their decompressed versions.
+        uncompressed=`zcat "${candidate}" 2> /dev/null | sha256sum | cut -c1-64`
+        if test $? -eq 0 ; then
+            if test "$uncompressed" != e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ; then
+                zcat "${candidate}" > "${dir}"/${uncompressed}
+                sed -r -i -e "s#sha256:$(basename ${candidate})#sha256:${uncompressed}#g" "${dir}"/manifest.json
+                sed -r -i -e "s#\"size\": $(wc -c < ${candidate}),#\"size\": $(wc -c < ${dir}/${uncompressed}),#g" "${dir}"/manifest.json
+                rm -f "${candidate}"
+            fi
+        fi
+    done
+done

integration/openshift.go

@@ -8,13 +8,11 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"slices"
 	"strings"
-	"testing"
 	"time"
 
 	"github.com/containers/storage/pkg/homedir"
-	"github.com/stretchr/testify/require"
+	"gopkg.in/check.v1"
 )
 
 var adminKUBECONFIG = map[string]string{
@@ -32,21 +30,21 @@ type openshiftCluster struct {
 // startOpenshiftCluster creates a new openshiftCluster.
 // WARNING: This affects state in users' home directory! Only run
 // in isolated test environment.
-func startOpenshiftCluster(t *testing.T) *openshiftCluster {
+func startOpenshiftCluster(c *check.C) *openshiftCluster {
 	cluster := &openshiftCluster{}
-	cluster.workingDir = t.TempDir()
+	cluster.workingDir = c.MkDir()
 
-	cluster.startMaster(t)
-	cluster.prepareRegistryConfig(t)
-	cluster.startRegistry(t)
-	cluster.ocLoginToProject(t)
-	cluster.dockerLogin(t)
-	cluster.relaxImageSignerPermissions(t)
+	cluster.startMaster(c)
+	cluster.prepareRegistryConfig(c)
+	cluster.startRegistry(c)
+	cluster.ocLoginToProject(c)
+	cluster.dockerLogin(c)
+	cluster.relaxImageSignerPermissions(c)
 
 	return cluster
 }
 
-// clusterCmd creates an exec.Cmd in cluster.workingDir with current environment modified by environment.
+// clusterCmd creates an exec.Cmd in cluster.workingDir with current environment modified by environment
 func (cluster *openshiftCluster) clusterCmd(env map[string]string, name string, args ...string) *exec.Cmd {
 	cmd := exec.Command(name, args...)
 	cmd.Dir = cluster.workingDir
@@ -58,20 +56,21 @@ func (cluster *openshiftCluster) clusterCmd(env map[string]string, name string,
 }
 
 // startMaster starts the OpenShift master (etcd+API server) and waits for it to be ready, or terminates on failure.
-func (cluster *openshiftCluster) startMaster(t *testing.T) {
+func (cluster *openshiftCluster) startMaster(c *check.C) {
 	cmd := cluster.clusterCmd(nil, "openshift", "start", "master")
 	cluster.processes = append(cluster.processes, cmd)
 	stdout, err := cmd.StdoutPipe()
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
+	// Send both to the same pipe. This might cause the two streams to be mixed up,
 	// but logging actually goes only to stderr - this primarily ensure we log any
 	// unexpected output to stdout.
 	cmd.Stderr = cmd.Stdout
 	err = cmd.Start()
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	portOpen, terminatePortCheck := newPortChecker(t, 8443)
+	portOpen, terminatePortCheck := newPortChecker(c, 8443)
 	defer func() {
-		t.Logf("Terminating port check")
+		c.Logf("Terminating port check")
 		terminatePortCheck <- true
 	}()
 
@@ -79,12 +78,12 @@ func (cluster *openshiftCluster) startMaster(t *testing.T) {
 	logCheckFound := make(chan bool)
 	go func() {
 		defer func() {
-			t.Logf("Log checker exiting")
+			c.Logf("Log checker exiting")
 		}()
 		scanner := bufio.NewScanner(stdout)
 		for scanner.Scan() {
 			line := scanner.Text()
-			t.Logf("Log line: %s", line)
+			c.Logf("Log line: %s", line)
 			if strings.Contains(line, "Started Origin Controllers") {
 				logCheckFound <- true
 				return
@@ -93,7 +92,7 @@ func (cluster *openshiftCluster) startMaster(t *testing.T) {
 			// Note: we can block before we get here.
 			select {
 			case <-terminateLogCheck:
-				t.Logf("terminated")
+				c.Logf("terminated")
 				return
 			default:
 				// Do not block here and read the next line.
@@ -102,7 +101,7 @@ func (cluster *openshiftCluster) startMaster(t *testing.T) {
 		logCheckFound <- false
 	}()
 	defer func() {
-		t.Logf("Terminating log check")
+		c.Logf("Terminating log check")
 		terminateLogCheck <- true
 	}()
 
@@ -111,26 +110,26 @@ func (cluster *openshiftCluster) startMaster(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 	defer cancel()
 	for !gotPortCheck || !gotLogCheck {
-		t.Logf("Waiting for master")
+		c.Logf("Waiting for master")
 		select {
 		case <-portOpen:
-			t.Logf("port check done")
+			c.Logf("port check done")
 			gotPortCheck = true
 		case found := <-logCheckFound:
-			t.Logf("log check done, found: %t", found)
+			c.Logf("log check done, found: %t", found)
 			if !found {
-				t.Fatal("log check done, success message not found")
+				c.Fatal("log check done, success message not found")
 			}
 			gotLogCheck = true
 		case <-ctx.Done():
-			t.Fatalf("Timed out waiting for master: %v", ctx.Err())
+			c.Fatalf("Timed out waiting for master: %v", ctx.Err())
 		}
 	}
-	t.Logf("OK, master started!")
+	c.Logf("OK, master started!")
 }
 
 // prepareRegistryConfig creates a registry service account and a related k8s client configuration in ${cluster.workingDir}/openshift.local.registry.
-func (cluster *openshiftCluster) prepareRegistryConfig(t *testing.T) {
+func (cluster *openshiftCluster) prepareRegistryConfig(c *check.C) {
 	// This partially mimics the objects created by (oadm registry), except that we run the
 	// server directly as an ordinary process instead of a pod with an implicitly attached service account.
 	saJSON := `{
@@ -141,93 +140,93 @@ func (cluster *openshiftCluster) prepareRegistryConfig(t *testing.T) {
 		}
 	}`
 	cmd := cluster.clusterCmd(adminKUBECONFIG, "oc", "create", "-f", "-")
-	runExecCmdWithInput(t, cmd, saJSON)
+	runExecCmdWithInput(c, cmd, saJSON)
 
 	cmd = cluster.clusterCmd(adminKUBECONFIG, "oadm", "policy", "add-cluster-role-to-user", "system:registry", "-z", "registry")
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "%s", string(out))
-	require.Equal(t, "cluster role \"system:registry\" added: \"registry\"\n", string(out))
+	c.Assert(err, check.IsNil, check.Commentf("%s", string(out)))
+	c.Assert(string(out), check.Equals, "cluster role \"system:registry\" added: \"registry\"\n")
 
 	cmd = cluster.clusterCmd(adminKUBECONFIG, "oadm", "create-api-client-config", "--client-dir=openshift.local.registry", "--basename=openshift-registry", "--user=system:serviceaccount:default:registry")
 	out, err = cmd.CombinedOutput()
-	require.NoError(t, err, "%s", string(out))
-	require.Equal(t, "", string(out))
+	c.Assert(err, check.IsNil, check.Commentf("%s", string(out)))
+	c.Assert(string(out), check.Equals, "")
 }
 
-// startRegistryProcess starts the OpenShift registry with configPart on port, waits for it to be ready, and returns the process object, or terminates on failure.
-func (cluster *openshiftCluster) startRegistryProcess(t *testing.T, port uint16, configPath string) *exec.Cmd {
+// startRegistry starts the OpenShift registry with configPart on port, waits for it to be ready, and returns the process object, or terminates on failure.
+func (cluster *openshiftCluster) startRegistryProcess(c *check.C, port int, configPath string) *exec.Cmd {
 	cmd := cluster.clusterCmd(map[string]string{
 		"KUBECONFIG":          "openshift.local.registry/openshift-registry.kubeconfig",
 		"DOCKER_REGISTRY_URL": fmt.Sprintf("127.0.0.1:%d", port),
 	}, "dockerregistry", configPath)
-	consumeAndLogOutputs(t, fmt.Sprintf("registry-%d", port), cmd)
+	consumeAndLogOutputs(c, fmt.Sprintf("registry-%d", port), cmd)
 	err := cmd.Start()
-	require.NoError(t, err, "%s")
+	c.Assert(err, check.IsNil)
 
-	portOpen, terminatePortCheck := newPortChecker(t, port)
+	portOpen, terminatePortCheck := newPortChecker(c, port)
 	defer func() {
 		terminatePortCheck <- true
 	}()
-	t.Logf("Waiting for registry to start")
+	c.Logf("Waiting for registry to start")
 	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
 	defer cancel()
 	select {
 	case <-portOpen:
-		t.Logf("OK, Registry port open")
+		c.Logf("OK, Registry port open")
 	case <-ctx.Done():
-		t.Fatalf("Timed out waiting for registry to start: %v", ctx.Err())
+		c.Fatalf("Timed out waiting for registry to start: %v", ctx.Err())
 	}
 
 	return cmd
 }
 
 // startRegistry starts the OpenShift registry and waits for it to be ready, or terminates on failure.
-func (cluster *openshiftCluster) startRegistry(t *testing.T) {
+func (cluster *openshiftCluster) startRegistry(c *check.C) {
 	// Our “primary” registry
-	cluster.processes = append(cluster.processes, cluster.startRegistryProcess(t, 5000, "/atomic-registry-config.yml"))
+	cluster.processes = append(cluster.processes, cluster.startRegistryProcess(c, 5000, "/atomic-registry-config.yml"))
 
 	// A registry configured with acceptschema2:false
-	schema1Config := fileFromFixture(t, "/atomic-registry-config.yml", map[string]string{
+	schema1Config := fileFromFixture(c, "/atomic-registry-config.yml", map[string]string{
 		"addr: :5000":              "addr: :5005",
 		"rootdirectory: /registry": "rootdirectory: /registry-schema1",
 		// The default configuration currently already contains acceptschema2: false
 	})
 	// Make sure the configuration contains "acceptschema2: false", because eventually it will be enabled upstream and this function will need to be updated.
 	configContents, err := os.ReadFile(schema1Config)
-	require.NoError(t, err)
-	require.Regexp(t, "(?s).*acceptschema2: false.*", string(configContents))
-	cluster.processes = append(cluster.processes, cluster.startRegistryProcess(t, 5005, schema1Config))
+	c.Assert(err, check.IsNil)
+	c.Assert(string(configContents), check.Matches, "(?s).*acceptschema2: false.*")
+	cluster.processes = append(cluster.processes, cluster.startRegistryProcess(c, 5005, schema1Config))
 
 	// A registry configured with acceptschema2:true
-	schema2Config := fileFromFixture(t, "/atomic-registry-config.yml", map[string]string{
+	schema2Config := fileFromFixture(c, "/atomic-registry-config.yml", map[string]string{
 		"addr: :5000":              "addr: :5006",
 		"rootdirectory: /registry": "rootdirectory: /registry-schema2",
 		"acceptschema2: false":     "acceptschema2: true",
 	})
-	cluster.processes = append(cluster.processes, cluster.startRegistryProcess(t, 5006, schema2Config))
+	cluster.processes = append(cluster.processes, cluster.startRegistryProcess(c, 5006, schema2Config))
 }
 
 // ocLogin runs (oc login) and (oc new-project) on the cluster, or terminates on failure.
-func (cluster *openshiftCluster) ocLoginToProject(t *testing.T) {
-	t.Logf("oc login")
+func (cluster *openshiftCluster) ocLoginToProject(c *check.C) {
+	c.Logf("oc login")
 	cmd := cluster.clusterCmd(nil, "oc", "login", "--certificate-authority=openshift.local.config/master/ca.crt", "-u", "myuser", "-p", "mypw", "https://localhost:8443")
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "%s", out)
-	require.Regexp(t, "(?s).*Login successful.*", string(out)) // (?s) : '.' will also match newlines
+	c.Assert(err, check.IsNil, check.Commentf("%s", out))
+	c.Assert(string(out), check.Matches, "(?s).*Login successful.*") // (?s) : '.' will also match newlines
 
-	outString := combinedOutputOfCommand(t, "oc", "new-project", "myns")
-	require.Regexp(t, `(?s).*Now using project "myns".*`, outString) // (?s) : '.' will also match newlines
+	outString := combinedOutputOfCommand(c, "oc", "new-project", "myns")
+	c.Assert(outString, check.Matches, `(?s).*Now using project "myns".*`) // (?s) : '.' will also match newlines
 }
 
