Merge pull request #2852 from TomSweeneyRedHat/dev/tsweeney/release-1.20-cve-2026-34986

[release-1.20] Bump Go Jose v4.1.4, CVE-2026-34986
[release-1.20] Bump Skopeo to 1.20.1
2026-07-02 23:14:14 +00:00 · 2026-04-17 14:08:50 +02:00 · 2026-04-16 18:05:07 -04:00 · 2026-04-16 18:02:29 -04:00
2169 changed files with 212286 additions and 111398 deletions
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -11,7 +11,7 @@ env:
    GOPATH: &gopath "/var/tmp/go"
    GOBIN: "${GOPATH}/bin"
    GOCACHE: "${GOPATH}/cache"
-    GOSRC: &gosrc "/var/tmp/go/src/go.podman.io/skopeo"
+    GOSRC: &gosrc "/var/tmp/go/src/github.com/containers/skopeo"
    # Required for consistency with containers/image CI
    SKOPEO_PATH: *gosrc
    CIRRUS_WORKING_DIR: *gosrc
@@ -21,7 +21,7 @@ env:
    SCRIPT_BASE: "./contrib/cirrus"

    # Google-cloud VM Images
-    IMAGE_SUFFIX: "c20260310t170224z-f43f42d14"
+    IMAGE_SUFFIX: "c20250721t181111z-f42f41d13"
    FEDORA_CACHE_IMAGE_NAME: "fedora-${IMAGE_SUFFIX}"

    # Container FQIN's
@@ -151,7 +151,7 @@ ostree-rs-ext_task:
        dockerfile: contrib/cirrus/ostree_ext.dockerfile
        docker_arguments:  # required build-args
            BASE_FQIN: quay.io/coreos-assembler/fcos-buildroot:testing-devel
-            CIRRUS_IMAGE_VERSION: 5
+            CIRRUS_IMAGE_VERSION: 3
    env:
        EXT_REPO_NAME: ostree-rs-ext
        EXT_REPO_HOME: $CIRRUS_WORKING_DIR/../$EXT_REPO_NAME
@@ -190,20 +190,14 @@ test_skopeo_task:
        # Required to be 200gig, do not modify - has i/o performance impact
        # according to gcloud CLI tool warning messages.
        disk: 200
-        image_name: ${VM_IMAGE_NAME}
+        image_name: ${FEDORA_CACHE_IMAGE_NAME}
    matrix:
        - name: "Skopeo Test"  # N/B: Name ref. by hack/get_fqin.sh
          env:
              BUILDTAGS: ''
-              VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
        - name: "Skopeo Test w/ opengpg"
          env:
              BUILDTAGS: *withopengpg
-              VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
-        - name: "Skopeo test w/ Sequoia"
-          env:
-              BUILDTAGS: 'containers_image_sequoia'
-              VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
    setup_script: >-
        "${GOSRC}/${SCRIPT_BASE}/runner.sh" setup
    vendor_script: >-
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -17,7 +17,7 @@ jobs:
      pull-requests: write  # for actions/stale to close stale PRs
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@v9
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        stale-issue-message: 'A friendly reminder that this issue had no activity for 30 days.'
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,9 +1,4 @@
 version: "2"
-
-formatters:
-  enable:
-    - gofumpt
-
 linters:
  settings:
    staticcheck:
--- a/.packit.yaml
+++ b/.packit.yaml
@@ -9,6 +9,27 @@
 downstream_package_name: skopeo
 upstream_tag_template: v{version}

+# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
+# propose-downstream job. This is done so tests maintained upstream can be run
+# downstream in Zuul CI and Bodhi.
+# Ref: https://packit.dev/docs/configuration#files_to_sync
+files_to_sync:
+  - src: rpm/gating.yaml
+    dest: gating.yaml
+    delete: true
+  - src: plans/
+    dest: plans/
+    delete: true
+    mkpath: true
+  - src: systemtest/tmt/
+    dest: test/tmt/
+    delete: true
+    mkpath: true
+  - src: .fmf/
+    dest: .fmf/
+    delete: true
+  - .packit.yaml
+
 packages:
  skopeo-fedora:
    pkg_tool: fedpkg
@@ -19,10 +40,6 @@ packages:
  skopeo-eln:
    specfile_path: rpm/skopeo.spec

-# https://packit.dev/docs/configuration/actions
-actions:
-  get-current-version: bash -c 'grep "^const Version" version/version.go | cut -f2 -d\" | tr \- \~'
-
 srpm_build_deps:
  - make

@@ -41,11 +58,12 @@ jobs:
    # https://packit.dev/posts/openscanhub-prototype
    osh_diff_scan_after_copr_build: false

+  # Ignore until golang is updated in distro buildroot to go 1.23.3+
  - job: copr_build
-    trigger: pull_request
+    trigger: ignore
    packages: [skopeo-eln]
    notifications: *copr_build_failure_notification
-    targets: &eln_copr_targets
+    targets:
      fedora-eln-x86_64:
        additional_repos:
          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/x86_64/"
@@ -54,8 +72,9 @@ jobs:
          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/"
    enable_net: true

+  # Ignore until golang is updated in distro buildroot to go 1.23.3+
  - job: copr_build
-    trigger: pull_request
+    trigger: ignore
    packages: [skopeo-centos]
    notifications: *copr_build_failure_notification
    targets: &centos_copr_targets
@@ -69,6 +88,9 @@ jobs:
  - job: copr_build
    trigger: commit
    packages: [skopeo-fedora]
+    notifications:
+      failure_comment:
+        message: "podman-next COPR build failed. @containers/packit-build please check."
    branch: main
    owner: rhcontainerbot
    project: podman-next
@@ -88,21 +110,10 @@ jobs:
          - type: repository-file
            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo

-  # Tests on ELN for main branch
-  - job: tests
-    trigger: pull_request
-    packages: [skopeo-eln]
-    notifications: *test_failure_notification
-    targets: *eln_copr_targets
-    tf_extra_params:
-      environments:
-        - artifacts:
-          - type: repository-file
-            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-eln/rhcontainerbot-podman-next-fedora-eln.repo
-
  # Tests on CentOS Stream for main branch
+  # Ignore until golang is updated in distro buildroot to go 1.23.3+
  - job: tests
-    trigger: pull_request
+    trigger: ignore
    packages: [skopeo-centos]
    notifications: *test_failure_notification
    targets: *centos_copr_targets
@@ -113,19 +124,12 @@ jobs:
            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo

  # Sync to Fedora
-  # NOTE: Breaking changes related to Podman6 will only be shipped to Fedora
-  # Rawhide (to be Fedora 45) and newer.
-  # TODO: Update dist_git_branches as and when new Fedora releases are
-  # available.
  - job: propose_downstream
    trigger: release
    packages: [skopeo-fedora]
    update_release: false
    dist_git_branches: &fedora_targets
-      - fedora-rawhide
-    actions:
-        post-modifications: >-
-          bash -c 'sed -i "s/^\(\s*\)ref: .*/\1ref: v${PACKIT_PROJECT_VERSION}/" ${PACKIT_DOWNSTREAM_REPO}/plans/main.fmf'
+      - fedora-all

  # Sync to CentOS Stream
  # FIXME: Switch trigger whenever we're ready to update CentOS Stream via
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,7 +5,6 @@ that we follow.

 ## Topics

-* [LLM ("AI") Policy](#llm-ai-policy)
 * [Reporting Issues](#reporting-issues)
 * [Submitting Pull Requests](#submitting-pull-requests)
 * [Communications](#communications)
@@ -13,11 +12,6 @@ that we follow.
 * [Becoming a Maintainer](#becoming-a-maintainer)
 -->

-## LLM ("AI") Policy
-
-If your contribution is aided by LLMs or other AI tools, please read the [LLM Policy in the Podman project](https://github.com/containers/podman/blob/main/LLM_POLICY.md).
-This project also follows this LLM policy, which includes comments, issues, PRs, and any other interactions with the team.
-
 ## Reporting Issues

 Before reporting an issue, check our backlog of 
@@ -135,19 +129,19 @@ In order to update an existing dependency:
 - use `go get -d -u path/to/dep@version` to update the relevant dependency line in `go.mod`
 - run `make vendor`

-When new PRs for [containers/container-libs](https://github.com/containers/container-libs) break `skopeo` (i.e. `containers/container-libs` tests fail in `make test-skopeo`):
+When new PRs for [containers/image](https://github.com/containers/image) break `skopeo` (i.e. `containers/image` tests fail in `make test-skopeo`):

 - create out a new branch in your `skopeo` checkout and switch to it
- find out the version of `containers/container-libs` you want to use and note its commit ID. You might also want to use a fork of `containers/container-libs`, in that case note its repo
- use `go get -d github.com/$REPO/container-libs/image/v5@$COMMIT_ID` to download the right version. The command will fetch the dependency and then fail because of a conflict in `go.mod`, this is expected. Note the pseudo-version (eg. `v5.13.1-0.20210707123201-50afbf0a326`)
- use `go mod edit -replace=go.podman.io/image/v5=github.com/$REPO/container-libs/image/v5@$PSEUDO_VERSION` to add a replacement line to `go.mod` (e.g. `replace go.podman.io/image/v5 => github.com/moio/container-libs/image/v5 v5.13.1-0.20210707123201-50afbf0a3262`)
+- find out the version of `containers/image` you want to use and note its commit ID. You might also want to use a fork of `containers/image`, in that case note its repo
+- use `go get -d github.com/$REPO/image/v5@$COMMIT_ID` to download the right version. The command will fetch the dependency and then fail because of a conflict in `go.mod`, this is expected. Note the pseudo-version (eg. `v5.13.1-0.20210707123201-50afbf0a326`)
+- use `go mod edit -replace=github.com/containers/image/v5=github.com/$REPO/image/v5@$PSEUDO_VERSION` to add a replacement line to `go.mod` (e.g. `replace github.com/containers/image/v5 => github.com/moio/image/v5 v5.13.1-0.20210707123201-50afbf0a3262`)
 - run `make vendor`
- make any other necessary changes in the skopeo repo (e.g. add other dependencies now required by `containers/container-libs`, or update skopeo for changed `containers/container-libs` API)
+- make any other necessary changes in the skopeo repo (e.g. add other dependencies now required by `containers/image`, or update skopeo for changed `containers/image` API)
 - optionally add new integration tests to the skopeo repo
 - submit the resulting branch as a skopeo PR, marked “DO NOT MERGE”
 - iterate until tests pass and the PR is reviewed
- then the original `containers/container-libs` PR can be merged, disregarding its `make test-skopeo` failure
- as soon as possible after that, in the skopeo PR, use `go mod edit -dropreplace=go.podman.io/image/v5` to remove the `replace` line in `go.mod`
+- then the original `containers/image` PR can be merged, disregarding its `make test-skopeo` failure
+- as soon as possible after that, in the skopeo PR, use `go mod edit -dropreplace=github.com/containers/image` to remove the `replace` line in `go.mod`
 - run `make vendor`
 - update the skopeo PR with the result, drop the “DO NOT MERGE” marking
 - after tests complete successfully again, merge the skopeo PR
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -7,5 +7,6 @@ except sections found in this document, which override those found in Podman's G

 # Maintainers File

-The definitive source of truth for maintainers of this repository is the local [MAINTAINERS.md](./MAINTAINERS.md) file. The [MAINTAINERS.md](https://github.com/containers/podman/blob/main/MAINTAINERS.md) file in the main Podman repository is used for project-spanning roles, including Core Maintainer and Community Manager.
+The definitive source of truth for maintainers of this repository is the local [MAINTAINERS.md](./MAINTAINERS.md) file. The [MAINTAINERS.md](https://github.com/containers/podman/blob/main/MAINTAINERS.md) file in the main Podman repository is used for project-spanning roles, including Core Maintainer and Community Manager. Some repositories in the project will also have a local [OWNERS](./OWNERS) file, which the CI system uses to map users to roles. Any changes to the [OWNERS](./OWNERS) file must make a corresponding change to the [MAINTAINERS.md](./MAINTAINERS.md) file to ensure that the file remains up to date. Most changes to [MAINTAINERS.md](./MAINTAINERS.md) will require a change to the repository’s [OWNERS](.OWNERS) file (e.g., adding a Reviewer), but some will not (e.g., promoting a Maintainer to a Core Maintainer, which comes with no additional CI-related privileges).

+Any Core Maintainers listed in Podman’s [MAINTAINERS.md](https://github.com/containers/podman/blob/main/MAINTAINERS.md) file should also be added to the list of “approvers” in the local [OWNERS](./OWNERS) file and as a Core Maintainer in the list of “Maintainers” in the local [MAINTAINERS.md](./MAINTAINERS.md) file.
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -13,7 +13,6 @@ describes the project's governance and the Project Roles used below.
 | Paul Holzinger    | [Luap99](https://github.com/Luap99)                      | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
 | Giuseppe Scrivano | [giuseppe](https://github.com/giuseppe)                  | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
 | Miloslav Trmač    | [mtrmac](https://github.com/mtrmac)                      | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
-| Mohan Boddu       | [mohanboddu](https://github.com/mohanboddu)              | Community Manager                | [Red Hat](https://github.com/RedHatOfficial) |
 | Neil Smith        | [actionmancan](https://github.com/actionmancan)          | Community Manager                | [Red Hat](https://github.com/RedHatOfficial) |
 | Tom Sweeney       | [TomSweeneyRedHat](https://github.com/TomSweeneyRedHat/) | Maintainer and Community Manager | [Red Hat](https://github.com/RedHatOfficial) |
 | Lokesh Mandvekar  | [lsm5](https://github.com/lsm5)                          | Maintainer                       | [Red Hat](https://github.com/RedHatOfficial) |
--- a/49
+++ b/49
@@ -24,12 +24,10 @@ GOBIN := $(shell $(GO) env GOBIN)
 GOOS ?= $(shell go env GOOS)
 GOARCH ?= $(shell go env GOARCH)

-SEQUOIA_SONAME_DIR =
-
 # N/B: This value is managed by Renovate, manual changes are
 # possible, as long as they don't disturb the formatting
 # (i.e. DO NOT ADD A 'v' prefix!)
-GOLANGCI_LINT_VERSION := 2.12.2
+GOLANGCI_LINT_VERSION := 2.3.0

 ifeq ($(GOBIN),)
 GOBIN := $(GOPATH)/bin
@@ -80,11 +78,13 @@ INTERACTIVE := $(shell [ -t 0 ] && echo 1 || echo 0)
 ifeq ($(INTERACTIVE), 1)
 	CONTAINER_CMD += -t
 endif
-CONTAINER_GOSRC = /src/go.podman.io/skopeo
+CONTAINER_GOSRC = /src/github.com/containers/skopeo
 CONTAINER_RUN ?= $(CONTAINER_CMD) --security-opt label=disable -v $(CURDIR):$(CONTAINER_GOSRC) -w $(CONTAINER_GOSRC) $(SKOPEO_CIDEV_CONTAINER_FQIN)

+GIT_COMMIT := $(shell GIT_CEILING_DIRECTORIES=$$(cd ..; pwd) git rev-parse HEAD 2> /dev/null || true)
+
 EXTRA_LDFLAGS ?=
-SKOPEO_LDFLAGS := -ldflags '-X go.podman.io/image/v5/signature/internal/sequoia.sequoiaLibraryDir=$(SEQUOIA_SONAME_DIR) $(EXTRA_LDFLAGS)'
+SKOPEO_LDFLAGS := -ldflags '-X main.gitCommit=${GIT_COMMIT} $(EXTRA_LDFLAGS)'

 MANPAGES_MD = $(wildcard docs/*.md)
 MANPAGES ?= $(MANPAGES_MD:%.md=%)
@@ -134,7 +134,7 @@ bin/skopeo:
 	$(GO) build ${GO_DYN_FLAGS} ${SKOPEO_LDFLAGS} -gcflags "$(GOGCFLAGS)" -tags "$(BUILDTAGS)" -o $@ ./cmd/skopeo
 bin/skopeo.%:
 	GOOS=$(word 2,$(subst ., ,$@)) GOARCH=$(word 3,$(subst ., ,$@)) $(GO) build ${SKOPEO_LDFLAGS} -tags "containers_image_openpgp $(BUILDTAGS)" -o $@ ./cmd/skopeo
-local-cross: bin/skopeo.darwin.amd64 bin/skopeo.linux.arm bin/skopeo.linux.arm64 bin/skopeo.linux.riscv64 bin/skopeo.windows.386.exe bin/skopeo.windows.amd64.exe
+local-cross: bin/skopeo.darwin.amd64 bin/skopeo.linux.arm bin/skopeo.linux.arm64 bin/skopeo.windows.386.exe bin/skopeo.windows.amd64.exe

 $(MANPAGES): %: %.md
 ifneq ($(DISABLE_DOCS), 1)
@@ -188,7 +188,7 @@ shell:

 tools:
 	if [ ! -x "$(GOBIN)/golangci-lint" ]; then \
-		curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(GOBIN) v$(GOLANGCI_LINT_VERSION) ; \
+		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOBIN) v$(GOLANGCI_LINT_VERSION) ; \
 	fi

 check: validate test-unit test-integration test-system
@@ -201,19 +201,10 @@ test-integration:
 		$(MAKE) test-integration-local


-# Helper target to set up SKOPEO_BINARY variable for local test targets
-# SKOPEO_BINARY only takes effect on `test-integration-local` and
-# `test-system-local` targets. It's not propagated into the container used for `test-integration` and
-# `test-system`. These targets will (build and) use skopeo binary at
-# ./bin/skopeo.
-.eval-skopeo-binary: $(if $(SKOPEO_BINARY),,bin/skopeo)
-	$(eval SKOPEO_BINARY := $(or $(SKOPEO_BINARY),./bin/skopeo))
-	@echo "Testing with $(SKOPEO_BINARY) ..."
-
-# Primarily intended for CI.
-test-integration-local: .eval-skopeo-binary
+# Intended for CI, assumed to be running in quay.io/libpod/skopeo_cidev container.
+test-integration-local: bin/skopeo
 	hack/warn-destructive-tests.sh
-	cd ./integration && SKOPEO_BINARY="$(abspath $(SKOPEO_BINARY))" $(GO) test $(SKOPEO_LDFLAGS) $(TESTFLAGS) $(if $(BUILDTAGS),-tags "$(BUILDTAGS)")
+	hack/test-integration.sh $(SKOPEO_LDFLAGS) $(TESTFLAGS)

 # complicated set of options needed to run podman-in-podman
 test-system:
@@ -227,10 +218,10 @@ test-system:
 	$(CONTAINER_RUNTIME) unshare rm -rf $$DTEMP; # This probably doesn't work with Docker, oh well, better than nothing... \
 	exit $$rc

-# Primarily intended for CI.
-test-system-local: .eval-skopeo-binary
+# Intended for CI, assumed to already be running in quay.io/libpod/skopeo_cidev container.
+test-system-local: bin/skopeo
 	hack/warn-destructive-tests.sh
-	hack/test-system.sh
+	hack/test-system.sh SKOPEO_LDFLAGS="$(SKOPEO_LDFLAGS)" BUILDTAGS="$(BUILDTAGS)"

 test-unit:
 	# Just call (make test unit-local) here instead of worrying about environment differences
@@ -242,13 +233,10 @@ validate:
 # This target is only intended for development, e.g. executing it from an IDE. Use (make test) for CI or pre-release testing.
 test-all-local: validate-local validate-docs test-unit-local

-.PHONY: fmt
-fmt: tools
-	$(GOBIN)/golangci-lint fmt
-
 .PHONY: validate-local
-validate-local: tools
+validate-local:
 	hack/validate-git-marks.sh
+	hack/validate-gofmt.sh
 	$(GOBIN)/golangci-lint run --build-tags "${BUILDTAGS}"
 	# An extra run with --tests=false allows detecting code unused outside of tests;
 	# ideally the linter should be able to find this automatically.
@@ -263,7 +251,7 @@ validate-docs: bin/skopeo
 	hack/xref-helpmsgs-manpages

 test-unit-local:
-	$(GO) test $(SKOPEO_LDFLAGS) -tags "$(BUILDTAGS)" $$($(GO) list -tags "$(BUILDTAGS)" -e ./... | grep -v '^go\.podman\.io/skopeo/\(integration\|vendor/.*\)$$')
+	$(GO) test -tags "$(BUILDTAGS)" $$($(GO) list -tags "$(BUILDTAGS)" -e ./... | grep -v '^github\.com/containers/skopeo/\(integration\|vendor/.*\)$$')

 vendor:
 	$(GO) mod tidy
@@ -272,3 +260,8 @@ vendor:

 vendor-in-container:
 	podman run --privileged --rm --env HOME=/root -v $(CURDIR):/src -w /src golang $(MAKE) vendor
+
+# CAUTION: This is not a replacement for RPMs provided by your distro.
+# Only intended to build and test the latest unreleased changes.
+rpm:
+	rpkg local
--- a/23
+++ b/23
@@ -0,0 +1,23 @@
+approvers:
+  - baude
+  - giuseppe
+  - lsm5
+  - Luap99
+  - mheon
+  - mtrmac
+  - nalind
+  - rhatdan
+  - TomSweeneyRedHat
+reviewers:
+  - ashley-cui
+  - baude
+  - cgwalters
+  - giuseppe
+  - lsm5
+  - Luap99
+  - mheon
+  - mtrmac
+  - nalind
+  - rhatdan
+  - TomSweeneyRedHat
+  - vrothberg
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@
 ----
 ![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)
 ![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/containers/skopeo)
+[![Go Report Card](https://goreportcard.com/badge/github.com/containers/skopeo)](https://goreportcard.com/report/github.com/containers/skopeo)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10516/badge)](https://www.bestpractices.dev/projects/10516)

 `skopeo` is a command line utility that performs various operations on container images and image repositories.
--- a/cmd/skopeo/completions.go
+++ b/cmd/skopeo/completions.go
@@ -1,17 +1,16 @@
 package main

 import (
-	"strings"
-
+	"github.com/containers/image/v5/directory"
+	"github.com/containers/image/v5/docker"
+	dockerArchive "github.com/containers/image/v5/docker/archive"
+	ociArchive "github.com/containers/image/v5/oci/archive"
+	oci "github.com/containers/image/v5/oci/layout"
+	"github.com/containers/image/v5/sif"
+	"github.com/containers/image/v5/tarball"
+	"github.com/containers/image/v5/transports"
 	"github.com/spf13/cobra"
-	"go.podman.io/image/v5/directory"
-	"go.podman.io/image/v5/docker"
-	dockerArchive "go.podman.io/image/v5/docker/archive"
-	ociArchive "go.podman.io/image/v5/oci/archive"
-	oci "go.podman.io/image/v5/oci/layout"
-	"go.podman.io/image/v5/sif"
-	"go.podman.io/image/v5/tarball"
-	"go.podman.io/image/v5/transports"
+	"strings"
 )

 func autocompleteImageNames(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
--- a/cmd/skopeo/copy.go
+++ b/cmd/skopeo/copy.go
@@ -7,16 +7,16 @@ import (
 	"os"
 	"strings"

+	commonFlag "github.com/containers/common/pkg/flag"
+	"github.com/containers/common/pkg/retry"
+	"github.com/containers/image/v5/copy"
+	"github.com/containers/image/v5/docker/reference"
+	"github.com/containers/image/v5/manifest"
+	"github.com/containers/image/v5/transports"
+	"github.com/containers/image/v5/transports/alltransports"
 	encconfig "github.com/containers/ocicrypt/config"
 	enchelpers "github.com/containers/ocicrypt/helpers"
 	"github.com/spf13/cobra"
-	commonFlag "go.podman.io/common/pkg/flag"
-	"go.podman.io/common/pkg/retry"
-	"go.podman.io/image/v5/copy"
-	"go.podman.io/image/v5/docker/reference"
-	"go.podman.io/image/v5/manifest"
-	"go.podman.io/image/v5/transports"
-	"go.podman.io/image/v5/transports/alltransports"
 )

 type copyOptions struct {
@@ -45,8 +45,7 @@ func copyCmd(global *globalOptions) *cobra.Command {
 	destFlags, destOpts := imageDestFlags(global, sharedOpts, deprecatedTLSVerifyOpt, "dest-", "dcreds")
 	retryFlags, retryOpts := retryFlags()
 	copyFlags, copyOpts := sharedCopyFlags()
-	opts := copyOptions{
-		global:              global,
+	opts := copyOptions{global: global,
 		deprecatedTLSVerify: deprecatedTLSVerifyOpt,
 		srcImage:            srcOpts,
 		destImage:           destOpts,
@@ -78,7 +77,7 @@ See skopeo(1) section "IMAGE NAMES" for the expected format
 	flags.StringSliceVar(&opts.additionalTags, "additional-tag", []string{}, "additional tags (supports docker-archive)")
 	flags.BoolVarP(&opts.quiet, "quiet", "q", false, "Suppress output information when copying images")
 	flags.BoolVarP(&opts.all, "all", "a", false, "Copy all images if SOURCE-IMAGE is a list")
-	flags.Var(commonFlag.NewOptionalStringValue(&opts.multiArch), "multi-arch", `How to handle multi-architecture images (system, all, index-only, or comma-separated platform list like linux/amd64,linux/arm64)`)
+	flags.Var(commonFlag.NewOptionalStringValue(&opts.multiArch), "multi-arch", `How to handle multi-architecture images (system, all, or index-only)`)
 	flags.StringVar(&opts.signIdentity, "sign-identity", "", "Identity of signed image, must be a fully specified docker reference. Defaults to the target docker reference.")
 	flags.StringVar(&opts.digestFile, "digestfile", "", "Write the digest of the pushed image to the specified file")
 	flags.StringSliceVar(&opts.encryptionKeys, "encryption-key", []string{}, "*Experimental* key with the encryption protocol to use needed to encrypt the image (e.g. jwe:/path/to/key.pem)")
@@ -89,37 +88,23 @@ See skopeo(1) section "IMAGE NAMES" for the expected format
 }

 // parseMultiArch parses the list processing selection
-// It returns the copy.ImageListSelection to use with image.Copy option,
-// and optionally a list of platform filters if specific platforms were requested
-func parseMultiArch(multiArch string) (copy.ImageListSelection, []copy.InstancePlatformFilter, error) {
+// It returns the copy.ImageListSelection to use with image.Copy option
+func parseMultiArch(multiArch string) (copy.ImageListSelection, error) {
 	switch multiArch {
 	case "system":
-		return copy.CopySystemImage, nil, nil
+		return copy.CopySystemImage, nil
 	case "all":
-		return copy.CopyAllImages, nil, nil
+		return copy.CopyAllImages, nil
 	// There is no CopyNoImages value in copy.ImageListSelection, but because we
 	// don't provide an option to select a set of images to copy, we can use
 	// CopySpecificImages.
 	case "index-only":
-		return copy.CopySpecificImages, nil, nil
+		return copy.CopySpecificImages, nil
+	// We don't expose CopySpecificImages other than index-only above, because
+	// we currently don't provide an option to choose the images to copy. That
+	// could be added in the future.
 	default:
-		if !strings.Contains(multiArch, "/") {
-			return copy.CopySystemImage, nil, fmt.Errorf("unknown multi-arch option %q. Choose one of the supported options: 'system', 'all', 'index-only', or a comma-separated platform list like 'linux/amd64,linux/arm64'", multiArch)
-		}
-		// Parse comma-separated platform list
-		var platforms []copy.InstancePlatformFilter
-		for platform := range strings.SplitSeq(multiArch, ",") {
-			platform = strings.TrimSpace(platform)
-			parts := strings.Split(platform, "/")
-			if len(parts) != 2 {
-				return copy.CopySystemImage, nil, fmt.Errorf("invalid platform format %q in --multi-arch, expected OS/Architecture (e.g., linux/amd64)", platform)
-			}
-			platforms = append(platforms, copy.InstancePlatformFilter{
-				OS:           parts[0],
-				Architecture: parts[1],
-			})
-		}
-		return copy.CopySpecificImages, platforms, nil
+		return copy.CopySystemImage, fmt.Errorf("unknown multi-arch option %q. Choose one of the supported options: 'system', 'all', or 'index-only'", multiArch)
 	}
 }

@@ -182,12 +167,11 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 	}

 	imageListSelection := copy.CopySystemImage
-	var instancePlatforms []copy.InstancePlatformFilter
 	if opts.multiArch.Present() && opts.all {
 		return fmt.Errorf("Cannot use --all and --multi-arch flags together")
 	}
 	if opts.multiArch.Present() {
-		imageListSelection, instancePlatforms, err = parseMultiArch(opts.multiArch.Value())
+		imageListSelection, err = parseMultiArch(opts.multiArch.Value())
 		if err != nil {
 			return err
 		}
@@ -251,12 +235,10 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 	copyOpts.SourceCtx = sourceCtx
 	copyOpts.DestinationCtx = destinationCtx
 	copyOpts.ImageListSelection = imageListSelection
-	copyOpts.InstancePlatforms = instancePlatforms
 	copyOpts.OciDecryptConfig = decConfig
 	copyOpts.OciEncryptLayers = encLayers
 	copyOpts.OciEncryptConfig = encConfig
 	copyOpts.MaxParallelDownloads = opts.imageParallelCopies
-	copyOpts.ForceCompressionFormat = opts.destImage.forceCompressionFormat

 	return retry.IfNecessary(ctx, func() error {
 		manifestBytes, err := copy.Image(ctx, policyContext, destRef, srcRef, copyOpts)
@@ -268,7 +250,7 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 			if err != nil {
 				return err
 			}
-			if err = os.WriteFile(opts.digestFile, []byte(manifestDigest.String()), 0o644); err != nil {
+			if err = os.WriteFile(opts.digestFile, []byte(manifestDigest.String()), 0644); err != nil {
 				return fmt.Errorf("Failed to write digest to file %q: %w", opts.digestFile, err)
 			}
 		}
--- a/cmd/skopeo/copy_test.go
+++ b/cmd/skopeo/copy_test.go
@@ -1,12 +1,6 @@
 package main

-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.podman.io/image/v5/copy"
-)
+import "testing"

 func TestCopy(t *testing.T) {
 	// Invalid command-line arguments
@@ -22,95 +16,3 @@ func TestCopy(t *testing.T) {
 	// FIXME: Much more test coverage
 	// Actual feature tests exist in integration and systemtest
 }
-
-func TestParseMultiArch(t *testing.T) {
-	tests := []struct {
-		name              string
-		input             string
-		expectedSelection copy.ImageListSelection
-		expectedPlatforms []copy.InstancePlatformFilter
-		expectError       bool
-	}{
-		{
-			name:              "system option",
-			input:             "system",
-			expectedSelection: copy.CopySystemImage,
-			expectedPlatforms: nil,
-			expectError:       false,
-		},
-		{
-			name:              "all option",
-			input:             "all",
-			expectedSelection: copy.CopyAllImages,
-			expectedPlatforms: nil,
-			expectError:       false,
-		},
-		{
-			name:              "index-only option",
-			input:             "index-only",
-			expectedSelection: copy.CopySpecificImages,
-			expectedPlatforms: nil,
-			expectError:       false,
-		},
-		{
-			name:              "single platform",
-			input:             "linux/amd64",
-			expectedSelection: copy.CopySpecificImages,
-			expectedPlatforms: []copy.InstancePlatformFilter{
-				{OS: "linux", Architecture: "amd64"},
-			},
-			expectError: false,
-		},
-		{
-			name:              "multiple platforms",
-			input:             "linux/amd64,linux/arm64",
-			expectedSelection: copy.CopySpecificImages,
-			expectedPlatforms: []copy.InstancePlatformFilter{
-				{OS: "linux", Architecture: "amd64"},
-				{OS: "linux", Architecture: "arm64"},
-			},
-			expectError: false,
-		},
-		{
-			name:              "platforms with whitespace",
-			input:             "linux/amd64, linux/arm64 , windows/amd64",
-			expectedSelection: copy.CopySpecificImages,
-			expectedPlatforms: []copy.InstancePlatformFilter{
-				{OS: "linux", Architecture: "amd64"},
-				{OS: "linux", Architecture: "arm64"},
-				{OS: "windows", Architecture: "amd64"},
-			},
-			expectError: false,
-		},
-		{
-			name:        "invalid option",
-			input:       "invalid",
-			expectError: true,
-		},
-		{
-			name:        "invalid platform format - no slash",
-			input:       "linux-amd64",
-			expectError: true,
-		},
-		{
-			name:        "invalid platform format - too many parts",
-			input:       "linux/amd64/extra",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			selection, platforms, err := parseMultiArch(tt.input)
-
-			if tt.expectError {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, tt.expectedSelection, selection)
-			assert.Equal(t, tt.expectedPlatforms, platforms)
-		})
-	}
-}
--- a/cmd/skopeo/delete.go
+++ b/cmd/skopeo/delete.go
@@ -6,10 +6,10 @@ import (
 	"io"
 	"strings"

+	"github.com/containers/common/pkg/retry"
+	"github.com/containers/image/v5/transports"
+	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/spf13/cobra"
-	"go.podman.io/common/pkg/retry"
-	"go.podman.io/image/v5/transports"
-	"go.podman.io/image/v5/transports/alltransports"
 )

 type deleteOptions struct {
--- a/cmd/skopeo/generate_sigstore_key.go
+++ b/cmd/skopeo/generate_sigstore_key.go
@@ -7,9 +7,9 @@ import (
 	"io/fs"
 	"os"

+	"github.com/containers/image/v5/pkg/cli"
+	"github.com/containers/image/v5/signature/sigstore"
 	"github.com/spf13/cobra"
-	"go.podman.io/image/v5/pkg/cli"
-	"go.podman.io/image/v5/signature/sigstore"
 )

 type generateSigstoreKeyOptions struct {
@@ -79,12 +79,12 @@ func (opts *generateSigstoreKeyOptions) run(args []string, stdout io.Writer) err
 		return fmt.Errorf("Error generating key pair: %w", err)
 	}

-	if err := os.WriteFile(privateKeyPath, keys.PrivateKey, 0o600); err != nil {
+	if err := os.WriteFile(privateKeyPath, keys.PrivateKey, 0600); err != nil {
 		return fmt.Errorf("Error writing private key to %q: %w", privateKeyPath, err)
 	}
-	if err := os.WriteFile(pubKeyPath, keys.PublicKey, 0o644); err != nil {
+	if err := os.WriteFile(pubKeyPath, keys.PublicKey, 0644); err != nil {
 		return fmt.Errorf("Error writing private key to %q: %w", pubKeyPath, err)
 	}
-	fmt.Fprintf(stdout, "Key written to %q and %q\n", privateKeyPath, pubKeyPath)
+	fmt.Fprintf(stdout, "Key written to %q and %q", privateKeyPath, pubKeyPath)
 	return nil
 }
--- a/cmd/skopeo/generate_sigstore_key_test.go
+++ b/cmd/skopeo/generate_sigstore_key_test.go
@@ -24,7 +24,7 @@ func TestGenerateSigstoreKey(t *testing.T) {
 	for _, suffix := range outputSuffixes {
 		dir := t.TempDir()
 		prefix := filepath.Join(dir, "prefix")
-		err := os.WriteFile(prefix+suffix, []byte{}, 0o600)
+		err := os.WriteFile(prefix+suffix, []byte{}, 0600)
 		require.NoError(t, err)
 		out, err := runSkopeo("generate-sigstore-key",
 			"--output-prefix", prefix, "--passphrase-file", "/dev/null",
@@ -37,7 +37,7 @@ func TestGenerateSigstoreKey(t *testing.T) {
 	for _, suffix := range outputSuffixes {
 		dir := t.TempDir()
 		nonDirectory := filepath.Join(dir, "nondirectory")
-		err := os.WriteFile(nonDirectory, []byte{}, 0o600)
+		err := os.WriteFile(nonDirectory, []byte{}, 0600)
 		require.NoError(t, err)
 		prefix := filepath.Join(dir, "prefix")
 		err = os.Symlink(filepath.Join(nonDirectory, "unaccessible"), prefix+suffix)
@@ -66,7 +66,7 @@ func TestGenerateSigstoreKey(t *testing.T) {
 	dir := t.TempDir()
 	prefix := filepath.Join(dir, "prefix")
 	passphraseFile := filepath.Join(dir, "passphrase")
-	err = os.WriteFile(passphraseFile, []byte("some passphrase"), 0o600)
+	err = os.WriteFile(passphraseFile, []byte("some passphrase"), 0600)
 	require.NoError(t, err)
 	out, err = runSkopeo("generate-sigstore-key",
 		"--output-prefix", prefix, "--passphrase-file", passphraseFile,
@@ -75,4 +75,5 @@ func TestGenerateSigstoreKey(t *testing.T) {
 	for _, suffix := range outputSuffixes {
 		assert.Contains(t, out, prefix+suffix)
 	}
+
 }
--- a/cmd/skopeo/inspect.go
+++ b/cmd/skopeo/inspect.go
@@ -7,30 +7,28 @@ import (
 	"io"
 	"strings"

+	"github.com/containers/common/pkg/report"
+	"github.com/containers/common/pkg/retry"
+	"github.com/containers/image/v5/docker"
+	"github.com/containers/image/v5/image"
+	"github.com/containers/image/v5/manifest"
+	"github.com/containers/image/v5/transports"
+	"github.com/containers/image/v5/types"
+	"github.com/containers/skopeo/cmd/skopeo/inspect"
 	"github.com/docker/distribution/registry/api/errcode"
-	"github.com/opencontainers/go-digest"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	"go.podman.io/common/pkg/report"
-	"go.podman.io/common/pkg/retry"
-	"go.podman.io/image/v5/docker"
-	"go.podman.io/image/v5/image"
-	"go.podman.io/image/v5/manifest"
-	"go.podman.io/image/v5/transports"
-	"go.podman.io/image/v5/types"
-	"go.podman.io/skopeo/cmd/skopeo/inspect"
 )

 type inspectOptions struct {
-	global         *globalOptions
-	image          *imageOptions
-	retryOpts      *retry.Options
-	format         string
-	raw            bool             // Output the raw manifest instead of parsing information about the image
-	config         bool             // Output the raw config blob instead of parsing information about the image
-	doNotListTags  bool             // Do not list all tags available in the same repository
-	manifestDigest digest.Algorithm // Algorithm to use for computing manifest digest
+	global        *globalOptions
+	image         *imageOptions
+	retryOpts     *retry.Options
+	format        string
+	raw           bool // Output the raw manifest instead of parsing information about the image
+	config        bool // Output the raw config blob instead of parsing information about the image
+	doNotListTags bool // Do not list all tags available in the same repository
 }

 func inspectCmd(global *globalOptions) *cobra.Command {
@@ -66,7 +64,6 @@ skopeo inspect --format "Name: {{.Name}} Digest: {{.Digest}}" docker://registry.
 	flags.BoolVar(&opts.config, "config", false, "output configuration")
 	flags.StringVarP(&opts.format, "format", "f", "", "Format the output to a Go template")
 	flags.BoolVarP(&opts.doNotListTags, "no-tags", "n", false, "Do not list the available tags from the repository in the output")
-	flags.Var(newAlgorithmValue(&opts.manifestDigest), "manifest-digest", "Algorithm to use for computing manifest digest (sha256, sha512); defaults to algorithm used in config digest")
 	return cmd
 }

@@ -179,7 +176,7 @@ func (opts *inspectOptions) run(args []string, stdout io.Writer) (retErr error)
 		LayersData:    imgInspect.LayersData,
 		Env:           imgInspect.Env,
 	}
-	outputData.Digest, err = manifestDigestFromManifest(rawManifest, img, opts.manifestDigest)
+	outputData.Digest, err = manifest.Digest(rawManifest)
 	if err != nil {
 		return fmt.Errorf("Error computing manifest digest: %w", err)
 	}
@@ -238,48 +235,3 @@ func (opts *inspectOptions) writeOutput(stdout io.Writer, data any) error {
 	defer rpt.Flush()
 	return rpt.Execute([]any{data})
 }
-
-func manifestDigestFromManifest(manifestBlob []byte, img types.Image, userAlgorithm digest.Algorithm) (digest.Digest, error) {
-	if userAlgorithm != "" {
-		if !userAlgorithm.Available() {
-			return "", fmt.Errorf("digest algorithm %q is not available", userAlgorithm)
-		}
-		return manifest.DigestWithAlgorithm(manifestBlob, userAlgorithm)
-	}
-
-	configInfo := img.ConfigInfo()
-	if configInfo.Digest != "" {
-		alg := configInfo.Digest.Algorithm()
-		if !alg.Available() {
-			return "", fmt.Errorf("config digest algorithm %q is not available", alg)
-		}
-		return manifest.DigestWithAlgorithm(manifestBlob, alg)
-	}
-
-	return manifest.Digest(manifestBlob)
-}
-
-type algorithmValue digest.Algorithm
-
-func newAlgorithmValue(alg *digest.Algorithm) *algorithmValue {
-	return (*algorithmValue)(alg)
-}
-
-func (a *algorithmValue) Set(value string) error {
-	algorithm := digest.Algorithm(value)
-
-	*a = algorithmValue(algorithm)
-	if algorithm == "" {
-		*a = algorithmValue(digest.Canonical)
-	}
-
-	return nil
-}
-
-func (a *algorithmValue) String() string {
-	return digest.Algorithm(*a).String()
-}
-
-func (a *algorithmValue) Type() string {
-	return "algorithm"
-}
--- a/cmd/skopeo/inspect/output.go
+++ b/cmd/skopeo/inspect/output.go
@@ -3,8 +3,8 @@ package inspect
 import (
 	"time"

+	"github.com/containers/image/v5/types"
 	digest "github.com/opencontainers/go-digest"
-	"go.podman.io/image/v5/types"
 )

 // Output is the output format of (skopeo inspect),
--- a/cmd/skopeo/layers.go
+++ b/cmd/skopeo/layers.go
@@ -7,13 +7,13 @@ import (
 	"os"
 	"strings"

+	"github.com/containers/common/pkg/retry"
+	"github.com/containers/image/v5/directory"
+	"github.com/containers/image/v5/image"
+	"github.com/containers/image/v5/pkg/blobinfocache"
+	"github.com/containers/image/v5/types"
 	"github.com/opencontainers/go-digest"
 	"github.com/spf13/cobra"
-	"go.podman.io/common/pkg/retry"
-	"go.podman.io/image/v5/directory"
-	"go.podman.io/image/v5/image"
-	"go.podman.io/image/v5/pkg/blobinfocache"
-	"go.podman.io/image/v5/types"
 )

 type layersOptions struct {
--- a/cmd/skopeo/list_tags.go
+++ b/cmd/skopeo/list_tags.go
@@ -10,13 +10,13 @@ import (
 	"slices"
 	"strings"

+	"github.com/containers/common/pkg/retry"
+	"github.com/containers/image/v5/docker"
+	"github.com/containers/image/v5/docker/archive"
+	"github.com/containers/image/v5/docker/reference"
+	"github.com/containers/image/v5/transports/alltransports"
+	"github.com/containers/image/v5/types"
 	"github.com/spf13/cobra"
-	"go.podman.io/common/pkg/retry"
-	"go.podman.io/image/v5/docker"
-	"go.podman.io/image/v5/docker/archive"
-	"go.podman.io/image/v5/docker/reference"
-	"go.podman.io/image/v5/transports/alltransports"
-	"go.podman.io/image/v5/types"
 )

 // tagListOutput is the output format of (skopeo list-tags), primarily so that we can format it with a simple json.MarshalIndent.
--- a/cmd/skopeo/list_tags_test.go
+++ b/cmd/skopeo/list_tags_test.go
@@ -3,16 +3,16 @@ package main
 import (
 	"testing"

+	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.podman.io/image/v5/transports/alltransports"
 )

 // Tests the kinds of inputs allowed and expected to the command
 func TestDockerRepositoryReferenceParser(t *testing.T) {
 	for _, test := range [][]string{
-		{"docker://myhost.com:1000/nginx"}, // no tag
-		{"docker://myhost.com/nginx"},      // no port or tag
+		{"docker://myhost.com:1000/nginx"}, //no tag
+		{"docker://myhost.com/nginx"},      //no port or tag
 		{"docker://somehost.com"},          // Valid default expansion
 		{"docker://nginx"},                 // Valid default expansion
 	} {
@@ -31,8 +31,8 @@ func TestDockerRepositoryReferenceParser(t *testing.T) {
 		{"docker-daemon:myhost.com/someimage"},
 		{"docker://myhost.com:1000/nginx:foobar:foobar"},           // Invalid repository ref
 		{"docker://somehost.com:5000/"},                            // no repo
-		{"docker://myhost.com:1000/nginx:latest"},                  // tag not allowed
-		{"docker://myhost.com:1000/nginx@sha256:abcdef1234567890"}, // digest not allowed
+		{"docker://myhost.com:1000/nginx:latest"},                  //tag not allowed
+		{"docker://myhost.com:1000/nginx@sha256:abcdef1234567890"}, //digest not allowed
 	} {
 		_, err := parseDockerRepositoryReference(test[0])
 		assert.Error(t, err, test[0])
@@ -41,8 +41,8 @@ func TestDockerRepositoryReferenceParser(t *testing.T) {

 func TestDockerRepositoryReferenceParserDrift(t *testing.T) {
 	for _, test := range [][]string{
-		{"docker://myhost.com:1000/nginx", "myhost.com:1000/nginx"}, // no tag
-		{"docker://myhost.com/nginx", "myhost.com/nginx"},           // no port or tag
+		{"docker://myhost.com:1000/nginx", "myhost.com:1000/nginx"}, //no tag
+		{"docker://myhost.com/nginx", "myhost.com/nginx"},           //no port or tag
 		{"docker://somehost.com", "docker.io/library/somehost.com"}, // Valid default expansion
 		{"docker://nginx", "docker.io/library/nginx"},               // Valid default expansion
 	} {
--- a/cmd/skopeo/login.go
+++ b/cmd/skopeo/login.go
@@ -4,10 +4,10 @@ import (
 	"io"
 	"os"

+	"github.com/containers/common/pkg/auth"
+	commonFlag "github.com/containers/common/pkg/flag"
+	"github.com/containers/image/v5/types"
 	"github.com/spf13/cobra"
-	"go.podman.io/common/pkg/auth"
-	commonFlag "go.podman.io/common/pkg/flag"
-	"go.podman.io/image/v5/types"
 )

 type loginOptions struct {
@@ -40,10 +40,7 @@ func (opts *loginOptions) run(args []string, stdout io.Writer) error {
 	opts.loginOpts.Stdout = stdout
 	opts.loginOpts.Stdin = os.Stdin
 	opts.loginOpts.AcceptRepositories = true
-	sys, err := opts.global.newSystemContext()
-	if err != nil {
-		return err
-	}
+	sys := opts.global.newSystemContext()
 	if opts.tlsVerify.Present() {
 		sys.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.Value())
 	}
--- a/cmd/skopeo/logout.go
+++ b/cmd/skopeo/logout.go
@@ -3,10 +3,10 @@ package main
 import (
 	"io"

+	"github.com/containers/common/pkg/auth"
+	commonFlag "github.com/containers/common/pkg/flag"
+	"github.com/containers/image/v5/types"
 	"github.com/spf13/cobra"
-	"go.podman.io/common/pkg/auth"
-	commonFlag "go.podman.io/common/pkg/flag"
-	"go.podman.io/image/v5/types"
 )

 type logoutOptions struct {
@@ -36,10 +36,7 @@ func logoutCmd(global *globalOptions) *cobra.Command {
 func (opts *logoutOptions) run(args []string, stdout io.Writer) error {
 	opts.logoutOpts.Stdout = stdout
 	opts.logoutOpts.AcceptRepositories = true
-	sys, err := opts.global.newSystemContext()
-	if err != nil {
-		return err
-	}
+	sys := opts.global.newSystemContext()
 	if opts.tlsVerify.Present() {
 		sys.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.Value())
 	}
--- a/cmd/skopeo/main.go
+++ b/cmd/skopeo/main.go
@@ -3,26 +3,27 @@ package main
 import (
 	"context"
 	"fmt"
-	"runtime/debug"
 	"strings"
 	"time"

+	commonFlag "github.com/containers/common/pkg/flag"
+	"github.com/containers/image/v5/signature"
+	"github.com/containers/image/v5/types"
+	"github.com/containers/skopeo/version"
+	"github.com/containers/storage/pkg/reexec"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	commonFlag "go.podman.io/common/pkg/flag"
-	"go.podman.io/image/v5/pkg/cli/basetls/tlsdetails"
-	"go.podman.io/image/v5/signature"
-	"go.podman.io/image/v5/types"
-	"go.podman.io/skopeo/version"
-	"go.podman.io/storage/pkg/reexec"
 )

+// gitCommit will be the hash that the binary was built from
+// and will be populated by the Makefile
+var gitCommit = ""
+
 var defaultUserAgent = "skopeo/" + version.Version

 type globalOptions struct {
 	debug              bool                    // Enable debug output
 	tlsVerify          commonFlag.OptionalBool // Require HTTPS and verify certificates (for docker: and docker-daemon:)
-	tlsDetailsPath     string                  // Path to a containers-tls-details.yaml(5) file
 	policyPath         string                  // Path to a signature verification policy file
 	insecurePolicy     bool                    // Use an "allow everything" signature verification policy
 	registriesDirPath  string                  // Path to a "registries.d" registry configuration directory
@@ -32,8 +33,6 @@ type globalOptions struct {
 	commandTimeout     time.Duration           // Timeout for the command execution
 	registriesConfPath string                  // Path to the "registries.conf" file
 	tmpDir             string                  // Path to use for big temporary files
-	userAgentPrefix    string                  // Prefix to add to the user agent string
-	requireSigned      bool                    // Require any pulled image to be signed
 }

 // requireSubcommand returns an error if no sub command is provided
@@ -71,10 +70,8 @@ func createApp() (*cobra.Command, *globalOptions) {
 		// (skopeo --tls-verify inspect) (causes a warning) and (skopeo inspect --tls-verify) (no warning).
 		TraverseChildren: true,
 	}
-	// We don’t use debug.ReadBuildInfo to automate version.Version, because that would not work well for builds from
-	// a released tarball (e.g. RPM builds).
-	if commit := gitCommit(); commit != "" {
-		rootCommand.Version = fmt.Sprintf("%s commit: %s", version.Version, commit)
+	if gitCommit != "" {
+		rootCommand.Version = fmt.Sprintf("%s commit: %s", version.Version, gitCommit)
 	} else {
 		rootCommand.Version = version.Version
 	}
@@ -82,10 +79,8 @@ func createApp() (*cobra.Command, *globalOptions) {
 	var dummyVersion bool
 	rootCommand.Flags().BoolVarP(&dummyVersion, "version", "v", false, "Version for Skopeo")
 	rootCommand.PersistentFlags().BoolVar(&opts.debug, "debug", false, "enable debug output")
-	rootCommand.PersistentFlags().StringVar(&opts.tlsDetailsPath, "tls-details", "", "path to a containers-tls-details.yaml(5) file")
 	rootCommand.PersistentFlags().StringVar(&opts.policyPath, "policy", "", "Path to a trust policy file")
 	rootCommand.PersistentFlags().BoolVar(&opts.insecurePolicy, "insecure-policy", false, "run the tool without any policy check")
-	rootCommand.PersistentFlags().BoolVar(&opts.requireSigned, "require-signed", false, "require any pulled image to be signed")
 	rootCommand.PersistentFlags().StringVar(&opts.registriesDirPath, "registries.d", "", "use registry configuration files in `DIR` (e.g. for container signature storage)")
 	rootCommand.PersistentFlags().StringVar(&opts.overrideArch, "override-arch", "", "use `ARCH` instead of the architecture of the machine for choosing images")
 	rootCommand.PersistentFlags().StringVar(&opts.overrideOS, "override-os", "", "use `OS` instead of the running OS for choosing images")
@@ -96,7 +91,6 @@ func createApp() (*cobra.Command, *globalOptions) {
 		logrus.Fatal("unable to mark registries-conf flag as hidden")
 	}
 	rootCommand.PersistentFlags().StringVar(&opts.tmpDir, "tmpdir", "", "directory used to store temporary files")
-	rootCommand.PersistentFlags().StringVar(&opts.userAgentPrefix, "user-agent-prefix", "", "prefix to add to the user agent string")
 	flag := commonFlag.OptionalBoolFlag(rootCommand.Flags(), &opts.tlsVerify, "tls-verify", "Require HTTPS and verify certificates when accessing the registry")
 	flag.Hidden = true
 	rootCommand.AddCommand(
@@ -118,20 +112,6 @@ func createApp() (*cobra.Command, *globalOptions) {
 	return rootCommand, &opts
 }

-// gitCommit returns the git commit for this codebase, if we are built from a git repo; "" otherwise.
-func gitCommit() string {
-	bi, ok := debug.ReadBuildInfo()
-	if !ok {
-		logrus.Fatal("runtime.ReadBuildInfo failed")
-	}
-	for _, e := range bi.Settings {
-		if e.Key == "vcs.revision" {
-			return e.Value
-		}
-	}
-	return ""
-}
-
 // before is run by the cli package for any command, before running the command-specific handler.
 func (opts *globalOptions) before(cmd *cobra.Command, args []string) error {
 	if opts.debug {
@@ -140,9 +120,6 @@ func (opts *globalOptions) before(cmd *cobra.Command, args []string) error {
 	if opts.tlsVerify.Present() {
 		logrus.Warn("'--tls-verify' is deprecated, please set this on the specific subcommand")
 	}
-	if opts.insecurePolicy && opts.requireSigned {
-		return fmt.Errorf("--insecure-policy and --require-signed are mutually exclusive")
-	}
 	return nil
 }

@@ -163,34 +140,18 @@ func main() {
 // getPolicyContext returns a *signature.PolicyContext based on opts.
 func (opts *globalOptions) getPolicyContext() (*signature.PolicyContext, error) {
 	var policy *signature.Policy // This could be cached across calls in opts.
+	var err error
 	if opts.insecurePolicy {
 		policy = &signature.Policy{Default: []signature.PolicyRequirement{signature.NewPRInsecureAcceptAnything()}}
 	} else if opts.policyPath == "" {
-		sys, err := opts.newSystemContext()
-		if err != nil {
-			return nil, err
-		}
-		p, err := signature.DefaultPolicy(sys)
-		if err != nil {
-			return nil, err
-		}
-		policy = p
+		policy, err = signature.DefaultPolicy(nil)
 	} else {
-		p, err := signature.NewPolicyFromFile(opts.policyPath)
-		if err != nil {
-			return nil, err
-		}
-		policy = p
+		policy, err = signature.NewPolicyFromFile(opts.policyPath)
 	}
-
-	pc, err := signature.NewPolicyContext(policy)
 	if err != nil {
 		return nil, err
 	}
-	if opts.requireSigned {
-		pc.RequireSignatureVerification(true)
-	}
-	return pc, nil
+	return signature.NewPolicyContext(policy)
 }

 // commandTimeoutContext returns a context.Context and a cancellation callback based on opts.
@@ -206,15 +167,7 @@ func (opts *globalOptions) commandTimeoutContext() (context.Context, context.Can

 // newSystemContext returns a *types.SystemContext corresponding to opts.
 // It is guaranteed to return a fresh instance, so it is safe to make additional updates to it.
-func (opts *globalOptions) newSystemContext() (*types.SystemContext, error) {
-	userAgent := defaultUserAgent
-	if opts.userAgentPrefix != "" {
-		userAgent = opts.userAgentPrefix + " " + defaultUserAgent
-	}
-	baseTLSConfig, err := tlsdetails.BaseTLSFromOptionalFile(opts.tlsDetailsPath)
-	if err != nil {
-		return nil, err
-	}
+func (opts *globalOptions) newSystemContext() *types.SystemContext {
 	ctx := &types.SystemContext{
 		RegistriesDirPath:        opts.registriesDirPath,
 		ArchitectureChoice:       opts.overrideArch,
@@ -222,12 +175,11 @@ func (opts *globalOptions) newSystemContext() (*types.SystemContext, error) {
 		VariantChoice:            opts.overrideVariant,
 		SystemRegistriesConfPath: opts.registriesConfPath,
 		BigFilesTemporaryDir:     opts.tmpDir,
-		BaseTLSConfig:            baseTLSConfig.TLSConfig(),
-		DockerRegistryUserAgent:  userAgent,
+		DockerRegistryUserAgent:  defaultUserAgent,
 	}
 	// DEPRECATED: We support this for backward compatibility, but override it if a per-image flag is provided.
 	if opts.tlsVerify.Present() {
 		ctx.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.Value())
 	}
-	return ctx, nil
+	return ctx
 }
--- a/cmd/skopeo/main_test.go
+++ b/cmd/skopeo/main_test.go
@@ -2,12 +2,10 @@ package main

 import (
 	"bytes"
-	"crypto/tls"
 	"testing"

+	"github.com/containers/image/v5/types"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.podman.io/image/v5/types"
 )

 // runSkopeo creates an app object and runs it with args, with an implied first "skopeo".
@@ -24,8 +22,7 @@ func runSkopeo(args ...string) (string, error) {
 func TestGlobalOptionsNewSystemContext(t *testing.T) {
 	// Default state
 	opts, _ := fakeGlobalOptions(t, []string{})
-	res, err := opts.newSystemContext()
-	require.NoError(t, err)
+	res := opts.newSystemContext()
 	assert.Equal(t, &types.SystemContext{
 		// User-Agent is set by default.
 		DockerRegistryUserAgent: defaultUserAgent,
@@ -36,22 +33,16 @@ func TestGlobalOptionsNewSystemContext(t *testing.T) {
 		"--override-arch", "overridden-arch",
 		"--override-os", "overridden-os",
 		"--override-variant", "overridden-variant",
-		"--tls-details", "../../integration/fixtures/tls-details-pqc-only.yaml",
 		"--tmpdir", "/srv",
 		"--registries-conf", "/srv/registries.conf",
 		"--tls-verify=false",
 	})
-	res, err = opts.newSystemContext()
-	require.NoError(t, err)
+	res = opts.newSystemContext()
 	assert.Equal(t, &types.SystemContext{
-		RegistriesDirPath:  "/srv/registries.d",
-		ArchitectureChoice: "overridden-arch",
-		OSChoice:           "overridden-os",
-		VariantChoice:      "overridden-variant",
-		BaseTLSConfig: &tls.Config{
-			MinVersion:       tls.VersionTLS13,
-			CurvePreferences: []tls.CurveID{tls.X25519MLKEM768},
-		},
+		RegistriesDirPath:           "/srv/registries.d",
+		ArchitectureChoice:          "overridden-arch",
+		OSChoice:                    "overridden-os",
+		VariantChoice:               "overridden-variant",
 		BigFilesTemporaryDir:        "/srv",
 		SystemRegistriesConfPath:    "/srv/registries.conf",
 		DockerInsecureSkipTLSVerify: types.OptionalBoolTrue,
--- a/cmd/skopeo/manifest.go
+++ b/cmd/skopeo/manifest.go
@@ -6,11 +6,12 @@ import (
 	"io"
 	"os"

+	"github.com/containers/image/v5/manifest"
 	"github.com/spf13/cobra"
-	"go.podman.io/image/v5/manifest"
 )

-type manifestDigestOptions struct{}
+type manifestDigestOptions struct {
+}

 func manifestDigestCmd() *cobra.Command {
 	var opts manifestDigestOptions
--- a/cmd/skopeo/proxy.go
+++ b/cmd/skopeo/proxy.go
@@ -9,13 +9,879 @@ package main
 */

 import (
+	"bytes"
 	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
 	"io"
+	"net"
+	"os"
+	"sync"
+	"syscall"

+	"github.com/containers/common/pkg/retry"
+	"github.com/containers/image/v5/image"
+	"github.com/containers/image/v5/manifest"
+	"github.com/containers/image/v5/pkg/blobinfocache"
+	"github.com/containers/image/v5/transports"
+	"github.com/containers/image/v5/transports/alltransports"
+	"github.com/containers/image/v5/types"
+	"github.com/opencontainers/go-digest"
+	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	"go.podman.io/common/pkg/json-proxy"
 )