 // dockerLogin simulates (docker login) to the cluster, or terminates on failure.
 // We do not run (docker login) directly, because that requires a running daemon and a docker package.
-func (cluster *openshiftCluster) dockerLogin(t *testing.T) {
+func (cluster *openshiftCluster) dockerLogin(c *check.C) {
 	cluster.dockerDir = filepath.Join(homedir.Get(), ".docker")
 	err := os.Mkdir(cluster.dockerDir, 0700)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	out := combinedOutputOfCommand(t, "oc", "config", "view", "-o", "json", "-o", "jsonpath={.users[*].user.token}")
-	t.Logf("oc config value: %s", out)
+	out := combinedOutputOfCommand(c, "oc", "config", "view", "-o", "json", "-o", "jsonpath={.users[*].user.token}")
+	c.Logf("oc config value: %s", out)
 	authValue := base64.StdEncoding.EncodeToString([]byte("unused:" + out))
 	auths := []string{}
 	for _, port := range []int{5000, 5005, 5006} {
@@ -238,29 +237,29 @@ func (cluster *openshiftCluster) dockerLogin(t *testing.T) {
 	}
 	configJSON := `{"auths": {` + strings.Join(auths, ",") + `}}`
 	err = os.WriteFile(filepath.Join(cluster.dockerDir, "config.json"), []byte(configJSON), 0600)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 }
 
 // relaxImageSignerPermissions opens up the system:image-signer permissions so that
 // anyone can work with signatures
 // FIXME: This also allows anyone to DoS anyone else; this design is really not all
 // that workable, but it is the best we can do for now.
-func (cluster *openshiftCluster) relaxImageSignerPermissions(t *testing.T) {
+func (cluster *openshiftCluster) relaxImageSignerPermissions(c *check.C) {
 	cmd := cluster.clusterCmd(adminKUBECONFIG, "oadm", "policy", "add-cluster-role-to-group", "system:image-signer", "system:authenticated")
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "%s", string(out))
-	require.Equal(t, "cluster role \"system:image-signer\" added: \"system:authenticated\"\n", string(out))
+	c.Assert(err, check.IsNil, check.Commentf("%s", string(out)))
+	c.Assert(string(out), check.Equals, "cluster role \"system:image-signer\" added: \"system:authenticated\"\n")
 }
 
 // tearDown stops the cluster services and deletes (only some!) of the state.
-func (cluster *openshiftCluster) tearDown(t *testing.T) {
-	for _, process := range slices.Backward(cluster.processes) {
+func (cluster *openshiftCluster) tearDown(c *check.C) {
+	for i := len(cluster.processes) - 1; i >= 0; i-- {
 		// It’s undocumented what Kill() returns if the process has terminated,
 		// so we couldn’t check just for that. This is running in a container anyway…
-		_ = process.Process.Kill()
+		_ = cluster.processes[i].Process.Kill()
 	}
 	if cluster.dockerDir != "" {
 		err := os.RemoveAll(cluster.dockerDir)
-		require.NoError(t, err)
+		c.Assert(err, check.IsNil)
 	}
 }

integration/openshift_shell_test.go

@@ -1,4 +1,5 @@
 //go:build openshift_shell
+// +build openshift_shell
 
 package main
 
@@ -6,8 +7,7 @@ import (
 	"os"
 	"os/exec"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"gopkg.in/check.v1"
 )
 
 /*
@@ -20,7 +20,7 @@ To use it, run:
 
 to start a container, then within the container:
 
-	SKOPEO_CONTAINER_TESTS=1 PS1='nested> ' go test -tags openshift_shell -timeout=24h ./integration -v -run='copySuite.TestRunShell'
+	SKOPEO_CONTAINER_TESTS=1 PS1='nested> ' go test -tags openshift_shell -timeout=24h ./integration -v -check.v -check.vv -check.f='CopySuite.TestRunShell'
 
 An example of what can be done within the container:
 
@@ -33,14 +33,13 @@ An example of what can be done within the container:
 	curl -L -v 'http://localhost:5000/v2/myns/personal/manifests/personal' --header 'Authorization: Bearer $token_from_oauth'
 	curl -L -v 'http://localhost:5000/extensions/v2/myns/personal/signatures/$manifest_digest' --header 'Authorization: Bearer $token_from_oauth'
 */
-func (s *copySuite) TestRunShell() {
-	t := s.T()
+func (s *CopySuite) TestRunShell(c *check.C) {
 	cmd := exec.Command("bash", "-i")
 	tty, err := os.OpenFile("/dev/tty", os.O_RDWR, 0)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	cmd.Stdin = tty
 	cmd.Stdout = tty
 	cmd.Stderr = tty
 	err = cmd.Run()
-	assert.NoError(t, err)
+	c.Assert(err, check.IsNil)
 }

integration/procutils.go

@@ -1,4 +1,5 @@
-//go:build unix && !linux
+//go:build !linux
+// +build !linux
 
 package main
 
@@ -6,6 +7,6 @@ import (
 	"os/exec"
 )
 
-// cmdLifecycleToParentIfPossible tries to exit if the parent process exits (only works on Linux).
+// cmdLifecycleToParentIfPossible tries to exit if the parent process exits (only works on Linux)
 func cmdLifecycleToParentIfPossible(c *exec.Cmd) {
 }

integration/procutils_linux.go

@@ -5,7 +5,7 @@ import (
 	"syscall"
 )
 
-// cmdLifecycleToParentIfPossible is a thin wrapper around prctl(PR_SET_PDEATHSIG)
+// cmdLifecyleToParentIfPossible is a thin wrapper around prctl(PR_SET_PDEATHSIG)
 // on Linux.
 func cmdLifecycleToParentIfPossible(c *exec.Cmd) {
 	c.SysProcAttr = &syscall.SysProcAttr{

integration/proxy_test.go

@@ -1,5 +1,3 @@
-//go:build unix
-
 package main
 
 import (
@@ -10,20 +8,17 @@ import (
 	"os"
 	"os/exec"
 	"strings"
-	"sync"
 	"syscall"
-	"testing"
 	"time"
 
+	"gopkg.in/check.v1"
+
 	"github.com/containers/image/v5/manifest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
 )
 
 // This image is known to be x86_64 only right now
-const knownNotManifestListedImageX8664 = "docker://quay.io/coreos/11bot"
+const knownNotManifestListedImage_x8664 = "docker://quay.io/coreos/11bot"
 
 // knownNotExtantImage would be very surprising if it did exist
 const knownNotExtantImage = "docker://quay.io/centos/centos:opensusewindowsubuntu"
@@ -37,7 +32,7 @@ type request struct {
 	// Method is the name of the function
 	Method string `json:"method"`
 	// Args is the arguments (parsed inside the function)
-	Args []any `json:"args"`
+	Args []interface{} `json:"args"`
 }
 
 // reply is copied from proxy.go
@@ -45,7 +40,7 @@ type reply struct {
 	// Success is true if and only if the call succeeded.
 	Success bool `json:"success"`
 	// Value is an arbitrary value (or values, as array/map) returned from the call.
-	Value any `json:"value"`
+	Value interface{} `json:"value"`
 	// PipeID is an index into open pipes, and should be passed to FinishPipe
 	PipeID uint32 `json:"pipeid"`
 	// Error should be non-empty if Success == false
@@ -61,12 +56,11 @@ type proxy struct {
 
 type pipefd struct {
 	// id is the remote identifier "pipeid"
-	id     uint
-	datafd *os.File
-	errfd  *os.File
+	id uint
+	fd *os.File
 }
 
-func (p *proxy) call(method string, args []any) (rval any, fd *pipefd, err error) {
+func (p *proxy) call(method string, args []interface{}) (rval interface{}, fd *pipefd, err error) {
 	req := request{
 		Method: method,
 		Args:   args,
@@ -87,7 +81,7 @@ func (p *proxy) call(method string, args []any) (rval any, fd *pipefd, err error
 	replybuf := make([]byte, maxMsgSize)
 	n, oobn, _, _, err := p.c.ReadMsgUnix(replybuf, oob)
 	if err != nil {
-		err = fmt.Errorf("reading reply: %w", err)
+		err = fmt.Errorf("reading reply: %v", err)
 		return
 	}
 	var reply reply
@@ -101,41 +95,26 @@ func (p *proxy) call(method string, args []any) (rval any, fd *pipefd, err error
 		return
 	}
 
-	var scms []syscall.SocketControlMessage
-	scms, err = syscall.ParseSocketControlMessage(oob[:oobn])
-	if err != nil {
-		err = fmt.Errorf("failed to parse control message: %w", err)
-		return
-	}
 	if reply.PipeID > 0 {
-		if len(scms) != 1 {
-			err = fmt.Errorf("Expected 1 socket control message, found %d", len(scms))
+		var scms []syscall.SocketControlMessage
+		scms, err = syscall.ParseSocketControlMessage(oob[:oobn])
+		if err != nil {
+			err = fmt.Errorf("failed to parse control message: %v", err)
+			return
+		}
+		if len(scms) != 1 {
+			err = fmt.Errorf("Expected 1 received fd, found %d", len(scms))
 			return
 		}
-	}
-	if len(scms) > 2 {
-		err = fmt.Errorf("Expected 1 or 2 socket control message, found %d", len(scms))
-		return
-	}
-	if len(scms) != 0 {
 		var fds []int
 		fds, err = syscall.ParseUnixRights(&scms[0])
 		if err != nil {
-			err = fmt.Errorf("failed to parse unix rights: %w", err)
+			err = fmt.Errorf("failed to parse unix rights: %v", err)
 			return
 		}
-		if len(fds) < 1 || len(fds) > 2 {
-			err = fmt.Errorf("expected 1 or 2 fds, found %d", len(fds))
-			return
-		}
-		var errfd *os.File
-		if len(fds) == 2 {
-			errfd = os.NewFile(uintptr(fds[1]), "errfd")
-		}
 		fd = &pipefd{
-			datafd: os.NewFile(uintptr(fds[0]), "replyfd"),
-			id:     uint(reply.PipeID),
-			errfd:  errfd,
+			fd: os.NewFile(uintptr(fds[0]), "replyfd"),
+			id: uint(reply.PipeID),
 		}
 	}
 
@@ -143,7 +122,7 @@ func (p *proxy) call(method string, args []any) (rval any, fd *pipefd, err error
 	return
 }
 
-func (p *proxy) callNoFd(method string, args []any) (rval any, err error) {
+func (p *proxy) callNoFd(method string, args []interface{}) (rval interface{}, err error) {
 	var fd *pipefd
 	rval, fd, err = p.call(method, args)
 	if err != nil {
@@ -156,7 +135,7 @@ func (p *proxy) callNoFd(method string, args []any) (rval any, err error) {
 	return rval, nil
 }
 
-func (p *proxy) callReadAllBytes(method string, args []any) (rval any, buf []byte, err error) {
+func (p *proxy) callReadAllBytes(method string, args []interface{}) (rval interface{}, buf []byte, err error) {
 	var fd *pipefd
 	rval, fd, err = p.call(method, args)
 	if err != nil {
@@ -168,13 +147,13 @@ func (p *proxy) callReadAllBytes(method string, args []any) (rval any, buf []byt
 	}
 	fetchchan := make(chan byteFetch)
 	go func() {
-		manifestBytes, err := io.ReadAll(fd.datafd)
+		manifestBytes, err := io.ReadAll(fd.fd)
 		fetchchan <- byteFetch{
 			content: manifestBytes,
 			err:     err,
 		}
 	}()
-	_, err = p.callNoFd("FinishPipe", []any{fd.id})
+	_, err = p.callNoFd("FinishPipe", []interface{}{fd.id})
 	if err != nil {
 		return
 	}
@@ -192,80 +171,6 @@ func (p *proxy) callReadAllBytes(method string, args []any) (rval any, buf []byt
 	return
 }
 
-type proxyError struct {
-	Code    string `json:"code"`
-	Message string `json:"message"`
-}
-
-func (p *proxy) callGetRawBlob(args []any) (rval any, buf []byte, err error) {
-	var fd *pipefd
-	rval, fd, err = p.call("GetRawBlob", args)
-	if err != nil {
-		return
-	}
-	if fd == nil {
-		err = fmt.Errorf("Expected fds from method GetRawBlob")
-		return
-	}
-	if fd.errfd == nil {
-		err = fmt.Errorf("Expected errfd from method GetRawBlob")
-		return
-	}
-	var wg sync.WaitGroup
-	fetchchan := make(chan byteFetch, 1)
-	errchan := make(chan proxyError, 1)
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		defer close(fetchchan)
-		defer fd.datafd.Close()
-		buf, err := io.ReadAll(fd.datafd)
-		fetchchan <- byteFetch{
-			content: buf,
-			err:     err,
-		}
-
-	}()
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		defer fd.errfd.Close()
-		defer close(errchan)
-		buf, err := io.ReadAll(fd.errfd)
-		var proxyErr proxyError
-		if err != nil {
-			proxyErr.Code = "read-from-proxy"
-			proxyErr.Message = err.Error()
-			errchan <- proxyErr
-			return
-		}
-		// No error, leave code+message unset
-		if len(buf) == 0 {
-			return
-		}
-		unmarshalErr := json.Unmarshal(buf, &proxyErr)
-		// Shouldn't happen
-		if unmarshalErr != nil {
-			panic(unmarshalErr)
-		}
-		errchan <- proxyErr
-	}()
-	wg.Wait()
-
-	errMsg := <-errchan
-	if errMsg.Code != "" {
-		return nil, nil, fmt.Errorf("(%s) %s", errMsg.Code, errMsg.Message)
-	}
-	fetchRes := <-fetchchan
-	err = fetchRes.err
-	if err != nil {
-		return
-	}
-
-	buf = fetchRes.content
-	return
-}
-
 func newProxy() (*proxy, error) {
 	fds, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET, 0)
 	if err != nil {
@@ -309,12 +214,17 @@ func newProxy() (*proxy, error) {
 	return p, nil
 }
 