+// protocolVersion is semantic version of the protocol used by this proxy.
+// The first version of the protocol has major version 0.2 to signify a
+// departure from the original code which used HTTP.
+//
+// When bumping this, please also update the man page.
+const protocolVersion = "0.2.8"
+
+// maxMsgSize is the current limit on a packet size.
+// Note that all non-metadata (i.e. payload data) is sent over a pipe.
+const maxMsgSize = 32 * 1024
+
+// maxJSONFloat is ECMA Number.MAX_SAFE_INTEGER
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/MAX_SAFE_INTEGER
+// We hard error if the input JSON numbers we expect to be
+// integers are above this.
+const maxJSONFloat = float64(uint64(1)<<53 - 1)
+
+// sentinelImageID represents "image not found" on the wire
+const sentinelImageID = 0
+
+// request is the JSON serialization of a function call
+type request struct {
+	// Method is the name of the function
+	Method string `json:"method"`
+	// Args is the arguments (parsed inside the function)
+	Args []any `json:"args"`
+}
+
+type proxyErrorCode string
+
+const (
+	// proxyErrPipe means we got EPIPE writing to a pipe owned by the client
+	proxyErrPipe proxyErrorCode = "EPIPE"
+	// proxyErrRetryable can be used by clients to automatically retry operations
+	proxyErrRetryable proxyErrorCode = "retryable"
+	// All other errors
+	proxyErrOther proxyErrorCode = "other"
+)
+
+// proxyError is serialized over the errfd channel for GetRawBlob
+type proxyError struct {
+	Code    proxyErrorCode `json:"code"`
+	Message string         `json:"message"`
+}
+
+// reply is serialized to JSON as the return value from a function call.
+type reply struct {
+	// Success is true if and only if the call succeeded.
+	Success bool `json:"success"`
+	// Value is an arbitrary value (or values, as array/map) returned from the call.
+	Value any `json:"value"`
+	// PipeID is an index into open pipes, and should be passed to FinishPipe
+	PipeID uint32 `json:"pipeid"`
+	// ErrorCode will be non-empty if error is set (new in 0.2.8)
+	ErrorCode proxyErrorCode `json:"error_code"`
+	// Error should be non-empty if Success == false
+	Error string `json:"error"`
+}
+
+// replyBuf is our internal deserialization of reply plus optional fd
+type replyBuf struct {
+	// value will be converted to a reply Value
+	value any
+	// fd is the read half of a pipe, passed back to the client for additional data
+	fd *os.File
+	// errfd will be a serialization of error state. This is optional and is currently
+	// only used by GetRawBlob.
+	errfd *os.File
+	// pipeid will be provided to the client as PipeID, an index into our open pipes
+	pipeid uint32
+}
+
+// activePipe is an open pipe to the client.
+// It contains an error value
+type activePipe struct {
+	// w is the write half of the pipe
+	w *os.File
+	// wg is completed when our worker goroutine is done
+	wg sync.WaitGroup
+	// err may be set in our worker goroutine
+	err error
+}
+
+// openImage is an opened image reference
+type openImage struct {
+	// id is an opaque integer handle
+	id        uint64
+	src       types.ImageSource
+	cachedimg types.Image
+}
+
+// proxyHandler is the state associated with our socket.
+type proxyHandler struct {
+	// lock protects everything else in this structure.
+	lock sync.Mutex
+	// opts is CLI options
+	opts   *proxyOptions
+	sysctx *types.SystemContext
+	cache  types.BlobInfoCache
+
+	// imageSerial is a counter for open images
+	imageSerial uint64
+	// images holds our opened images
+	images map[uint64]*openImage
+	// activePipes maps from "pipeid" to a pipe + goroutine pair
+	activePipes map[uint32]*activePipe
+}
+
+// convertedLayerInfo is the reduced form of the OCI type BlobInfo
+// Used in the return value of GetLayerInfo
+type convertedLayerInfo struct {
+	Digest    digest.Digest `json:"digest"`
+	Size      int64         `json:"size"`
+	MediaType string        `json:"media_type"`
+}
+
+// mapProxyErrorCode turns an error into a known string value.
+func mapProxyErrorCode(err error) proxyErrorCode {
+	switch {
+	case err == nil:
+		return ""
+	case errors.Is(err, syscall.EPIPE):
+		return proxyErrPipe
+	case retry.IsErrorRetryable(err):
+		return proxyErrRetryable
+	default:
+		return proxyErrOther
+	}
+}
+
+// newProxyError creates a serializable structure for
+// the client containing a mapped error code based
+// on the error type, plus its value as a string.
+func newProxyError(err error) proxyError {
+	return proxyError{
+		Code:    mapProxyErrorCode(err),
+		Message: fmt.Sprintf("%v", err),
+	}
+}
+
+// Initialize performs one-time initialization, and returns the protocol version
+func (h *proxyHandler) Initialize(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	if len(args) != 0 {
+		return ret, fmt.Errorf("invalid request, expecting zero arguments")
+	}
+
+	if h.sysctx != nil {
+		return ret, fmt.Errorf("already initialized")
+	}
+
+	sysctx, err := h.opts.imageOpts.newSystemContext()
+	if err != nil {
+		return ret, err
+	}
+	h.sysctx = sysctx
+	h.cache = blobinfocache.DefaultCache(sysctx)
+
+	r := replyBuf{
+		value: protocolVersion,
+	}
+	return r, nil
+}
+
+// OpenImage accepts a string image reference i.e. TRANSPORT:REF - like `skopeo copy`.
+// The return value is an opaque integer handle.
+func (h *proxyHandler) OpenImage(args []any) (replyBuf, error) {
+	return h.openImageImpl(args, false)
+}
+
+func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (retReplyBuf replyBuf, retErr error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+	if len(args) != 1 {
+		return ret, fmt.Errorf("invalid request, expecting one argument")
+	}
+	imageref, ok := args[0].(string)
+	if !ok {
+		return ret, fmt.Errorf("expecting string imageref, not %T", args[0])
+	}
+
+	imgRef, err := alltransports.ParseImageName(imageref)
+	if err != nil {
+		return ret, err
+	}
+	imgsrc, err := imgRef.NewImageSource(context.Background(), h.sysctx)
+	if err != nil {
+		if allowNotFound && isNotFoundImageError(err) {
+			ret.value = sentinelImageID
+			return ret, nil
+		}
+		return ret, err
+	}
+
+	policyContext, err := h.opts.global.getPolicyContext()
+	if err != nil {
+		return ret, err
+	}
+	defer func() {
+		if err := policyContext.Destroy(); err != nil {
+			retErr = noteCloseFailure(retErr, "tearing down policy context", err)
+		}
+	}()
+
+	unparsedTopLevel := image.UnparsedInstance(imgsrc, nil)
+	allowed, err := policyContext.IsRunningImageAllowed(context.Background(), unparsedTopLevel)
+	if err != nil {
+		return ret, err
+	}
+	if !allowed {
+		return ret, fmt.Errorf("internal inconsistency: policy verification failed without returning an error")
+	}
+
+	// Note that we never return zero as an imageid; this code doesn't yet
+	// handle overflow though.
+	h.imageSerial++
+	openimg := &openImage{
+		id:  h.imageSerial,
+		src: imgsrc,
+	}
+	h.images[openimg.id] = openimg
+	ret.value = openimg.id
+
+	return ret, nil
+}
+
+// OpenImageOptional accepts a string image reference i.e. TRANSPORT:REF - like `skopeo copy`.
+// The return value is an opaque integer handle.  If the image does not exist, zero
+// is returned.
+func (h *proxyHandler) OpenImageOptional(args []any) (replyBuf, error) {
+	return h.openImageImpl(args, true)
+}
+
+func (h *proxyHandler) CloseImage(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+	if len(args) != 1 {
+		return ret, fmt.Errorf("invalid request, expecting one argument")
+	}
+	imgref, err := h.parseImageFromID(args[0])
+	if err != nil {
+		return ret, err
+	}
+	imgref.src.Close()
+	delete(h.images, imgref.id)
+
+	return ret, nil
+}
+
+// parseUint64 validates that a number fits inside a JavaScript safe integer
+func parseUint64(v any) (uint64, error) {
+	f, ok := v.(float64)
+	if !ok {
+		return 0, fmt.Errorf("expecting numeric, not %T", v)
+	}
+	if f > maxJSONFloat {
+		return 0, fmt.Errorf("out of range integer for numeric %f", f)
+	}
+	return uint64(f), nil
+}
+
+func (h *proxyHandler) parseImageFromID(v any) (*openImage, error) {
+	imgid, err := parseUint64(v)
+	if err != nil {
+		return nil, err
+	}
+	if imgid == sentinelImageID {
+		return nil, fmt.Errorf("Invalid imageid value of zero")
+	}
+	imgref, ok := h.images[imgid]
+	if !ok {
+		return nil, fmt.Errorf("no image %v", imgid)
+	}
+	return imgref, nil
+}
+
+func (h *proxyHandler) allocPipe() (*os.File, *activePipe, error) {
+	piper, pipew, err := os.Pipe()
+	if err != nil {
+		return nil, nil, err
+	}
+	f := activePipe{
+		w: pipew,
+	}
+	h.activePipes[uint32(pipew.Fd())] = &f
+	f.wg.Add(1)
+	return piper, &f, nil
+}
+
+// returnBytes generates a return pipe() from a byte array
+// In the future it might be nicer to return this via memfd_create()
+func (h *proxyHandler) returnBytes(retval any, buf []byte) (replyBuf, error) {
+	var ret replyBuf
+	piper, f, err := h.allocPipe()
+	if err != nil {
+		return ret, err
+	}
+
+	go func() {
+		// Signal completion when we return
+		defer f.wg.Done()
+		_, err = io.Copy(f.w, bytes.NewReader(buf))
+		if err != nil {
+			f.err = err
+		}
+	}()
+
+	ret.value = retval
+	ret.fd = piper
+	ret.pipeid = uint32(f.w.Fd())
+	return ret, nil
+}
+
+// cacheTargetManifest is invoked when GetManifest or GetConfig is invoked
+// the first time for a given image.  If the requested image is a manifest
+// list, this function resolves it to the image matching the calling process'
+// operating system and architecture.
+//
+// TODO: Add GetRawManifest or so that exposes manifest lists
+func (h *proxyHandler) cacheTargetManifest(img *openImage) error {
+	ctx := context.Background()
+	if img.cachedimg != nil {
+		return nil
+	}
+	unparsedToplevel := image.UnparsedInstance(img.src, nil)
+	mfest, manifestType, err := unparsedToplevel.Manifest(ctx)
+	if err != nil {
+		return err
+	}
+	var target *image.UnparsedImage
+	if manifest.MIMETypeIsMultiImage(manifestType) {
+		manifestList, err := manifest.ListFromBlob(mfest, manifestType)
+		if err != nil {
+			return err
+		}
+		instanceDigest, err := manifestList.ChooseInstance(h.sysctx)
+		if err != nil {
+			return err
+		}
+		target = image.UnparsedInstance(img.src, &instanceDigest)
+	} else {
+		target = unparsedToplevel
+	}
+	cachedimg, err := image.FromUnparsedImage(ctx, h.sysctx, target)
+	if err != nil {
+		return err
+	}
+	img.cachedimg = cachedimg
+	return nil
+}
+
+// GetManifest returns a copy of the manifest, converted to OCI format, along with the original digest.
+// Manifest lists are resolved to the current operating system and architecture.
+func (h *proxyHandler) GetManifest(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+	if len(args) != 1 {
+		return ret, fmt.Errorf("invalid request, expecting one argument")
+	}
+	imgref, err := h.parseImageFromID(args[0])
+	if err != nil {
+		return ret, err
+	}
+
+	err = h.cacheTargetManifest(imgref)
+	if err != nil {
+		return ret, err
+	}
+	img := imgref.cachedimg
+
+	ctx := context.Background()
+	rawManifest, manifestType, err := img.Manifest(ctx)
+	if err != nil {
+		return ret, err
+	}
+
+	// We only support OCI and docker2schema2.  We know docker2schema2 can be easily+cheaply
+	// converted into OCI, so consumers only need to see OCI.
+	switch manifestType {
+	case imgspecv1.MediaTypeImageManifest, manifest.DockerV2Schema2MediaType:
+		break
+	// Explicitly reject e.g. docker schema 1 type with a "legacy" note
+	case manifest.DockerV2Schema1MediaType, manifest.DockerV2Schema1SignedMediaType:
+		return ret, fmt.Errorf("unsupported legacy manifest MIME type: %s", manifestType)
+	default:
+		return ret, fmt.Errorf("unsupported manifest MIME type: %s", manifestType)
+	}
+
+	// We always return the original digest, as that's what clients need to do pull-by-digest
+	// and in general identify the image.
+	digest, err := manifest.Digest(rawManifest)
+	if err != nil {
+		return ret, err
+	}
+	var serialized []byte
+	// But, we convert to OCI format on the wire if it's not already.  The idea here is that by reusing the containers/image
+	// stack, clients to this proxy can pretend the world is OCI only, and not need to care about e.g.
+	// docker schema and MIME types.
+	if manifestType != imgspecv1.MediaTypeImageManifest {
+		manifestUpdates := types.ManifestUpdateOptions{ManifestMIMEType: imgspecv1.MediaTypeImageManifest}
+		ociImage, err := img.UpdatedImage(ctx, manifestUpdates)
+		if err != nil {
+			return ret, err
+		}
+
+		ociSerialized, _, err := ociImage.Manifest(ctx)
+		if err != nil {
+			return ret, err
+		}
+		serialized = ociSerialized
+	} else {
+		serialized = rawManifest
+	}
+	return h.returnBytes(digest, serialized)
+}
+
+// GetFullConfig returns a copy of the image configuration, converted to OCI format.
+// https://github.com/opencontainers/image-spec/blob/main/config.md
+func (h *proxyHandler) GetFullConfig(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+	if len(args) != 1 {
+		return ret, fmt.Errorf("invalid request, expecting: [imgid]")
+	}
+	imgref, err := h.parseImageFromID(args[0])
+	if err != nil {
+		return ret, err
+	}
+	err = h.cacheTargetManifest(imgref)
+	if err != nil {
+		return ret, err
+	}
+	img := imgref.cachedimg
+
+	ctx := context.TODO()
+	config, err := img.OCIConfig(ctx)
+	if err != nil {
+		return ret, err
+	}
+	serialized, err := json.Marshal(&config)
+	if err != nil {
+		return ret, err
+	}
+	return h.returnBytes(nil, serialized)
+}
+
+// GetConfig returns a copy of the container runtime configuration, converted to OCI format.
+// Note that due to a historical mistake, this returns not the full image configuration,
+// but just the container runtime configuration.  You should use GetFullConfig instead.
+func (h *proxyHandler) GetConfig(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+	if len(args) != 1 {
+		return ret, fmt.Errorf("invalid request, expecting: [imgid]")
+	}
+	imgref, err := h.parseImageFromID(args[0])
+	if err != nil {
+		return ret, err
+	}
+	err = h.cacheTargetManifest(imgref)
+	if err != nil {
+		return ret, err
+	}
+	img := imgref.cachedimg
+
+	ctx := context.TODO()
+	config, err := img.OCIConfig(ctx)
+	if err != nil {
+		return ret, err
+	}
+	serialized, err := json.Marshal(&config.Config)
+	if err != nil {
+		return ret, err
+	}
+	return h.returnBytes(nil, serialized)
+}
+
+// GetBlob fetches a blob, performing digest verification.
+func (h *proxyHandler) GetBlob(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+	if len(args) != 3 {
+		return ret, fmt.Errorf("found %d args, expecting (imgid, digest, size)", len(args))
+	}
+	imgref, err := h.parseImageFromID(args[0])
+	if err != nil {
+		return ret, err
+	}
+	digestStr, ok := args[1].(string)
+	if !ok {
+		return ret, fmt.Errorf("expecting string blobid")
+	}
+	size, err := parseUint64(args[2])
+	if err != nil {
+		return ret, err
+	}
+
+	ctx := context.TODO()
+	d, err := digest.Parse(digestStr)
+	if err != nil {
+		return ret, err
+	}
+	blobr, blobSize, err := imgref.src.GetBlob(ctx, types.BlobInfo{Digest: d, Size: int64(size)}, h.cache)
+	if err != nil {
+		return ret, err
+	}
+
+	piper, f, err := h.allocPipe()
+	if err != nil {
+		blobr.Close()
+		return ret, err
+	}
+	go func() {
+		// Signal completion when we return
+		defer blobr.Close()
+		defer f.wg.Done()
+		verifier := d.Verifier()
+		tr := io.TeeReader(blobr, verifier)
+		n, err := io.Copy(f.w, tr)
+		if err != nil {
+			f.err = err
+			return
+		}
+		if n != int64(size) {
+			f.err = fmt.Errorf("expected %d bytes in blob, got %d", size, n)
+		}
+		if !verifier.Verified() {
+			f.err = fmt.Errorf("corrupted blob, expecting %s", d.String())
+		}
+	}()
+
+	ret.value = blobSize
+	ret.fd = piper
+	ret.pipeid = uint32(f.w.Fd())
+	return ret, nil
+}
+
+// GetRawBlob can be viewed as a more general purpose successor
+// to GetBlob. First, it does not verify the digest, which in
+// some cases is unnecessary as the client would prefer to do it.
+//
+// It also does not use the "FinishPipe" API call, but instead
+// returns *two* file descriptors, one for errors and one for data.
+//
+// On (initial) success, the return value provided to the client is the size of the blob.
+func (h *proxyHandler) GetRawBlob(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+	if len(args) != 2 {
+		return ret, fmt.Errorf("found %d args, expecting (imgid, digest)", len(args))
+	}
+	imgref, err := h.parseImageFromID(args[0])
+	if err != nil {
+		return ret, err
+	}
+	digestStr, ok := args[1].(string)
+	if !ok {
+		return ret, fmt.Errorf("expecting string blobid")
+	}
+
+	ctx := context.TODO()
+	d, err := digest.Parse(digestStr)
+	if err != nil {
+		return ret, err
+	}
+	blobr, blobSize, err := imgref.src.GetBlob(ctx, types.BlobInfo{Digest: d, Size: int64(-1)}, h.cache)
+	if err != nil {
+		return ret, err
+	}
+
+	// Note this doesn't call allocPipe; we're not using the FinishPipe infrastructure.
+	piper, pipew, err := os.Pipe()
+	if err != nil {
+		blobr.Close()
+		return ret, err
+	}
+	errpipeR, errpipeW, err := os.Pipe()
+	if err != nil {
+		piper.Close()
+		pipew.Close()
+		blobr.Close()
+		return ret, err
+	}
+	// Asynchronous worker doing a copy
+	go func() {
+		// We own the read from registry, and write pipe objects
+		defer blobr.Close()
+		defer pipew.Close()
+		defer errpipeW.Close()
+		logrus.Debugf("Copying blob to client: %d bytes", blobSize)
+		_, err := io.Copy(pipew, blobr)
+		// Handle errors here by serializing a JSON error back over
+		// the error channel. In either case, both file descriptors
+		// will be closed, signaling the completion of the operation.
+		if err != nil {
+			logrus.Debugf("Sending error to client: %v", err)
+			serializedErr := newProxyError(err)
+			buf, err := json.Marshal(serializedErr)
+			if err != nil {
+				// Should never happen
+				panic(err)
+			}
+			_, writeErr := errpipeW.Write(buf)
+			if writeErr != nil && !errors.Is(err, syscall.EPIPE) {
+				logrus.Debugf("Writing to client: %v", err)
+			}
+		}
+		logrus.Debugf("Completed GetRawBlob operation")
+	}()
+
+	ret.value = blobSize
+	ret.fd = piper
+	ret.errfd = errpipeR
+	return ret, nil
+}
+
+// GetLayerInfo returns data about the layers of an image, useful for reading the layer contents.
+//
+// This is the same as GetLayerInfoPiped, but returns its contents inline. This is subject to
+// failure for large images (because we use SOCK_SEQPACKET which has a maximum buffer size)
+// and is hence only retained for backwards compatibility. Callers are expected to use
+// the semver to know whether they can call the new API.
+func (h *proxyHandler) GetLayerInfo(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+
+	if len(args) != 1 {
+		return ret, fmt.Errorf("found %d args, expecting (imgid)", len(args))
+	}
+
+	imgref, err := h.parseImageFromID(args[0])
+	if err != nil {
+		return ret, err
+	}
+
+	ctx := context.TODO()
+
+	err = h.cacheTargetManifest(imgref)
+	if err != nil {
+		return ret, err
+	}
+	img := imgref.cachedimg
+
+	layerInfos, err := img.LayerInfosForCopy(ctx)
+	if err != nil {
+		return ret, err
+	}
+
+	if layerInfos == nil {
+		layerInfos = img.LayerInfos()
+	}
+
+	layers := make([]convertedLayerInfo, 0, len(layerInfos))
+	for _, layer := range layerInfos {
+		layers = append(layers, convertedLayerInfo{layer.Digest, layer.Size, layer.MediaType})
+	}
+
+	ret.value = layers
+	return ret, nil
+}
+
+// GetLayerInfoPiped returns data about the layers of an image, useful for reading the layer contents.
+//
+// This needs to be called since the data returned by GetManifest() does not allow to correctly
+// calling GetBlob() for the containers-storage: transport (which doesn’t store the original compressed
+// representations referenced in the manifest).
+func (h *proxyHandler) GetLayerInfoPiped(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	if h.sysctx == nil {
+		return ret, fmt.Errorf("client error: must invoke Initialize")
+	}
+
+	if len(args) != 1 {
+		return ret, fmt.Errorf("found %d args, expecting (imgid)", len(args))
+	}
+
+	imgref, err := h.parseImageFromID(args[0])
+	if err != nil {
+		return ret, err
+	}
+
+	ctx := context.TODO()
+
+	err = h.cacheTargetManifest(imgref)
+	if err != nil {
+		return ret, err
+	}
+	img := imgref.cachedimg
+
+	layerInfos, err := img.LayerInfosForCopy(ctx)
+	if err != nil {
+		return ret, err
+	}
+
+	if layerInfos == nil {
+		layerInfos = img.LayerInfos()
+	}
+
+	layers := make([]convertedLayerInfo, 0, len(layerInfos))
+	for _, layer := range layerInfos {
+		layers = append(layers, convertedLayerInfo{layer.Digest, layer.Size, layer.MediaType})
+	}
+
+	serialized, err := json.Marshal(&layers)
+	if err != nil {
+		return ret, err
+	}
+	return h.returnBytes(nil, serialized)
+}
+
+// FinishPipe waits for the worker goroutine to finish, and closes the write side of the pipe.
+func (h *proxyHandler) FinishPipe(args []any) (replyBuf, error) {
+	h.lock.Lock()
+	defer h.lock.Unlock()
+
+	var ret replyBuf
+
+	pipeidv, err := parseUint64(args[0])
+	if err != nil {
+		return ret, err
+	}
+	pipeid := uint32(pipeidv)
+
+	f, ok := h.activePipes[pipeid]
+	if !ok {
+		return ret, fmt.Errorf("finishpipe: no active pipe %d", pipeid)
+	}
+
+	// Wait for the goroutine to complete
+	f.wg.Wait()
+	logrus.Debug("Completed pipe goroutine")
+	// And only now do we close the write half; this forces the client to call this API
+	f.w.Close()
+	// Propagate any errors from the goroutine worker
+	err = f.err
+	delete(h.activePipes, pipeid)
+	return ret, err
+}
+
+// close releases all resources associated with this proxy backend
+func (h *proxyHandler) close() {
+	for _, image := range h.images {
+		err := image.src.Close()
+		if err != nil {
+			// This shouldn't be fatal
+			logrus.Warnf("Failed to close image %s: %v", transports.ImageName(image.cachedimg.Reference()), err)
+		}
+	}
+}
+
+// send writes a reply buffer to the socket
+func (buf replyBuf) send(conn *net.UnixConn, err error) error {
+	logrus.Debugf("Sending reply: err=%v value=%v pipeid=%v datafd=%v errfd=%v", err, buf.value, buf.pipeid, buf.fd, buf.errfd)
+	// We took ownership of these FDs, so close when we're done sending them or on error
+	defer func() {
+		if buf.fd != nil {
+			buf.fd.Close()
+		}
+		if buf.errfd != nil {
+			buf.errfd.Close()
+		}
+	}()
+	replyToSerialize := reply{
+		Success: err == nil,
+		Value:   buf.value,
+		PipeID:  buf.pipeid,
+	}
+	if err != nil {
+		replyToSerialize.ErrorCode = mapProxyErrorCode(err)
+		replyToSerialize.Error = err.Error()
+	}
+	serializedReply, err := json.Marshal(&replyToSerialize)
+	if err != nil {
+		return err
+	}
+	// Copy the FD number(s) to the socket ancillary buffer
+	fds := make([]int, 0)
+	if buf.fd != nil {
+		fds = append(fds, int(buf.fd.Fd()))
+	}
+	if buf.errfd != nil {
+		fds = append(fds, int(buf.errfd.Fd()))
+	}
+	oob := syscall.UnixRights(fds...)
+	n, oobn, err := conn.WriteMsgUnix(serializedReply, oob, nil)
+	if err != nil {
+		return err
+	}
+	// Validate that we sent the full packet
+	if n != len(serializedReply) || oobn != len(oob) {
+		return io.ErrShortWrite
+	}
+	return nil
+}
+
 type proxyOptions struct {
 	global    *globalOptions
 	imageOpts *imageOptions
@@ -44,15 +910,92 @@ func proxyCmd(global *globalOptions) *cobra.Command {
 	return cmd
 }

-// Implementation of podman experimental-image-proxy using the library
+// processRequest dispatches a remote request.
+// replyBuf is the result of the invocation.
+// terminate should be true if processing of requests should halt.
+func (h *proxyHandler) processRequest(readBytes []byte) (rb replyBuf, terminate bool, err error) {
+	var req request
+
+	// Parse the request JSON
+	if err = json.Unmarshal(readBytes, &req); err != nil {
+		err = fmt.Errorf("invalid request: %v", err)
+		return
+	}
+	logrus.Debugf("Executing method %s", req.Method)
+
+	// Dispatch on the method
+	switch req.Method {
+	case "Initialize":
+		rb, err = h.Initialize(req.Args)
+	case "OpenImage":
+		rb, err = h.OpenImage(req.Args)
+	case "OpenImageOptional":
+		rb, err = h.OpenImageOptional(req.Args)
+	case "CloseImage":
+		rb, err = h.CloseImage(req.Args)
+	case "GetManifest":
+		rb, err = h.GetManifest(req.Args)
+	case "GetConfig":
+		rb, err = h.GetConfig(req.Args)
+	case "GetFullConfig":
+		rb, err = h.GetFullConfig(req.Args)
+	case "GetBlob":
+		rb, err = h.GetBlob(req.Args)
+	case "GetRawBlob":
+		rb, err = h.GetRawBlob(req.Args)
+	case "GetLayerInfo":
+		rb, err = h.GetLayerInfo(req.Args)
+	case "GetLayerInfoPiped":
+		rb, err = h.GetLayerInfoPiped(req.Args)
+	case "FinishPipe":
+		rb, err = h.FinishPipe(req.Args)
+	case "Shutdown":
+		terminate = true
+	// NOTE: If you add a method here, you should very likely be bumping the
+	// const protocolVersion above.
+	default:
+		err = fmt.Errorf("unknown method: %s", req.Method)
+	}
+	return
+}
+
+// Implementation of podman experimental-image-proxy
 func (opts *proxyOptions) run(args []string, stdout io.Writer) error {
-	manager, err := jsonproxy.NewManager(
-		jsonproxy.WithSystemContext(opts.imageOpts.newSystemContext),
-		jsonproxy.WithPolicyContext(opts.global.getPolicyContext),
-	)
+	handler := &proxyHandler{
+		opts:        opts,
+		images:      make(map[uint64]*openImage),
+		activePipes: make(map[uint32]*activePipe),
+	}
+	defer handler.close()
+
+	// Convert the socket FD passed by client into a net.FileConn
+	fd := os.NewFile(uintptr(opts.sockFd), "sock")
+	fconn, err := net.FileConn(fd)
 	if err != nil {
 		return err
 	}
-	defer manager.Close()
-	return manager.Serve(context.Background(), opts.sockFd)
+	conn := fconn.(*net.UnixConn)
+
+	// Allocate a buffer to copy the packet into
+	buf := make([]byte, maxMsgSize)
+	for {
+		n, _, err := conn.ReadFrom(buf)
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return nil
+			}
+			return fmt.Errorf("reading socket: %v", err)
+		}
+		readbuf := buf[0:n]
+
+		rb, terminate, err := handler.processRequest(readbuf)
+		if terminate {
+			logrus.Debug("terminating")
+			return nil
+		}
+
+		if err := rb.send(conn, err); err != nil {
+			return fmt.Errorf("writing to socket: %w", err)
+		}
+	}
 }
--- a/cmd/skopeo/signing.go
+++ b/cmd/skopeo/signing.go
@@ -8,9 +8,9 @@ import (
 	"os"
 	"strings"

+	"github.com/containers/image/v5/pkg/cli"
+	"github.com/containers/image/v5/signature"
 	"github.com/spf13/cobra"
-	"go.podman.io/image/v5/pkg/cli"
-	"go.podman.io/image/v5/signature"
 )

 type standaloneSignOptions struct {
@@ -61,7 +61,7 @@ func (opts *standaloneSignOptions) run(args []string, stdout io.Writer) error {
 		return fmt.Errorf("Error creating signature: %w", err)
 	}

-	if err := os.WriteFile(opts.output, signature, 0o644); err != nil {
+	if err := os.WriteFile(opts.output, signature, 0644); err != nil {
 		return fmt.Errorf("Error writing signature to %s: %w", opts.output, err)
 	}
 	return nil
@@ -118,6 +118,7 @@ func (opts *standaloneVerifyOptions) run(args []string, stdout io.Writer) error
 		mech, publicKeyfingerprints, err = signature.NewEphemeralGPGSigningMechanism(publicKeys)
 		if err != nil {
 			return fmt.Errorf("Error initializing GPG: %w", err)
+
 		}
 	} else {
 		mech, err = signature.NewGPGSigningMechanism()
@@ -146,7 +147,8 @@ func (opts *standaloneVerifyOptions) run(args []string, stdout io.Writer) error
 // (including things like “✅ Verified by $authority”)
 //
 // The subcommand is undocumented, and it may be renamed or entirely disappear in the future.
-type untrustedSignatureDumpOptions struct{}
+type untrustedSignatureDumpOptions struct {
+}

 func untrustedSignatureDumpCmd() *cobra.Command {
 	opts := untrustedSignatureDumpOptions{}
--- a/cmd/skopeo/signing_test.go
+++ b/cmd/skopeo/signing_test.go
@@ -3,14 +3,13 @@ package main
 import (
 	"encoding/json"
 	"os"
-	"path/filepath"
 	"testing"
 	"time"

+	"github.com/containers/image/v5/signature"
 	"github.com/opencontainers/go-digest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.podman.io/image/v5/signature"
 )

 const (
@@ -30,8 +29,7 @@ func assertTestFailed(t *testing.T, stdout string, err error, substring string)
 }

 func TestStandaloneSign(t *testing.T) {
-	t.Setenv("GNUPGHOME", "fixtures")
-	mech, err := signature.NewGPGSigningMechanism()
+	mech, _, err := signature.NewEphemeralGPGSigningMechanism([]byte{})
 	require.NoError(t, err)
 	defer mech.Close()
 	if err := mech.SupportsSigning(); err != nil {
@@ -40,6 +38,7 @@ func TestStandaloneSign(t *testing.T) {

 	manifestPath := "fixtures/image.manifest.json"
 	dockerReference := "testing/manifest"
+	t.Setenv("GNUPGHOME", "fixtures")

 	// Invalid command-line arguments
 	for _, args := range [][]string{
@@ -76,16 +75,21 @@ func TestStandaloneSign(t *testing.T) {
 	assertTestFailed(t, out, err, "/dev/full")

 	// Success
-	sigOutput := filepath.Join(t.TempDir(), "sig")
-	out, err = runSkopeo("standalone-sign", "-o", sigOutput,
+	sigOutput, err := os.CreateTemp("", "sig")
+	require.NoError(t, err)
+	defer os.Remove(sigOutput.Name())
+	out, err = runSkopeo("standalone-sign", "-o", sigOutput.Name(),
 		manifestPath, dockerReference, fixturesTestKeyFingerprint)
 	require.NoError(t, err)
 	assert.Empty(t, out)

-	sig, err := os.ReadFile(sigOutput)
+	sig, err := os.ReadFile(sigOutput.Name())
 	require.NoError(t, err)
 	manifest, err := os.ReadFile(manifestPath)
 	require.NoError(t, err)
+	mech, err = signature.NewGPGSigningMechanism()
+	require.NoError(t, err)
+	defer mech.Close()
 	verified, err := signature.VerifyDockerManifestSignature(sig, manifest, dockerReference, mech, fixturesTestKeyFingerprint)
 	require.NoError(t, err)
 	assert.Equal(t, dockerReference, verified.DockerReference)
--- a/cmd/skopeo/sync.go
+++ b/cmd/skopeo/sync.go
@@ -14,17 +14,17 @@ import (
 	"strings"

 	"github.com/Masterminds/semver/v3"
+	"github.com/containers/common/pkg/retry"
+	"github.com/containers/image/v5/copy"
+	"github.com/containers/image/v5/directory"
+	"github.com/containers/image/v5/docker"
+	"github.com/containers/image/v5/docker/reference"
+	"github.com/containers/image/v5/manifest"
+	"github.com/containers/image/v5/transports"
+	"github.com/containers/image/v5/types"
 	"github.com/opencontainers/go-digest"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	"go.podman.io/common/pkg/retry"
-	"go.podman.io/image/v5/copy"
-	"go.podman.io/image/v5/directory"
-	"go.podman.io/image/v5/docker"
-	"go.podman.io/image/v5/docker/reference"
-	"go.podman.io/image/v5/manifest"
-	"go.podman.io/image/v5/transports"
-	"go.podman.io/image/v5/types"
 	"gopkg.in/yaml.v3"
 )

@@ -182,7 +182,7 @@ func destinationReference(destination string, transport string) (types.ImageRefe
 			return nil, fmt.Errorf("Destination directory could not be used: %w", err)
 		}
 		// the directory holding the image must be created here
-		if err = os.MkdirAll(destination, 0o755); err != nil {
+		if err = os.MkdirAll(destination, 0755); err != nil {
 			return nil, fmt.Errorf("Error creating directory for image %s: %w", destination, err)
 		}
 		imageTransport = directory.Transport
@@ -270,6 +270,7 @@ func imagesToCopyFromDir(dirPath string) ([]types.ImageReference, error) {
 		}
 		return nil
 	})
+
 	if err != nil {
 		return sourceReferences,
 			fmt.Errorf("Error walking the path %q: %w", dirPath, err)
@@ -288,11 +289,8 @@ func imagesToCopyFromRegistry(registryName string, cfg registrySyncConfig, sourc
 	// override ctx with per-registryName options
 	serverCtx.DockerCertPath = cfg.CertDir
 	serverCtx.DockerDaemonCertPath = cfg.CertDir
-	// Only override TLS verification if explicitly specified in YAML; otherwise, keep CLI/global settings.
-	if cfg.TLSVerify.skip != types.OptionalBoolUndefined {
-		serverCtx.DockerDaemonInsecureSkipTLSVerify = (cfg.TLSVerify.skip == types.OptionalBoolTrue)
-		serverCtx.DockerInsecureSkipTLSVerify = cfg.TLSVerify.skip
-	}
+	serverCtx.DockerDaemonInsecureSkipTLSVerify = (cfg.TLSVerify.skip == types.OptionalBoolTrue)
+	serverCtx.DockerInsecureSkipTLSVerify = cfg.TLSVerify.skip
 	if cfg.Credentials != (types.DockerAuthConfig{}) {
 		serverCtx.DockerAuthConfig = &cfg.Credentials
 	}
@@ -366,8 +364,7 @@ func imagesToCopyFromRegistry(registryName string, cfg registrySyncConfig, sourc
 		}
 		repoDescList = append(repoDescList, repoDescriptor{
 			ImageRefs: sourceReferences,
-			Context:   serverCtx,
-		})
+			Context:   serverCtx})
 	}

 	// include repository descriptors for cfg.ImagesByTagRegex
@@ -667,7 +664,7 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {

 	var digestFile *os.File
 	if opts.digestFile != "" && !opts.dryRun {
-		digestFile, err = os.OpenFile(opts.digestFile, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0o644)
+		digestFile, err = os.OpenFile(opts.digestFile, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0644)
 		if err != nil {
 			return fmt.Errorf("Error creating digest file: %w", err)
 		}
--- a/cmd/skopeo/sync_test.go
+++ b/cmd/skopeo/sync_test.go
@@ -1,12 +1,11 @@
 package main

 import (
-	"fmt"
 	"testing"

+	"github.com/containers/image/v5/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.podman.io/image/v5/types"
 	"gopkg.in/yaml.v3"
 )

@@ -60,42 +59,3 @@ func TestSync(t *testing.T) {
 	// FIXME: Much more test coverage
 	// Actual feature tests exist in integration and systemtest
 }
-
-// TestSyncTLSPrecedence validates the interactions of tls-verify in YAML and --src-tls-verify in the CLI.
-func TestSyncTLSPrecedence(t *testing.T) {
-	for _, tt := range []struct {
-		cli            string
-		yaml           string
-		wantSkip       types.OptionalBool
-		wantDaemonSkip bool
-	}{
-		{"--src-tls-verify=false", `# nothing`, types.OptionalBoolTrue, true},
-		{"--src-tls-verify=true", `# nothing`, types.OptionalBoolFalse, false},
-		{"", `# nothing`, types.OptionalBoolUndefined, false},
-		{"--src-tls-verify=false", "tls-verify: true", types.OptionalBoolFalse, false},
-		{"--src-tls-verify=true", "tls-verify: false", types.OptionalBoolTrue, true},
-	} {
-		t.Run(fmt.Sprintf("%#v + %q", tt.cli, tt.yaml), func(t *testing.T) {
-			opts := fakeImageOptions(t, "src-", true, []string{}, []string{tt.cli})
-			sourceCtx, err := opts.newSystemContext()
-			require.NoError(t, err)
-			var cfg registrySyncConfig
-			err = yaml.Unmarshal(fmt.Appendf(nil, `
-%s
-images:
-  repo: # Specifying an explicit repo+tag avoids imagesToCopyFromRegistry trying to contact the registry.
-    - latest
-`, tt.yaml,
-			), &cfg)
-			require.NoError(t, err)
-
-			descs, err := imagesToCopyFromRegistry("example.com", cfg, *sourceCtx)
-			require.NoError(t, err)
-			require.NotEmpty(t, descs)
-			ctx := descs[0].Context
-			require.NotNil(t, ctx)
-			assert.Equal(t, tt.wantSkip, ctx.DockerInsecureSkipTLSVerify)
-			assert.Equal(t, tt.wantDaemonSkip, ctx.DockerDaemonInsecureSkipTLSVerify)
-		})
-	}
-}
--- a/cmd/skopeo/unshare_linux.go
+++ b/cmd/skopeo/unshare_linux.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"slices"

+	"github.com/containers/image/v5/transports/alltransports"
+	"github.com/containers/storage/pkg/unshare"
 	"github.com/moby/sys/capability"
-	"go.podman.io/image/v5/transports/alltransports"
-	"go.podman.io/storage/pkg/unshare"
 )

 var neededCapabilities = []capability.Cap{
--- a/cmd/skopeo/utils.go
+++ b/cmd/skopeo/utils.go
@@ -9,27 +9,26 @@ import (
 	"strings"
 	"time"

+	commonFlag "github.com/containers/common/pkg/flag"
+	"github.com/containers/common/pkg/retry"
+	"github.com/containers/image/v5/copy"
+	"github.com/containers/image/v5/directory"
+	"github.com/containers/image/v5/manifest"
+	ociarchive "github.com/containers/image/v5/oci/archive"
+	ocilayout "github.com/containers/image/v5/oci/layout"
+	"github.com/containers/image/v5/pkg/cli"
+	"github.com/containers/image/v5/pkg/cli/sigstore"
+	"github.com/containers/image/v5/pkg/compression"
+	"github.com/containers/image/v5/signature/signer"
+	"github.com/containers/image/v5/storage"
+	"github.com/containers/image/v5/transports/alltransports"
+	"github.com/containers/image/v5/types"
 	dockerdistributionerrcode "github.com/docker/distribution/registry/api/errcode"
 	dockerdistributionapi "github.com/docker/distribution/registry/api/v2"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
-	commonFlag "go.podman.io/common/pkg/flag"
-	"go.podman.io/common/pkg/retry"
-	"go.podman.io/image/v5/copy"
-	"go.podman.io/image/v5/directory"
-	"go.podman.io/image/v5/manifest"
-	ociarchive "go.podman.io/image/v5/oci/archive"
-	ocilayout "go.podman.io/image/v5/oci/layout"
-	"go.podman.io/image/v5/pkg/cli"
-	"go.podman.io/image/v5/pkg/cli/sigstore"
-	"go.podman.io/image/v5/pkg/compression"
-	"go.podman.io/image/v5/signature/signer"
-	"go.podman.io/image/v5/signature/simplesequoia"
-	"go.podman.io/image/v5/storage"
-	"go.podman.io/image/v5/transports/alltransports"
-	"go.podman.io/image/v5/types"
 	"golang.org/x/term"
 )

@@ -200,10 +199,7 @@ func retryFlags() (pflag.FlagSet, *retry.Options) {
 func (opts *imageOptions) newSystemContext() (*types.SystemContext, error) {
 	// *types.SystemContext instance from globalOptions
 	//  imageOptions option overrides the instance if both are present.
-	ctx, err := opts.global.newSystemContext()
-	if err != nil {
-		return nil, err
-	}
+	ctx := opts.global.newSystemContext()
 	ctx.DockerCertPath = opts.dockerCertPath
 	ctx.OCISharedBlobDirPath = opts.sharedBlobDir
 	ctx.AuthFilePath = opts.shared.authFilePath
@@ -270,7 +266,6 @@ type imageDestOptions struct {
 	compressionFormat           string                 // Format to use for the compression
 	compressionLevel            commonFlag.OptionalInt // Level to use for the compression
 	precomputeDigests           bool                   // Precompute digests to dedup layers when saving to the docker: transport
-	forceCompressionFormat      bool                   // Ensures that the compression algorithm set in compressionFormat is used exclusively
 	imageDestFlagPrefix         string
 }

@@ -286,7 +281,6 @@ func imageDestFlags(global *globalOptions, shared *sharedImageOptions, deprecate
 	fs.StringVar(&opts.compressionFormat, flagPrefix+"compress-format", "", "`FORMAT` to use for the compression")
 	fs.Var(commonFlag.NewOptionalIntValue(&opts.compressionLevel), flagPrefix+"compress-level", "`LEVEL` to use for the compression")
 	fs.BoolVar(&opts.precomputeDigests, flagPrefix+"precompute-digests", false, "Precompute digests to prevent uploading layers already on the registry using the 'docker' transport.")
-	fs.BoolVar(&opts.forceCompressionFormat, flagPrefix+"force-compress-format", false, "Force exclusive use of the compression algorithm set in --dest-compress-format")
 	return fs, &opts
 }

@@ -333,7 +327,6 @@ func (opts *imageDestOptions) warnAboutIneffectiveOptions(destTransport types.Im
 type sharedCopyOptions struct {
 	removeSignatures         bool                      // Do not copy signatures from the source image
 	signByFingerprint        string                    // Sign the image using a GPG key with the specified fingerprint
-	signBySequoiaFingerprint string                    // Sign the image using a Sequoia-PGP key with the specified fingerprint
 	signBySigstoreParamFile  string                    // Sign the image using a sigstore signature per configuration in a param file
 	signBySigstorePrivateKey string                    // Sign the image using a sigstore private key
 	signPassphraseFile       string                    // Path pointing to a passphrase file when signing
@@ -347,7 +340,6 @@ func sharedCopyFlags() (pflag.FlagSet, *sharedCopyOptions) {
 	fs := pflag.FlagSet{}
 	fs.BoolVar(&opts.removeSignatures, "remove-signatures", false, "Do not copy signatures from source")
 	fs.StringVar(&opts.signByFingerprint, "sign-by", "", "Sign the image using a GPG key with the specified `FINGERPRINT`")
-	fs.StringVar(&opts.signBySequoiaFingerprint, "sign-by-sq-fingerprint", "", "Sign the image using a Sequoia-PGP key with the specified `FINGERPRINT`")
 	fs.StringVar(&opts.signBySigstoreParamFile, "sign-by-sigstore", "", "Sign the image using a sigstore parameter file at `PATH`")
 	fs.StringVar(&opts.signBySigstorePrivateKey, "sign-by-sigstore-private-key", "", "Sign the image using a sigstore private key at `PATH`")
 	fs.StringVar(&opts.signPassphraseFile, "sign-passphrase-file", "", "Read a passphrase for signing an image from `PATH`")
@@ -371,43 +363,25 @@ func (opts *sharedCopyOptions) copyOptions(stdout io.Writer) (*copy.Options, fun
 	// c/image/copy.Image does allow creating both simple signing and sigstore signatures simultaneously,
 	// with independent passphrases, but that would make the CLI probably too confusing.
 	// For now, use the passphrase with either, but only one of them.
-	if opts.signPassphraseFile != "" {
-		count := 0
-		if opts.signByFingerprint != "" {
-			count++
-		}
-		if opts.signBySequoiaFingerprint != "" {
-			count++
-		}
-		if opts.signBySigstorePrivateKey != "" {
-			count++
-		}
-		if count > 1 {
-			return nil, nil, fmt.Errorf("Only one of --sign-by, --sign-by-sq-fingerprint and --sign-by-sigstore-private-key can be used with --sign-passphrase-file")
-		}
+	if opts.signPassphraseFile != "" && opts.signByFingerprint != "" && opts.signBySigstorePrivateKey != "" {
+		return nil, nil, fmt.Errorf("Only one of --sign-by and sign-by-sigstore-private-key can be used with sign-passphrase-file")
 	}
-	// Simple signing does not really allow empty but present passphrases — but for sigstore, cosign does support creating keys encrypted with an empty passphrase;
-	// so, at least for that case, we must track the distinction between an empty and a missing passphrase precisely.
 	var passphrase string
-	passphraseSet := false
 	if opts.signPassphraseFile != "" {
 		p, err := cli.ReadPassphraseFile(opts.signPassphraseFile)
 		if err != nil {
 			return nil, nil, err
 		}
 		passphrase = p
-		passphraseSet = true
 	} else if opts.signBySigstorePrivateKey != "" {
 		p, err := promptForPassphrase(opts.signBySigstorePrivateKey, os.Stdin, os.Stdout)
 		if err != nil {
 			return nil, nil, err
 		}
 		passphrase = p
-		passphraseSet = true
 	} // opts.signByFingerprint triggers a GPG-agent passphrase prompt, possibly using a more secure channel, so we usually shouldn’t prompt ourselves if no passphrase was explicitly provided.
-	// With opts.signBySequoiaFingerprint, we don’t prompt for a passphrase (for now??): We don’t know whether the key requires a passphrase.
 	var passphraseBytes []byte
-	if passphraseSet {
+	if passphrase != "" {
 		passphraseBytes = []byte(passphrase)
 	}

@@ -436,19 +410,6 @@ func (opts *sharedCopyOptions) copyOptions(stdout io.Writer) (*copy.Options, fun
 		}
 		signers = append(signers, signer)
 	}
-	if opts.signBySequoiaFingerprint != "" {
-		sqOpts := []simplesequoia.Option{
-			simplesequoia.WithKeyFingerprint(opts.signBySequoiaFingerprint),
-		}
-		if passphraseSet {
-			sqOpts = append(sqOpts, simplesequoia.WithPassphrase(passphrase))
-		}
-		signer, err := simplesequoia.NewSigner(sqOpts...)
-		if err != nil {
-			return nil, nil, fmt.Errorf("Error using --sign-by-sq-fingerprint: %w", err)
-		}
-		signers = append(signers, signer)
-	}

 	succeeded = true
 	return &copy.Options{
--- a/cmd/skopeo/utils_nosequoia_test.go
+++ b/cmd/skopeo/utils_nosequoia_test.go
@@ -1,5 +0,0 @@
-//go:build !containers_image_sequoia
-
-package main
-
-const buildWithSequoia = false
--- a/cmd/skopeo/utils_sequoia_test.go
+++ b/cmd/skopeo/utils_sequoia_test.go
@@ -1,5 +0,0 @@
-//go:build containers_image_sequoia
-
-package main
-
-const buildWithSequoia = true
--- a/cmd/skopeo/utils_test.go
+++ b/cmd/skopeo/utils_test.go
@@ -4,17 +4,16 @@ import (
 	"bytes"
 	"errors"
 	"os"
-	"path/filepath"
 	"testing"

+	"github.com/containers/image/v5/copy"
+	"github.com/containers/image/v5/manifest"
+	"github.com/containers/image/v5/types"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.podman.io/image/v5/copy"
-	"go.podman.io/image/v5/manifest"
-	"go.podman.io/image/v5/types"
 )

 func TestNoteCloseFailure(t *testing.T) {
@@ -50,8 +49,7 @@ func fakeGlobalOptions(t *testing.T, flags []string) (*globalOptions, *cobra.Com

 // fakeImageOptions creates imageOptions and sets it according to globalFlags/cmdFlags.
 func fakeImageOptions(t *testing.T, flagPrefix string, useDeprecatedTLSVerify bool,
-	globalFlags []string, cmdFlags []string,
-) *imageOptions {
+	globalFlags []string, cmdFlags []string) *imageOptions {
 	globalOpts, cmd := fakeGlobalOptions(t, globalFlags)
 	sharedFlags, sharedOpts := sharedImageFlags()
 	var deprecatedTLSVerifyFlag pflag.FlagSet
@@ -126,8 +124,7 @@ func TestImageOptionsNewSystemContext(t *testing.T) {

 // fakeImageDestOptions creates imageDestOptions and sets it according to globalFlags/cmdFlags.
 func fakeImageDestOptions(t *testing.T, flagPrefix string, useDeprecatedTLSVerify bool,
-	globalFlags []string, cmdFlags []string,
-) *imageDestOptions {
+	globalFlags []string, cmdFlags []string) *imageDestOptions {
 	globalOpts, cmd := fakeGlobalOptions(t, globalFlags)
 	sharedFlags, sharedOpts := sharedImageFlags()
 	var deprecatedTLSVerifyFlag pflag.FlagSet
@@ -369,119 +366,77 @@ func fakeSharedCopyOptions(t *testing.T, cmdFlags []string) *sharedCopyOptions {
 func TestSharedCopyOptionsCopyOptions(t *testing.T) {
 	someStdout := bytes.Buffer{}

-	passphraseFile := filepath.Join(t.TempDir(), "passphrase") // Eventually we could refer to a passphrase fixture instead
-	err := os.WriteFile(passphraseFile, []byte("test-passphrase"), 0o600)
+	// Default state
+	opts := fakeSharedCopyOptions(t, []string{})
+	res, cleanup, err := opts.copyOptions(&someStdout)
 	require.NoError(t, err)
+	defer cleanup()
+	assert.Equal(t, &copy.Options{
+		ReportWriter: &someStdout,
+	}, res)

-	type tc struct {
-		options        []string
-		expected       copy.Options
-		expectedSigner bool
-	}
-	c := []tc{
-		{ // Default state
-			options: []string{},
-			expected: copy.Options{
-				ReportWriter: &someStdout,
-			},
-		},
-		// Set most flags to non-default values
-		// This should also test --sign-by-sigstore and --sign-by-sigstore-private-key; we would have
-		// to create test keys for that.
-		// This does not test --sign-by-sq-fingerprint, because that needs to be conditional based on buildWithSequoia.
-		{
-			options: []string{
-				"--remove-signatures",
-				"--sign-by", "gpgFingerprint",
-				"--format", "oci",
-				"--preserve-digests",
-			},
-			expected: copy.Options{
-				RemoveSignatures:      true,
-				SignBy:                "gpgFingerprint",
-				ReportWriter:          &someStdout,
-				PreserveDigests:       true,
-				ForceManifestMIMEType: imgspecv1.MediaTypeImageManifest,
-			},
-		},
-		{ // --sign-passphrase-file + --sign-by work
-			options: []string{
-				"--sign-by", "gpgFingerprint",
-				"--sign-passphrase-file", passphraseFile,
-			},
-			expected: copy.Options{
-				SignBy:                           "gpgFingerprint",
-				SignPassphrase:                   "test-passphrase",
-				SignSigstorePrivateKeyPassphrase: []byte("test-passphrase"),
-				ReportWriter:                     &someStdout,
-			},
-		},
-		{ // --sign-passphrase-file + --sign-by-sigstore-private-key work
-			options: []string{
-				"--sign-by-sigstore-private-key", "/some/key/path.private",
-				"--sign-passphrase-file", passphraseFile,
-			},
-			expected: copy.Options{
-				SignPassphrase:                   "test-passphrase",
-				SignBySigstorePrivateKeyFile:     "/some/key/path.private",
-				SignSigstorePrivateKeyPassphrase: []byte("test-passphrase"),
-				ReportWriter:                     &someStdout,
-			},
-		},
-		{ // --sign-passphrase-file + --sign-by-sigstore-private-key work with an empty passphrase
-			options: []string{
-				"--sign-by-sigstore-private-key", "/some/key/path.private",
-				"--sign-passphrase-file", "./fixtures/empty.passphrase",
-			},
-			expected: copy.Options{
-				SignPassphrase:                   "",
-				SignBySigstorePrivateKeyFile:     "/some/key/path.private",
-				SignSigstorePrivateKeyPassphrase: []byte(""),
-				ReportWriter:                     &someStdout,
-			},
-		},
-	}
-	// If Sequoia is supported, --sign-passphrase-file + --sign-by-sq-fingerprint work
-	if buildWithSequoia {
-		c = append(c, tc{
-			options: []string{
-				"--sign-by-sq-fingerprint", "sqFingerprint",
-				"--sign-passphrase-file", passphraseFile,
-			},
-			expected: copy.Options{
-				SignPassphrase:                   "test-passphrase",
-				SignSigstorePrivateKeyPassphrase: []byte("test-passphrase"),
-				ReportWriter:                     &someStdout,
-			},
-			expectedSigner: true,
-		})
-	}
-	for _, c := range c {
-		opts := fakeSharedCopyOptions(t, c.options)
-		res, cleanup, err := opts.copyOptions(&someStdout)
-		require.NoError(t, err)
-		defer cleanup()
-		if c.expectedSigner {
-			assert.NotNil(t, res.Signers)
-			res.Signers = nil // To allow the comparison below
-		}
-		assert.Equal(t, &c.expected, res)
-	}
+	// Set most flags to non-default values
+	// This should also test --sign-by-sigstore and --sign-by-sigstore-private-key; we would have
+	// to create test keys for that.
+	opts = fakeSharedCopyOptions(t, []string{
+		"--remove-signatures",
+		"--sign-by", "gpgFingerprint",
+		"--format", "oci",
+		"--preserve-digests",
+	})
+	res, cleanup, err = opts.copyOptions(&someStdout)
+	require.NoError(t, err)
+	defer cleanup()
+	assert.Equal(t, &copy.Options{
+		RemoveSignatures:      true,
+		SignBy:                "gpgFingerprint",
+		ReportWriter:          &someStdout,
+		PreserveDigests:       true,
+		ForceManifestMIMEType: imgspecv1.MediaTypeImageManifest,
+	}, res)

-	for _, opts := range [][]string{
-		{"--format", "invalid"}, // Invalid --format
-		// More --sign-by-sigstore-private-key, --sign-by-sigstore failure cases should be tested here.
-		// --sign-passphrase-file + more than one key option
-		{"--sign-by", "gpgFingerprint", "--sign-by-sq-fingerprint", "sqFingerprint", "--sign-passphrase-file", passphraseFile},
-		{"--sign-by", "gpgFingerprint", "--sign-by-sigstore-private-key", "sigstorePrivateKey", "--sign-passphrase-file", passphraseFile},
-		{"--sign-by-sq-fingerprint", "sqFingerprint", "--sign-by-sigstore-private-key", "sigstorePrivateKey", "--sign-passphrase-file", passphraseFile},
-		{"--sign-by", "gpgFingerprint", "--sign-passphrase-file", "/dev/null/this/does/not/exist"}, // --sign-passphrase-file not found
-		{"--sign-by-sigstore", "/dev/null/this/does/not/exist"},                                    // --sign-by-sigstore file not found
-	} {
-		opts := fakeSharedCopyOptions(t, opts)
-		_, _, err = opts.copyOptions(&someStdout)
-		assert.Error(t, err)
-	}
+	// --sign-passphrase-file + --sign-by work
+	passphraseFile, err := os.CreateTemp("", "passphrase") // Eventually we could refer to a passphrase fixture instead
+	require.NoError(t, err)
+	defer os.Remove(passphraseFile.Name())
+	_, err = passphraseFile.WriteString("test-passphrase")
+	require.NoError(t, err)
+	opts = fakeSharedCopyOptions(t, []string{
+		"--sign-by", "gpgFingerprint",
+		"--sign-passphrase-file", passphraseFile.Name(),
+	})
+	res, cleanup, err = opts.copyOptions(&someStdout)
+	require.NoError(t, err)
+	defer cleanup()
+	assert.Equal(t, &copy.Options{
+		SignBy:                           "gpgFingerprint",
+		SignPassphrase:                   "test-passphrase",
+		SignSigstorePrivateKeyPassphrase: []byte("test-passphrase"),
+		ReportWriter:                     &someStdout,
+	}, res)
+	// --sign-passphrase-file + --sign-by-sigstore-private-key should be tested here.
+
+	// Invalid --format
+	opts = fakeSharedCopyOptions(t, []string{"--format", "invalid"})
+	_, _, err = opts.copyOptions(&someStdout)
+	assert.Error(t, err)
+
+	// More --sign-passphrase-file, --sign-by-sigstore-private-key, --sign-by-sigstore failure cases should be tested here.
+
+	// --sign-passphrase-file not found
+	opts = fakeSharedCopyOptions(t, []string{
+		"--sign-by", "gpgFingerprint",
+		"--sign-passphrase-file", "/dev/null/this/does/not/exist",
+	})
+	_, _, err = opts.copyOptions(&someStdout)
+	assert.Error(t, err)
+
+	// --sign-by-sigstore file not found
+	opts = fakeSharedCopyOptions(t, []string{
+		"--sign-by-sigstore", "/dev/null/this/does/not/exist",
+	})
+	_, _, err = opts.copyOptions(&someStdout)
+	assert.Error(t, err)
 }

 func TestParseManifestFormat(t *testing.T) {
@@ -490,31 +445,21 @@ func TestParseManifestFormat(t *testing.T) {
 		expectedManifestType string
 		expectErr            bool
 	}{
-		{
-			"oci",
+		{"oci",
 			imgspecv1.MediaTypeImageManifest,
-			false,
-		},
-		{
-			"v2s1",
+			false},
+		{"v2s1",
 			manifest.DockerV2Schema1SignedMediaType,
-			false,
-		},
-		{
-			"v2s2",
+			false},
+		{"v2s2",
 			manifest.DockerV2Schema2MediaType,
-			false,
-		},
-		{
+			false},
+		{"",
 			"",
+			true},
+		{"badValue",
 			"",
-			true,
-		},
-		{
-			"badValue",
-			"",
-			true,
-		},
+			true},
 	} {
 		manifestType, err := parseManifestFormat(testCase.formatParam)
 		if testCase.expectErr {
@@ -535,37 +480,28 @@ func TestImageOptionsAuthfileOverride(t *testing.T) {
 		expectedAuthfilePath string
 	}{
 		// if there is no prefix, only authfile is allowed.
-		{
-			"",
+		{"",
 			[]string{
 				"--authfile", "/srv/authfile",
-			},
-			"/srv/authfile",
-		},
+			}, "/srv/authfile"},
 		// if authfile and dest-authfile is provided, dest-authfile wins
-		{
-			"dest-",
+		{"dest-",
 			[]string{
 				"--authfile", "/srv/authfile",
 				"--dest-authfile", "/srv/dest-authfile",
-			},
-			"/srv/dest-authfile",
+			}, "/srv/dest-authfile",
 		},
 		// if only the shared authfile is provided, authfile must be present in system context
-		{
-			"dest-",
+		{"dest-",
 			[]string{
 				"--authfile", "/srv/authfile",
-			},
-			"/srv/authfile",
+			}, "/srv/authfile",
 		},
 		// if only the dest authfile is provided, dest-authfile must be present in system context
-		{
-			"dest-",
+		{"dest-",
 			[]string{
 				"--dest-authfile", "/srv/dest-authfile",
-			},
-			"/srv/dest-authfile",
+			}, "/srv/dest-authfile",
 		},
 	} {
 		opts := fakeImageOptions(t, testCase.flagPrefix, false, []string{}, testCase.cmdFlags)
--- a/contrib/cirrus/runner.sh
+++ b/contrib/cirrus/runner.sh
@@ -71,8 +71,8 @@ _run_setup() {
    # automation, but the sources are in different directories.  It's
    # possible for a mismatch to happen, but should (hopefully) be unlikely.
    # Double-check to make sure.
-    if ! grep -Fqx "ID=$OS_RELEASE_ID" $mnt/etc/os-release || \
-       ! grep -Fqx "VERSION_ID=$OS_RELEASE_VER" $mnt/etc/os-release; then
+    if ! fgrep -qx "ID=$OS_RELEASE_ID" $mnt/etc/os-release || \
+       ! fgrep -qx "VERSION_ID=$OS_RELEASE_VER" $mnt/etc/os-release; then
            die "Somehow $SKOPEO_CIDEV_CONTAINER_FQIN is not based on $OS_REL_VER."
    fi
    msg "Copying test binaries from $SKOPEO_CIDEV_CONTAINER_FQIN /usr/local/bin/"
@@ -97,7 +97,7 @@ _run_vendor() {

 _run_build() {
    make bin/skopeo BUILDTAGS="$BUILDTAGS"
-    make install PREFIX=/usr/local BUILDTAGS="$BUILDTAGS"
+    make install PREFIX=/usr/local
 }

 _run_cross() {
--- a/docs/skopeo-copy.1.md
+++ b/docs/skopeo-copy.1.md
@@ -83,11 +83,8 @@ Options:
 - system: Copy only the image that matches the system architecture
 - all: Copy the full multi-architecture image
 - index-only: Copy only the index
- _platform-list_: Copy only specific platforms (comma-separated list of OS/Architecture pairs, e.g., `linux/amd64,linux/arm64`)

-The index-only option and platform-list both create sparse manifest lists, which usually fail unless the referenced per-architecture images are already present in the destination, or the target registry supports sparse indexes.
-
-When specifying a platform list, all compression variants and other variations for each platform are copied.
+The index-only option usually fails unless the referenced per-architecture images are already present in the destination, or the target registry supports sparse indexes.

 **--quiet**, **-q**

@@ -110,14 +107,9 @@ See containers-sigstore-signing-params.yaml(5) for details about the file format

 Add a sigstore signature using a private key at _path_ for an image name corresponding to _destination-image_

-**--sign-by-sq-fingerprint** _fingerprint_
-
-Add a “simple signing” signature using a Sequoia-PGP key with the specified _fingerprint_.
-
 **--sign-passphrase-file** _path_

-The passphrase to use when signing with `--sign-by`, `--sign-by-sigstore-private-key` or `--sign-by-sq-fingerprint`.
-Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.
+The passphare to use when signing with `--sign-by` or `--sign-by-sigstore-private-key`. Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.

 **--sign-identity** _reference_

@@ -199,10 +191,6 @@ and will be treated as `zstd` with a warning in that case.

 Specifies the compression level to use.  The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive), while for gzip it is 1-9 (inclusive).

-**--dest-force-compress-format**
-
-Ensures that the compression algorithm set in --dest-compress-format is used exclusively.
-
 **--src-registry-token** _token_

 Bearer token for accessing the source registry.
@@ -217,7 +205,7 @@ Precompute digests to ensure layers are not uploaded that already exist on the d

 **--retry-times**

-The number of times to retry. By default, no retries are attempted.
+The number of times to retry.

 **--retry-delay**

@@ -270,11 +258,6 @@ To copy and sign an image:
 $ skopeo copy --sign-by dev@example.com containers-storage:example/busybox:streaming docker://example/busybox:gold
 ```

-To copy only specific platforms from a multi-architecture image (creates a sparse manifest list):
-```console
-$ skopeo copy --multi-arch=linux/amd64,linux/arm64 docker://quay.io/skopeo/stable:latest docker://registry.example.com/skopeo:latest
-```
-
 To encrypt an image:
 ```console
 $ skopeo copy docker://docker.io/library/nginx:1.17.8 oci:local_nginx:1.17.8
--- a/docs/skopeo-delete.1.md
+++ b/docs/skopeo-delete.1.md
@@ -70,7 +70,7 @@ Bearer token for accessing the registry.

 **--retry-times**

-The number of times to retry. By default, no retries are attempted.
+The number of times to retry.

 **--retry-delay**

--- a/docs/skopeo-inspect.1.md
+++ b/docs/skopeo-inspect.1.md
@@ -69,7 +69,7 @@ Registry token for accessing the registry.

 **--retry-times**

-The number of times to retry. By default, no retries are attempted.
+The number of times to retry.

 **--retry-delay**

@@ -95,12 +95,6 @@ The password to access the registry.

 Do not list the available tags from the repository in the output. When `true`, the `RepoTags` array will be empty.  Defaults to `false`, which includes all available tags.