-func TestProxy(t *testing.T) {
-	suite.Run(t, &proxySuite{})
+func init() {
+	check.Suite(&ProxySuite{})
 }
 
-type proxySuite struct {
-	suite.Suite
+type ProxySuite struct {
+}
+
+func (s *ProxySuite) SetUpSuite(c *check.C) {
+}
+
+func (s *ProxySuite) TearDownSuite(c *check.C) {
 }
 
 type byteFetch struct {
@@ -322,9 +232,8 @@ type byteFetch struct {
 	err     error
 }
 
-// This exercises all the metadata fetching APIs.
-func runTestMetadataAPIs(p *proxy, img string) error {
-	v, err := p.callNoFd("OpenImage", []any{img})
+func runTestGetManifestAndConfig(p *proxy, img string) error {
+	v, err := p.callNoFd("OpenImage", []interface{}{knownNotManifestListedImage_x8664})
 	if err != nil {
 		return err
 	}
@@ -333,13 +242,13 @@ func runTestMetadataAPIs(p *proxy, img string) error {
 	if !ok {
 		return fmt.Errorf("OpenImage return value is %T", v)
 	}
-	imgid := uint64(imgidv)
+	imgid := uint32(imgidv)
 	if imgid == 0 {
 		return fmt.Errorf("got zero from expected image")
 	}
 
 	// Also verify the optional path
-	v, err = p.callNoFd("OpenImageOptional", []any{img})
+	v, err = p.callNoFd("OpenImageOptional", []interface{}{knownNotManifestListedImage_x8664})
 	if err != nil {
 		return err
 	}
@@ -348,17 +257,17 @@ func runTestMetadataAPIs(p *proxy, img string) error {
 	if !ok {
 		return fmt.Errorf("OpenImageOptional return value is %T", v)
 	}
-	imgid2 := uint64(imgidv)
+	imgid2 := uint32(imgidv)
 	if imgid2 == 0 {
 		return fmt.Errorf("got zero from expected image")
 	}
 
-	_, err = p.callNoFd("CloseImage", []any{imgid2})
+	_, err = p.callNoFd("CloseImage", []interface{}{imgid2})
 	if err != nil {
 		return err
 	}
 
-	_, manifestBytes, err := p.callReadAllBytes("GetManifest", []any{imgid})
+	_, manifestBytes, err := p.callReadAllBytes("GetManifest", []interface{}{imgid})
 	if err != nil {
 		return err
 	}
@@ -367,7 +276,7 @@ func runTestMetadataAPIs(p *proxy, img string) error {
 		return err
 	}
 
-	_, configBytes, err := p.callReadAllBytes("GetFullConfig", []any{imgid})
+	_, configBytes, err := p.callReadAllBytes("GetFullConfig", []interface{}{imgid})
 	if err != nil {
 		return err
 	}
@@ -385,21 +294,8 @@ func runTestMetadataAPIs(p *proxy, img string) error {
 		return fmt.Errorf("No CMD or ENTRYPOINT set")
 	}
 
-	_, layerInfoBytes, err := p.callReadAllBytes("GetLayerInfoPiped", []any{imgid})
-	if err != nil {
-		return err
-	}
-	var layerInfoBytesData []interface{}
-	err = json.Unmarshal(layerInfoBytes, &layerInfoBytesData)
-	if err != nil {
-		return err
-	}
-	if len(layerInfoBytesData) == 0 {
-		return fmt.Errorf("expected layer info data")
-	}
-
 	// Also test this legacy interface
-	_, ctrconfigBytes, err := p.callReadAllBytes("GetConfig", []any{imgid})
+	_, ctrconfigBytes, err := p.callReadAllBytes("GetConfig", []interface{}{imgid})
 	if err != nil {
 		return err
 	}
@@ -414,7 +310,7 @@ func runTestMetadataAPIs(p *proxy, img string) error {
 		return fmt.Errorf("No CMD or ENTRYPOINT set")
 	}
 
-	_, err = p.callNoFd("CloseImage", []any{imgid})
+	_, err = p.callNoFd("CloseImage", []interface{}{imgid})
 	if err != nil {
 		return err
 	}
@@ -423,7 +319,7 @@ func runTestMetadataAPIs(p *proxy, img string) error {
 }
 
 func runTestOpenImageOptionalNotFound(p *proxy, img string) error {
-	v, err := p.callNoFd("OpenImageOptional", []any{img})
+	v, err := p.callNoFd("OpenImageOptional", []interface{}{img})
 	if err != nil {
 		return err
 	}
@@ -432,84 +328,32 @@ func runTestOpenImageOptionalNotFound(p *proxy, img string) error {
 	if !ok {
 		return fmt.Errorf("OpenImageOptional return value is %T", v)
 	}
-	imgid := uint64(imgidv)
+	imgid := uint32(imgidv)
 	if imgid != 0 {
 		return fmt.Errorf("Unexpected optional image id %v", imgid)
 	}
 	return nil
 }
 
-func runTestGetBlob(p *proxy, img string) error {
-	imgid, err := p.callNoFd("OpenImage", []any{img})
-	if err != nil {
-		return err
-	}
-
-	_, manifestBytes, err := p.callReadAllBytes("GetManifest", []any{imgid})
-	if err != nil {
-		return err
-	}
-	mfest, err := manifest.OCI1FromManifest(manifestBytes)
-	if err != nil {
-		return err
-	}
-
-	for _, layer := range mfest.Layers {
-		_, blobBytes, err := p.callGetRawBlob([]any{imgid, layer.Digest})
-		if err != nil {
-			return err
-		}
-		if len(blobBytes) != int(layer.Size) {
-			panic(fmt.Sprintf("Expected %d bytes, got %d", layer.Size, len(blobBytes)))
-		}
-	}
-
-	// echo "not a valid layer" | sha256sum
-	invalidDigest := "sha256:21a9aab5a3494674d2b4d8e7381c236a799384dd10545531014606cf652c119f"
-
-	_, blobBytes, err := p.callGetRawBlob([]any{imgid, invalidDigest})
-	if err == nil {
-		panic("Expected error fetching invalid blob")
-	}
-	if blobBytes != nil {
-		panic("Expected no bytes fetching invalid blob")
-	}
-
-	return nil
-}
-
-func (s *proxySuite) TestProxyMetadata() {
-	t := s.T()
+func (s *ProxySuite) TestProxy(c *check.C) {
 	p, err := newProxy()
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	err = runTestMetadataAPIs(p, knownNotManifestListedImageX8664)
+	err = runTestGetManifestAndConfig(p, knownNotManifestListedImage_x8664)
 	if err != nil {
-		err = fmt.Errorf("Testing image %s: %v", knownNotManifestListedImageX8664, err)
+		err = fmt.Errorf("Testing image %s: %v", knownNotManifestListedImage_x8664, err)
 	}
-	assert.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	err = runTestMetadataAPIs(p, knownListImage)
+	err = runTestGetManifestAndConfig(p, knownListImage)
 	if err != nil {
 		err = fmt.Errorf("Testing image %s: %v", knownListImage, err)
 	}
-	assert.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	err = runTestOpenImageOptionalNotFound(p, knownNotExtantImage)
 	if err != nil {
 		err = fmt.Errorf("Testing optional image %s: %v", knownNotExtantImage, err)
 	}
-	assert.NoError(t, err)
-}
-
-func (s *proxySuite) TestProxyGetBlob() {
-	t := s.T()
-	p, err := newProxy()
-	require.NoError(t, err)
-
-	err = runTestGetBlob(p, knownListImage)
-	if err != nil {
-		err = fmt.Errorf("Testing GetBLob for %s: %v", knownListImage, err)
-	}
-	assert.NoError(t, err)
+	c.Assert(err, check.IsNil)
 }

integration/registry.go

@@ -6,10 +6,9 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"testing"
 	"time"
 
-	"github.com/stretchr/testify/require"
+	"gopkg.in/check.v1"
 )
 
 const (
@@ -25,12 +24,12 @@ type testRegistryV2 struct {
 	email    string
 }
 
-func setupRegistryV2At(t *testing.T, url string, auth, schema1 bool) *testRegistryV2 {
-	reg, err := newTestRegistryV2At(t, url, auth, schema1)
-	require.NoError(t, err)
+func setupRegistryV2At(c *check.C, url string, auth, schema1 bool) *testRegistryV2 {
+	reg, err := newTestRegistryV2At(c, url, auth, schema1)
+	c.Assert(err, check.IsNil)
 
 	// Wait for registry to be ready to serve requests.
-	for range 50 {
+	for i := 0; i != 50; i++ {
 		if err = reg.Ping(); err == nil {
 			break
 		}
@@ -38,13 +37,13 @@ func setupRegistryV2At(t *testing.T, url string, auth, schema1 bool) *testRegist
 	}
 
 	if err != nil {
-		t.Fatal("Timeout waiting for test registry to become available")
+		c.Fatal("Timeout waiting for test registry to become available")
 	}
 	return reg
 }
 
-func newTestRegistryV2At(t *testing.T, url string, auth, schema1 bool) (*testRegistryV2, error) {
-	tmp := t.TempDir()
+func newTestRegistryV2At(c *check.C, url string, auth, schema1 bool) (*testRegistryV2, error) {
+	tmp := c.MkDir()
 	template := `version: 0.1
 loglevel: debug
 storage:
@@ -95,10 +94,10 @@ compatibility:
 		cmd = exec.Command(binaryV2, "serve", confPath)
 	}
 
-	consumeAndLogOutputs(t, fmt.Sprintf("registry-%s", url), cmd)
+	consumeAndLogOutputs(c, fmt.Sprintf("registry-%s", url), cmd)
 	if err := cmd.Start(); err != nil {
 		if os.IsNotExist(err) {
-			t.Skip(err.Error())
+			c.Skip(err.Error())
 		}
 		return nil, err
 	}
@@ -111,9 +110,9 @@ compatibility:
 	}, nil
 }
 
-func (r *testRegistryV2) Ping() error {
+func (t *testRegistryV2) Ping() error {
 	// We always ping through HTTP for our test registry.
-	resp, err := http.Get(fmt.Sprintf("http://%s/v2/", r.url))
+	resp, err := http.Get(fmt.Sprintf("http://%s/v2/", t.url))
 	if err != nil {
 		return err
 	}
@@ -124,8 +123,8 @@ func (r *testRegistryV2) Ping() error {
 	return nil
 }
 
-func (r *testRegistryV2) tearDown() {
+func (t *testRegistryV2) tearDown(c *check.C) {
 	// It’s undocumented what Kill() returns if the process has terminated,
 	// so we couldn’t check just for that. This is running in a container anyway…
-	_ = r.cmd.Process.Kill()
+	_ = t.cmd.Process.Kill()
 }

integration/signing_test.go

@@ -6,28 +6,23 @@ import (
 	"os"
 	"os/exec"
 	"strings"
-	"testing"
 
 	"github.com/containers/image/v5/signature"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
+	"gopkg.in/check.v1"
 )
 
 const (
 	gpgBinary = "gpg"
 )
 
-func TestSigning(t *testing.T) {
-	suite.Run(t, &signingSuite{})
+func init() {
+	check.Suite(&SigningSuite{})
 }
 
-type signingSuite struct {
-	suite.Suite
+type SigningSuite struct {
 	fingerprint string
 }
 
-var _ = suite.SetupAllSuite(&signingSuite{})
-
 func findFingerprint(lineBytes []byte) (string, error) {
 	lines := string(lineBytes)
 	for _, line := range strings.Split(lines, "\n") {
@@ -39,41 +34,43 @@ func findFingerprint(lineBytes []byte) (string, error) {
 	return "", errors.New("No fingerprint found")
 }
 
-func (s *signingSuite) SetupSuite() {
-	t := s.T()
+func (s *SigningSuite) SetUpSuite(c *check.C) {
 	_, err := exec.LookPath(skopeoBinary)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	gpgHome := t.TempDir()
-	t.Setenv("GNUPGHOME", gpgHome)
+	gpgHome := c.MkDir()
+	os.Setenv("GNUPGHOME", gpgHome)
 
-	runCommandWithInput(t, "Key-Type: RSA\nName-Real: Testing user\n%no-protection\n%commit\n", gpgBinary, "--homedir", gpgHome, "--batch", "--gen-key")
+	runCommandWithInput(c, "Key-Type: RSA\nName-Real: Testing user\n%no-protection\n%commit\n", gpgBinary, "--homedir", gpgHome, "--batch", "--gen-key")
 
 	lines, err := exec.Command(gpgBinary, "--homedir", gpgHome, "--with-colons", "--no-permission-warning", "--fingerprint").Output()
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	s.fingerprint, err = findFingerprint(lines)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 }
 