-**--manifest-digest**=_algorithm_ **EXPERIMENTAL**
-
-Algorithm to use for computing manifest digest (sha256, sha512); defaults to algorithm used in config digest.
-
-**Note:** This flag is experimental and its behavior may change in future releases.
-
 ## EXAMPLES

 To review information for the image fedora from the docker.io registry:
@@ -192,12 +186,6 @@ $ /bin/skopeo inspect --format '{{ .Env }}' docker://registry.access.redhat.com/
 [PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin container=oci]
 ```

-To get the digest using a specific algorithm:
-```console
-$ skopeo inspect --manifest-digest=sha512 docker://docker.io/library/alpine:latest --format "Digest: {{.Digest}}"
-Digest: sha512:5acb33fb56a7791bf0c69d5b19a1c70272148e4107be5261d57305d14e9509792bbca53e5277c456181ecfa1c20ad8427f9b8ba46868020584a819de1128dbd2
-```
-
 # SEE ALSO
 skopeo(1), skopeo-login(1), docker-login(1), containers-auth.json(5)

--- a/docs/skopeo-list-tags.1.md
+++ b/docs/skopeo-list-tags.1.md
@@ -43,7 +43,7 @@ Bearer token for accessing the registry.

 **--retry-times**

-The number of times to retry. By default, no retries are attempted.
+The number of times to retry.

 **--retry-delay**

--- a/docs/skopeo-sync.1.md
+++ b/docs/skopeo-sync.1.md
@@ -103,14 +103,9 @@ See containers-sigstore-signing-params.yaml(5) for details about the file format

 Add a sigstore signature using a private key at _path_ for an image name corresponding to _destination-image_

-**--sign-by-sq-fingerprint** _fingerprint_
-
-Add a “simple signing” signature using a Sequoia-PGP key with the specified _fingerprint_.
-
 **--sign-passphrase-file** _path_

-The passphrase to use when signing with `--sign-by`, `--sign-by-sigstore-private-key` or `--sign-by-sq-fingerprint`.
-Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.
+The passphare to use when signing with `--sign-by` or `--sign-by-sigstore-private-key`. Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.

 **--src-creds** _username[:password]_ for accessing the source registry.

@@ -134,7 +129,7 @@ Only the first line will be read. A passphrase stored in a file is of questionab

 **--retry-times**

-The number of times to retry. By default, no retries are attempted.
+The number of times to retry.

 **--retry-delay**

--- a/docs/skopeo.1.md
+++ b/docs/skopeo.1.md
@@ -92,27 +92,10 @@ Path to a policy.json file to use for verifying signatures and deciding whether

 Use registry configuration files in _dir_ (e.g. for container signature storage), overriding the default path.

-**--require-signed**
-
-Require that any pulled image must be signed regardless of what the default or provided trust policy file says.
-
-**--tls-details** _path_
-
-Path to a containers-tls-details(5) file, affecting TLS behavior throughout the program.
-
-If not set, defaults to a reasonable default that may change over time (depending on system’s global policy,
-version of the program, version of the Go language, and the like).
-
-Users should generally not use this option unless they have a process to ensure that the configuration will be kept up to date.
-
 **--tmpdir** _dir_

 Directory used to store temporary files. Defaults to /var/tmp.

-**--user-agent-prefix** _prefix_
-
-Prefix to add to the user agent string. The resulting user agent will be in the format "_prefix_ skopeo/_version_".
-
 **--version**, **-v**

 Print the version number
--- a/go.mod
+++ b/go.mod
@@ -1,57 +1,60 @@
-module go.podman.io/skopeo
+module github.com/containers/skopeo

 // Minimum required golang version
-go 1.25.6
+go 1.24.0

 // Warning: Ensure the "go" and "toolchain" versions match exactly to prevent unwanted auto-updates

 require (
-	github.com/Masterminds/semver/v3 v3.5.0
-	github.com/containers/ocicrypt v1.3.0
+	github.com/Masterminds/semver/v3 v3.4.0
+	github.com/containers/common v0.64.0
+	github.com/containers/image/v5 v5.36.0
+	github.com/containers/ocicrypt v1.2.1
+	github.com/containers/storage v1.59.0
 	github.com/docker/distribution v2.8.3+incompatible
 	github.com/moby/sys/capability v0.4.0
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec v1.1.2-0.20260226102121-a4c6ade7bb82
+	github.com/opencontainers/image-spec v1.1.2-0.20250724175814-2daaaaf0e7c1
 	github.com/opencontainers/image-tools v1.0.0-rc3
-	github.com/sirupsen/logrus v1.9.4
-	github.com/spf13/cobra v1.10.2
-	github.com/spf13/pflag v1.0.10
-	github.com/stretchr/testify v1.11.1
-	go.podman.io/common v0.68.0
-	go.podman.io/image/v5 v5.40.0
-	go.podman.io/storage v1.63.0
-	golang.org/x/term v0.43.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/cobra v1.9.1
+	github.com/spf13/pflag v1.0.7
+	github.com/stretchr/testify v1.10.0
+	golang.org/x/term v0.33.0
 	gopkg.in/yaml.v3 v3.0.1
 )

 require (
-	cyphar.com/go-pathrs v0.2.4 // indirect
 	dario.cat/mergo v1.0.2 // indirect
-	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/Microsoft/hcsshim v0.13.0 // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/containerd/cgroups/v3 v3.0.5 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
+	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
-	github.com/coreos/go-oidc/v3 v3.17.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.14.1 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
-	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/docker-credential-helpers v0.9.7 // indirect
-	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/docker v28.3.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/go-containerregistry v0.21.1 // indirect
+	github.com/google/go-containerregistry v0.20.3 // indirect
 	github.com/google/go-intervals v0.0.2 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
@@ -60,51 +63,54 @@ require (
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/mattn/go-runewidth v0.0.23 // indirect
-	github.com/mattn/go-sqlite3 v1.14.44 // indirect
+	github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-sqlite3 v1.14.28 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
-	github.com/mistifyio/go-zfs/v4 v4.0.0 // indirect
+	github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/moby/api v1.54.2 // indirect
-	github.com/moby/moby/client v0.4.1 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/opencontainers/image-spec/schema v0.0.0-20250717171153-ab80ff15c2dd // indirect
-	github.com/opencontainers/runtime-spec v1.3.0 // indirect
-	github.com/opencontainers/selinux v1.14.1 // indirect
-	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/opencontainers/runtime-spec v1.2.1 // indirect
+	github.com/opencontainers/selinux v1.12.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/proglottis/gpgme v0.1.6 // indirect
+	github.com/proglottis/gpgme v0.1.4 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
-	github.com/sigstore/fulcio v1.8.5 // indirect
-	github.com/sigstore/protobuf-specs v0.5.0 // indirect
-	github.com/sigstore/sigstore v1.10.6 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
+	github.com/segmentio/ksuid v1.0.4 // indirect
+	github.com/sigstore/fulcio v1.6.6 // indirect
+	github.com/sigstore/protobuf-specs v0.4.1 // indirect
+	github.com/sigstore/sigstore v1.9.5 // indirect
+	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/smallstep/pkcs7 v0.1.1 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
-	github.com/sylabs/sif/v2 v2.24.0 // indirect
+	github.com/sylabs/sif/v2 v2.21.1 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
-	github.com/vbatts/tar-split v0.12.3 // indirect
-	github.com/vbauerster/mpb/v8 v8.12.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
-	golang.org/x/net v0.54.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
-	google.golang.org/grpc v1.80.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
+	github.com/vbatts/tar-split v0.12.1 // indirect
+	github.com/vbauerster/mpb/v8 v8.10.2 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
+	google.golang.org/grpc v1.72.2 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -1,38 +1,59 @@
-cyphar.com/go-pathrs v0.2.4 h1:iD/mge36swa1UFKdINkr1Frkpp6wZsy3YYEildj9cLY=
-cyphar.com/go-pathrs v0.2.4/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
-github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
-github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/Microsoft/hcsshim v0.13.0 h1:/BcXOiS6Qi7N9XqUcv27vkIuVOkBEcWstd2pMlWSeaA=
+github.com/Microsoft/hcsshim v0.13.0/go.mod h1:9KWJ/8DgU+QzYGupX4tzMhRQE8h6w90lH6HAaclpEok=
 github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
 github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
-github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=
+github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
-github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
-github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
+github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
+github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
+github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
+github.com/containers/common v0.64.0 h1:Jdjq1e5tqrLov9tcAVc/AfvQCgX4krhcfDBgOXwrSfw=
+github.com/containers/common v0.64.0/go.mod h1:bq2UIiFP8vUJdgM+WN8E8jkD7wF69SpDRGzU7epJljg=
+github.com/containers/image/v5 v5.36.0 h1:Zh+xFcLjRmicnOT5AFPHH/xj+e3s9ojDN/9X2Kx1+Jo=
+github.com/containers/image/v5 v5.36.0/go.mod h1:VZ6cyDHbxZoOt4dklUJ+WNEH9FrgSgfH3qUBYKFlcT0=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
-github.com/containers/ocicrypt v1.3.0 h1:ps3St6ZWNWhOQ/Kqld6K2wPHt01Mj3AqRTNCZLIWOfo=
-github.com/containers/ocicrypt v1.3.0/go.mod h1:PmfuGFpBwnGLnbqBm+QIy2nc8noDJ1Wt6B19la7VBFo=
-github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
-github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
+github.com/containers/ocicrypt v1.2.1 h1:0qIOTT9DoYwcKmxSt8QJt+VzMY18onl9jUXsxpVhSmM=
+github.com/containers/ocicrypt v1.2.1/go.mod h1:aD0AAqfMp0MtwqWgHM1bUwe1anx0VazI108CRrSKINQ=
+github.com/containers/storage v1.59.0 h1:r2pYSTzQpJTROZbjJQ54Z0GT+rUC6+wHzlSY8yPjsXk=
+github.com/containers/storage v1.59.0/go.mod h1:KoAYHnAjP3/cTsRS+mmWZGkufSY2GACiKQ4V3ZLQnR0=
+github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
+github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
 github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
-github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
-github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
+github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
+github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -41,21 +62,29 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/cli v29.5.1+incompatible h1:NiufLAJoRcPauFoBNYthfuM4REFwM8H2h9xnLABNHGs=
-github.com/docker/cli v29.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.3.2+incompatible h1:mOt9fcLE7zaACbxW1GeS65RI67wIJrTnqS3hP2huFsY=
+github.com/docker/cli v28.3.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker-credential-helpers v0.9.7 h1:jaPIxEIDz5bQeghNAdzz0ETwMMnM4vzjZlxz3pWP4JA=
-github.com/docker/docker-credential-helpers v0.9.7/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
-github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
+github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
@@ -69,24 +98,51 @@ github.com/go-rod/rod v0.116.2 h1:A5t2Ky2A+5eD/ZJQr1EfsQSe5rms5Xof/qj296e+ZqA=
 github.com/go-rod/rod v0.116.2/go.mod h1:H+CMO9SCNc2TJ2WfrG+pKhITz57uGNYU43qYHh438Mg=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.1 h1:sOt/o9BS2b87FnR7wxXPvRKU1XVJn2QCwOS5g8zQXlc=
-github.com/google/go-containerregistry v0.21.1/go.mod h1:ctO5aCaewH4AK1AumSF5DPW+0+R+d2FmylMJdp5G7p0=
+github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
+github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
 github.com/google/go-intervals v0.0.2 h1:FGrVEiUnTRKR8yE04qzXYaJMtnIYqobR5QbblK3ixcM=
 github.com/google/go-intervals v0.0.2/go.mod h1:MkaR3LNRfeKLPmqgJYs4E66z5InYjmCjbbr4TQlcT6Y=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 h1:VNqngBF40hVlDloBruUehVYC3ArSgIyScOAyMRqBxRg=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1/go.mod h1:RBRO7fro65R6tjKzYgLAFo0t1QEXY1Dp+i/bvpRiqiQ=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
@@ -97,11 +153,15 @@ github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVU
 github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jmhodges/clock v1.2.0 h1:eq4kys+NI0PLngzaHEe7AmPT90XMGIEySD1JfV1PDIs=
+github.com/jmhodges/clock v1.2.0/go.mod h1:qKjhA7x7u/lQpPB1XAqX1b1lCI/w3/fNuYpI/ZjLynI=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -109,105 +169,134 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec h1:2tTW6cDth2TSgRbAhD7yjZzTQmcN25sDRPEeinR51yQ=
+github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec/go.mod h1:TmwEoGCwIti7BCeJ9hescZgRtatxRE+A72pCoPfmcfk=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
-github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-sqlite3 v1.14.44 h1:3VSe+xafpbzsLbdr2AWlAZk9yRHiBhTBakioXaCKTF8=
-github.com/mattn/go-sqlite3 v1.14.44/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
+github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
-github.com/mistifyio/go-zfs/v4 v4.0.0 h1:sU0+5dX45tdDK5xNZ3HBi95nxUc48FS92qbIZEvpAg4=
-github.com/mistifyio/go-zfs/v4 v4.0.0/go.mod h1:weotFtXTHvBwhr9Mv96KYnDkTPBOHFUbm9cBmQpesL0=
+github.com/mistifyio/go-zfs/v3 v3.0.1 h1:YaoXgBePoMA12+S1u/ddkv+QqxcfiZK4prI6HPnkFiU=
+github.com/mistifyio/go-zfs/v3 v3.0.1/go.mod h1:CzVgeB0RvF2EGzQnytKVvVSDwmKJXxkOTUGbNrTja/k=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
-github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
+github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
+github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
 github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/onsi/ginkgo/v2 v2.29.0 h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=
-github.com/onsi/ginkgo/v2 v2.29.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
-github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
+github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
+github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
+github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.2-0.20260226102121-a4c6ade7bb82 h1:E+Fkd2gXu1H0wGsF/81ghtqacuzl+OkuS4rEnGOsTCw=
-github.com/opencontainers/image-spec v1.1.2-0.20260226102121-a4c6ade7bb82/go.mod h1:GRy5q9c6/vsqXmQ1I6TL1PkhA64F6eXG9fUOQ9tFvm8=
+github.com/opencontainers/image-spec v1.1.2-0.20250724175814-2daaaaf0e7c1 h1:4Fo/qGEjjR6Ugeqb0Ldokiy/VYG4669QIlD0+ZN3jQg=
+github.com/opencontainers/image-spec v1.1.2-0.20250724175814-2daaaaf0e7c1/go.mod h1:GRy5q9c6/vsqXmQ1I6TL1PkhA64F6eXG9fUOQ9tFvm8=
 github.com/opencontainers/image-spec/schema v0.0.0-20250717171153-ab80ff15c2dd h1:demTtfPH+DsqagnumQZv8nQrFoUqCJDNVrw+6LsGpm4=
 github.com/opencontainers/image-spec/schema v0.0.0-20250717171153-ab80ff15c2dd/go.mod h1:vPOv9cXqxB6ycHY5iVwqL4rkYbwRh46GZj13CfkZ6As=
 github.com/opencontainers/image-tools v1.0.0-rc3 h1:ZR837lBIxq6mmwEqfYrbLMuf75eBSHhccVHy6lsBeM4=
 github.com/opencontainers/image-tools v1.0.0-rc3/go.mod h1:A9btVpZLzttF4iFaKNychhPyrhfOjJ1OF5KrA8GcLj4=
-github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
-github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/selinux v1.14.1 h1:a7XlXV/nN/l5zFP1FWZYoExpClu1QOPMfWUV2CZ8kEQ=
-github.com/opencontainers/selinux v1.14.1/go.mod h1:LenyElirjUHszfxrjuFqC85HIeXZKumHcKMQtnaDlQQ=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
+github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
+github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/proglottis/gpgme v0.1.6 h1:8WpQ8VWggLdxkuTnW+sZ1r1t92XBNd8GZNDhQ4Rz+98=
-github.com/proglottis/gpgme v0.1.6/go.mod h1:5LoXMgpE4bttgwwdv9bLs/vwqv3qV7F4glEEZ7mRKrM=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/proglottis/gpgme v0.1.4 h1:3nE7YNA70o2aLjcg63tXMOhPD7bplfE5CBdV+hLAm2M=
+github.com/proglottis/gpgme v0.1.4/go.mod h1:5LoXMgpE4bttgwwdv9bLs/vwqv3qV7F4glEEZ7mRKrM=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
-github.com/sebdah/goldie/v2 v2.8.0 h1:dZb9wR8q5++oplmEiJT+U/5KyotVD+HNGCAc5gNr8rc=
-github.com/sebdah/goldie/v2 v2.8.0/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
-github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGvPLoKZLv9YvwPYVr0473BdtFs=
-github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q=
-github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
-github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/sigstore/fulcio v1.8.5 h1:HYTD1/L5wlBp8JxsWxUf8hmfaNBBF/x3r3p5l6tZwbA=
-github.com/sigstore/fulcio v1.8.5/go.mod h1:tSLYK3JsKvJpDW1BsIsVHZgHj+f8TjXARzqIUWSsSPQ=
-github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
-github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
-github.com/sigstore/sigstore v1.10.6 h1:YWhMQfTrJSK80QB1pbxjYeAwGKx+5UwWPPAY9hrPPZg=
-github.com/sigstore/sigstore v1.10.6/go.mod h1:k/mcVVXw3I87dYG/iCVTSW2xTrW7vPzxxGic4KqsqXs=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sebdah/goldie/v2 v2.5.5 h1:rx1mwF95RxZ3/83sdS4Yp7t2C5TCokvWP4TBRbAyEWY=
+github.com/sebdah/goldie/v2 v2.5.5/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
+github.com/secure-systems-lab/go-securesystemslib v0.9.0 h1:rf1HIbL64nUpEIZnjLZ3mcNEL9NBPB0iuVjyxvq3LZc=
+github.com/secure-systems-lab/go-securesystemslib v0.9.0/go.mod h1:DVHKMcZ+V4/woA/peqr+L0joiRXbPpQ042GgJckkFgw=
+github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
+github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/sigstore/fulcio v1.6.6 h1:XaMYX6TNT+8n7Npe8D94nyZ7/ERjEsNGFC+REdi/wzw=
+github.com/sigstore/fulcio v1.6.6/go.mod h1:BhQ22lwaebDgIxVBEYOOqLRcN5+xOV+C9bh/GUXRhOk=
+github.com/sigstore/protobuf-specs v0.4.1 h1:5SsMqZbdkcO/DNHudaxuCUEjj6x29tS2Xby1BxGU7Zc=
+github.com/sigstore/protobuf-specs v0.4.1/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
+github.com/sigstore/sigstore v1.9.5 h1:Wm1LT9yF4LhQdEMy5A2JeGRHTrAWGjT3ubE5JUSrGVU=
+github.com/sigstore/sigstore v1.9.5/go.mod h1:VtxgvGqCmEZN9X2zhFSOkfXxvKUjpy8RpUW39oCtoII=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
+github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/smallstep/pkcs7 v0.1.1 h1:x+rPdt2W088V9Vkjho4KtoggyktZJlMduZAtRHm68LU=
 github.com/smallstep/pkcs7 v0.1.1/go.mod h1:dL6j5AIz9GHjVEBTXtW+QliALcgM19RtXaTeyxI+AfA=
-github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
-github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6/go.mod h1:39R/xuhNgVhi+K0/zst4TLrJrVmbm6LVgl4A0+ZFS5M=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/sylabs/sif/v2 v2.24.0 h1:1wB5uMDUQYjk8AckTySaDcP9YnpMb1LyDRr1Jt9A10w=
-github.com/sylabs/sif/v2 v2.24.0/go.mod h1:DbXWqWZ1hdLSU+K9ipdds5AmZeHWsyxCOj/oQakBa88=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/sylabs/sif/v2 v2.21.1 h1:GZ0b5//AFAqJEChd8wHV/uSKx/l1iuGYwjR8nx+4wPI=
+github.com/sylabs/sif/v2 v2.21.1/go.mod h1:YoqEGQnb5x/ItV653bawXHZJOXQaEWpGwHsSD3YePJI=
 github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=
 github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
+github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
+github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
-github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/vbatts/tar-split v0.12.3 h1:Cd46rkGXI3Td4yrVNwU8ripbxFaQbmesqhjBUUYAJSw=
-github.com/vbatts/tar-split v0.12.3/go.mod h1:sQOc6OlqGCr7HkGx/IDBeKiTIvqhmj8KffNhEXG4Nq0=
-github.com/vbauerster/mpb/v8 v8.12.0 h1:+gneY3ifzc88tKDzOtfG8k8gfngCx615S2ZmFM4liWg=
-github.com/vbauerster/mpb/v8 v8.12.0/go.mod h1:V02YIuMVo301Y1VE9VtZlD8s84OMsk+EKN6mwvf/588=
+github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
+github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
+github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+github.com/vbauerster/mpb/v8 v8.10.2 h1:2uBykSHAYHekE11YvJhKxYmLATKHAGorZwFlyNw4hHM=
+github.com/vbauerster/mpb/v8 v8.10.2/go.mod h1:+Ja4P92E3/CorSZgfDtK46D7AVbDqmBQRTmyTqPElo0=
 github.com/ysmood/fetchup v0.2.3 h1:ulX+SonA0Vma5zUFXtv52Kzip/xe7aj4vqT5AJwQ+ZQ=
 github.com/ysmood/fetchup v0.2.3/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns=
 github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ=
@@ -218,45 +307,63 @@ github.com/ysmood/gson v0.7.3 h1:QFkWbTH8MxyUTKPkVWAENJhxqdBa4lYTQWqZCiLG6kE=
 github.com/ysmood/gson v0.7.3/go.mod h1:3Kzs5zDl21g5F/BlLTNcuAGAYLKt2lV5G8D1zF3RNmg=
 github.com/ysmood/leakless v0.9.0 h1:qxCG5VirSBvmi3uynXFkcnLMzkphdh3xx5FtrORwDCU=
 github.com/ysmood/leakless v0.9.0/go.mod h1:R8iAXPRaG97QJwqxs74RdwzcRHT1SWCGTNqY8q0JvMQ=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-go.podman.io/common v0.68.0 h1:6V8nZS33vLTPC047RfSGxARgS/Ui6CQtgdZXLo18qAc=
-go.podman.io/common v0.68.0/go.mod h1:zVzufHkRpLueF6NW6N+fAs1C2METdzYcfD9zuw+oJKA=
-go.podman.io/image/v5 v5.40.0 h1:gNQvj343Eb4juCitUBkuDz1T82Zpp6nhgMEXzNfCges=
-go.podman.io/image/v5 v5.40.0/go.mod h1:qgXf1abXJ+2l01pL8+CljaMKryeo6ahaHO7H51ooKIc=
-go.podman.io/storage v1.63.0 h1:bj/pAWFhChbuBmejzno0iQLhU7FevGVXepRXm5pFGeA=
-go.podman.io/storage v1.63.0/go.mod h1:z4Z9K+7GhKjWL/Y1O17+4f8a1KGijVeC9hr3tymhSOs=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 h1:IJFEoHiytixx8cMiVAO+GmHR6Frwu+u5Ur8njpFO6Ac=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0/go.mod h1:3rHrKNtLIoS0oZwkY2vxi+oJcwFRWdtUyRII+so45p8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
@@ -264,33 +371,41 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -300,8 +415,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
+golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -311,34 +426,62 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
-gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 h1:iK2jbkWL86DXjEx0qiHcRE9dE4/Ahua5k6V8OWFb//c=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.72.2 h1:TdbGzwb82ty4OusHWepvFWGLgIbNo1/SUynEN0ssqv8=
+google.golang.org/grpc v1.72.2/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
-pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
--- a/hack/get_ci_vm.sh
+++ b/hack/get_ci_vm.sh
@@ -29,7 +29,7 @@ in_get_ci_vm() {
 if [[ "$1" == "--config" ]]; then
    in_get_ci_vm "$1"
    cat <<EOF
-DESTDIR="/var/tmp/go/src/go.podman.io/skopeo"
+DESTDIR="/var/tmp/go/src/github.com/containers/skopeo"
 UPSTREAM_REPO="https://github.com/containers/skopeo.git"
 GCLOUD_PROJECT="skopeo"
 GCLOUD_IMGPROJECT="libpod-218412"
--- a/hack/test-integration.sh
+++ b/hack/test-integration.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+set -e
+
+make PREFIX=/usr install
+
+echo "cd ./integration;" go test "$@" ${BUILDTAGS:+-tags "$BUILDTAGS"}
+cd ./integration
+go test "$@" ${BUILDTAGS:+-tags "$BUILDTAGS"}
--- a/hack/test-system.sh
+++ b/hack/test-system.sh
@@ -37,4 +37,8 @@ EOF
    export CONTAINERS_STORAGE_CONF=/etc/containers/storage.conf
 fi

-bats --tap systemtest
+# Build skopeo, install into /usr/bin
+make PREFIX=/usr install "$@"
+
+# Run tests
+SKOPEO_BINARY=/usr/bin/skopeo bats --tap systemtest
--- a/hack/validate-gofmt.sh
+++ b/hack/validate-gofmt.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+IFS=$'\n'
+files=( $(find . -name '*.go' | grep -v '^./vendor/' | sort || true) )
+unset IFS
+
+badFiles=()
+for f in "${files[@]}"; do
+	if [ "$(gofmt -s -l < $f)" ]; then
+		badFiles+=( "$f" )
+	fi
+done
+
+if [ ${#badFiles[@]} -eq 0 ]; then
+	echo 'Congratulations!  All Go source files are properly formatted.'
+else
+	{
+		echo "These files are not properly gofmt'd:"
+		for f in "${badFiles[@]}"; do
+			echo " - $f"
+		done
+		echo
+		echo 'Please reformat the above files using "gofmt -s -w" and commit the result.'
+		echo
+	} >&2
+	exit 1
+fi
--- a/install.md
+++ b/install.md
@@ -183,8 +183,8 @@ sudo pacman -S base-devel gpgme btrfs-progs
 Make sure to clone this repository in your `GOPATH` - otherwise compilation fails.

 ```bash
-git clone https://github.com/containers/skopeo $GOPATH/src/go.podman.io/skopeo
-cd $GOPATH/src/go.podman.io/skopeo && make bin/skopeo
+git clone https://github.com/containers/skopeo $GOPATH/src/github.com/containers/skopeo
+cd $GOPATH/src/github.com/containers/skopeo && make bin/skopeo
 ```

 By default the `make` command (make all) will build bin/skopeo and the documentation locally.
--- a/integration/blocked_test.go
+++ b/integration/blocked_test.go
@@ -1,9 +1,7 @@
 package main

-const (
-	blockedRegistriesConf = "./fixtures/blocked-registries.conf"
-	blockedErrorRegex     = `.*registry registry-blocked.com is blocked in .*`
-)
+const blockedRegistriesConf = "./fixtures/blocked-registries.conf"
+const blockedErrorRegex = `.*registry registry-blocked.com is blocked in .*`

 func (s *skopeoSuite) TestCopyBlockedSource() {
 	t := s.T()
--- a/integration/check_test.go
+++ b/integration/check_test.go
@@ -5,10 +5,10 @@ import (
 	"os/exec"
 	"testing"

+	"github.com/containers/skopeo/version"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
-	"go.podman.io/skopeo/version"
 )

 const (
@@ -26,17 +26,15 @@ type skopeoSuite struct {
 	regV2WithAuth *testRegistryV2
 }

-var (
-	_ = suite.SetupAllSuite(&skopeoSuite{})
-	_ = suite.TearDownAllSuite(&skopeoSuite{})
-)
+var _ = suite.SetupAllSuite(&skopeoSuite{})
+var _ = suite.TearDownAllSuite(&skopeoSuite{})

 func (s *skopeoSuite) SetupSuite() {
 	t := s.T()
 	_, err := exec.LookPath(skopeoBinary)
 	require.NoError(t, err)
-	s.regV2 = setupRegistryV2At(t, privateRegistryURL0, false, registryVersionModern)
-	s.regV2WithAuth = setupRegistryV2At(t, privateRegistryURL1, true, registryVersionModern)
+	s.regV2 = setupRegistryV2At(t, privateRegistryURL0, false, false)
+	s.regV2WithAuth = setupRegistryV2At(t, privateRegistryURL1, true, false)
 }

 func (s *skopeoSuite) TearDownSuite() {
@@ -52,7 +50,7 @@ func (s *skopeoSuite) TearDownSuite() {

 func (s *skopeoSuite) TestVersion() {
 	t := s.T()
-	assertSkopeoSucceeds(t, fmt.Sprintf(".*skopeo version %s.*", version.Version),
+	assertSkopeoSucceeds(t, fmt.Sprintf(".*%s version %s.*", skopeoBinary, version.Version),
 		"--version")
 }

--- a/integration/copy_test.go
+++ b/integration/copy_test.go
@@ -12,30 +12,27 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"

+	"github.com/containers/image/v5/manifest"
+	"github.com/containers/image/v5/signature"
+	"github.com/containers/image/v5/types"
 	digest "github.com/opencontainers/go-digest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/opencontainers/image-tools/image"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
-	"go.podman.io/image/v5/manifest"
-	"go.podman.io/image/v5/signature"
-	"go.podman.io/image/v5/signature/simplesequoia"
-	"go.podman.io/image/v5/types"
 )

 const (
-	v2DockerRegistryURL            = "localhost:5555" // Update also policy.json
-	v2s1OnlyDockerRegistryURL      = "localhost:5556"
-	v2s1SupportedDockerRegistryURL = "localhost:5557"
-	knownWindowsOnlyImage          = "docker://mcr.microsoft.com/windows/nanoserver:1909"
-	knownListImageRepo             = "docker://registry.fedoraproject.org/fedora-minimal"
-	knownListImage                 = knownListImageRepo + ":38"
+	v2DockerRegistryURL   = "localhost:5555" // Update also policy.json
+	v2s1DockerRegistryURL = "localhost:5556"
+	knownWindowsOnlyImage = "docker://mcr.microsoft.com/windows/nanoserver:1909"
+	knownListImageRepo    = "docker://registry.fedoraproject.org/fedora-minimal"
+	knownListImage        = knownListImageRepo + ":38"
 )

 func TestCopy(t *testing.T) {
@@ -44,18 +41,14 @@ func TestCopy(t *testing.T) {

 type copySuite struct {
 	suite.Suite
-	cluster             *openshiftCluster
-	registry            *testRegistryV2
-	s1OnlyRegistry      *testRegistryV2
-	s1SupportedRegistry *testRegistryV2
-	gpgHome             string
-	fingerprint         string
+	cluster    *openshiftCluster
+	registry   *testRegistryV2
+	s1Registry *testRegistryV2
+	gpgHome    string
 }

-var (
-	_ = suite.SetupAllSuite(&copySuite{})
-	_ = suite.TearDownAllSuite(&copySuite{})
-)
+var _ = suite.SetupAllSuite(&copySuite{})
+var _ = suite.TearDownAllSuite(&copySuite{})

 func (s *copySuite) SetupSuite() {
 	t := s.T()
@@ -78,9 +71,8 @@ func (s *copySuite) SetupSuite() {
 	}

 	// FIXME: Set up TLS for the docker registry port instead of using "--tls-verify=false" all over the place.
-	s.registry = setupRegistryV2At(t, v2DockerRegistryURL, false, registryVersionModern)
-	s.s1OnlyRegistry = setupRegistryV2At(t, v2s1OnlyDockerRegistryURL, false, registryVersionSchema1Only)
-	s.s1SupportedRegistry = setupRegistryV2At(t, v2s1SupportedDockerRegistryURL, false, registryVersionSchema1Supported)
+	s.registry = setupRegistryV2At(t, v2DockerRegistryURL, false, false)
+	s.s1Registry = setupRegistryV2At(t, v2s1DockerRegistryURL, false, true)

 	s.gpgHome = t.TempDir()
 	t.Setenv("GNUPGHOME", s.gpgHome)
@@ -92,15 +84,9 @@ func (s *copySuite) SetupSuite() {

 		out := combinedOutputOfCommand(t, gpgBinary, "--armor", "--export", fmt.Sprintf("%s@example.com", key))
 		err := os.WriteFile(filepath.Join(s.gpgHome, fmt.Sprintf("%s-pubkey.gpg", key)),
-			[]byte(out), 0o600)
+			[]byte(out), 0600)
 		require.NoError(t, err)
 	}
-
-	// Get fingerprint for the personal key (used by some tests)
-	lines, err := exec.Command(gpgBinary, "--homedir", s.gpgHome, "--with-colons", "--no-permission-warning", "--fingerprint", "personal@example.com").Output()
-	require.NoError(t, err)
-	s.fingerprint, err = findFingerprint(lines)
-	require.NoError(t, err)
 }

 func (s *copySuite) TearDownSuite() {
@@ -108,11 +94,8 @@ func (s *copySuite) TearDownSuite() {
 	if s.registry != nil {
 		s.registry.tearDown()
 	}
-	if s.s1OnlyRegistry != nil {
-		s.s1OnlyRegistry.tearDown()
-	}
-	if s.s1SupportedRegistry != nil {
-		s.s1SupportedRegistry.tearDown()
+	if s.s1Registry != nil {
+		s.s1Registry.tearDown()
 	}
 	if s.cluster != nil {
 		s.cluster.tearDown(t)
@@ -123,9 +106,7 @@ func (s *copySuite) TearDownSuite() {
 // and returns a path to a policy, which will be automatically removed when the test completes.
 func (s *copySuite) policyFixture(extraSubstitutions map[string]string) string {
 	t := s.T()
-	fixtureDir, err := filepath.Abs("fixtures")
-	require.NoError(t, err)
-	edits := map[string]string{"@keydir@": s.gpgHome, "@fixturedir@": fixtureDir}
+	edits := map[string]string{"@keydir@": s.gpgHome}
 	maps.Copy(edits, extraSubstitutions)
 	policyPath := fileFromFixture(t, "fixtures/policy.json", edits)
 	return policyPath
@@ -134,13 +115,13 @@ func (s *copySuite) policyFixture(extraSubstitutions map[string]string) string {
 func (s *copySuite) TestCopyWithManifestList() {
 	t := s.T()
 	dir := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImage, "dir:"+dir)
+	assertSkopeoSucceeds(t, "", "copy", knownListImage, "dir:"+dir)
 }

 func (s *copySuite) TestCopyAllWithManifestList() {
 	t := s.T()
 	dir := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--all", knownListImage, "dir:"+dir)
+	assertSkopeoSucceeds(t, "", "copy", "--all", knownListImage, "dir:"+dir)
 }

 func (s *copySuite) TestCopyAllWithManifestListRoundTrip() {
@@ -149,7 +130,7 @@ func (s *copySuite) TestCopyAllWithManifestListRoundTrip() {
 	oci2 := t.TempDir()
 	dir1 := t.TempDir()
 	dir2 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--multi-arch=all", knownListImage, "oci:"+oci1)
+	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", knownListImage, "oci:"+oci1)
 	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", "oci:"+oci1, "dir:"+dir1)
 	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", "dir:"+dir1, "oci:"+oci2)
 	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", "oci:"+oci2, "dir:"+dir2)
@@ -164,9 +145,9 @@ func (s *copySuite) TestCopyAllWithManifestListConverge() {
 	oci2 := t.TempDir()
 	dir1 := t.TempDir()
 	dir2 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--multi-arch=all", knownListImage, "oci:"+oci1)
+	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", knownListImage, "oci:"+oci1)
 	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", "oci:"+oci1, "dir:"+dir1)
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--multi-arch=all", "--format", "oci", knownListImage, "dir:"+dir2)
+	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", "--format", "oci", knownListImage, "dir:"+dir2)
 	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", "dir:"+dir2, "oci:"+oci2)
 	assertDirImagesAreEqual(t, dir1, dir2)
 	out := combinedOutputOfCommand(t, "diff", "-urN", oci1, oci2)
@@ -176,7 +157,7 @@ func (s *copySuite) TestCopyAllWithManifestListConverge() {
 func (s *copySuite) TestCopyNoneWithManifestList() {
 	t := s.T()
 	dir1 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--multi-arch=index-only", knownListImage, "dir:"+dir1)
+	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=index-only", knownListImage, "dir:"+dir1)

 	manifestPath := filepath.Join(dir1, "manifest.json")
 	readManifest, err := os.ReadFile(manifestPath)
@@ -187,32 +168,15 @@ func (s *copySuite) TestCopyNoneWithManifestList() {
 	assert.Equal(t, "manifest.json\nversion\n", out)
 }

-func (s *copySuite) TestCopyWithPlatformList() {
-	t := s.T()
-	dir1 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--multi-arch=linux/amd64,linux/arm64", knownListImage, "dir:"+dir1)
-
-	manifestPath := filepath.Join(dir1, "manifest.json")
-	readManifest, err := os.ReadFile(manifestPath)
-	require.NoError(t, err)
-	mimeType := manifest.GuessMIMEType(readManifest)
-	assert.Equal(t, "application/vnd.docker.distribution.manifest.list.v2+json", mimeType)
-
-	// Verify that we copied exactly 2 platform manifests (manifest list + 2 platforms = 3 manifest files)
-	manifestFiles, err := filepath.Glob(filepath.Join(dir1, "*manifest.json"))
-	require.NoError(t, err)
-	assert.Equal(t, 3, len(manifestFiles), "Expected manifest list + 2 platform manifests")
-}
-
 func (s *copySuite) TestCopyWithManifestListConverge() {
 	t := s.T()
 	oci1 := t.TempDir()
 	oci2 := t.TempDir()
 	dir1 := t.TempDir()
 	dir2 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImage, "oci:"+oci1)
+	assertSkopeoSucceeds(t, "", "copy", knownListImage, "oci:"+oci1)
 	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", "oci:"+oci1, "dir:"+dir1)
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--format", "oci", knownListImage, "dir:"+dir2)
+	assertSkopeoSucceeds(t, "", "copy", "--format", "oci", knownListImage, "dir:"+dir2)
 	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", "dir:"+dir2, "oci:"+oci2)
 	assertDirImagesAreEqual(t, dir1, dir2)
 	out := combinedOutputOfCommand(t, "diff", "-urN", oci1, oci2)
@@ -223,8 +187,7 @@ func (s *copySuite) TestCopyAllWithManifestListStorageFails() {
 	t := s.T()
 	storage := t.TempDir()
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	assertSkopeoFails(t, `.*destination transport .* does not support copying multiple images as a group.*`,
-		"copy", "--retry-times", "3", "--multi-arch=all", knownListImage, "containers-storage:"+storage+"test")
+	assertSkopeoFails(t, `.*destination transport .* does not support copying multiple images as a group.*`, "copy", "--multi-arch=all", knownListImage, "containers-storage:"+storage+"test")
 }

 func (s *copySuite) TestCopyWithManifestListStorage() {
@@ -233,8 +196,8 @@ func (s *copySuite) TestCopyWithManifestListStorage() {
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	dir1 := t.TempDir()
 	dir2 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImage, "containers-storage:"+storage+"test")
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImage, "dir:"+dir1)
+	assertSkopeoSucceeds(t, "", "copy", knownListImage, "containers-storage:"+storage+"test")
+	assertSkopeoSucceeds(t, "", "copy", knownListImage, "dir:"+dir1)
 	assertSkopeoSucceeds(t, "", "copy", "containers-storage:"+storage+"test", "dir:"+dir2)
 	decompressDirs(t, dir1, dir2)
 	assertDirImagesAreEqual(t, dir1, dir2)
@@ -246,9 +209,9 @@ func (s *copySuite) TestCopyWithManifestListStorageMultiple() {
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	dir1 := t.TempDir()
 	dir2 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "--override-arch", "amd64", "copy", "--retry-times", "3", knownListImage, "containers-storage:"+storage+"test")
-	assertSkopeoSucceeds(t, "", "--override-arch", "arm64", "copy", "--retry-times", "3", knownListImage, "containers-storage:"+storage+"test")
-	assertSkopeoSucceeds(t, "", "--override-arch", "arm64", "copy", "--retry-times", "3", knownListImage, "dir:"+dir1)
+	assertSkopeoSucceeds(t, "", "--override-arch", "amd64", "copy", knownListImage, "containers-storage:"+storage+"test")
+	assertSkopeoSucceeds(t, "", "--override-arch", "arm64", "copy", knownListImage, "containers-storage:"+storage+"test")
+	assertSkopeoSucceeds(t, "", "--override-arch", "arm64", "copy", knownListImage, "dir:"+dir1)
 	assertSkopeoSucceeds(t, "", "copy", "containers-storage:"+storage+"test", "dir:"+dir2)
 	decompressDirs(t, dir1, dir2)
 	assertDirImagesAreEqual(t, dir1, dir2)
@@ -260,12 +223,12 @@ func (s *copySuite) TestCopyWithManifestListDigest() {
 	dir2 := t.TempDir()
 	oci1 := t.TempDir()
 	oci2 := t.TempDir()
-	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--retry-times", "3", "--raw", knownListImage)
+	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	require.NoError(t, err)
 	digest := manifestDigest.String()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "dir:"+dir1)
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--multi-arch=all", knownListImageRepo+"@"+digest, "dir:"+dir2)
+	assertSkopeoSucceeds(t, "", "copy", knownListImageRepo+"@"+digest, "dir:"+dir1)
+	assertSkopeoSucceeds(t, "", "copy", "--multi-arch=all", knownListImageRepo+"@"+digest, "dir:"+dir2)
 	assertSkopeoSucceeds(t, "", "copy", "dir:"+dir1, "oci:"+oci1)
 	assertSkopeoSucceeds(t, "", "copy", "dir:"+dir2, "oci:"+oci2)
 	out := combinedOutputOfCommand(t, "diff", "-urN", oci1, oci2)
@@ -277,7 +240,7 @@ func (s *copySuite) TestCopyWithDigestfileOutput() {
 	tempdir := t.TempDir()
 	dir1 := t.TempDir()
 	digestOutPath := filepath.Join(tempdir, "digest.txt")
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--digestfile="+digestOutPath, knownListImage, "dir:"+dir1)
+	assertSkopeoSucceeds(t, "", "copy", "--digestfile="+digestOutPath, knownListImage, "dir:"+dir1)
 	readDigest, err := os.ReadFile(digestOutPath)
 	require.NoError(t, err)
 	_, err = digest.Parse(string(readDigest))
@@ -290,13 +253,13 @@ func (s *copySuite) TestCopyWithManifestListStorageDigest() {
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	dir1 := t.TempDir()
 	dir2 := t.TempDir()
-	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--retry-times", "3", "--raw", knownListImage)
+	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	require.NoError(t, err)
 	digest := manifestDigest.String()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
 	assertSkopeoSucceeds(t, "", "copy", "containers-storage:"+storage+"test@"+digest, "dir:"+dir1)
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "dir:"+dir2)
+	assertSkopeoSucceeds(t, "", "copy", knownListImageRepo+"@"+digest, "dir:"+dir2)
 	decompressDirs(t, dir1, dir2)
 	assertDirImagesAreEqual(t, dir1, dir2)
 }
@@ -307,13 +270,13 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArches() {
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	dir1 := t.TempDir()
 	dir2 := t.TempDir()
-	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--retry-times", "3", "--raw", knownListImage)
+	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	require.NoError(t, err)
 	digest := manifestDigest.String()
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
 	assertSkopeoSucceeds(t, "", "copy", "containers-storage:"+storage+"test@"+digest, "dir:"+dir1)
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "dir:"+dir2)
+	assertSkopeoSucceeds(t, "", "copy", knownListImageRepo+"@"+digest, "dir:"+dir2)
 	decompressDirs(t, dir1, dir2)
 	assertDirImagesAreEqual(t, dir1, dir2)
 }
@@ -322,14 +285,14 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesBothUseLi
 	t := s.T()
 	storage := t.TempDir()
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--retry-times", "3", "--raw", knownListImage)
+	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	require.NoError(t, err)
 	digest := manifestDigest.String()
 	_, err = manifest.ListFromBlob([]byte(m), manifest.GuessMIMEType([]byte(m)))
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
-	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
 	assertSkopeoFails(t, `.*reading manifest for image instance.*does not exist.*`, "--override-arch=amd64", "inspect", "containers-storage:"+storage+"test@"+digest)
 	assertSkopeoFails(t, `.*reading manifest for image instance.*does not exist.*`, "--override-arch=amd64", "inspect", "--config", "containers-storage:"+storage+"test@"+digest)
 	i2 := combinedOutputOfCommand(t, skopeoBinary, "--override-arch=arm64", "inspect", "--config", "containers-storage:"+storage+"test@"+digest)
@@ -343,7 +306,7 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesFirstUses
 	t := s.T()
 	storage := t.TempDir()
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--retry-times", "3", "--raw", knownListImage)
+	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	require.NoError(t, err)
 	digest := manifestDigest.String()
@@ -353,8 +316,8 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesFirstUses
 	require.NoError(t, err)
 	arm64Instance, err := list.ChooseInstance(&types.SystemContext{ArchitectureChoice: "arm64"})
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
-	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", "--retry-times", "3", knownListImageRepo+"@"+arm64Instance.String(), "containers-storage:"+storage+"test@"+arm64Instance.String())
+	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", knownListImageRepo+"@"+arm64Instance.String(), "containers-storage:"+storage+"test@"+arm64Instance.String())
 	i1 := combinedOutputOfCommand(t, skopeoBinary, "--override-arch=amd64", "inspect", "--config", "containers-storage:"+storage+"test@"+digest)
 	var image1 imgspecv1.Image
 	err = json.Unmarshal([]byte(i1), &image1)
@@ -378,7 +341,7 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesSecondUse
 	t := s.T()
 	storage := t.TempDir()
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--retry-times", "3", "--raw", knownListImage)
+	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	require.NoError(t, err)
 	digest := manifestDigest.String()
@@ -388,8 +351,8 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesSecondUse
 	require.NoError(t, err)
 	arm64Instance, err := list.ChooseInstance(&types.SystemContext{ArchitectureChoice: "arm64"})
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", "--retry-times", "3", knownListImageRepo+"@"+amd64Instance.String(), "containers-storage:"+storage+"test@"+amd64Instance.String())
-	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", knownListImageRepo+"@"+amd64Instance.String(), "containers-storage:"+storage+"test@"+amd64Instance.String())
+	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
 	i1 := combinedOutputOfCommand(t, skopeoBinary, "--override-arch=amd64", "inspect", "--config", "containers-storage:"+storage+"test@"+amd64Instance.String())
 	var image1 imgspecv1.Image
 	err = json.Unmarshal([]byte(i1), &image1)
@@ -413,7 +376,7 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesThirdUses
 	t := s.T()
 	storage := t.TempDir()
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--retry-times", "3", "--raw", knownListImage)
+	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	require.NoError(t, err)
 	digest := manifestDigest.String()
@@ -423,9 +386,9 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesThirdUses
 	require.NoError(t, err)
 	arm64Instance, err := list.ChooseInstance(&types.SystemContext{ArchitectureChoice: "arm64"})
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", "--retry-times", "3", knownListImageRepo+"@"+amd64Instance.String(), "containers-storage:"+storage+"test@"+amd64Instance.String())
-	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
-	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", knownListImageRepo+"@"+amd64Instance.String(), "containers-storage:"+storage+"test@"+amd64Instance.String())
+	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
 	assertSkopeoFails(t, `.*reading manifest for image instance.*does not exist.*`, "--override-arch=amd64", "inspect", "--config", "containers-storage:"+storage+"test@"+digest)
 	i1 := combinedOutputOfCommand(t, skopeoBinary, "--override-arch=amd64", "inspect", "--config", "containers-storage:"+storage+"test@"+amd64Instance.String())
 	var image1 imgspecv1.Image
@@ -448,7 +411,7 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesTagAndDig
 	t := s.T()
 	storage := t.TempDir()
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--retry-times", "3", "--raw", knownListImage)
+	m := combinedOutputOfCommand(t, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	require.NoError(t, err)
 	digest := manifestDigest.String()
@@ -458,8 +421,8 @@ func (s *copySuite) TestCopyWithManifestListStorageDigestMultipleArchesTagAndDig
 	require.NoError(t, err)
 	arm64Instance, err := list.ChooseInstance(&types.SystemContext{ArchitectureChoice: "arm64"})
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", "--retry-times", "3", knownListImage, "containers-storage:"+storage+"test:latest")
-	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", "--retry-times", "3", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
+	assertSkopeoSucceeds(t, "", "--override-arch=amd64", "copy", knownListImage, "containers-storage:"+storage+"test:latest")
+	assertSkopeoSucceeds(t, "", "--override-arch=arm64", "copy", knownListImageRepo+"@"+digest, "containers-storage:"+storage+"test@"+digest)
 	assertSkopeoFails(t, `.*reading manifest for image instance.*does not exist.*`, "--override-arch=amd64", "inspect", "--config", "containers-storage:"+storage+"test@"+digest)
 	i1 := combinedOutputOfCommand(t, skopeoBinary, "--override-arch=arm64", "inspect", "--config", "containers-storage:"+storage+"test:latest")
 	var image1 imgspecv1.Image
@@ -492,14 +455,14 @@ func (s *copySuite) TestCopyFailsWhenImageOSDoesNotMatchRuntimeOS() {
 	t := s.T()
 	storage := t.TempDir()
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	assertSkopeoFails(t, `.*no image found in manifest list for architecture .*, variant .*, OS .*`, "copy", "--retry-times", "3", knownWindowsOnlyImage, "containers-storage:"+storage+"test")
+	assertSkopeoFails(t, `.*no image found in manifest list for architecture .*, variant .*, OS .*`, "copy", knownWindowsOnlyImage, "containers-storage:"+storage+"test")
 }

 func (s *copySuite) TestCopySucceedsWhenImageDoesNotMatchRuntimeButWeOverride() {
 	t := s.T()
 	storage := t.TempDir()
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	assertSkopeoSucceeds(t, "", "--override-os=windows", "--override-arch=amd64", "copy", "--retry-times", "3", knownWindowsOnlyImage,
+	assertSkopeoSucceeds(t, "", "--override-os=windows", "--override-arch=amd64", "copy", knownWindowsOnlyImage, "--retry-times", "3",
 		"containers-storage:"+storage+"test")
 }

@@ -528,7 +491,7 @@ func (s *copySuite) TestCopySimple() {

 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	// "pull": docker: → dir:
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "docker://registry.k8s.io/pause", "dir:"+dir1)
+	assertSkopeoSucceeds(t, "", "copy", "docker://registry.k8s.io/pause", "dir:"+dir1)
 	// "push": dir: → docker(v2s2):
 	assertSkopeoSucceeds(t, "", "--tls-verify=false", "--debug", "copy", "dir:"+dir1, ourRegistry+"pause:unsigned")
 	// The result of pushing and pulling is an unmodified image.
@@ -542,7 +505,7 @@ func (s *copySuite) TestCopySimple() {
 	ociDest := "pause-latest-image"
 	ociImgName := "pause"
 	defer os.RemoveAll(ociDest)
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "docker://registry.k8s.io/pause:latest", "oci:"+ociDest+":"+ociImgName)
+	assertSkopeoSucceeds(t, "", "copy", "docker://registry.k8s.io/pause:latest", "oci:"+ociDest+":"+ociImgName)
 	_, err := os.Stat(ociDest)
 	require.NoError(t, err)
 	// copy exits with status 2 if the image is not found within the container, in some transports.
@@ -551,7 +514,7 @@ func (s *copySuite) TestCopySimple() {
 	// docker v2s2 -> OCI image layout without image name
 	ociDest = "pause-latest-noimage"
 	defer os.RemoveAll(ociDest)
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "docker://registry.k8s.io/pause:latest", "oci:"+ociDest)
+	assertSkopeoSucceeds(t, "", "copy", "docker://registry.k8s.io/pause:latest", "oci:"+ociDest)
 	_, err = os.Stat(ociDest)
 	require.NoError(t, err)
 }
@@ -574,9 +537,9 @@ func (s *copySuite) TestCopyEncryption() {
 	privateKeyBytes := x509.MarshalPKCS1PrivateKey(privateKey)
 	publicKeyBytes, err := x509.MarshalPKIXPublicKey(publicKey)
 	require.NoError(t, err)
-	err = os.WriteFile(keysDir+"/private.key", privateKeyBytes, 0o644)
+	err = os.WriteFile(keysDir+"/private.key", privateKeyBytes, 0644)
 	require.NoError(t, err)
-	err = os.WriteFile(keysDir+"/public.key", publicKeyBytes, 0o644)
+	err = os.WriteFile(keysDir+"/public.key", publicKeyBytes, 0644)
 	require.NoError(t, err)

 	// We can either perform encryption or decryption on the image.
@@ -601,7 +564,7 @@ func (s *copySuite) TestCopyEncryption() {
 	invalidPrivateKey, err := rsa.GenerateKey(rand.Reader, 4096)
 	require.NoError(t, err)
 	invalidPrivateKeyBytes := x509.MarshalPKCS1PrivateKey(invalidPrivateKey)
-	err = os.WriteFile(keysDir+"/invalid_private.key", invalidPrivateKeyBytes, 0o644)
+	err = os.WriteFile(keysDir+"/invalid_private.key", invalidPrivateKeyBytes, 0644)
 	require.NoError(t, err)
 	assertSkopeoFails(t, ".*no suitable key unwrapper found or none of the private keys could be used for decryption.*",
 		"copy", "--decryption-key", keysDir+"/invalid_private.key",
@@ -637,6 +600,7 @@ func (s *copySuite) TestCopyEncryption() {

 	// After successful decryption we should find the gzipped layers from the nginx image
 	matchLayerBlobBinaryType(t, partiallyDecryptedImgDir+"/blobs/sha256", "application/x-gzip", 3)
+
 }

 func matchLayerBlobBinaryType(t *testing.T, ociImageDirPath string, contentType string, matchCount int) {
@@ -781,7 +745,7 @@ func (s *copySuite) TestCopyOCIRoundTrip() {
 // --sign-by and --policy copy, primarily using atomic:
 func (s *copySuite) TestCopySignatures() {
 	t := s.T()
-	mech, err := signature.NewGPGSigningMechanism()
+	mech, _, err := signature.NewEphemeralGPGSigningMechanism([]byte{})
 	require.NoError(t, err)
 	defer mech.Close()
 	if err := mech.SupportsSigning(); err != nil { // FIXME? Test that verification and policy enforcement works, using signatures from fixtures
@@ -795,10 +759,10 @@ func (s *copySuite) TestCopySignatures() {

 	// type: reject
 	assertSkopeoFails(t, fmt.Sprintf(".*Source image rejected: Running image %s:latest is rejected by policy.*", testFQIN),
-		"--policy", policy, "copy", "--retry-times", "3", testFQIN+":latest", dirDest)
+		"--policy", policy, "copy", testFQIN+":latest", dirDest)

 	// type: insecureAcceptAnything
-	assertSkopeoSucceeds(t, "", "--policy", policy, "copy", "--retry-times", "3", "docker://quay.io/openshift/origin-hello-openshift", dirDest)
+	assertSkopeoSucceeds(t, "", "--policy", policy, "copy", "docker://quay.io/openshift/origin-hello-openshift", dirDest)

 	// type: signedBy
 	// Sign the images
@@ -812,10 +776,9 @@ func (s *copySuite) TestCopySignatures() {
 	// Verify that mis-signed images are rejected
 	assertSkopeoSucceeds(t, "", "--tls-verify=false", "copy", "atomic:localhost:5006/myns/personal:personal", "atomic:localhost:5006/myns/official:attack")
 	assertSkopeoSucceeds(t, "", "--tls-verify=false", "copy", "atomic:localhost:5006/myns/official:official", "atomic:localhost:5006/myns/personal:attack")
-	// "Invalid GPG signature" is reported by the gpgme mechanism; "Missing key: $fingerprint" or "Missing key $fingerprint" by Sequoia.
-	assertSkopeoFails(t, ".*Source image rejected: (Invalid GPG signature|Missing key).*",
+	assertSkopeoFails(t, ".*Source image rejected: Invalid GPG signature.*",
 		"--tls-verify=false", "--policy", policy, "copy", "atomic:localhost:5006/myns/personal:attack", dirDest)
-	assertSkopeoFails(t, ".*Source image rejected: (Invalid GPG signature|Missing key).*",
+	assertSkopeoFails(t, ".*Source image rejected: Invalid GPG signature.*",
 		"--tls-verify=false", "--policy", policy, "copy", "atomic:localhost:5006/myns/official:attack", dirDest)

 	// Verify that signed identity is verified.
@@ -828,8 +791,7 @@ func (s *copySuite) TestCopySignatures() {

 	// Verify that cosigning requirements are enforced
 	assertSkopeoSucceeds(t, "", "--tls-verify=false", "copy", "atomic:localhost:5006/myns/official:official", "atomic:localhost:5006/myns/cosigned:cosigned")
-	// "Invalid GPG signature" is reported by the gpgme mechanism; "Missing key: $fingerprint" or "Missing key $fingerprint" by Sequoia.
-	assertSkopeoFails(t, ".*Source image rejected: (Invalid GPG signature|Missing key).*",
+	assertSkopeoFails(t, ".*Source image rejected: Invalid GPG signature.*",
 		"--tls-verify=false", "--policy", policy, "copy", "atomic:localhost:5006/myns/cosigned:cosigned", dirDest)

 	assertSkopeoSucceeds(t, "", "--tls-verify=false", "copy", "--sign-by", "personal@example.com", "atomic:localhost:5006/myns/official:official", "atomic:localhost:5006/myns/cosigned:cosigned")
@@ -839,7 +801,7 @@ func (s *copySuite) TestCopySignatures() {
 // --policy copy for dir: sources
 func (s *copySuite) TestCopyDirSignatures() {
 	t := s.T()
-	mech, err := signature.NewGPGSigningMechanism()
+	mech, _, err := signature.NewEphemeralGPGSigningMechanism([]byte{})
 	require.NoError(t, err)
 	defer mech.Close()
 	if err := mech.SupportsSigning(); err != nil { // FIXME? Test that verification and policy enforcement works, using signatures from fixtures
@@ -850,7 +812,7 @@ func (s *copySuite) TestCopyDirSignatures() {
 	topDirDest := "dir:" + topDir

 	for _, suffix := range []string{"/dir1", "/dir2", "/restricted/personal", "/restricted/official", "/restricted/badidentity", "/dest"} {
-		err := os.MkdirAll(topDir+suffix, 0o755)
+		err := os.MkdirAll(topDir+suffix, 0755)
 		require.NoError(t, err)
 	}

@@ -874,8 +836,7 @@ func (s *copySuite) TestCopyDirSignatures() {
 	// Verify that correct images are accepted
 	assertSkopeoSucceeds(t, "", "--policy", policy, "copy", topDirDest+"/restricted/official", topDirDest+"/dest")
 	// ... and that mis-signed images are rejected.
-	// "Invalid GPG signature" is reported by the gpgme mechanism; "Missing key: $fingerprint" or "Missing key $fingerprint" by Sequoia.
-	assertSkopeoFails(t, ".*Source image rejected: (Invalid GPG signature|Missing key).*",