-func (s *signingSuite) TestSignVerifySmoke() {
-	t := s.T()
+func (s *SigningSuite) TearDownSuite(c *check.C) {
+	os.Unsetenv("GNUPGHOME")
+}
+
+func (s *SigningSuite) TestSignVerifySmoke(c *check.C) {
 	mech, _, err := signature.NewEphemeralGPGSigningMechanism([]byte{})
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	defer mech.Close()
 	if err := mech.SupportsSigning(); err != nil { // FIXME? Test that verification and policy enforcement works, using signatures from fixtures
-		t.Skipf("Signing not supported: %v", err)
+		c.Skip(fmt.Sprintf("Signing not supported: %v", err))
 	}
 
 	manifestPath := "fixtures/image.manifest.json"
 	dockerReference := "testing/smoketest"
 
 	sigOutput, err := os.CreateTemp("", "sig")
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	defer os.Remove(sigOutput.Name())
-	assertSkopeoSucceeds(t, "^$", "standalone-sign", "-o", sigOutput.Name(),
+	assertSkopeoSucceeds(c, "^$", "standalone-sign", "-o", sigOutput.Name(),
 		manifestPath, dockerReference, s.fingerprint)
 
-	expected := fmt.Sprintf("^Signature verified using fingerprint %s, digest %s\n$", s.fingerprint, TestImageManifestDigest)
-	assertSkopeoSucceeds(t, expected, "standalone-verify", manifestPath,
+	expected := fmt.Sprintf("^Signature verified, digest %s\n$", TestImageManifestDigest)
+	assertSkopeoSucceeds(c, expected, "standalone-verify", manifestPath,
 		dockerReference, s.fingerprint, sigOutput.Name())
 }

integration/sync_test.go

@@ -9,16 +9,13 @@ import (
 	"path/filepath"
 	"regexp"
 	"strings"
-	"testing"
 
 	"github.com/containers/image/v5/docker"
 	"github.com/containers/image/v5/docker/reference"
 	"github.com/containers/image/v5/manifest"
 	"github.com/containers/image/v5/types"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
+	"gopkg.in/check.v1"
 )
 
 const (
@@ -36,36 +33,30 @@ const (
 	pullableRepoWithLatestTag = "registry.k8s.io/pause"
 )
 
-func TestSync(t *testing.T) {
-	suite.Run(t, &syncSuite{})
+func init() {
+	check.Suite(&SyncSuite{})
 }
 
-type syncSuite struct {
-	suite.Suite
+type SyncSuite struct {
 	cluster  *openshiftCluster
 	registry *testRegistryV2
 }
 
-var _ = suite.SetupAllSuite(&syncSuite{})
-var _ = suite.TearDownAllSuite(&syncSuite{})
-
-func (s *syncSuite) SetupSuite() {
-	t := s.T()
-
+func (s *SyncSuite) SetUpSuite(c *check.C) {
 	const registryAuth = false
 	const registrySchema1 = false
 
 	if os.Getenv("SKOPEO_LOCAL_TESTS") == "1" {
-		t.Log("Running tests without a container")
+		c.Log("Running tests without a container")
 		fmt.Printf("NOTE: tests requires a V2 registry at url=%s, with auth=%t, schema1=%t \n", v2DockerRegistryURL, registryAuth, registrySchema1)
 		return
 	}
 
 	if os.Getenv("SKOPEO_CONTAINER_TESTS") != "1" {
-		t.Skip("Not running in a container, refusing to affect user state")
+		c.Skip("Not running in a container, refusing to affect user state")
 	}
 
-	s.cluster = startOpenshiftCluster(t) // FIXME: Set up TLS for the docker registry port instead of using "--tls-verify=false" all over the place.
+	s.cluster = startOpenshiftCluster(c) // FIXME: Set up TLS for the docker registry port instead of using "--tls-verify=false" all over the place.
 
 	for _, stream := range []string{"unsigned", "personal", "official", "naming", "cosigned", "compression", "schema1", "schema2"} {
 		isJSON := fmt.Sprintf(`{
@@ -76,42 +67,41 @@ func (s *syncSuite) SetupSuite() {
 			},
 			"spec": {}
 		}`, stream)
-		runCommandWithInput(t, isJSON, "oc", "create", "-f", "-")
+		runCommandWithInput(c, isJSON, "oc", "create", "-f", "-")
 	}
 
 	// FIXME: Set up TLS for the docker registry port instead of using "--tls-verify=false" all over the place.
-	s.registry = setupRegistryV2At(t, v2DockerRegistryURL, registryAuth, registrySchema1)
+	s.registry = setupRegistryV2At(c, v2DockerRegistryURL, registryAuth, registrySchema1)
 
-	gpgHome := t.TempDir()
-	t.Setenv("GNUPGHOME", gpgHome)
+	gpgHome := c.MkDir()
+	os.Setenv("GNUPGHOME", gpgHome)
 
 	for _, key := range []string{"personal", "official"} {
 		batchInput := fmt.Sprintf("Key-Type: RSA\nName-Real: Test key - %s\nName-email: %s@example.com\n%%no-protection\n%%commit\n",
 			key, key)
-		runCommandWithInput(t, batchInput, gpgBinary, "--batch", "--gen-key")
+		runCommandWithInput(c, batchInput, gpgBinary, "--batch", "--gen-key")
 
-		out := combinedOutputOfCommand(t, gpgBinary, "--armor", "--export", fmt.Sprintf("%s@example.com", key))
+		out := combinedOutputOfCommand(c, gpgBinary, "--armor", "--export", fmt.Sprintf("%s@example.com", key))
 		err := os.WriteFile(filepath.Join(gpgHome, fmt.Sprintf("%s-pubkey.gpg", key)),
 			[]byte(out), 0600)
-		require.NoError(t, err)
+		c.Assert(err, check.IsNil)
 	}
 }
 
-func (s *syncSuite) TearDownSuite() {
-	t := s.T()
+func (s *SyncSuite) TearDownSuite(c *check.C) {
 	if os.Getenv("SKOPEO_LOCAL_TESTS") == "1" {
 		return
 	}
 
 	if s.registry != nil {
-		s.registry.tearDown()
+		s.registry.tearDown(c)
 	}
 	if s.cluster != nil {
-		s.cluster.tearDown(t)
+		s.cluster.tearDown(c)
 	}
 }
 
-func assertNumberOfManifestsInSubdirs(t *testing.T, dir string, expectedCount int) {
+func assertNumberOfManifestsInSubdirs(c *check.C, dir string, expectedCount int) {
 	nManifests := 0
 	err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
@@ -123,163 +113,156 @@ func assertNumberOfManifestsInSubdirs(t *testing.T, dir string, expectedCount in
 		}
 		return nil
 	})
-	require.NoError(t, err)
-	assert.Equal(t, expectedCount, nManifests)
+	c.Assert(err, check.IsNil)
+	c.Assert(nManifests, check.Equals, expectedCount)
 }
 
-func (s *syncSuite) TestDocker2DirTagged() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestDocker2DirTagged(c *check.C) {
+	tmpDir := c.MkDir()
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedImage
 	imageRef, err := docker.ParseReference(fmt.Sprintf("//%s", image))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	imagePath := imageRef.DockerReference().String()
 
 	dir1 := path.Join(tmpDir, "dir1")
 	dir2 := path.Join(tmpDir, "dir2")
 
 	// sync docker => dir
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "docker://"+image, "dir:"+dir2)
+	assertSkopeoSucceeds(c, "", "copy", "docker://"+image, "dir:"+dir2)
 	_, err = os.Stat(path.Join(dir2, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	out := combinedOutputOfCommand(t, "diff", "-urN", path.Join(dir1, imagePath), dir2)
-	assert.Equal(t, "", out)
+	out := combinedOutputOfCommand(c, "diff", "-urN", path.Join(dir1, imagePath), dir2)
+	c.Assert(out, check.Equals, "")
 }
 
-func (s *syncSuite) TestDocker2DirTaggedAll() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestDocker2DirTaggedAll(c *check.C) {
+	tmpDir := c.MkDir()
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedManifestList
 	imageRef, err := docker.ParseReference(fmt.Sprintf("//%s", image))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	imagePath := imageRef.DockerReference().String()
 
 	dir1 := path.Join(tmpDir, "dir1")
 	dir2 := path.Join(tmpDir, "dir2")
 
 	// sync docker => dir
-	assertSkopeoSucceeds(t, "", "sync", "--all", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(c, "", "sync", "--all", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--all", "docker://"+image, "dir:"+dir2)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "docker://"+image, "dir:"+dir2)
 	_, err = os.Stat(path.Join(dir2, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	out := combinedOutputOfCommand(t, "diff", "-urN", path.Join(dir1, imagePath), dir2)
-	assert.Equal(t, "", out)
+	out := combinedOutputOfCommand(c, "diff", "-urN", path.Join(dir1, imagePath), dir2)
+	c.Assert(out, check.Equals, "")
 }
 
-func (s *syncSuite) TestPreserveDigests() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestPreserveDigests(c *check.C) {
+	tmpDir := c.MkDir()
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedManifestList
 
 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--all", "--preserve-digests", "docker://"+image, "dir:"+tmpDir)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "--preserve-digests", "docker://"+image, "dir:"+tmpDir)
 	_, err := os.Stat(path.Join(tmpDir, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	assertSkopeoFails(t, ".*Instructed to preserve digests.*", "copy", "--all", "--preserve-digests", "--format=oci", "docker://"+image, "dir:"+tmpDir)
+	assertSkopeoFails(c, ".*Instructed to preserve digests.*", "copy", "--all", "--preserve-digests", "--format=oci", "docker://"+image, "dir:"+tmpDir)
 }
 
-func (s *syncSuite) TestScoped() {
-	t := s.T()
+func (s *SyncSuite) TestScoped(c *check.C) {
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedImage
 	imageRef, err := docker.ParseReference(fmt.Sprintf("//%s", image))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	imagePath := imageRef.DockerReference().String()
 
-	dir1 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "sync", "--src", "docker", "--dest", "dir", image, dir1)
+	dir1 := c.MkDir()
+	assertSkopeoSucceeds(c, "", "sync", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, path.Base(imagePath), "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 }
 
-func (s *syncSuite) TestDirIsNotOverwritten() {
-	t := s.T()
+func (s *SyncSuite) TestDirIsNotOverwritten(c *check.C) {
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableRepoWithLatestTag
 	imageRef, err := docker.ParseReference(fmt.Sprintf("//%s", image))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	imagePath := imageRef.DockerReference().String()
 
 	// make a copy of the image in the local registry
-	assertSkopeoSucceeds(t, "", "copy", "--dest-tls-verify=false", "docker://"+image, "docker://"+path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())))
+	assertSkopeoSucceeds(c, "", "copy", "--dest-tls-verify=false", "docker://"+image, "docker://"+path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())))
 
 	//sync upstream image to dir, not scoped
-	dir1 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "sync", "--src", "docker", "--dest", "dir", image, dir1)
+	dir1 := c.MkDir()
+	assertSkopeoSucceeds(c, "", "sync", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, path.Base(imagePath), "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	//sync local registry image to dir, not scoped
-	assertSkopeoFails(t, ".*Refusing to overwrite destination directory.*", "sync", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())), dir1)
+	assertSkopeoFails(c, ".*Refusing to overwrite destination directory.*", "sync", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())), dir1)
 
 	//sync local registry image to dir, scoped
 	imageRef, err = docker.ParseReference(fmt.Sprintf("//%s", path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference()))))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	imagePath = imageRef.DockerReference().String()
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())), dir1)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())), dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 }
 
-func (s *syncSuite) TestDocker2DirUntagged() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestDocker2DirUntagged(c *check.C) {
+	tmpDir := c.MkDir()
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableRepo
 	imageRef, err := docker.ParseReference(fmt.Sprintf("//%s", image))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	imagePath := imageRef.DockerReference().String()
 
 	dir1 := path.Join(tmpDir, "dir1")
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
 
 	sysCtx := types.SystemContext{}
 	tags, err := docker.GetRepositoryTags(context.Background(), &sysCtx, imageRef)
-	require.NoError(t, err)
-	assert.NotZero(t, len(tags))
+	c.Assert(err, check.IsNil)
+	c.Check(len(tags), check.Not(check.Equals), 0)
 
 	nManifests, err := filepath.Glob(path.Join(dir1, path.Dir(imagePath), "*", "manifest.json"))
-	require.NoError(t, err)
-	assert.Len(t, nManifests, len(tags))
+	c.Assert(err, check.IsNil)
+	c.Assert(len(nManifests), check.Equals, len(tags))
 }
 
-func (s *syncSuite) TestYamlUntagged() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestYamlUntagged(c *check.C) {
+	tmpDir := c.MkDir()
 	dir1 := path.Join(tmpDir, "dir1")
 
 	image := pullableRepo
 	imageRef, err := docker.ParseReference(fmt.Sprintf("//%s", image))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	imagePath := imageRef.DockerReference().Name()
 
 	sysCtx := types.SystemContext{}
 	tags, err := docker.GetRepositoryTags(context.Background(), &sysCtx, imageRef)
-	require.NoError(t, err)
-	assert.NotZero(t, len(tags))
+	c.Assert(err, check.IsNil)
+	c.Check(len(tags), check.Not(check.Equals), 0)
 
 	yamlConfig := fmt.Sprintf(`
 %s:
@@ -290,8 +273,8 @@ func (s *syncSuite) TestYamlUntagged() {
 	// sync to the local registry
 	yamlFile := path.Join(tmpDir, "registries.yaml")
 	err = os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "docker", "--dest-tls-verify=false", yamlFile, v2DockerRegistryURL)
+	c.Assert(err, check.IsNil)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "docker", "--dest-tls-verify=false", yamlFile, v2DockerRegistryURL)
 	// sync back from local registry to a folder
 	os.Remove(yamlFile)
 	yamlConfig = fmt.Sprintf(`
@@ -302,24 +285,23 @@ func (s *syncSuite) TestYamlUntagged() {
 `, v2DockerRegistryURL, imagePath)
 
 	err = os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
+	c.Assert(err, check.IsNil)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
 
 	sysCtx = types.SystemContext{
 		DockerInsecureSkipTLSVerify: types.NewOptionalBool(true),
 	}
 	localImageRef, err := docker.ParseReference(fmt.Sprintf("//%s/%s", v2DockerRegistryURL, imagePath))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	localTags, err := docker.GetRepositoryTags(context.Background(), &sysCtx, localImageRef)
-	require.NoError(t, err)
-	assert.NotZero(t, len(localTags))
-	assert.Len(t, localTags, len(tags))
-	assertNumberOfManifestsInSubdirs(t, dir1, len(tags))
+	c.Assert(err, check.IsNil)
+	c.Check(len(localTags), check.Not(check.Equals), 0)
+	c.Assert(len(localTags), check.Equals, len(tags))
+	assertNumberOfManifestsInSubdirs(c, dir1, len(tags))
 }
 
-func (s *syncSuite) TestYamlRegex2Dir() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestYamlRegex2Dir(c *check.C) {
+	tmpDir := c.MkDir()
 	dir1 := path.Join(tmpDir, "dir1")
 
 	yamlConfig := `
@@ -329,18 +311,17 @@ registry.k8s.io:
 `
 	// the       ↑    regex strings always matches only 2 images
 	var nTags = 2
-	assert.NotZero(t, nTags)
+	c.Assert(nTags, check.Not(check.Equals), 0)
 
 	yamlFile := path.Join(tmpDir, "registries.yaml")
 	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
-	assertNumberOfManifestsInSubdirs(t, dir1, nTags)
+	c.Assert(err, check.IsNil)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
+	assertNumberOfManifestsInSubdirs(c, dir1, nTags)
 }
 
-func (s *syncSuite) TestYamlDigest2Dir() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestYamlDigest2Dir(c *check.C) {
+	tmpDir := c.MkDir()
 	dir1 := path.Join(tmpDir, "dir1")
 
 	yamlConfig := `
@@ -351,14 +332,13 @@ registry.k8s.io:
 `
 	yamlFile := path.Join(tmpDir, "registries.yaml")
 	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
-	assertNumberOfManifestsInSubdirs(t, dir1, 1)
+	c.Assert(err, check.IsNil)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
+	assertNumberOfManifestsInSubdirs(c, dir1, 1)
 }
 
-func (s *syncSuite) TestYaml2Dir() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestYaml2Dir(c *check.C) {
+	tmpDir := c.MkDir()
 	dir1 := path.Join(tmpDir, "dir1")
 
 	yamlConfig := `
@@ -386,26 +366,25 @@ quay.io:
 			nTags++
 		}
 	}
-	assert.NotZero(t, nTags)
+	c.Assert(nTags, check.Not(check.Equals), 0)
 
 	yamlFile := path.Join(tmpDir, "registries.yaml")
 	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
-	assertNumberOfManifestsInSubdirs(t, dir1, nTags)
+	c.Assert(err, check.IsNil)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
+	assertNumberOfManifestsInSubdirs(c, dir1, nTags)
 }
 
-func (s *syncSuite) TestYamlTLSVerify() {
-	t := s.T()
+func (s *SyncSuite) TestYamlTLSVerify(c *check.C) {
 	const localRegURL = "docker://" + v2DockerRegistryURL + "/"
-	tmpDir := t.TempDir()
+	tmpDir := c.MkDir()
 	dir1 := path.Join(tmpDir, "dir1")
 	image := pullableRepoWithLatestTag
 	tag := "latest"
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	// copy docker => docker
-	assertSkopeoSucceeds(t, "", "copy", "--dest-tls-verify=false", "docker://"+image+":"+tag, localRegURL+image+":"+tag)
+	assertSkopeoSucceeds(c, "", "copy", "--dest-tls-verify=false", "docker://"+image+":"+tag, localRegURL+image+":"+tag)
 
 	yamlTemplate := `
 %s:
@@ -417,7 +396,7 @@ func (s *syncSuite) TestYamlTLSVerify() {
 	testCfg := []struct {
 		tlsVerify string
 		msg       string
-		checker   func(t *testing.T, regexp string, args ...string)
+		checker   func(c *check.C, regexp string, args ...string)
 	}{
 		{
 			tlsVerify: "tls-verify: false",
@@ -441,18 +420,17 @@ func (s *syncSuite) TestYamlTLSVerify() {
 		yamlConfig := fmt.Sprintf(yamlTemplate, v2DockerRegistryURL, cfg.tlsVerify, image, tag)
 		yamlFile := path.Join(tmpDir, "registries.yaml")
 		err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-		require.NoError(t, err)
+		c.Assert(err, check.IsNil)
 
-		cfg.checker(t, cfg.msg, "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
+		cfg.checker(c, cfg.msg, "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
 		os.Remove(yamlFile)
 		os.RemoveAll(dir1)
 	}
 
 }
 
-func (s *syncSuite) TestSyncManifestOutput() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestSyncManifestOutput(c *check.C) {
+	tmpDir := c.MkDir()
 
 	destDir1 := filepath.Join(tmpDir, "dest1")
 	destDir2 := filepath.Join(tmpDir, "dest2")
@@ -461,162 +439,154 @@ func (s *syncSuite) TestSyncManifestOutput() {
 	//Split image:tag path from image URI for manifest comparison
 	imageDir := pullableTaggedImage[strings.LastIndex(pullableTaggedImage, "/")+1:]
 
-	assertSkopeoSucceeds(t, "", "sync", "--format=oci", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir1)
-	verifyManifestMIMEType(t, filepath.Join(destDir1, imageDir), imgspecv1.MediaTypeImageManifest)
-	assertSkopeoSucceeds(t, "", "sync", "--format=v2s2", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir2)
-	verifyManifestMIMEType(t, filepath.Join(destDir2, imageDir), manifest.DockerV2Schema2MediaType)
-	assertSkopeoSucceeds(t, "", "sync", "--format=v2s1", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir3)
-	verifyManifestMIMEType(t, filepath.Join(destDir3, imageDir), manifest.DockerV2Schema1SignedMediaType)
+	assertSkopeoSucceeds(c, "", "sync", "--format=oci", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir1)
+	verifyManifestMIMEType(c, filepath.Join(destDir1, imageDir), imgspecv1.MediaTypeImageManifest)
+	assertSkopeoSucceeds(c, "", "sync", "--format=v2s2", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir2)
+	verifyManifestMIMEType(c, filepath.Join(destDir2, imageDir), manifest.DockerV2Schema2MediaType)
+	assertSkopeoSucceeds(c, "", "sync", "--format=v2s1", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir3)
+	verifyManifestMIMEType(c, filepath.Join(destDir3, imageDir), manifest.DockerV2Schema1SignedMediaType)
 }
 
-func (s *syncSuite) TestDocker2DockerTagged() {
-	t := s.T()
+func (s *SyncSuite) TestDocker2DockerTagged(c *check.C) {
 	const localRegURL = "docker://" + v2DockerRegistryURL + "/"
 
-	tmpDir := t.TempDir()
+	tmpDir := c.MkDir()
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedImage
 	imageRef, err := docker.ParseReference(fmt.Sprintf("//%s", image))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	imagePath := imageRef.DockerReference().String()
 
 	dir1 := path.Join(tmpDir, "dir1")
 	dir2 := path.Join(tmpDir, "dir2")
 
 	// sync docker => docker
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--dest-tls-verify=false", "--src", "docker", "--dest", "docker", image, v2DockerRegistryURL)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--dest-tls-verify=false", "--src", "docker", "--dest", "docker", image, v2DockerRegistryURL)
 
 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "docker://"+image, "dir:"+dir1)
+	assertSkopeoSucceeds(c, "", "copy", "docker://"+image, "dir:"+dir1)
 	_, err = os.Stat(path.Join(dir1, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--src-tls-verify=false", localRegURL+imagePath, "dir:"+dir2)
+	assertSkopeoSucceeds(c, "", "copy", "--src-tls-verify=false", localRegURL+imagePath, "dir:"+dir2)
 	_, err = os.Stat(path.Join(dir2, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	out := combinedOutputOfCommand(t, "diff", "-urN", dir1, dir2)
-	assert.Equal(t, "", out)
+	out := combinedOutputOfCommand(c, "diff", "-urN", dir1, dir2)
+	c.Assert(out, check.Equals, "")
 }
 
-func (s *syncSuite) TestDir2DockerTagged() {
-	t := s.T()
+func (s *SyncSuite) TestDir2DockerTagged(c *check.C) {
 	const localRegURL = "docker://" + v2DockerRegistryURL + "/"
 
-	tmpDir := t.TempDir()
+	tmpDir := c.MkDir()
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableRepoWithLatestTag
 
 	dir1 := path.Join(tmpDir, "dir1")
 	err := os.Mkdir(dir1, 0755)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	dir2 := path.Join(tmpDir, "dir2")
 	err = os.Mkdir(dir2, 0755)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// create leading dirs
 	err = os.MkdirAll(path.Dir(path.Join(dir1, image)), 0755)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "docker://"+image, "dir:"+path.Join(dir1, image))
+	assertSkopeoSucceeds(c, "", "copy", "docker://"+image, "dir:"+path.Join(dir1, image))
 	_, err = os.Stat(path.Join(dir1, image, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// sync dir => docker
-	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--dest-tls-verify=false", "--src", "dir", "--dest", "docker", dir1, v2DockerRegistryURL)
+	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--dest-tls-verify=false", "--src", "dir", "--dest", "docker", dir1, v2DockerRegistryURL)
 
 	// create leading dirs
 	err = os.MkdirAll(path.Dir(path.Join(dir2, image)), 0755)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--src-tls-verify=false", localRegURL+image, "dir:"+path.Join(dir2, image))
+	assertSkopeoSucceeds(c, "", "copy", "--src-tls-verify=false", localRegURL+image, "dir:"+path.Join(dir2, image))
 	_, err = os.Stat(path.Join(dir2, image, "manifest.json"))
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
-	out := combinedOutputOfCommand(t, "diff", "-urN", dir1, dir2)
-	assert.Equal(t, "", out)
+	out := combinedOutputOfCommand(c, "diff", "-urN", dir1, dir2)
+	c.Assert(out, check.Equals, "")
 }
 
-func (s *syncSuite) TestFailsWithDir2Dir() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestFailsWithDir2Dir(c *check.C) {
+	tmpDir := c.MkDir()
 
 	dir1 := path.Join(tmpDir, "dir1")
 	dir2 := path.Join(tmpDir, "dir2")
 
 	// sync dir => dir is not allowed
-	assertSkopeoFails(t, ".*sync from 'dir' to 'dir' not implemented.*", "sync", "--scoped", "--src", "dir", "--dest", "dir", dir1, dir2)
+	assertSkopeoFails(c, ".*sync from 'dir' to 'dir' not implemented.*", "sync", "--scoped", "--src", "dir", "--dest", "dir", dir1, dir2)
 }
 
-func (s *syncSuite) TestFailsNoSourceImages() {
-	t := s.T()
-	tmpDir := t.TempDir()
+func (s *SyncSuite) TestFailsNoSourceImages(c *check.C) {
+	tmpDir := c.MkDir()
 
-	assertSkopeoFails(t, ".*No images to sync found in .*",
+	assertSkopeoFails(c, ".*No images to sync found in .*",
 		"sync", "--scoped", "--dest-tls-verify=false", "--src", "dir", "--dest", "docker", tmpDir, v2DockerRegistryURL)
 
-	assertSkopeoFails(t, ".*Error determining repository tags for repo docker.io/library/hopefully_no_images_will_ever_be_called_like_this: fetching tags list: requested access to the resource is denied.*",
+	assertSkopeoFails(c, ".*Error determining repository tags for repo docker.io/library/hopefully_no_images_will_ever_be_called_like_this: fetching tags list: requested access to the resource is denied.*",
 		"sync", "--scoped", "--dest-tls-verify=false", "--src", "docker", "--dest", "docker", "hopefully_no_images_will_ever_be_called_like_this", v2DockerRegistryURL)
 }
 
-func (s *syncSuite) TestFailsWithDockerSourceNoRegistry() {
-	t := s.T()
+func (s *SyncSuite) TestFailsWithDockerSourceNoRegistry(c *check.C) {
 	const regURL = "google.com/namespace/imagename"
 
-	tmpDir := t.TempDir()
+	tmpDir := c.MkDir()
 
 	//untagged
-	assertSkopeoFails(t, ".*StatusCode: 404.*",
+	assertSkopeoFails(c, ".*StatusCode: 404.*",
 		"sync", "--scoped", "--src", "docker", "--dest", "dir", regURL, tmpDir)
 