+	assertSkopeoFails(t, ".*Source image rejected: Invalid GPG signature.*",
 		"--policy", policy, "copy", topDirDest+"/restricted/personal", topDirDest+"/dest")

 	// Verify that the signed identity is verified.
@@ -885,39 +846,6 @@ func (s *copySuite) TestCopyDirSignatures() {
 		"--policy", policy, "copy", topDirDest+"/restricted/badidentity", topDirDest+"/dest")
 }

-func (s *copySuite) TestCopySequoiaSignatures() {
-	t := s.T()
-	signer, err := simplesequoia.NewSigner(simplesequoia.WithSequoiaHome(testSequoiaHome), simplesequoia.WithKeyFingerprint(testSequoiaKeyFingerprint))
-	if err != nil {
-		t.Skipf("Sequoia not supported: %v", err)
-	}
-	signer.Close()
-
-	const ourRegistry = "docker://" + v2DockerRegistryURL + "/"
-
-	dirDest := "dir:" + t.TempDir()
-
-	policy := s.policyFixture(nil)
-	registriesDir := t.TempDir()
-	registriesFile := fileFromFixture(t, "fixtures/registries.yaml",
-		map[string]string{"@lookaside@": t.TempDir(), "@split-staging@": "/var/empty", "@split-read@": "file://var/empty"})
-	err = os.Symlink(registriesFile, filepath.Join(registriesDir, "registries.yaml"))
-	require.NoError(t, err)
-
-	// Sign the images
-	absSequoiaHome, err := filepath.Abs(testSequoiaHome)
-	require.NoError(t, err)
-	t.Setenv("SEQUOIA_HOME", absSequoiaHome)
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--dest-tls-verify=false", "--sign-by-sq-fingerprint", testSequoiaKeyFingerprint,
-		testFQIN+":1.26", ourRegistry+"sequoia-no-passphrase")
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--dest-tls-verify=false", "--sign-by-sq-fingerprint", testSequoiaKeyFingerprintWithPassphrase,
-		"--sign-passphrase-file", filepath.Join(absSequoiaHome, "with-passphrase.passphrase"),
-		testFQIN+":1.26.1", ourRegistry+"sequoia-with-passphrase")
-	// Verify that we can pull them
-	assertSkopeoSucceeds(t, "", "--policy", policy, "copy", "--src-tls-verify=false", ourRegistry+"sequoia-no-passphrase", dirDest)
-	assertSkopeoSucceeds(t, "", "--policy", policy, "copy", "--src-tls-verify=false", ourRegistry+"sequoia-with-passphrase", dirDest)
-}
-
 // Compression during copy
 func (s *copySuite) TestCopyCompression() {
 	t := s.T()
@@ -926,13 +854,13 @@ func (s *copySuite) TestCopyCompression() {
 	topDir := t.TempDir()

 	for i, c := range []struct{ fixture, remote string }{
-		{"uncompressed-image-s1", "docker://" + v2s1SupportedDockerRegistryURL + "/compression/compression:s1"},
+		{"uncompressed-image-s1", "docker://" + v2DockerRegistryURL + "/compression/compression:s1"},
 		{"uncompressed-image-s2", "docker://" + v2DockerRegistryURL + "/compression/compression:s2"},
 		{"uncompressed-image-s1", "atomic:localhost:5000/myns/compression:s1"},
 		{"uncompressed-image-s2", "atomic:localhost:5000/myns/compression:s2"},
 	} {
 		dir := filepath.Join(topDir, fmt.Sprintf("case%d", i))
-		err := os.MkdirAll(dir, 0o755)
+		err := os.MkdirAll(dir, 0755)
 		require.NoError(t, err)

 		assertSkopeoSucceeds(t, "", "--tls-verify=false", "copy", "dir:fixtures/"+c.fixture, c.remote)
@@ -974,7 +902,7 @@ func findRegularFiles(t *testing.T, root string) []string {
 // --sign-by and policy use for docker: with lookaside
 func (s *copySuite) TestCopyDockerLookaside() {
 	t := s.T()
-	mech, err := signature.NewGPGSigningMechanism()
+	mech, _, err := signature.NewEphemeralGPGSigningMechanism([]byte{})
 	require.NoError(t, err)
 	defer mech.Close()
 	if err := mech.SupportsSigning(); err != nil { // FIXME? Test that verification and policy enforcement works, using signatures from fixtures
@@ -985,7 +913,7 @@ func (s *copySuite) TestCopyDockerLookaside() {

 	tmpDir := t.TempDir()
 	copyDest := filepath.Join(tmpDir, "dest")
-	err = os.Mkdir(copyDest, 0o755)
+	err = os.Mkdir(copyDest, 0755)
 	require.NoError(t, err)
 	dirDest := "dir:" + copyDest
 	plainLookaside := filepath.Join(tmpDir, "lookaside")
@@ -999,7 +927,7 @@ func (s *copySuite) TestCopyDockerLookaside() {

 	policy := s.policyFixture(nil)
 	registriesDir := filepath.Join(tmpDir, "registries.d")
-	err = os.Mkdir(registriesDir, 0o755)
+	err = os.Mkdir(registriesDir, 0755)
 	require.NoError(t, err)
 	registriesFile := fileFromFixture(t, "fixtures/registries.yaml",
 		map[string]string{"@lookaside@": plainLookaside, "@split-staging@": splitLookasideStaging, "@split-read@": splitLookasideReadServer.URL})
@@ -1043,7 +971,7 @@ func (s *copySuite) TestCopyDockerLookaside() {
 // atomic: and docker: X-Registry-Supports-Signatures works and interoperates
 func (s *copySuite) TestCopyAtomicExtension() {
 	t := s.T()
-	mech, err := signature.NewGPGSigningMechanism()
+	mech, _, err := signature.NewEphemeralGPGSigningMechanism([]byte{})
 	require.NoError(t, err)
 	defer mech.Close()
 	if err := mech.SupportsSigning(); err != nil { // FIXME? Test that the reading/writing works using signatures from fixtures
@@ -1052,7 +980,7 @@ func (s *copySuite) TestCopyAtomicExtension() {

 	topDir := t.TempDir()
 	for _, subdir := range []string{"dirAA", "dirAD", "dirDA", "dirDD", "registries.d"} {
-		err := os.MkdirAll(filepath.Join(topDir, subdir), 0o755)
+		err := os.MkdirAll(filepath.Join(topDir, subdir), 0755)
 		require.NoError(t, err)
 	}
 	registriesDir := filepath.Join(topDir, "registries.d")
@@ -1103,7 +1031,7 @@ func (s *copySuite) TestCopyVerifyingMirroredSignatures() {
 	t := s.T()
 	const regPrefix = "docker://localhost:5006/myns/mirroring-"

-	mech, err := signature.NewGPGSigningMechanism()
+	mech, _, err := signature.NewEphemeralGPGSigningMechanism([]byte{})
 	require.NoError(t, err)
 	defer mech.Close()
 	if err := mech.SupportsSigning(); err != nil { // FIXME? Test that verification and policy enforcement works, using signatures from fixtures
@@ -1206,7 +1134,7 @@ func (s *copySuite) TestCopySchemaConversion() {
 	// Test conversion / schema autodetection both for the OpenShift embedded registry…
 	s.testCopySchemaConversionRegistries(t, "docker://localhost:5005/myns/schema1", "docker://localhost:5006/myns/schema2")
 	// … and for various docker/distribution registry versions.
-	s.testCopySchemaConversionRegistries(t, "docker://"+v2s1OnlyDockerRegistryURL+"/schema1", "docker://"+v2s1SupportedDockerRegistryURL+"/schema2")
+	s.testCopySchemaConversionRegistries(t, "docker://"+v2s1DockerRegistryURL+"/schema1", "docker://"+v2DockerRegistryURL+"/schema2")
 }

 func (s *copySuite) TestCopyManifestConversion() {
@@ -1238,14 +1166,14 @@ func (s *copySuite) TestCopyPreserveDigests() {
 	t := s.T()
 	topDir := t.TempDir()

-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", knownListImage, "--multi-arch=all", "--preserve-digests", "dir:"+topDir)
-	assertSkopeoFails(t, ".*Instructed to preserve digests.*", "copy", "--retry-times", "3", knownListImage, "--multi-arch=all", "--preserve-digests", "--format=oci", "dir:"+topDir)
+	assertSkopeoSucceeds(t, "", "copy", knownListImage, "--multi-arch=all", "--preserve-digests", "dir:"+topDir)
+	assertSkopeoFails(t, ".*Instructed to preserve digests.*", "copy", knownListImage, "--multi-arch=all", "--preserve-digests", "--format=oci", "dir:"+topDir)
 }

 func (s *copySuite) testCopySchemaConversionRegistries(t *testing.T, schema1Registry, schema2Registry string) {
 	topDir := t.TempDir()
 	for _, subdir := range []string{"input1", "input2", "dest2"} {
-		err := os.MkdirAll(filepath.Join(topDir, subdir), 0o755)
+		err := os.MkdirAll(filepath.Join(topDir, subdir), 0755)
 		require.NoError(t, err)
 	}
 	input1Dir := filepath.Join(topDir, "input1")
@@ -1316,83 +1244,3 @@ func (s *copySuite) TestCopyFailsWhenReferenceIsInvalid() {
 	t := s.T()
 	assertSkopeoFails(t, `.*Invalid image name.*`, "copy", "unknown:transport", "unknown:test")
 }
-
-func (s *copySuite) TestInsecurePolicyAndRequireSignedConflict() {
-	t := s.T()
-	assertSkopeoFails(t, ".*--insecure-policy and --require-signed are mutually exclusive.*",
-		"--insecure-policy", "--require-signed", "inspect", "dir:/nonexistent")
-}
-
-func (s *copySuite) TestRequireSignedAcceptsSignedImage() {
-	t := s.T()
-	mech, err := signature.NewGPGSigningMechanism()
-	require.NoError(t, err)
-	defer mech.Close()
-	if err := mech.SupportsSigning(); err != nil {
-		t.Skipf("Signing not supported: %v", err)
-	}
-
-	srcDir := t.TempDir()
-
-	// get an image to work with
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3",
-		testFQIN64, "dir:"+srcDir)
-
-	// first, sanity-check that without --require-signed, we can copy it since by default, `dir:` is insecureAcceptAnything
-	destDir1 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "copy", "dir:"+srcDir, "dir:"+destDir1)
-
-	// now verify that copying fails with --require-signed
-	destDir2 := t.TempDir()
-	assertSkopeoFails(t, ".*Source image rejected: No signature verification policy found for image.*",
-		"--require-signed", "copy",
-		"dir:"+srcDir, "dir:"+destDir2)
-
-	// sign the image
-	manifestPath := filepath.Join(srcDir, "manifest.json")
-	signaturePath := filepath.Join(srcDir, "signature-1")
-	dockerReference := "localhost/test:latest"
-
-	assertSkopeoSucceeds(t, "", "standalone-sign",
-		"-o", signaturePath,
-		manifestPath, dockerReference, s.fingerprint)
-
-	// sanity-check signature file is there
-	_, err = os.Stat(signaturePath)
-	require.NoError(t, err)
-
-	// create a basic policy that requires signatures
-	policy := map[string]any{
-		"default": []map[string]any{{
-			"type":    "signedBy",
-			"keyType": "GPGKeys",
-			"keyPath": filepath.Join(s.gpgHome, "personal-pubkey.gpg"),
-			"signedIdentity": map[string]any{
-				"type":             "exactRepository",
-				"dockerRepository": dockerReference,
-			},
-		}},
-	}
-	policyJSON, err := json.Marshal(policy)
-	require.NoError(t, err)
-
-	policyFile := filepath.Join(t.TempDir(), "policy.json")
-	err = os.WriteFile(policyFile, policyJSON, 0o600)
-	require.NoError(t, err)
-
-	// now copying with --require-signed should pass
-	destDir3 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "--policy", policyFile, "--require-signed", "copy",
-		"dir:"+srcDir, "dir:"+destDir3)
-
-	// Delete the signature and sanity-check that copying fails. This doesn't
-	// strictly test --require-signed, but rather the PolicyRequirements logic, but
-	// it makes the test feel complete.
-	err = os.Remove(signaturePath)
-	require.NoError(t, err)
-
-	destDir4 := t.TempDir()
-	assertSkopeoFails(t, ".*Source image rejected: A signature was required, but no signature exists.*",
-		"--policy", policyFile, "--require-signed", "copy",
-		"dir:"+srcDir, "dir:"+destDir4)
-}
--- a/integration/fixtures/.gitignore
+++ b/integration/fixtures/.gitignore
@@ -1 +0,0 @@
-/data/pgp.cert.d/_sequoia*
--- a/integration/fixtures/data/keystore/keystore.cookie
+++ b/integration/fixtures/data/keystore/keystore.cookie
--- a/integration/fixtures/data/keystore/softkeys/1F5825285B785E1DB13BF36D2D11A19ABA41C6AE.pgp
+++ b/integration/fixtures/data/keystore/softkeys/1F5825285B785E1DB13BF36D2D11A19ABA41C6AE.pgp
--- a/integration/fixtures/data/keystore/softkeys/50DDE898DF4E48755C8C2B7AF6F908B6FA48A229.pgp
+++ b/integration/fixtures/data/keystore/softkeys/50DDE898DF4E48755C8C2B7AF6F908B6FA48A229.pgp
--- a/integration/fixtures/data/pgp.cert.d/1f/5825285b785e1db13bf36d2d11a19aba41c6ae
+++ b/integration/fixtures/data/pgp.cert.d/1f/5825285b785e1db13bf36d2d11a19aba41c6ae
--- a/integration/fixtures/data/pgp.cert.d/4d/8bcd544b7573eefaad18c278473e5f255d10b8
+++ b/integration/fixtures/data/pgp.cert.d/4d/8bcd544b7573eefaad18c278473e5f255d10b8
--- a/integration/fixtures/data/pgp.cert.d/50/dde898df4e48755c8c2b7af6f908b6fa48a229
+++ b/integration/fixtures/data/pgp.cert.d/50/dde898df4e48755c8c2b7af6f908b6fa48a229
--- a/integration/fixtures/data/pgp.cert.d/68/de230c4a009f5ee5fbb27984642d0130b86046
+++ b/integration/fixtures/data/pgp.cert.d/68/de230c4a009f5ee5fbb27984642d0130b86046
--- a/integration/fixtures/data/pgp.cert.d/trust-root
+++ b/integration/fixtures/data/pgp.cert.d/trust-root
--- a/integration/fixtures/data/pgp.cert.d/writelock
+++ b/integration/fixtures/data/pgp.cert.d/writelock
--- a/integration/fixtures/no-passphrase.pub
+++ b/integration/fixtures/no-passphrase.pub
@@ -1,38 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-xjMEaGwFVhYJKwYBBAHaRw8BAQdAZzfnqEAgvE3RoCtPWEOc3Xp8oMURR0qjq+Ru
-PHJrc6TCwAsEHxYKAH0FgmhsBVYDCwkHCRD2+Qi2+kiiKUcUAAAAAAAeACBzYWx0
-QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmcEjRQtILaFnIhczxeUkcfW0KMHEZ30
-wTdJ1v1iHB7NKQMVCggCmwECHgkWIQRQ3eiY305IdVyMK3r2+Qi2+kiiKQAA86gA
-/1ZkXWPHUxh3nQu/EL72ZeP9k/SLWkEuNKs6dJrmRud9AQCHbWwSUwKyt12EFVt/
-QvMFSQ95brUxsWLHgFMPpNfWAc0aU2tvcGVvIFNlcXVvaWEgdGVzdGluZyBrZXnC
-wA4EExYKAIAFgmhsBVYDCwkHCRD2+Qi2+kiiKUcUAAAAAAAeACBzYWx0QG5vdGF0
-aW9ucy5zZXF1b2lhLXBncC5vcmctF7xuY06GUyedOGjd2iNKwab85gV64zEAGKgi
-ExHRxgMVCggCmQECmwECHgkWIQRQ3eiY305IdVyMK3r2+Qi2+kiiKQAA3SEBAMe1
-y6rWaPjDpkeiDthLV1Umr6NsXVBv/IJTcP9RM4quAQCwmlsdQMddCsc+K3Y5KH88
-saIG0/MRZaPJdsd8vRGUCs4zBGhsBVYWCSsGAQQB2kcPAQEHQLN8yt/21QDMzcB4
-2bzFRg1LpkFZWECjkb2ty7Iju/aOwsC/BBgWCgExBYJobAVWCRD2+Qi2+kiiKUcU
-AAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmce9QEurrtI24ys
-vXssO/40rI5rlsNokEEFr7CVwVgWvAKbAr6gBBkWCgBvBYJobAVWCRB63Ra9Qdgp
-tkcUAAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmcBWCJsdUfj
-oYpld4qcYBqjxsyScwpID2vkNlYMLmS+IhYhBKyZqvZ6WI3zgaapXHrdFr1B2Cm2
-AAAEZwEA/UhpNN1XElYx6Xq+JMKlXywoIgButkQy1+H2EcRBeHsBAM7lq8BXvRKz
-bDjRlgxiIAYl77p7ihVQ5NYcuZcAlH0CFiEEUN3omN9OSHVcjCt69vkItvpIoikA
-AJcwAP9D4spfb28k16w2cemrWAtAE1WUgV8V+OEpE7+gpV+17gEA+0Kzf7jBHgd3
-pBAWwttuRd8OHlZZzKs3f26z28I6mgLOMwRobAVWFgkrBgEEAdpHDwEBB0DPyS14
-jQk1mSWNmuYR4P9M5zOfU2mkhwaqx1l3OWTZD8LAvwQYFgoBMQWCaGwFVgkQ9vkI
-tvpIoilHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3Jn+wfK
-FmPmtrsi0sY5zIq9KFmbrQyhXz/VZIw6K8D1zdECmyC+oAQZFgoAbwWCaGwFVgkQ
-bwujLUxU69BHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3Jn
-xF3KXB4+dN9suOhCD2XkYlAWUJ4GVBVV2wAmdQAueyEWIQTv1sMw2eUTIMQmb7Zv
-C6MtTFTr0AAA/LYA/iBkRh6dGbp76VzuuHVNUNgTqvXgz9FjizZGJKnVZctXAPwL
-TlHxcH6XX96AuiCy9QAMUpm8ZvMu8TAgjgOrlFPKCBYhBFDd6JjfTkh1XIwrevb5
-CLb6SKIpAAA0rQD9HWbBeSoshjH6/k5ntZjOfIAha4/TLlBrMq2w+t4LWD0A/2q5
-DEbYh6PwMidDxXteyHWf4Qnr0vH8vip9d+WHbDYEzjgEaGwFVhIKKwYBBAGXVQEF
-AQEHQLxXHw9STOAhb2PLEjrl3uQDwpaXIdigg67vId0jSstVAwEIB8LAAAQYFgoA
-cgWCaGwFVgkQ9vkItvpIoilHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9p
-YS1wZ3Aub3Jn8bvuQCv3uEYJtK6h5y5e4AY9lJtVXx3brexR5bmFCwcCmwwWIQRQ
-3eiY305IdVyMK3r2+Qi2+kiiKQAAEzkA/Az97rdlp3hf97S6a5AxU8pTry4gKI63
-lwKtBAT+uF/pAP9lAziQRlNEa1sX6qCXrQqeA/aQ0nj9gRJ1Wvi1PMxWBA==
-=7jmE
-----END PGP PUBLIC KEY BLOCK-----
--- a/integration/fixtures/policy.json
+++ b/integration/fixtures/policy.json
@@ -13,20 +13,6 @@
                    "keyPath": "@keydir@/personal-pubkey.gpg"
                }
            ],
-            "localhost:5555/sequoia-no-passphrase": [
-                {
-                    "type": "signedBy",
-                    "keyType": "GPGKeys",
-                    "keyPath": "@fixturedir@/no-passphrase.pub"
-                }
-            ],
-            "localhost:5555/sequoia-with-passphrase": [
-                {
-                    "type": "signedBy",
-                    "keyType": "GPGKeys",
-                    "keyPath": "@fixturedir@/with-passphrase.pub"
-                }
-            ],
            "localhost:5000/myns/extension": [
                {
                    "type": "signedBy",
--- a/integration/fixtures/tls-details-1.3.yaml
+++ b/integration/fixtures/tls-details-1.3.yaml
@@ -1 +0,0 @@
-minVersion: "1.3"
--- a/integration/fixtures/tls-details-anything.yaml
+++ b/integration/fixtures/tls-details-anything.yaml
@@ -1 +0,0 @@
-{} # No fields
--- a/integration/fixtures/tls-details-pqc-only.yaml
+++ b/integration/fixtures/tls-details-pqc-only.yaml
@@ -1,3 +0,0 @@
-minVersion: "1.3"
-namedGroups:
-  - "X25519MLKEM768"
--- a/integration/fixtures/with-passphrase.passphrase
+++ b/integration/fixtures/with-passphrase.passphrase
@@ -1 +0,0 @@
-WithPassphrase123
--- a/integration/fixtures/with-passphrase.pub
+++ b/integration/fixtures/with-passphrase.pub
@@ -1,39 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-xjMEaGwF3RYJKwYBBAHaRw8BAQdAouHF6y7foOScub78AINlTzXnEQrYrAJyH8fr
-3biwuMzCwAsEHxYKAH0FgmhsBd0DCwkHCRAtEaGaukHGrkcUAAAAAAAeACBzYWx0
-QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmdRHdDbkndmp7Q96YisL7ezwrLxSfQj
-46zFb8wob+6yvgMVCggCmwECHgkWIQQfWCUoW3heHbE7820tEaGaukHGrgAAbd8A
-/3iwAF7qTVgqqCqLVIj8oJxrZr/jWbHbjO1DzFafQQjMAQDwwOuL9dhy9Q7N5UkW
-x3kq3WLEIuogh+0meAwfMrJMAM0qU2tvcGVvIFNlcXVvaWEgdGVzdGluZyBrZXkg
-d2l0aCBwYXNzcGhyYXNlwsAOBBMWCgCABYJobAXdAwsJBwkQLRGhmrpBxq5HFAAA
-AAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnwGFwQkw9BWc963pG
-lBgz8D9CbfsqoDS58GXyd24W8g4DFQoIApkBApsBAh4JFiEEH1glKFt4Xh2xO/Nt
-LRGhmrpBxq4AAKTpAPsHMyzeL+fT/EdPbU/+fi/+RbGuRQH5QHtzaDfAu+ZGUwD+
-Oeoi7OOy8+bgvnEdj31TohAGEexTvhMIILglL9ymTgfOMwRobAXdFgkrBgEEAdpH
-DwEBB0DNeYLgt7VaYbdJ3TyTqiYp7pEuXYVYjeqRtt055Hs60cLAvwQYFgoBMQWC
-aGwF3QkQLRGhmrpBxq5HFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1w
-Z3Aub3Jnr08xd/fCttifQZ/b+oVq2huO6HT9zpTITLIzPLLBI6cCmwK+oAQZFgoA
-bwWCaGwF3QkQVNJA3Fgs7h9HFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9p
-YS1wZ3Aub3JnN1Kokqv7bIxnM7EODP0bX7yuAV8OP+kCivD84d8TrkEWIQQemi42
-PEh1us0v16FU0kDcWCzuHwAAUisBAKBMLjhkVO+KCFNKxYoak/Hj7VAHwiqnEAXB
-aMstWEE1AP9rVWwZ85IdlSejb475H9HGl+Nl0a5BOioR/Y+Kl15UBxYhBB9YJShb
-eF4dsTvzbS0RoZq6QcauAAAKnAEAvgb1r2cteb+9wd9U5vYZ7/xXKEljojjA7CQT
-QFmecoYBAO3/rNK3xYcKleni3lknNhzQap+Ed6ri2WVQCKujRgIAzjMEaGwF3RYJ
-KwYBBAHaRw8BAQdA1JYMc2I192WwvCI/qFcLrwmFPwDDkHvNDDt4Kc2ziHjCwL8E
-GBYKATEFgmhsBd0JEC0RoZq6QcauRxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNl
-cXVvaWEtcGdwLm9yZxDKeHct4SrN5lJ3oAkhIfwcJpCTVv9Sux05J7Pn0U6TApsg
-vqAEGRYKAG8FgmhsBd0JEMb35fxT9XmfRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z
-LnNlcXVvaWEtcGdwLm9yZ9MZe54S5aYMdKLQmZiNN7Q1tot0zCuRp0DOMrZIsWQg
-FiEEzXeihzhK/PSlCtVwxvfl/FP1eZ8AAFpUAQC1WlWjrTCL+ZiG3X9ThPO8418f
-wu+p3l9jJAF1SK15QQEA6Go0+bbWOHMpkMNckSwlXhbBKVp53y2IhQnwLAfbZwoW
-IQQfWCUoW3heHbE7820tEaGaukHGrgAAhYMA/iuXYUHqeXNpFCmoDFWmvwHDoPIs
-8ZrgBJOfSnzg+x5wAQCFIWANcwYD/rCHTN6KQY70VI/x7SmkqKJZVrIBCB7DB844
-BGhsBd0SCisGAQQBl1UBBQEBB0CYZYh5OKFAiuKOx4MIk6pocGCdfpL/XrJVoWjT
-9aDSNAMBCAfCwAAEGBYKAHIFgmhsBd0JEC0RoZq6QcauRxQAAAAAAB4AIHNhbHRA
-bm90YXRpb25zLnNlcXVvaWEtcGdwLm9yZ0oyJPZxXWc2dSxHpS1UAuvCfc80DaDy
-mr1nRs5/QO0aApsMFiEEH1glKFt4Xh2xO/NtLRGhmrpBxq4AANKZAP0T00LyderN
-Qsdk2UgpeeoZhN4wKtlUGocUs7I90P3AhgD/WuDXAlF6b9IXyTUoG9VkLrnlemCx
-Dii+5qsdk0HFcgA=
-=YS7U
-----END PGP PUBLIC KEY BLOCK-----
--- a/integration/fixtures_info_test.go
+++ b/integration/fixtures_info_test.go
@@ -3,12 +3,4 @@ package main
 const (
 	// TestImageManifestDigest is the Docker manifest digest of "fixtures/image.manifest.json"
 	TestImageManifestDigest = "sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"
-
-	testSequoiaHome = "./fixtures"
-	// testSequoiaKeyFingerprint is a fingerprint of a test key in testSequoiaHome, generated using
-	// > sq --home $(pwd)/signature/simplesequoia/testdata key generate --name 'Skopeo Sequoia testing key' --own-key --expiration=never
-	testSequoiaKeyFingerprint = "50DDE898DF4E48755C8C2B7AF6F908B6FA48A229"
-	// testSequoiaKeyFingerprintWithPassphrase is a fingerprint of a test key in testSequoiaHome, generated using
-	// > sq --home $(pwd)/signature/simplesequoia/testdata key generate --name 'Skopeo Sequoia testing key with passphrase' --own-key --expiration=never
-	testSequoiaKeyFingerprintWithPassphrase = "1F5825285B785E1DB13BF36D2D11A19ABA41C6AE"
 )
--- a/integration/openshift_test.go
+++ b/integration/openshift_test.go
@@ -13,8 +13,8 @@ import (
 	"testing"
 	"time"

+	"github.com/containers/storage/pkg/homedir"
 	"github.com/stretchr/testify/require"
-	"go.podman.io/storage/pkg/homedir"
 )

 var adminKUBECONFIG = map[string]string{
@@ -207,7 +207,7 @@ func (cluster *openshiftCluster) startRegistry(t *testing.T) {
 	cluster.processes = append(cluster.processes, cluster.startRegistryProcess(t, 5006, schema2Config))
 }

-// ocLoginToProject runs (oc login) and (oc new-project) on the cluster, or terminates on failure.
+// ocLogin runs (oc login) and (oc new-project) on the cluster, or terminates on failure.
 func (cluster *openshiftCluster) ocLoginToProject(t *testing.T) {
 	t.Logf("oc login")
 	cmd := cluster.clusterCmd(nil, "oc", "login", "--certificate-authority=openshift.local.config/master/ca.crt", "-u", "myuser", "-p", "mypw", "https://localhost:8443")
@@ -223,7 +223,7 @@ func (cluster *openshiftCluster) ocLoginToProject(t *testing.T) {
 // We do not run (docker login) directly, because that requires a running daemon and a docker package.
 func (cluster *openshiftCluster) dockerLogin(t *testing.T) {
 	cluster.dockerDir = filepath.Join(homedir.Get(), ".docker")
-	err := os.MkdirAll(cluster.dockerDir, 0o700)
+	err := os.MkdirAll(cluster.dockerDir, 0700)
 	require.NoError(t, err)

 	out := combinedOutputOfCommand(t, "oc", "config", "view", "-o", "json", "-o", "jsonpath={.users[*].user.token}")
@@ -237,7 +237,7 @@ func (cluster *openshiftCluster) dockerLogin(t *testing.T) {
 			}`, port, authValue))
 	}
 	configJSON := `{"auths": {` + strings.Join(auths, ",") + `}}`
-	err = os.WriteFile(filepath.Join(cluster.dockerDir, "config.json"), []byte(configJSON), 0o600)
+	err = os.WriteFile(filepath.Join(cluster.dockerDir, "config.json"), []byte(configJSON), 0600)
 	require.NoError(t, err)
 }

--- a/integration/proxy_test.go
+++ b/integration/proxy_test.go
@@ -15,11 +15,11 @@ import (
 	"testing"
 	"time"

+	"github.com/containers/image/v5/manifest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
-	"go.podman.io/image/v5/manifest"
 )

 // This image is known to be x86_64 only right now
@@ -214,7 +214,9 @@ func (p *proxy) callGetRawBlob(args []any) (rval any, buf []byte, err error) {
 	var wg sync.WaitGroup
 	fetchchan := make(chan byteFetch, 1)
 	errchan := make(chan proxyError, 1)
-	wg.Go(func() {
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
 		defer close(fetchchan)
 		defer fd.datafd.Close()
 		buf, err := io.ReadAll(fd.datafd)
@@ -222,8 +224,11 @@ func (p *proxy) callGetRawBlob(args []any) (rval any, buf []byte, err error) {
 			content: buf,
 			err:     err,
 		}
-	})
-	wg.Go(func() {
+
+	}()
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
 		defer fd.errfd.Close()
 		defer close(errchan)
 		buf, err := io.ReadAll(fd.errfd)
@@ -244,7 +249,7 @@ func (p *proxy) callGetRawBlob(args []any) (rval any, buf []byte, err error) {
 			panic(unmarshalErr)
 		}
 		errchan <- proxyErr
-	})
+	}()
 	wg.Wait()

 	errMsg := <-errchan
@@ -261,7 +266,7 @@ func (p *proxy) callGetRawBlob(args []any) (rval any, buf []byte, err error) {
 	return
 }

-func newProxy(extraArgs ...string) (*proxy, error) {
+func newProxy() (*proxy, error) {
 	fds, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET, 0)
 	if err != nil {
 		return nil, err
@@ -277,8 +282,7 @@ func newProxy(extraArgs ...string) (*proxy, error) {
 	}

 	// Note ExtraFiles starts at 3
-	args := append(append([]string{}, extraArgs...), "experimental-image-proxy", "--sockfd", "3")
-	proc := exec.Command(skopeoBinary, args...)
+	proc := exec.Command("skopeo", "experimental-image-proxy", "--sockfd", "3")
 	proc.Stderr = os.Stderr
 	cmdLifecycleToParentIfPossible(proc)
 	proc.ExtraFiles = append(proc.ExtraFiles, theirfd)
@@ -385,7 +389,7 @@ func runTestMetadataAPIs(p *proxy, img string) error {
 	if err != nil {
 		return err
 	}
-	var layerInfoBytesData []any
+	var layerInfoBytesData []interface{}
 	err = json.Unmarshal(layerInfoBytes, &layerInfoBytesData)
 	if err != nil {
 		return err
@@ -476,8 +480,7 @@ func runTestGetBlob(p *proxy, img string) error {

 func (s *proxySuite) TestProxyMetadata() {
 	t := s.T()
-	// The test image quay.io/coreos/11bot is only available for amd64
-	p, err := newProxy("--override-arch", "amd64")
+	p, err := newProxy()
 	require.NoError(t, err)

 	err = runTestMetadataAPIs(p, knownNotManifestListedImageX8664)
--- a/integration/registry_test.go
+++ b/integration/registry_test.go
@@ -13,18 +13,8 @@ import (
 )

 const (
-	binaryV2                 = "registry"
-	binaryV2Schema1Only      = "registry-v2-schema1-only"
-	binaryV2Schema1Supported = "registry-v2-schema1-supported"
-)
-
-type registryVersion int
-
-const (
-	registryVersionInvalid          registryVersion = iota
-	registryVersionModern                           // Whatever comes from a packaged docker-distribution; as of 2026-03 supports schema2, not schema1.
-	registryVersionSchema1Only                      // Supports only schema1
-	registryVersionSchema1Supported                 // Supports both schema1 and schema2
+	binaryV2        = "registry"
+	binaryV2Schema1 = "registry-v2-schema1"
 )

 type testRegistryV2 struct {
@@ -35,8 +25,8 @@ type testRegistryV2 struct {
 	email    string
 }

-func setupRegistryV2At(t *testing.T, url string, auth bool, version registryVersion) *testRegistryV2 {
-	reg, err := newTestRegistryV2At(t, url, auth, version)
+func setupRegistryV2At(t *testing.T, url string, auth, schema1 bool) *testRegistryV2 {
+	reg, err := newTestRegistryV2At(t, url, auth, schema1)
 	require.NoError(t, err)

 	// Wait for registry to be ready to serve requests.
@@ -53,7 +43,7 @@ func setupRegistryV2At(t *testing.T, url string, auth bool, version registryVers
 	return reg
 }

-func newTestRegistryV2At(t *testing.T, url string, auth bool, version registryVersion) (*testRegistryV2, error) {
+func newTestRegistryV2At(t *testing.T, url string, auth, schema1 bool) (*testRegistryV2, error) {
 	tmp := t.TempDir()
 	template := `version: 0.1
 loglevel: debug
@@ -80,7 +70,7 @@ compatibility:
 		username = "testuser"
 		password = "testpassword"
 		email = "test@test.org"
-		if err := os.WriteFile(htpasswdPath, []byte(userpasswd), os.FileMode(0o644)); err != nil {
+		if err := os.WriteFile(htpasswdPath, []byte(userpasswd), os.FileMode(0644)); err != nil {
 			return nil, err
 		}
 		htpasswd = fmt.Sprintf(`auth:
@@ -99,15 +89,10 @@ compatibility:
 	}

 	var cmd *exec.Cmd
-	switch version {
-	case registryVersionModern:
+	if schema1 {
+		cmd = exec.Command(binaryV2Schema1, confPath)
+	} else {
 		cmd = exec.Command(binaryV2, "serve", confPath)
-	case registryVersionSchema1Only:
-		cmd = exec.Command(binaryV2Schema1Only, confPath)
-	case registryVersionSchema1Supported:
-		cmd = exec.Command(binaryV2Schema1Supported, "serve", confPath)
-	default:
-		return nil, fmt.Errorf("invalid registry version: %v", version)
 	}

 	consumeAndLogOutputs(t, fmt.Sprintf("registry-%s", url), cmd)
--- a/integration/signing_test.go
+++ b/integration/signing_test.go
@@ -1,14 +1,16 @@
 package main

 import (
+	"errors"
 	"fmt"
+	"os"
 	"os/exec"
-	"path/filepath"
+	"strings"
 	"testing"

+	"github.com/containers/image/v5/signature"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
-	"go.podman.io/image/v5/signature"
 )

 const (
@@ -26,6 +28,17 @@ type signingSuite struct {

 var _ = suite.SetupAllSuite(&signingSuite{})

+func findFingerprint(lineBytes []byte) (string, error) {
+	lines := string(lineBytes)
+	for _, line := range strings.Split(lines, "\n") {
+		fields := strings.Split(line, ":")
+		if len(fields) >= 10 && fields[0] == "fpr" {
+			return fields[9], nil
+		}
+	}
+	return "", errors.New("No fingerprint found")
+}
+
 func (s *signingSuite) SetupSuite() {
 	t := s.T()
 	_, err := exec.LookPath(skopeoBinary)
@@ -44,7 +57,7 @@ func (s *signingSuite) SetupSuite() {

 func (s *signingSuite) TestSignVerifySmoke() {
 	t := s.T()
-	mech, err := signature.NewGPGSigningMechanism()
+	mech, _, err := signature.NewEphemeralGPGSigningMechanism([]byte{})
 	require.NoError(t, err)
 	defer mech.Close()
 	if err := mech.SupportsSigning(); err != nil { // FIXME? Test that verification and policy enforcement works, using signatures from fixtures
@@ -54,11 +67,13 @@ func (s *signingSuite) TestSignVerifySmoke() {
 	manifestPath := "fixtures/image.manifest.json"
 	dockerReference := "testing/smoketest"

-	sigOutput := filepath.Join(t.TempDir(), "sig")
-	assertSkopeoSucceeds(t, "^$", "standalone-sign", "-o", sigOutput,
+	sigOutput, err := os.CreateTemp("", "sig")
+	require.NoError(t, err)
+	defer os.Remove(sigOutput.Name())
+	assertSkopeoSucceeds(t, "^$", "standalone-sign", "-o", sigOutput.Name(),
 		manifestPath, dockerReference, s.fingerprint)

 	expected := fmt.Sprintf("^Signature verified using fingerprint %s, digest %s\n$", s.fingerprint, TestImageManifestDigest)
 	assertSkopeoSucceeds(t, expected, "standalone-verify", manifestPath,
-		dockerReference, s.fingerprint, sigOutput)
+		dockerReference, s.fingerprint, sigOutput.Name())
 }
--- a/integration/sync_test.go
+++ b/integration/sync_test.go
@@ -11,14 +11,14 @@ import (
 	"strings"
 	"testing"

+	"github.com/containers/image/v5/docker"
+	"github.com/containers/image/v5/docker/reference"
+	"github.com/containers/image/v5/manifest"
+	"github.com/containers/image/v5/types"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
-	"go.podman.io/image/v5/docker"
-	"go.podman.io/image/v5/docker/reference"
-	"go.podman.io/image/v5/manifest"
-	"go.podman.io/image/v5/types"
 )

 const (
@@ -46,17 +46,18 @@ type syncSuite struct {
 	registry *testRegistryV2
 }

-var (
-	_ = suite.SetupAllSuite(&syncSuite{})
-	_ = suite.TearDownAllSuite(&syncSuite{})
-)
+var _ = suite.SetupAllSuite(&syncSuite{})
+var _ = suite.TearDownAllSuite(&syncSuite{})

 func (s *syncSuite) SetupSuite() {
 	t := s.T()

+	const registryAuth = false
+	const registrySchema1 = false
+
 	if os.Getenv("SKOPEO_LOCAL_TESTS") == "1" {
 		t.Log("Running tests without a container")
-		fmt.Printf("NOTE: tests requires a V2 registry at url=%s\n", v2DockerRegistryURL)
+		fmt.Printf("NOTE: tests requires a V2 registry at url=%s, with auth=%t, schema1=%t \n", v2DockerRegistryURL, registryAuth, registrySchema1)
 		return
 	}

@@ -79,7 +80,7 @@ func (s *syncSuite) SetupSuite() {
 	}

 	// FIXME: Set up TLS for the docker registry port instead of using "--tls-verify=false" all over the place.
-	s.registry = setupRegistryV2At(t, v2DockerRegistryURL, false, registryVersionModern)
+	s.registry = setupRegistryV2At(t, v2DockerRegistryURL, registryAuth, registrySchema1)

 	gpgHome := t.TempDir()
 	t.Setenv("GNUPGHOME", gpgHome)
@@ -91,7 +92,7 @@ func (s *syncSuite) SetupSuite() {

 		out := combinedOutputOfCommand(t, gpgBinary, "--armor", "--export", fmt.Sprintf("%s@example.com", key))
 		err := os.WriteFile(filepath.Join(gpgHome, fmt.Sprintf("%s-pubkey.gpg", key)),
-			[]byte(out), 0o600)
+			[]byte(out), 0600)
 		require.NoError(t, err)
 	}
 }
@@ -140,12 +141,12 @@ func (s *syncSuite) TestDocker2DirTagged() {
 	dir2 := path.Join(tmpDir, "dir2")

 	// sync docker => dir
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
 	require.NoError(t, err)

 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "docker://"+image, "dir:"+dir2)
+	assertSkopeoSucceeds(t, "", "copy", "docker://"+image, "dir:"+dir2)