 	//tagged
-	assertSkopeoFails(t, ".*StatusCode: 404.*",
+	assertSkopeoFails(c, ".*StatusCode: 404.*",
 		"sync", "--scoped", "--src", "docker", "--dest", "dir", regURL+":thetag", tmpDir)
 }
 
-func (s *syncSuite) TestFailsWithDockerSourceUnauthorized() {
-	t := s.T()
+func (s *SyncSuite) TestFailsWithDockerSourceUnauthorized(c *check.C) {
 	const repo = "privateimagenamethatshouldnotbepublic"
-	tmpDir := t.TempDir()
+	tmpDir := c.MkDir()
 
 	//untagged
-	assertSkopeoFails(t, ".*requested access to the resource is denied.*",
+	assertSkopeoFails(c, ".*requested access to the resource is denied.*",
 		"sync", "--scoped", "--src", "docker", "--dest", "dir", repo, tmpDir)
 
 	//tagged
-	assertSkopeoFails(t, ".*requested access to the resource is denied.*",
+	assertSkopeoFails(c, ".*requested access to the resource is denied.*",
 		"sync", "--scoped", "--src", "docker", "--dest", "dir", repo+":thetag", tmpDir)
 }
 
-func (s *syncSuite) TestFailsWithDockerSourceNotExisting() {
-	t := s.T()
+func (s *SyncSuite) TestFailsWithDockerSourceNotExisting(c *check.C) {
 	repo := path.Join(v2DockerRegistryURL, "imagedoesnotexist")
-	tmpDir := t.TempDir()
+	tmpDir := c.MkDir()
 
 	//untagged
-	assertSkopeoFails(t, ".*repository name not known to registry.*",
+	assertSkopeoFails(c, ".*repository name not known to registry.*",
 		"sync", "--scoped", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", repo, tmpDir)
 
 	//tagged
-	assertSkopeoFails(t, ".*reading manifest.*",
+	assertSkopeoFails(c, ".*reading manifest.*",
 		"sync", "--scoped", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", repo+":thetag", tmpDir)
 }
 
-func (s *syncSuite) TestFailsWithDirSourceNotExisting() {
-	t := s.T()
+func (s *SyncSuite) TestFailsWithDirSourceNotExisting(c *check.C) {
 	// Make sure the dir does not exist!
-	tmpDir := t.TempDir()
+	tmpDir := c.MkDir()
 	tmpDir = filepath.Join(tmpDir, "this-does-not-exist")
 	err := os.RemoveAll(tmpDir)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	_, err = os.Stat(path.Join(tmpDir))
-	assert.True(t, os.IsNotExist(err))
+	c.Check(os.IsNotExist(err), check.Equals, true)
 
-	assertSkopeoFails(t, ".*no such file or directory.*",
+	assertSkopeoFails(c, ".*no such file or directory.*",
 		"sync", "--scoped", "--dest-tls-verify=false", "--src", "dir", "--dest", "docker", tmpDir, v2DockerRegistryURL)
 }

integration/utils.go

@@ -0,0 +1,215 @@
+package main
+
+import (
+	"bytes"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/containers/image/v5/manifest"
+	"gopkg.in/check.v1"
+)
+
+const skopeoBinary = "skopeo"
+const decompressDirsBinary = "./decompress-dirs.sh"
+
+const testFQIN = "docker://quay.io/libpod/busybox" // tag left off on purpose, some tests need to add a special one
+const testFQIN64 = "docker://quay.io/libpod/busybox:amd64"
+const testFQINMultiLayer = "docker://quay.io/libpod/alpine_nginx:latest" // multi-layer
+
+// consumeAndLogOutputStream takes (f, err) from an exec.*Pipe(), and causes all output to it to be logged to c.
+func consumeAndLogOutputStream(c *check.C, id string, f io.ReadCloser, err error) {
+	c.Assert(err, check.IsNil)
+	go func() {
+		defer func() {
+			f.Close()
+			c.Logf("Output %s: Closed", id)
+		}()
+		buf := make([]byte, 1024)
+		for {
+			c.Logf("Output %s: waiting", id)
+			n, err := f.Read(buf)
+			c.Logf("Output %s: got %d,%#v: %s", id, n, err, strings.TrimSuffix(string(buf[:n]), "\n"))
+			if n <= 0 {
+				break
+			}
+		}
+	}()
+}
+
+// consumeAndLogOutputs causes all output to stdout and stderr from an *exec.Cmd to be logged to c
+func consumeAndLogOutputs(c *check.C, id string, cmd *exec.Cmd) {
+	stdout, err := cmd.StdoutPipe()
+	consumeAndLogOutputStream(c, id+" stdout", stdout, err)
+	stderr, err := cmd.StderrPipe()
+	consumeAndLogOutputStream(c, id+" stderr", stderr, err)
+}
+
+// combinedOutputOfCommand runs a command as if exec.Command().CombinedOutput(), verifies that the exit status is 0, and returns the output,
+// or terminates c on failure.
+func combinedOutputOfCommand(c *check.C, name string, args ...string) string {
+	c.Logf("Running %s %s", name, strings.Join(args, " "))
+	out, err := exec.Command(name, args...).CombinedOutput()
+	c.Assert(err, check.IsNil, check.Commentf("%s", out))
+	return string(out)
+}
+
+// assertSkopeoSucceeds runs a skopeo command as if exec.Command().CombinedOutput, verifies that the exit status is 0,
+// and optionally that the output matches a multi-line regexp if it is nonempty;
+// or terminates c on failure
+func assertSkopeoSucceeds(c *check.C, regexp string, args ...string) {
+	c.Logf("Running %s %s", skopeoBinary, strings.Join(args, " "))
+	out, err := exec.Command(skopeoBinary, args...).CombinedOutput()
+	c.Assert(err, check.IsNil, check.Commentf("%s", out))
+	if regexp != "" {
+		c.Assert(string(out), check.Matches, "(?s)"+regexp) // (?s) : '.' will also match newlines
+	}
+}
+
+// assertSkopeoFails runs a skopeo command as if exec.Command().CombinedOutput, verifies that the exit status is 0,
+// and that the output matches a multi-line regexp;
+// or terminates c on failure
+func assertSkopeoFails(c *check.C, regexp string, args ...string) {
+	c.Logf("Running %s %s", skopeoBinary, strings.Join(args, " "))
+	out, err := exec.Command(skopeoBinary, args...).CombinedOutput()
+	c.Assert(err, check.NotNil, check.Commentf("%s", out))
+	c.Assert(string(out), check.Matches, "(?s)"+regexp) // (?s) : '.' will also match newlines
+}
+
+// runCommandWithInput runs a command as if exec.Command(), sending it the input to stdin,
+// and verifies that the exit status is 0, or terminates c on failure.
+func runCommandWithInput(c *check.C, input string, name string, args ...string) {
+	cmd := exec.Command(name, args...)
+	runExecCmdWithInput(c, cmd, input)
+}
+
+// runExecCmdWithInput runs an exec.Cmd, sending it the input to stdin,
+// and verifies that the exit status is 0, or terminates c on failure.
+func runExecCmdWithInput(c *check.C, cmd *exec.Cmd, input string) {
+	c.Logf("Running %s %s", cmd.Path, strings.Join(cmd.Args, " "))
+	consumeAndLogOutputs(c, cmd.Path+" "+strings.Join(cmd.Args, " "), cmd)
+	stdin, err := cmd.StdinPipe()
+	c.Assert(err, check.IsNil)
+	err = cmd.Start()
+	c.Assert(err, check.IsNil)
+	_, err = stdin.Write([]byte(input))
+	c.Assert(err, check.IsNil)
+	err = stdin.Close()
+	c.Assert(err, check.IsNil)
+	err = cmd.Wait()
+	c.Assert(err, check.IsNil)
+}
+
+// isPortOpen returns true iff the specified port on localhost is open.
+func isPortOpen(port int) bool {
+	conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port})
+	if err != nil {
+		return false
+	}
+	conn.Close()
+	return true
+}
+
+// newPortChecker sets up a portOpen channel which will receive true after the specified port is open.
+// The checking can be aborted by sending a value to the terminate channel, which the caller should
+// always do using
+// defer func() {terminate <- true}()
+func newPortChecker(c *check.C, port int) (portOpen <-chan bool, terminate chan<- bool) {
+	portOpenBidi := make(chan bool)
+	// Buffered, so that sending a terminate request after the goroutine has exited does not block.
+	terminateBidi := make(chan bool, 1)
+
+	go func() {
+		defer func() {
+			c.Logf("Port checker for port %d exiting", port)
+		}()
+		for {
+			c.Logf("Checking for port %d...", port)
+			if isPortOpen(port) {
+				c.Logf("Port %d open", port)
+				portOpenBidi <- true
+				return
+			}
+			c.Logf("Sleeping for port %d", port)
+			sleepChan := time.After(100 * time.Millisecond)
+			select {
+			case <-sleepChan: // Try again
+				c.Logf("Sleeping for port %d done, will retry", port)
+			case <-terminateBidi:
+				c.Logf("Check for port %d terminated", port)
+				return
+			}
+		}
+	}()
+	return portOpenBidi, terminateBidi
+}
+
+// modifyEnviron modifies os.Environ()-like list of name=value assignments to set name to value.
+func modifyEnviron(env []string, name, value string) []string {
+	prefix := name + "="
+	res := []string{}
+	for _, e := range env {
+		if !strings.HasPrefix(e, prefix) {
+			res = append(res, e)
+		}
+	}
+	return append(res, prefix+value)
+}
+
+// fileFromFixtureFixture applies edits to inputPath and returns a path to the temporary file.
+// Callers should defer os.Remove(the_returned_path)
+func fileFromFixture(c *check.C, inputPath string, edits map[string]string) string {
+	contents, err := os.ReadFile(inputPath)
+	c.Assert(err, check.IsNil)
+	for template, value := range edits {
+		updated := bytes.ReplaceAll(contents, []byte(template), []byte(value))
+		c.Assert(bytes.Equal(updated, contents), check.Equals, false, check.Commentf("Replacing %s in %#v failed", template, string(contents))) // Verify that the template has matched something and we are not silently ignoring it.
+		contents = updated
+	}
+
+	file, err := os.CreateTemp("", "policy.json")
+	c.Assert(err, check.IsNil)
+	path := file.Name()
+
+	_, err = file.Write(contents)
+	c.Assert(err, check.IsNil)
+	err = file.Close()
+	c.Assert(err, check.IsNil)
+	return path
+}
+
+// runDecompressDirs runs decompress-dirs.sh using exec.Command().CombinedOutput, verifies that the exit status is 0,
+// and optionally that the output matches a multi-line regexp if it is nonempty; or terminates c on failure
+func runDecompressDirs(c *check.C, regexp string, args ...string) {
+	c.Logf("Running %s %s", decompressDirsBinary, strings.Join(args, " "))
+	for i, dir := range args {
+		m, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
+		c.Assert(err, check.IsNil)
+		c.Logf("manifest %d before: %s", i+1, string(m))
+	}
+	out, err := exec.Command(decompressDirsBinary, args...).CombinedOutput()
+	c.Assert(err, check.IsNil, check.Commentf("%s", out))
+	for i, dir := range args {
+		if len(out) > 0 {
+			c.Logf("output: %s", out)
+		}
+		m, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
+		c.Assert(err, check.IsNil)
+		c.Logf("manifest %d after: %s", i+1, string(m))
+	}
+	if regexp != "" {
+		c.Assert(string(out), check.Matches, "(?s)"+regexp) // (?s) : '.' will also match newlines
+	}
+}
+
+// Verify manifest in a dir: image at dir is expectedMIMEType.
+func verifyManifestMIMEType(c *check.C, dir string, expectedMIMEType string) {
+	manifestBlob, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
+	c.Assert(err, check.IsNil)
+	mimeType := manifest.GuessMIMEType(manifestBlob)
+	c.Assert(mimeType, check.Equals, expectedMIMEType)
+}

integration/utils_test.go

@@ -1,291 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"compress/gzip"
-	"encoding/json"
-	"io"
-	"net"
-	"net/netip"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/containers/image/v5/manifest"
-	"github.com/opencontainers/go-digest"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const skopeoBinary = "skopeo"
-
-const testFQIN = "docker://quay.io/libpod/busybox" // tag left off on purpose, some tests need to add a special one
-const testFQIN64 = "docker://quay.io/libpod/busybox:amd64"
-const testFQINMultiLayer = "docker://quay.io/libpod/alpine_nginx:latest" // multi-layer
-
-// consumeAndLogOutputStream takes (f, err) from an exec.*Pipe(), and causes all output to it to be logged to t.
-func consumeAndLogOutputStream(t *testing.T, id string, f io.ReadCloser, err error) {
-	require.NoError(t, err)
-	go func() {
-		defer func() {
-			f.Close()
-			t.Logf("Output %s: Closed", id)
-		}()
-		buf := make([]byte, 1024)
-		for {
-			t.Logf("Output %s: waiting", id)
-			n, err := f.Read(buf)
-			t.Logf("Output %s: got %d,%#v: %s", id, n, err, strings.TrimSuffix(string(buf[:n]), "\n"))
-			if n <= 0 {
-				break
-			}
-		}
-	}()
-}
-
-// consumeAndLogOutputs causes all output to stdout and stderr from an *exec.Cmd to be logged to c.
-func consumeAndLogOutputs(t *testing.T, id string, cmd *exec.Cmd) {
-	stdout, err := cmd.StdoutPipe()
-	consumeAndLogOutputStream(t, id+" stdout", stdout, err)
-	stderr, err := cmd.StderrPipe()
-	consumeAndLogOutputStream(t, id+" stderr", stderr, err)
-}
-
-// combinedOutputOfCommand runs a command as if exec.Command().CombinedOutput(), verifies that the exit status is 0, and returns the output,
-// or terminates c on failure.
-func combinedOutputOfCommand(t *testing.T, name string, args ...string) string {
-	t.Logf("Running %s %s", name, strings.Join(args, " "))
-	out, err := exec.Command(name, args...).CombinedOutput()
-	require.NoError(t, err, "%s", out)
-	return string(out)
-}
-
-// assertSkopeoSucceeds runs a skopeo command as if exec.Command().CombinedOutput, verifies that the exit status is 0,
-// and optionally that the output matches a multi-line regexp if it is nonempty;
-// or terminates c on failure
-func assertSkopeoSucceeds(t *testing.T, regexp string, args ...string) {
-	t.Logf("Running %s %s", skopeoBinary, strings.Join(args, " "))
-	out, err := exec.Command(skopeoBinary, args...).CombinedOutput()
-	assert.NoError(t, err, "%s", out)
-	if regexp != "" {
-		assert.Regexp(t, "(?s)"+regexp, string(out)) // (?s) : '.' will also match newlines
-	}
-}
-
-// assertSkopeoFails runs a skopeo command as if exec.Command().CombinedOutput, verifies that the exit status is 0,
-// and that the output matches a multi-line regexp;
-// or terminates c on failure
-func assertSkopeoFails(t *testing.T, regexp string, args ...string) {
-	t.Logf("Running %s %s", skopeoBinary, strings.Join(args, " "))
-	out, err := exec.Command(skopeoBinary, args...).CombinedOutput()
-	assert.Error(t, err, "%s", out)
-	assert.Regexp(t, "(?s)"+regexp, string(out)) // (?s) : '.' will also match newlines
-}
-
-// runCommandWithInput runs a command as if exec.Command(), sending it the input to stdin,
-// and verifies that the exit status is 0, or terminates c on failure.
-func runCommandWithInput(t *testing.T, input string, name string, args ...string) {
-	cmd := exec.Command(name, args...)
-	runExecCmdWithInput(t, cmd, input)
-}
-
-// runExecCmdWithInput runs an exec.Cmd, sending it the input to stdin,
-// and verifies that the exit status is 0, or terminates c on failure.
-func runExecCmdWithInput(t *testing.T, cmd *exec.Cmd, input string) {
-	t.Logf("Running %s %s", cmd.Path, strings.Join(cmd.Args, " "))
-	consumeAndLogOutputs(t, cmd.Path+" "+strings.Join(cmd.Args, " "), cmd)
-	stdin, err := cmd.StdinPipe()
-	require.NoError(t, err)
-	err = cmd.Start()
-	require.NoError(t, err)
-	_, err = io.WriteString(stdin, input)
-	require.NoError(t, err)
-	err = stdin.Close()
-	require.NoError(t, err)
-	err = cmd.Wait()
-	assert.NoError(t, err)
-}
-
-// isPortOpen returns true iff the specified port on localhost is open.
-func isPortOpen(port uint16) bool {
-	ap := netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), port)
-	conn, err := net.DialTCP("tcp", nil, net.TCPAddrFromAddrPort(ap))
-	if err != nil {
-		return false
-	}
-	conn.Close()
-	return true
-}
-
-// newPortChecker sets up a portOpen channel which will receive true after the specified port is open.
-// The checking can be aborted by sending a value to the terminate channel, which the caller should
-// always do using
-// defer func() {terminate <- true}()
-func newPortChecker(t *testing.T, port uint16) (portOpen <-chan bool, terminate chan<- bool) {
-	portOpenBidi := make(chan bool)
-	// Buffered, so that sending a terminate request after the goroutine has exited does not block.
-	terminateBidi := make(chan bool, 1)
-
-	go func() {
-		defer func() {
-			t.Logf("Port checker for port %d exiting", port)
-		}()
-		for {
-			t.Logf("Checking for port %d...", port)
-			if isPortOpen(port) {
-				t.Logf("Port %d open", port)
-				portOpenBidi <- true
-				return
-			}
-			t.Logf("Sleeping for port %d", port)
-			sleepChan := time.After(100 * time.Millisecond)
-			select {
-			case <-sleepChan: // Try again
-				t.Logf("Sleeping for port %d done, will retry", port)
-			case <-terminateBidi:
-				t.Logf("Check for port %d terminated", port)
-				return
-			}
-		}
-	}()
-	return portOpenBidi, terminateBidi
-}
-
-// modifyEnviron modifies os.Environ()-like list of name=value assignments to set name to value.
-func modifyEnviron(env []string, name, value string) []string {
-	prefix := name + "="
-	res := []string{}
-	for _, e := range env {
-		if !strings.HasPrefix(e, prefix) {
-			res = append(res, e)
-		}
-	}
-	return append(res, prefix+value)
-}
-
-// fileFromFixture applies edits to inputPath and returns a path to the temporary file.
-// Callers should defer os.Remove(the_returned_path)
-func fileFromFixture(t *testing.T, inputPath string, edits map[string]string) string {
-	contents, err := os.ReadFile(inputPath)
-	require.NoError(t, err)
-	for template, value := range edits {
-		updated := bytes.ReplaceAll(contents, []byte(template), []byte(value))
-		require.NotEqual(t, contents, updated, "Replacing %s in %#v failed", template, string(contents)) // Verify that the template has matched something and we are not silently ignoring it.
-		contents = updated
-	}
-
-	file, err := os.CreateTemp("", "policy.json")
-	require.NoError(t, err)
-	path := file.Name()
-
-	_, err = file.Write(contents)
-	require.NoError(t, err)
-	err = file.Close()
-	require.NoError(t, err)
-	return path
-}
-
-// decompressDirs decompresses specified dir:-formatted directories
-func decompressDirs(t *testing.T, dirs ...string) {
-	t.Logf("Decompressing %s", strings.Join(dirs, " "))
-	for i, dir := range dirs {
-		m, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
-		require.NoError(t, err)
-		t.Logf("manifest %d before: %s", i+1, string(m))
-
-		decompressDir(t, dir)
-
-		m, err = os.ReadFile(filepath.Join(dir, "manifest.json"))
-		require.NoError(t, err)
-		t.Logf("manifest %d after: %s", i+1, string(m))
-	}
-}
-
-// getRawMapField assigns a value of rawMap[key] to dest,
-// failing if it does not exist or if it doesn’t have the expected type
-func getRawMapField[T any](t *testing.T, rawMap map[string]any, key string, dest *T) {
-	rawValue, ok := rawMap[key]
-	require.True(t, ok, key)
-	value, ok := rawValue.(T)
-	require.True(t, ok, key, "%#v", value)
-	*dest = value
-}
-
-// decompressDir modifies a dir:-formatted directory to replace gzip-compressed layers with uncompressed variants,
-// and to use a ~canonical formatting of manifest.json.
-func decompressDir(t *testing.T, dir string) {
-	// This is, overall, very dumb; the “obvious” way would be to invoke skopeo to decompress,
-	// or at least to use c/image to parse/format the manifest.
-	//
-	// But this is used to test (aspects of) those code paths… so, it’s acceptable for this to be
-	// dumb and to make assumptions about the data, but it should not share code.
-
-	manifestBlob, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
-	require.NoError(t, err)
-	var rawManifest map[string]any
-	err = json.Unmarshal(manifestBlob, &rawManifest)
-	require.NoError(t, err)
-	var rawLayers []any
-	getRawMapField(t, rawManifest, "layers", &rawLayers)
-	for i, rawLayerValue := range rawLayers {
-		rawLayer, ok := rawLayerValue.(map[string]any)
-		require.True(t, ok)
-		var digestString string
-		getRawMapField(t, rawLayer, "digest", &digestString)
-		compressedDigest, err := digest.Parse(digestString)
-		require.NoError(t, err)
-		if compressedDigest.String() == "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" { // An empty file
-			continue
-		}
-
-		compressedPath := filepath.Join(dir, compressedDigest.Encoded())
-		compressedStream, err := os.Open(compressedPath)
-		require.NoError(t, err)
-		defer compressedStream.Close()
-
-		uncompressedStream, err := gzip.NewReader(compressedStream)
-		if err != nil {
-			continue // Silently assume the layer is not gzip-compressed
-		}
-		tempDest, err := os.CreateTemp(dir, "decompressing")
-		require.NoError(t, err)
-		digester := digest.Canonical.Digester()
-		uncompressedSize, err := io.Copy(tempDest, io.TeeReader(uncompressedStream, digester.Hash()))
-		require.NoError(t, err)
-		err = uncompressedStream.Close()
-		require.NoError(t, err)
-		uncompressedDigest := digester.Digest()
-		uncompressedPath := filepath.Join(dir, uncompressedDigest.Encoded())
-		err = os.Rename(tempDest.Name(), uncompressedPath)
-		require.NoError(t, err)
-		err = os.Remove(compressedPath)
-		require.NoError(t, err)
-
-		rawLayer["digest"] = uncompressedDigest.String()
-		rawLayer["size"] = uncompressedSize
-		var mimeType string
-		getRawMapField(t, rawLayer, "mediaType", &mimeType)
-		if uncompressedMIMEType, ok := strings.CutSuffix(mimeType, ".gzip"); ok {
-			rawLayer["mediaType"] = uncompressedMIMEType
-		}
-
-		rawLayers[i] = rawLayer
-	}
-	rawManifest["layers"] = rawLayers
-
-	manifestBlob, err = json.Marshal(rawManifest)
-	require.NoError(t, err)
-	err = os.WriteFile(filepath.Join(dir, "manifest.json"), manifestBlob, 0o600)
-	require.NoError(t, err)
-}
-
-// Verify manifest in a dir: image at dir is expectedMIMEType.
-func verifyManifestMIMEType(t *testing.T, dir string, expectedMIMEType string) {
-	manifestBlob, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
-	require.NoError(t, err)
-	mimeType := manifest.GuessMIMEType(manifestBlob)
-	assert.Equal(t, expectedMIMEType, mimeType)
-}

plans/main.fmf

@@ -1,20 +0,0 @@
-discover:
-    how: fmf
-execute:
-    how: tmt
-prepare:
-    - when: distro == centos-stream or distro == rhel
-      how: shell
-      script: |
-        dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
-        dnf -y config-manager --set-enabled epel
-      order: 10
-    - when: initiator == packit
-      how: shell
-      script: |
-        COPR_REPO_FILE="/etc/yum.repos.d/*podman-next*.repo"
-        if compgen -G $COPR_REPO_FILE > /dev/null; then
-            sed -i -n '/^priority=/!p;$apriority=1' $COPR_REPO_FILE
-        fi
-        dnf -y upgrade --allowerasing
-      order: 20

rpm/gating.yaml

@@ -1,16 +0,0 @@
---- !Policy
-product_versions:
-  - fedora-*
-decision_context:
-  - bodhi_update_push_stable
-  - bodhi_update_push_testing
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
-
---- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

rpm/skopeo.spec

@@ -1,173 +0,0 @@
-%global with_debug 1
-
-%if 0%{?with_debug}
-%global _find_debuginfo_dwz_opts %{nil}
-%global _dwz_low_mem_die_limit 0
-%else
-%global debug_package %{nil}
-%endif
-
-%global gomodulesmode GO111MODULE=on
-
-# No btrfs on RHEL
-%if %{defined fedora}
-%define build_with_btrfs 1
-%endif
-
-%if %{defined rhel}
-%define fips 1
-%endif
-
-# Only used in official koji builds
-# Copr builds set a separate epoch for all environments
-%if %{defined fedora}
-%define conditional_epoch 1
-%define fakeroot 1
-%else
-%define conditional_epoch 2
-%endif
-
-Name: skopeo
-%if %{defined copr_username}
-Epoch: 102
-%else
-Epoch: %{conditional_epoch}
-%endif
-# DO NOT TOUCH the Version string!
-# The TRUE source of this specfile is:
-# https://github.com/containers/skopeo/blob/main/rpm/skopeo.spec
-# If that's what you're reading, Version must be 0, and will be updated by Packit for
-# copr and koji builds.
-# If you're reading this on dist-git, the version is automatically filled in by Packit.
-Version: 0
-# The `AND` needs to be uppercase in the License for SPDX compatibility
-License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
-Release: %autorelease
-%if %{defined golang_arches_future}
-ExclusiveArch: %{golang_arches_future}
-%else
-ExclusiveArch: aarch64 ppc64le s390x x86_64
-%endif
-Summary: Inspect container images and repositories on registries
-URL: https://github.com/containers/%{name}
-# Tarball fetched from upstream
-Source0: %{url}/archive/v%{version}.tar.gz
-BuildRequires: %{_bindir}/go-md2man
-%if %{defined build_with_btrfs}
-BuildRequires: btrfs-progs-devel
-%endif
-BuildRequires: git-core
-BuildRequires: golang
-%if !%{defined gobuild}
-BuildRequires: go-rpm-macros
-%endif
-BuildRequires: gpgme-devel
-BuildRequires: libassuan-devel
-BuildRequires: ostree-devel
-BuildRequires: glib2-devel
-BuildRequires: make
-BuildRequires: shadow-utils-subid-devel
-Requires: containers-common >= 4:1-21
-
-%description
-Command line utility to inspect images and repositories directly on Docker
-registries without the need to pull them
-
-# NOTE: The tests subpackage is only intended for testing and will not be supported
-# for end-users and/or customers.
-%package tests
-Summary: Tests for %{name}
-
-Requires: %{name} = %{epoch}:%{version}-%{release}
-Requires: bats
-%if %{defined fakeroot}
-Requires: fakeroot
-%endif
-Requires: gnupg
-Requires: jq
-Requires: golang
-Requires: podman
-Requires: crun
-Requires: httpd-tools
-Requires: openssl
-Requires: squashfs-tools
-
-%description tests
-%{summary}
-
-This package contains system tests for %{name}
-
-%prep
-%autosetup -Sgit %{name}-%{version}
-# The %%install stage should not rebuild anything but only install what's
-# built in the %%build stage. So, remove any dependency on build targets.
-sed -i 's/^install-binary: bin\/%{name}.*/install-binary:/' Makefile
-sed -i 's/^completions: bin\/%{name}.*/completions:/' Makefile
-sed -i 's/^install-docs: docs.*/install-docs:/' Makefile
-
-%build
-%set_build_flags
-export CGO_CFLAGS=$CFLAGS
-
-# These extra flags present in $CFLAGS have been skipped for now as they break the build
-CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-flto=auto//g')
-CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-Wp,D_GLIBCXX_ASSERTIONS//g')
-CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-specs=\/usr\/lib\/rpm\/redhat\/redhat-annobin-cc1//g')
-
-%ifarch x86_64
-export CGO_CFLAGS="$CGO_CFLAGS -m64 -mtune=generic -fcf-protection=full"
-%endif
-
-BASEBUILDTAGS="$(hack/libsubid_tag.sh)"
-%if %{defined build_with_btrfs}
-export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)"
-%else
-export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs"
-%endif
-
-%if %{defined fips}
-export BUILDTAGS="$BUILDTAGS libtrust_openssl"
-%endif
-
-# unset LDFLAGS earlier set from set_build_flags
-LDFLAGS=''
-
-%gobuild -o bin/%{name} ./cmd/%{name}
-%{__make} docs
-
-%install
-make \
-    DESTDIR=%{buildroot} \
-    PREFIX=%{_prefix} \
-    install-binary install-docs install-completions
-
-# system tests
-install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
-cp -pav systemtest/* %{buildroot}/%{_datadir}/%{name}/test/system/
-
-#define license tag if not already defined
-%{!?_licensedir:%global license %doc}
-
-# Include this to silence rpmlint.
-# Especially annoying if you use syntastic vim plugin.
-%check
-
-%files
-%license LICENSE
-%doc README.md
-%{_bindir}/%{name}
-%{_mandir}/man1/%{name}*
-%dir %{_datadir}/bash-completion
-%dir %{_datadir}/bash-completion/completions
-%{_datadir}/bash-completion/completions/%{name}
-%dir %{_datadir}/fish/vendor_completions.d
-%{_datadir}/fish/vendor_completions.d/%{name}.fish
-%dir %{_datadir}/zsh/site-functions
-%{_datadir}/zsh/site-functions/_%{name}
-
-%files tests
-%license LICENSE vendor/modules.txt
-%{_datadir}/%{name}/test
-
-%changelog
-%autochangelog

skopeo.spec.rpkg

@@ -0,0 +1,132 @@
+# For automatic rebuilds in COPR
+
+# The following tag is to get correct syntax highlighting for this file in vim text editor
+# vim: syntax=spec
+
+# Any additinoal comments should go below this line or else syntax highlighting
+# may not work.
+
+# CAUTION: This is not a replacement for RPMs provided by your distro.
+# Only intended to build and test the latest unreleased changes.
+
+%global gomodulesmode GO111MODULE=on
+%global with_debug 1
+
+%if 0%{?with_debug}
+%global _find_debuginfo_dwz_opts %{nil}
+%global _dwz_low_mem_die_limit 0
+%else
+%global debug_package %{nil}
+%endif
+
+%if ! 0%{?gobuild:1}
+%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v -x %{?**};
+%endif
+
+Name: {{{ git_dir_name }}}
+Epoch: 101
+Version: {{{ git_dir_version }}}
+Release: 1%{?dist}
+Summary: Inspect container images and repositories on registries
+License: ASL 2.0
+URL: https://github.com/containers/skopeo
+VCS: {{{ git_dir_vcs }}}
+Source: {{{ git_dir_pack }}}
+%if 0%{?fedora} && ! 0%{?rhel}
+BuildRequires: btrfs-progs-devel
+%endif
+BuildRequires: golang >= 1.16.6
+BuildRequires: glib2-devel
+BuildRequires: git-core
+BuildRequires: go-md2man
+%if 0%{?fedora} || 0%{?rhel} >= 9
+BuildRequires: go-rpm-macros
+%endif
+BuildRequires: pkgconfig(devmapper)
+BuildRequires: gpgme-devel
+BuildRequires: libassuan-devel
+BuildRequires: pkgconfig
+BuildRequires: make
+BuildRequires: ostree-devel
+%if 0%{?fedora} <= 35
+Requires: containers-common >= 4:1-39
+%else
+Requires: containers-common >= 4:1-46
+%endif
+
+%description
+Command line utility to inspect images and repositories directly on Docker
+registries without the need to pull them.
+
+%package tests
+Summary: Tests for %{name}
+Requires: %{name} = %{epoch}:%{version}-%{release}
+Requires: bats
+Requires: gnupg
+Requires: jq
+Requires: podman
+Requires: httpd-tools
+Requires: openssl
+Requires: fakeroot
+Requires: squashfs-tools
+
+%description tests
+%{summary}
+
+This package contains system tests for %{name}
+
+%prep
+{{{ git_dir_setup_macro }}}
+
+sed -i 's/install-binary: bin\/skopeo/install-binary:/' Makefile
+
+# This will invoke `make` command in the directory with the extracted sources.
+%build
+%set_build_flags
+export CGO_CFLAGS=$CFLAGS
+# These extra flags present in $CFLAGS have been skipped for now as they break the build
+CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-flto=auto//g')
+CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-Wp,D_GLIBCXX_ASSERTIONS//g')
+CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-specs=\/usr\/lib\/rpm\/redhat\/redhat-annobin-cc1//g')
+
+%ifarch x86_64
+export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full"
+%endif
+
+LDFLAGS=""
+
+export BUILDTAGS="$(hack/libdm_tag.sh)"
+%if 0%{?rhel}
+export BUILDTAGS="$BUILDTAGS exclude_graphdriver_btrfs btrfs_noversion"
+%endif
+
+%gobuild -o bin/%{name} ./cmd/%{name}
+
+%install
+%{__make} PREFIX=%{buildroot}%{_prefix} install-binary install-docs install-completions
+
+# system tests
+install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
+cp -pav systemtest/* %{buildroot}/%{_datadir}/%{name}/test/system/
+
+%files
+%license LICENSE
+%doc README.md
+%{_bindir}/%{name}
+%{_mandir}/man1/%%{name}*
+%dir %{_datadir}/bash-completion
+%dir %{_datadir}/bash-completion/completions
+%{_datadir}/bash-completion/completions/%{name}
+%dir %{_datadir}/fish
+%dir %{_datadir}/fish/vendor_completions.d
+%{_datadir}/fish/vendor_completions.d/%{name}.fish
+%dir %{_datadir}/zsh
+%dir %{_datadir}/zsh/site-functions
+%{_datadir}/zsh/site-functions/_%{name}
+
+%files tests
+%license LICENSE
+%{_datadir}/%{name}/test
+
+%changelog
+{{{ git_dir_changelog }}}

systemtest/001-basic.bats

@@ -16,4 +16,29 @@ function setup() {
     expect_output --substring "skopeo version [0-9.]+"
 }
 
+@test "skopeo release isn't a development version" {
+    [[ "${RELEASE_TESTING:-false}" == "true" ]] || \
+      skip "Release testing may be enabled by setting \$RELEASE_TESTING = 'true'."
+
+    run_skopeo --version
+
+    # expect_output() doesn't support negative matching
+    if [[ "$output" =~ "dev" ]]; then
+        # This is a multi-line message, which may in turn contain multi-line
+        # output, so let's format it ourselves, readably
+        local -a output_split
+        readarray -t output_split <<<"$output"
+        printf "#/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv\n"  >&2
+        printf "#|       FAIL: $BATS_TEST_NAME\n"                   >&2
+        printf "#| unexpected: 'dev'\n"                             >&2
+        printf "#|     actual: '%s'\n" "${output_split[0]}"         >&2
+        local line
+        for line in "${output_split[@]:1}"; do
+            printf "#|           > '%s'\n" "$line"                  >&2
+        done
+        printf "#\\^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n" >&2
+        false
+    fi
+}
+
 # vim: filetype=sh

systemtest/010-inspect.bats

@@ -36,7 +36,7 @@ load helpers
     # the output of 'inspect' lists layer digests,
     # but not the digest of the config blob ($config_digest), if any.
     layers=$(jq -r '.Layers' <<<"$inspect_local")
-    for sha in $(find $workdir -type f | xargs -l1 basename | grep -E '^[0-9a-f]{64}$'); do
+    for sha in $(find $workdir -type f | xargs -l1 basename | egrep '^[0-9a-f]{64}$'); do
         if [ "sha256:$sha" != "$config_digest" ]; then
             expect_output --from="$layers" --substring "sha256:$sha" \
                         "Locally-extracted SHA file is present in 'inspect'"
@@ -103,7 +103,7 @@ END_EXPECT
 
     # By default, 'inspect' tries to match our host os+arch. This should fail.
     run_skopeo 1 inspect $img
-    expect_output --substring "parsing manifest for image: choosing image instance: no image found in manifest list for architecture \\\\\"$arch\\\\\", variant " \
+    expect_output --substring "parsing manifest for image: choosing image instance: no image found in manifest list for architecture $arch, variant " \
                   "skopeo inspect, without --raw, fails"
 
     # With --raw, we can inspect
@@ -129,11 +129,4 @@ END_EXPECT
     expect_output --from="$repo_tags" "" "inspect --no-tags was expected to return empty RepoTags[]"
 }
 
-@test "inspect: image unknown" {
-    # non existing image
-    run_skopeo 2 inspect containers-storage:non-existing-tag
-    expect_output --substring "does not resolve to an image ID" \
-		  "skopeo inspect containers-storage:010101010101"
-}
-
 # vim: filetype=sh

systemtest/040-local-registry-auth.bats

@@ -16,8 +16,7 @@ function setup() {
 
     _cred_dir=$TESTDIR/credentials
     # It is important to change XDG_RUNTIME_DIR only after we start the registry, otherwise it affects the path of $XDG_RUNTIME_DIR/netns maintained by Podman,
-    # making it impossible to clean up after ourselves.
-    export XDG_RUNTIME_DIR_OLD=$XDG_RUNTIME_DIR
+    # making it imposible to clean up after ourselves.
     export XDG_RUNTIME_DIR=$_cred_dir
     mkdir -p $_cred_dir/containers
     # Remove old/stale cred file
@@ -40,7 +39,7 @@ function setup() {
     expect_output --substring "authentication required"
 
     # Correct creds, but no such image
-    run_skopeo 2 inspect --tls-verify=false --creds=$testuser:$testpassword \
+    run_skopeo 1 inspect --tls-verify=false --creds=$testuser:$testpassword \
                docker://localhost:5000/nonesuch
     expect_output --substring "manifest unknown"
 
@@ -112,9 +111,6 @@ function setup() {
 }
 
 teardown() {
-    # Need to restore XDG_RUNTIME_DIR.
-    XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR_OLD
-
     podman rm -f reg
 
     if [[ -n $_cred_dir ]]; then

systemtest/050-signing.bats

@@ -155,7 +155,7 @@ END_PUSH
     done <<END_TESTS
 /myns/alice:signed
 /myns/bob:signedbyalice    Invalid GPG signature
-/myns/alice:unsigned       Signature for identity \\\\\\\\"localhost:5000/myns/alice:signed\\\\\\\\" is not accepted
+/myns/alice:unsigned       Signature for identity localhost:5000/myns/alice:signed is not accepted
 /myns/carol:latest         Running image docker://localhost:5000/myns/carol:latest is rejected by policy.
 /open/forall:latest
 END_TESTS
@@ -242,7 +242,7 @@ END_TESTS
                $fingerprint \
                $TESTDIR/busybox.signature
     # manifest digest
-    digest=$(echo "$output" | awk '{print $NF;}')
+    digest=$(echo "$output" | awk '{print $4;}')
     run_skopeo manifest-digest $TESTDIR/busybox/manifest.json
     expect_output $digest
 }