 	_, err = os.Stat(path.Join(dir2, "manifest.json"))
 	require.NoError(t, err)

@@ -167,12 +168,12 @@ func (s *syncSuite) TestDocker2DirTaggedAll() {
 	dir2 := path.Join(tmpDir, "dir2")

 	// sync docker => dir
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--all", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--all", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
 	require.NoError(t, err)

 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--all", "docker://"+image, "dir:"+dir2)
+	assertSkopeoSucceeds(t, "", "copy", "--all", "docker://"+image, "dir:"+dir2)
 	_, err = os.Stat(path.Join(dir2, "manifest.json"))
 	require.NoError(t, err)

@@ -188,12 +189,11 @@ func (s *syncSuite) TestPreserveDigests() {
 	image := pullableTaggedManifestList

 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--all", "--preserve-digests", "docker://"+image, "dir:"+tmpDir)
+	assertSkopeoSucceeds(t, "", "copy", "--all", "--preserve-digests", "docker://"+image, "dir:"+tmpDir)
 	_, err := os.Stat(path.Join(tmpDir, "manifest.json"))
 	require.NoError(t, err)

-	assertSkopeoFails(t, ".*Instructed to preserve digests.*",
-		"copy", "--retry-times", "3", "--all", "--preserve-digests", "--format=oci", "docker://"+image, "dir:"+tmpDir)
+	assertSkopeoFails(t, ".*Instructed to preserve digests.*", "copy", "--all", "--preserve-digests", "--format=oci", "docker://"+image, "dir:"+tmpDir)
 }

 func (s *syncSuite) TestScoped() {
@@ -205,11 +205,11 @@ func (s *syncSuite) TestScoped() {
 	imagePath := imageRef.DockerReference().String()

 	dir1 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, path.Base(imagePath), "manifest.json"))
 	require.NoError(t, err)

-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
 	require.NoError(t, err)
 }
@@ -223,18 +223,18 @@ func (s *syncSuite) TestDirIsNotOverwritten() {
 	imagePath := imageRef.DockerReference().String()

 	// make a copy of the image in the local registry
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--dest-tls-verify=false", "docker://"+image, "docker://"+path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())))
+	assertSkopeoSucceeds(t, "", "copy", "--dest-tls-verify=false", "docker://"+image, "docker://"+path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())))

-	// sync upstream image to dir, not scoped
+	//sync upstream image to dir, not scoped
 	dir1 := t.TempDir()
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, path.Base(imagePath), "manifest.json"))
 	require.NoError(t, err)

-	// sync local registry image to dir, not scoped
+	//sync local registry image to dir, not scoped
 	assertSkopeoFails(t, ".*Refusing to overwrite destination directory.*", "sync", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())), dir1)

-	// sync local registry image to dir, scoped
+	//sync local registry image to dir, scoped
 	imageRef, err = docker.ParseReference(fmt.Sprintf("//%s", path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference()))))
 	require.NoError(t, err)
 	imagePath = imageRef.DockerReference().String()
@@ -254,7 +254,7 @@ func (s *syncSuite) TestDocker2DirUntagged() {
 	imagePath := imageRef.DockerReference().String()

 	dir1 := path.Join(tmpDir, "dir1")
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)

 	sysCtx := types.SystemContext{}
 	tags, err := docker.GetRepositoryTags(context.Background(), &sysCtx, imageRef)
@@ -289,9 +289,9 @@ func (s *syncSuite) TestYamlUntagged() {

 	// sync to the local registry
 	yamlFile := path.Join(tmpDir, "registries.yaml")
-	err = os.WriteFile(yamlFile, []byte(yamlConfig), 0o644)
+	err = os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--scoped", "--src", "yaml", "--dest", "docker", "--dest-tls-verify=false", yamlFile, v2DockerRegistryURL)
+	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "docker", "--dest-tls-verify=false", yamlFile, v2DockerRegistryURL)
 	// sync back from local registry to a folder
 	os.Remove(yamlFile)
 	yamlConfig = fmt.Sprintf(`
@@ -301,7 +301,7 @@ func (s *syncSuite) TestYamlUntagged() {
    %s: []
 `, v2DockerRegistryURL, imagePath)

-	err = os.WriteFile(yamlFile, []byte(yamlConfig), 0o644)
+	err = os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	require.NoError(t, err)
 	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)

@@ -328,13 +328,13 @@ registry.k8s.io:
    pause: ^[12]\.0$  # regex string test
 `
 	// the       ↑    regex strings always matches only 2 images
-	nTags := 2
+	var nTags = 2
 	assert.NotZero(t, nTags)

 	yamlFile := path.Join(tmpDir, "registries.yaml")
-	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0o644)
+	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
 	assertNumberOfManifestsInSubdirs(t, dir1, nTags)
 }

@@ -350,9 +350,9 @@ registry.k8s.io:
    - sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610
 `
 	yamlFile := path.Join(tmpDir, "registries.yaml")
-	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0o644)
+	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
 	assertNumberOfManifestsInSubdirs(t, dir1, 1)
 }

@@ -381,7 +381,7 @@ quay.io:
 	// get the number of tags
 	re := regexp.MustCompile(`^ +- +[^:/ ]+`)
 	var nTags int
-	for l := range strings.SplitSeq(yamlConfig, "\n") {
+	for _, l := range strings.Split(yamlConfig, "\n") {
 		if re.MatchString(l) {
 			nTags++
 		}
@@ -389,9 +389,9 @@ quay.io:
 	assert.NotZero(t, nTags)

 	yamlFile := path.Join(tmpDir, "registries.yaml")
-	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0o644)
+	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	require.NoError(t, err)
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
+	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
 	assertNumberOfManifestsInSubdirs(t, dir1, nTags)
 }

@@ -405,7 +405,7 @@ func (s *syncSuite) TestYamlTLSVerify() {

 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	// copy docker => docker
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "--dest-tls-verify=false", "docker://"+image+":"+tag, localRegURL+image+":"+tag)
+	assertSkopeoSucceeds(t, "", "copy", "--dest-tls-verify=false", "docker://"+image+":"+tag, localRegURL+image+":"+tag)

 	yamlTemplate := `
 %s:
@@ -440,13 +440,14 @@ func (s *syncSuite) TestYamlTLSVerify() {
 	for _, cfg := range testCfg {
 		yamlConfig := fmt.Sprintf(yamlTemplate, v2DockerRegistryURL, cfg.tlsVerify, image, tag)
 		yamlFile := path.Join(tmpDir, "registries.yaml")
-		err := os.WriteFile(yamlFile, []byte(yamlConfig), 0o644)
+		err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 		require.NoError(t, err)

 		cfg.checker(t, cfg.msg, "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
 		os.Remove(yamlFile)
 		os.RemoveAll(dir1)
 	}
+
 }

 func (s *syncSuite) TestSyncManifestOutput() {
@@ -457,14 +458,14 @@ func (s *syncSuite) TestSyncManifestOutput() {
 	destDir2 := filepath.Join(tmpDir, "dest2")
 	destDir3 := filepath.Join(tmpDir, "dest3")

-	// Split image:tag path from image URI for manifest comparison
+	//Split image:tag path from image URI for manifest comparison
 	imageDir := pullableTaggedImage[strings.LastIndex(pullableTaggedImage, "/")+1:]

-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--format=oci", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir1)
+	assertSkopeoSucceeds(t, "", "sync", "--format=oci", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir1)
 	verifyManifestMIMEType(t, filepath.Join(destDir1, imageDir), imgspecv1.MediaTypeImageManifest)
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--format=v2s2", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir2)
+	assertSkopeoSucceeds(t, "", "sync", "--format=v2s2", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir2)
 	verifyManifestMIMEType(t, filepath.Join(destDir2, imageDir), manifest.DockerV2Schema2MediaType)
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--format=v2s1", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir3)
+	assertSkopeoSucceeds(t, "", "sync", "--format=v2s1", "--all", "--src", "docker", "--dest", "dir", pullableTaggedImage, destDir3)
 	verifyManifestMIMEType(t, filepath.Join(destDir3, imageDir), manifest.DockerV2Schema1SignedMediaType)
 }

@@ -484,10 +485,10 @@ func (s *syncSuite) TestDocker2DockerTagged() {
 	dir2 := path.Join(tmpDir, "dir2")

 	// sync docker => docker
-	assertSkopeoSucceeds(t, "", "sync", "--retry-times", "3", "--scoped", "--dest-tls-verify=false", "--src", "docker", "--dest", "docker", image, v2DockerRegistryURL)
+	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--dest-tls-verify=false", "--src", "docker", "--dest", "docker", image, v2DockerRegistryURL)

 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "docker://"+image, "dir:"+dir1)
+	assertSkopeoSucceeds(t, "", "copy", "docker://"+image, "dir:"+dir1)
 	_, err = os.Stat(path.Join(dir1, "manifest.json"))
 	require.NoError(t, err)

@@ -510,18 +511,18 @@ func (s *syncSuite) TestDir2DockerTagged() {
 	image := pullableRepoWithLatestTag

 	dir1 := path.Join(tmpDir, "dir1")
-	err := os.Mkdir(dir1, 0o755)
+	err := os.Mkdir(dir1, 0755)
 	require.NoError(t, err)
 	dir2 := path.Join(tmpDir, "dir2")
-	err = os.Mkdir(dir2, 0o755)
+	err = os.Mkdir(dir2, 0755)
 	require.NoError(t, err)

 	// create leading dirs
-	err = os.MkdirAll(path.Dir(path.Join(dir1, image)), 0o755)
+	err = os.MkdirAll(path.Dir(path.Join(dir1, image)), 0755)
 	require.NoError(t, err)

 	// copy docker => dir
-	assertSkopeoSucceeds(t, "", "copy", "--retry-times", "3", "docker://"+image, "dir:"+path.Join(dir1, image))
+	assertSkopeoSucceeds(t, "", "copy", "docker://"+image, "dir:"+path.Join(dir1, image))
 	_, err = os.Stat(path.Join(dir1, image, "manifest.json"))
 	require.NoError(t, err)

@@ -529,7 +530,7 @@ func (s *syncSuite) TestDir2DockerTagged() {
 	assertSkopeoSucceeds(t, "", "sync", "--scoped", "--dest-tls-verify=false", "--src", "dir", "--dest", "docker", dir1, v2DockerRegistryURL)

 	// create leading dirs
-	err = os.MkdirAll(path.Dir(path.Join(dir2, image)), 0o755)
+	err = os.MkdirAll(path.Dir(path.Join(dir2, image)), 0755)
 	require.NoError(t, err)

 	// copy docker => dir
@@ -569,11 +570,11 @@ func (s *syncSuite) TestFailsWithDockerSourceNoRegistry() {

 	tmpDir := t.TempDir()

-	// untagged
+	//untagged
 	assertSkopeoFails(t, ".*StatusCode: 404.*",
 		"sync", "--scoped", "--src", "docker", "--dest", "dir", regURL, tmpDir)

-	// tagged
+	//tagged
 	assertSkopeoFails(t, ".*StatusCode: 404.*",
 		"sync", "--scoped", "--src", "docker", "--dest", "dir", regURL+":thetag", tmpDir)
 }
@@ -583,11 +584,11 @@ func (s *syncSuite) TestFailsWithDockerSourceUnauthorized() {
 	const repo = "privateimagenamethatshouldnotbepublic"
 	tmpDir := t.TempDir()

-	// untagged
+	//untagged
 	assertSkopeoFails(t, ".*requested access to the resource is denied.*",
 		"sync", "--scoped", "--src", "docker", "--dest", "dir", repo, tmpDir)

-	// tagged
+	//tagged
 	assertSkopeoFails(t, ".*requested access to the resource is denied.*",
 		"sync", "--scoped", "--src", "docker", "--dest", "dir", repo+":thetag", tmpDir)
 }
@@ -597,11 +598,11 @@ func (s *syncSuite) TestFailsWithDockerSourceNotExisting() {
 	repo := path.Join(v2DockerRegistryURL, "imagedoesnotexist")
 	tmpDir := t.TempDir()

-	// untagged
+	//untagged
 	assertSkopeoFails(t, ".*repository name not known to registry.*",
 		"sync", "--scoped", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", repo, tmpDir)

-	// tagged
+	//tagged
 	assertSkopeoFails(t, ".*reading manifest.*",
 		"sync", "--scoped", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", repo+":thetag", tmpDir)
 }
--- a/integration/tls_test.go
+++ b/integration/tls_test.go
@@ -1,302 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/opencontainers/image-spec/specs-go"
-	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
-	"go.podman.io/image/v5/oci/layout"
-)
-
-func TestTLS(t *testing.T) {
-	suite.Run(t, &tlsSuite{})
-}
-
-type tlsSuite struct {
-	suite.Suite
-	defaultServer *tlsConfigServer
-	tls12Server   *tlsConfigServer
-	nonPQCserver  *tlsConfigServer
-	pqcServer     *tlsConfigServer
-
-	expected []expectedBehavior
-}
-
-var (
-	_ = suite.SetupAllSuite(&tlsSuite{})
-	_ = suite.TearDownAllSuite(&tlsSuite{})
-)
-
-type expectedBehavior struct {
-	server     *tlsConfigServer
-	tlsDetails string
-	expected   string
-}
-
-func (s *tlsSuite) SetupSuite() {
-	t := s.T()
-
-	s.defaultServer = newServer(t, &tls.Config{})
-	s.tls12Server = newServer(t, &tls.Config{
-		MaxVersion: tls.VersionTLS12,
-	})
-	s.nonPQCserver = newServer(t, &tls.Config{
-		MinVersion:       tls.VersionTLS13,
-		CurvePreferences: []tls.CurveID{tls.X25519, tls.CurveP256, tls.CurveP384, tls.CurveP521},
-	})
-	s.pqcServer = newServer(t, &tls.Config{
-		MinVersion:       tls.VersionTLS13,
-		CurvePreferences: []tls.CurveID{tls.X25519MLKEM768},
-	})
-
-	s.expected = []expectedBehavior{
-		{
-			server:     s.defaultServer,
-			tlsDetails: "fixtures/tls-details-anything.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-		{
-			server:     s.tls12Server,
-			tlsDetails: "fixtures/tls-details-anything.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-		{
-			server:     s.nonPQCserver,
-			tlsDetails: "fixtures/tls-details-anything.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-		{
-			server:     s.pqcServer,
-			tlsDetails: "fixtures/tls-details-anything.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-
-		{
-			server:     s.defaultServer,
-			tlsDetails: "fixtures/tls-details-1.3.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-		{
-			server:     s.tls12Server,
-			tlsDetails: "fixtures/tls-details-1.3.yaml",
-			expected:   `protocol version not supported`,
-		},
-		{
-			server:     s.nonPQCserver,
-			tlsDetails: "fixtures/tls-details-1.3.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-		{
-			server:     s.pqcServer,
-			tlsDetails: "fixtures/tls-details-1.3.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-
-		{
-			server:     s.defaultServer,
-			tlsDetails: "fixtures/tls-details-pqc-only.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-		{
-			server:     s.tls12Server,
-			tlsDetails: "fixtures/tls-details-pqc-only.yaml",
-			expected:   `protocol version not supported`,
-		},
-		{
-			server:     s.nonPQCserver,
-			tlsDetails: "fixtures/tls-details-pqc-only.yaml",
-			expected:   `handshake failure`,
-		},
-		{
-			server:     s.pqcServer,
-			tlsDetails: "fixtures/tls-details-pqc-only.yaml",
-			expected:   `\b418\b`, // "I'm a teapot"
-		},
-	}
-}
-
-func (s *tlsSuite) TearDownSuite() {
-}
-
-func (s *tlsSuite) TestDockerDaemon() {
-	t := s.T()
-
-	// Our server doesn’t perform client authentication, but the docker-daemon: option semantics
-	// requires us to provide a certificate if we want to specify a CA.
-	dockerCertPath := t.TempDir()
-	caPath := filepath.Join(dockerCertPath, "ca.pem")
-
-	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
-	require.NoError(t, err)
-	publicKey := &privateKey.PublicKey
-
-	err = os.WriteFile(filepath.Join(dockerCertPath, "key.pem"), pem.EncodeToMemory(&pem.Block{
-		Type:  "RSA PRIVATE KEY",
-		Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
-	}), 0o644)
-	require.NoError(t, err)
-
-	referenceTime := time.Now()
-	template := &x509.Certificate{
-		Subject: pkix.Name{
-			CommonName: "client",
-		},
-		NotBefore: referenceTime.Add(-1 * time.Minute),
-		NotAfter:  referenceTime.Add(1 * time.Hour),
-	}
-	certDER, err := x509.CreateCertificate(rand.Reader, template, template, publicKey, privateKey)
-	require.NoError(t, err)
-	err = os.WriteFile(filepath.Join(dockerCertPath, "cert.pem"), pem.EncodeToMemory(&pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: certDER,
-	}), 0o644)
-	require.NoError(t, err)
-
-	for _, e := range s.expected {
-		err := os.WriteFile(caPath, e.server.certBytes, 0o644)
-		require.NoError(t, err)
-		assertSkopeoFails(t, e.expected, "--tls-details", e.tlsDetails, "inspect", "--daemon-host", e.server.server.URL, "--cert-dir", dockerCertPath, "docker-daemon:repo:tag")
-	}
-}
-
-func (s *tlsSuite) TestRegistry() {
-	t := s.T()
-
-	caDir := t.TempDir()
-	caPath := filepath.Join(caDir, "ca.crt")
-
-	for _, e := range s.expected {
-		err := os.WriteFile(caPath, e.server.certBytes, 0o644)
-		require.NoError(t, err)
-		assertSkopeoFails(t, e.expected, "--tls-details", e.tlsDetails, "inspect", "--cert-dir", caDir, "docker://"+e.server.hostPort+"/repo")
-	}
-}
-
-func (s *tlsSuite) TestOCILayout() {
-	t := s.T()
-
-	caDir := t.TempDir()
-	caPath := filepath.Join(caDir, "ca.crt")
-
-	for _, e := range s.expected {
-		err := os.WriteFile(caPath, e.server.certBytes, 0o644)
-		require.NoError(t, err)
-
-		ociLayoutDir := t.TempDir()
-		destRef, err := layout.NewReference(ociLayoutDir, "repo:tag")
-		require.NoError(t, err)
-		dest, err := destRef.NewImageDestination(context.Background(), nil)
-		require.NoError(t, err)
-		manifestBytes, err := json.Marshal(imgspecv1.Manifest{
-			Versioned: specs.Versioned{SchemaVersion: 2},
-			MediaType: imgspecv1.MediaTypeImageManifest,
-			Config: imgspecv1.Descriptor{
-				MediaType: imgspecv1.MediaTypeImageConfig,
-				Digest:    "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-				Size:      42,
-				URLs:      []string{e.server.server.URL + "/config.json"},
-			},
-			Layers:       []imgspecv1.Descriptor{},
-			ArtifactType: "",
-			Subject:      &imgspecv1.Descriptor{},
-			Annotations:  map[string]string{},
-		})
-		require.NoError(t, err)
-		err = dest.PutManifest(context.Background(), manifestBytes, nil)
-		require.NoError(t, err)
-		err = dest.Commit(context.Background(), nil) // nil is technically invalid, but works here
-		require.NoError(t, err)
-		err = dest.Close()
-		require.NoError(t, err)
-
-		// We don’t expose types.OCICertPath in the CLI. But if we get far enough to be worrying about certificates,
-		// we already negotiated the TLS version and named group.
-		expected := e.expected
-		if expected == `\b418\b` {
-			expected = `certificate signed by unknown authority`
-		}
-		assertSkopeoFails(t, expected, "--tls-details", e.tlsDetails, "inspect", "oci:"+ociLayoutDir)
-	}
-}
-
-func (s *tlsSuite) TestOpenShift() {
-	t := s.T()
-
-	configDir := t.TempDir()
-	configPath := filepath.Join(configDir, "kubeconfig")
-	t.Setenv("KUBECONFIG", configPath)
-
-	for _, e := range s.expected {
-		err := os.WriteFile(configPath, fmt.Appendf(nil,
-			`apiVersion: v1
-clusters:
- cluster:
-    certificate-authority: "%s"
-    server: "%s"
-  name: our-cluster
-contexts:
- context:
-    cluster: our-cluster
-    namespace: default
-  name: our-context
-current-context: our-context
-kind: Config
-`, e.server.certPath, e.server.server.URL), 0o644)
-		require.NoError(t, err)
-		// The atomic: image access starts with resolving the tag in a k8s API (and that will always fail, one way or another),
-		// so we never actually contact registry.example.
-		assertSkopeoFails(t, e.expected, "--tls-details", e.tlsDetails, "inspect", "atomic:registry.example/namespace/repo:tag")
-	}
-}
-
-// tlsConfigServer serves TLS with a specific configuration.
-// It returns StatusTeapot on all requests; we use that to detect that the TLS negotiation succeeded,
-// without bothering to actually implement any of the protocols.
-type tlsConfigServer struct {
-	server    *httptest.Server
-	hostPort  string
-	certBytes []byte
-	certPath  string
-}
-
-func newServer(t *testing.T, config *tls.Config) *tlsConfigServer {
-	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusTeapot)
-	}))
-	t.Cleanup(server.Close)
-
-	server.TLS = config.Clone()
-	server.StartTLS()
-
-	certBytes := pem.EncodeToMemory(&pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: server.Certificate().Raw,
-	})
-	certDir := t.TempDir()
-	certPath := filepath.Join(certDir, "cert.pem")
-	err := os.WriteFile(certPath, certBytes, 0o644)
-	require.NoError(t, err)
-
-	return &tlsConfigServer{
-		server:    server,
-		hostPort:  server.Listener.Addr().String(),
-		certBytes: certBytes,
-		certPath:  certPath,
-	}
-}
--- a/integration/user_agent_test.go
+++ b/integration/user_agent_test.go
@@ -1,114 +0,0 @@
-package main
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// mockRegistryHandler implements a minimal Docker Registry V2 API that captures User-Agent headers
-type mockRegistryHandler struct {
-	mu         sync.Mutex
-	userAgents []string
-}
-
-func (h *mockRegistryHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// Capture the User-Agent header
-	h.mu.Lock()
-	h.userAgents = append(h.userAgents, r.Header.Get("User-Agent"))
-	h.mu.Unlock()
-
-	// Implement minimal Docker Registry V2 API endpoints for inspect --raw
-	switch {
-	case r.URL.Path == "/v2/":
-		// Registry version check endpoint
-		w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
-		w.WriteHeader(http.StatusOK)
-
-	case strings.HasSuffix(r.URL.Path, "/manifests/latest"):
-		// Return a minimal OCI manifest as raw string
-		// The digest matches this exact content
-		manifest := `{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0}]}`
-		w.Header().Set("Content-Type", "application/vnd.oci.image.manifest.v1+json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(manifest)); err != nil {
-			panic(err)
-		}
-
-	default:
-		w.WriteHeader(http.StatusNotFound)
-	}
-}
-
-func (h *mockRegistryHandler) getUserAgents() []string {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return slices.Clone(h.userAgents)
-}
-
-func TestUserAgent(t *testing.T) {
-	testCases := []struct {
-		name               string
-		extraArgs          []string
-		userAgentValidator func(string) bool
-		description        string
-	}{
-		{
-			name:      "default user agent",
-			extraArgs: []string{},
-			userAgentValidator: func(ua string) bool {
-				return strings.HasPrefix(ua, "skopeo/")
-			},
-			description: "Default user agent should start with 'skopeo/'",
-		},
-		{
-			name:      "custom user agent prefix",
-			extraArgs: []string{"--user-agent-prefix", "bootc/1.0"},
-			userAgentValidator: func(ua string) bool {
-				return strings.HasPrefix(ua, "bootc/1.0 skopeo/")
-			},
-			description: "Custom user agent should be in format 'prefix skopeo/version'",
-		},
-		{
-			name:      "prefix with spaces",
-			extraArgs: []string{"--user-agent-prefix", "my cool app"},
-			userAgentValidator: func(ua string) bool {
-				return strings.HasPrefix(ua, "my cool app skopeo/")
-			},
-			description: "User agent with spaces should work correctly",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			handler := &mockRegistryHandler{}
-			server := httptest.NewServer(handler)
-			defer server.Close()
-
-			// Extract host:port from the test server URL
-			registryAddr := strings.TrimPrefix(server.URL, "http://")
-			imageRef := "docker://" + registryAddr + "/test/image:latest"
-
-			// Build arguments: base args + test-specific args + image ref
-			args := append([]string{"--tls-verify=false"}, tc.extraArgs...)
-			args = append(args, "inspect", "--raw", imageRef)
-
-			// Run skopeo inspect --raw
-			assertSkopeoSucceeds(t, "", args...)
-
-			// Verify that at least one request was made with the expected User-Agent
-			userAgents := handler.getUserAgents()
-			require.NotEmpty(t, userAgents, "Expected at least one request to be made")
-
-			// Check that at least one User-Agent matches the validator
-			require.True(t,
-				slices.ContainsFunc(userAgents, tc.userAgentValidator),
-				"%s, got: %v", tc.description, userAgents)
-		})
-	}
-}
--- a/integration/utils_test.go
+++ b/integration/utils_test.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/json"
-	"errors"
 	"io"
 	"net"
 	"net/netip"
@@ -15,37 +14,17 @@ import (
 	"testing"
 	"time"

+	"github.com/containers/image/v5/manifest"
 	"github.com/opencontainers/go-digest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.podman.io/image/v5/manifest"
 )

-// FIXME: Move to SetupSuite
-// https://github.com/containers/skopeo/pull/2703#discussion_r2331374730
-var skopeoBinary = func() string {
-	if binary := os.Getenv("SKOPEO_BINARY"); binary != "" {
-		return binary
-	}
-	return "skopeo"
-}()
+const skopeoBinary = "skopeo"

-// findFingerprint extracts the GPG key fingerprint from gpg --with-colons output.
-func findFingerprint(lineBytes []byte) (string, error) {
-	for line := range bytes.SplitSeq(lineBytes, []byte{'\n'}) {
-		fields := strings.Split(string(line), ":")
-		if len(fields) >= 10 && fields[0] == "fpr" {
-			return fields[9], nil
-		}
-	}
-	return "", errors.New("No fingerprint found")
-}
-
-const (
-	testFQIN           = "docker://quay.io/libpod/busybox" // tag left off on purpose, some tests need to add a special one
-	testFQIN64         = "docker://quay.io/libpod/busybox:amd64"
-	testFQINMultiLayer = "docker://quay.io/libpod/alpine_nginx:latest" // multi-layer
-)
+const testFQIN = "docker://quay.io/libpod/busybox" // tag left off on purpose, some tests need to add a special one
+const testFQIN64 = "docker://quay.io/libpod/busybox:amd64"
+const testFQINMultiLayer = "docker://quay.io/libpod/alpine_nginx:latest" // multi-layer

 // consumeAndLogOutputStream takes (f, err) from an exec.*Pipe(), and causes all output to it to be logged to t.
 func consumeAndLogOutputStream(t *testing.T, id string, f io.ReadCloser, err error) {
@@ -206,9 +185,14 @@ func fileFromFixture(t *testing.T, inputPath string, edits map[string]string) st
 		contents = updated
 	}

-	path := filepath.Join(t.TempDir(), "policy.json")
+	file, err := os.CreateTemp("", "policy.json")
+	require.NoError(t, err)
+	path := file.Name()
+	t.Cleanup(func() { os.Remove(path) })

-	err = os.WriteFile(path, contents, 0o600)
+	_, err = file.Write(contents)
+	require.NoError(t, err)
+	err = file.Close()
 	require.NoError(t, err)
 	return path
 }
--- a/plans/main.fmf
+++ b/plans/main.fmf
@@ -24,11 +24,3 @@ prepare:
        fi
        dnf -y upgrade --allowerasing
      order: 20
-    - name: Disable installing everything from srpm
-      how: install
-      exclude:
-        - ".*"
-    - name: Install the main package
-      how: install
-      package:
-        - skopeo-tests
--- a/rpm/gating.yaml
+++ b/rpm/gating.yaml
@@ -0,0 +1,16 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts:
+  - bodhi_update_push_stable
+  - bodhi_update_push_testing
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+
+--- !Policy
+product_versions:
+  - rhel-*
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
--- a/rpm/skopeo.spec
+++ b/rpm/skopeo.spec
@@ -9,27 +9,26 @@

 %global gomodulesmode GO111MODULE=on

-# Distro and environment conditionals
+# No btrfs on RHEL
 %if %{defined fedora}
-# Fedora conditionals
 %define build_with_btrfs 1
-%define conditional_epoch 1
-%if %{?fedora} >= 43
-%define sequoia 1
 %endif
-%else
-# RHEL conditionals
-%define conditional_epoch 2
+
+%if %{defined rhel}
 %define fips 1
 %endif

-# set higher Epoch only for podman-next builds
-%if %{defined copr_username} && "%{copr_username}" == "rhcontainerbot" && "%{copr_projectname}" == "podman-next"
-%define next_build 1
+# Only used in official koji builds
+# Copr builds set a separate epoch for all environments
+%if %{defined fedora}
+%define conditional_epoch 1
+%define fakeroot 1
+%else
+%define conditional_epoch 2
 %endif

 Name: skopeo
-%if %{defined next_build}
+%if %{defined copr_username}
 Epoch: 102
 %else
 Epoch: %{conditional_epoch}
@@ -69,20 +68,20 @@ BuildRequires: make
 BuildRequires: shadow-utils-subid-devel
 BuildRequires: sqlite-devel
 Requires: containers-common >= 4:1-21
-%if %{defined sequoia}
-Requires: podman-sequoia
-%endif

 %description
 Command line utility to inspect images and repositories directly on Docker
-registries without the need to pull them.
+registries without the need to pull them

 # NOTE: The tests subpackage is only intended for testing and will not be supported
 # for end-users and/or customers.
 %package tests
-Summary: Test dependencies for %{name}
+Summary: Tests for %{name}

 Requires: %{name} = %{epoch}:%{version}-%{release}
+%if %{defined fakeroot}
+Requires: fakeroot
+%endif
 Requires: gnupg
 Requires: jq
 Requires: golang
@@ -91,12 +90,13 @@ Requires: crun
 Requires: httpd-tools
 Requires: openssl
 Requires: squashfs-tools
-# bats and fakeroot are not present on RHEL and ELN so they shouldn't be strong deps
+# bats is not present on RHEL and ELN so it shouldn't be a strong dep
 Recommends: bats
-Recommends: fakeroot

 %description tests
-This package installs system test dependencies for %{name}
+%{summary}
+
+This package contains system tests for %{name}

 %prep
 %autosetup -Sgit %{name}-%{version}
@@ -130,10 +130,6 @@ export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs"
 export BUILDTAGS="$BUILDTAGS libtrust_openssl"
 %endif

-%if %{defined sequoia}
-export BUILDTAGS="$BUILDTAGS containers_image_sequoia"
-%endif
-
 # unset LDFLAGS earlier set from set_build_flags
 LDFLAGS=''

@@ -146,6 +142,10 @@ make \
    PREFIX=%{_prefix} \
    install-binary install-docs install-completions

+# system tests
+install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
+cp -pav systemtest/* %{buildroot}/%{_datadir}/%{name}/test/system/
+
 #define license tag if not already defined
 %{!?_licensedir:%global license %doc}

@@ -166,8 +166,9 @@ make \
 %dir %{_datadir}/zsh/site-functions
 %{_datadir}/zsh/site-functions/_%{name}

-# Only test dependencies installed, no files.
 %files tests
+%license LICENSE vendor/modules.txt
+%{_datadir}/%{name}/test

 %changelog
 %autochangelog
--- a/systemtest/050-signing.bats
+++ b/systemtest/050-signing.bats
@@ -136,8 +136,6 @@ END_PUSH
    # Done pushing. Now try to fetch. From here on we use the --policy option.
    # The table below lists the paths to fetch, and the expected errors (or
    # none, if we expect them to pass).
-    #
-    # "Invalid GPG signature" is reported by the gpgme mechanism; "Missing key: $fingerprint" or "Missing key $fingerprint" by Sequoia.
    while read path expected_error; do
        expected_rc=
        if [[ -n $expected_error ]]; then
@@ -156,7 +154,7 @@ END_PUSH
        fi
    done <<END_TESTS
 /myns/alice:signed
-/myns/bob:signedbyalice    (Invalid GPG signature|Missing key)
+/myns/bob:signedbyalice    Invalid GPG signature
 /myns/alice:unsigned       Signature for identity \\\\\\\\"localhost:5000/myns/alice:signed\\\\\\\\" is not accepted
 /myns/carol:latest         Running image docker://localhost:5000/myns/carol:latest is rejected by policy.
 /open/forall:latest
--- a/systemtest/tmt/main.fmf
+++ b/systemtest/tmt/main.fmf
@@ -1,3 +1,6 @@
+require:
+    - skopeo-tests
+
 environment:
    SKOPEO_BINARY: /usr/bin/skopeo

@@ -7,13 +10,5 @@ adjust:
        RELEASE_TESTING: true

 summary: System test
-test: |
-    rpm -q containers-common skopeo-tests
-    # If these tests are to be run anywhere else, TMT can fetch
-    # them using the URL and git ref, so git commands should work.
-    make -C $(git rev-parse --show-toplevel) test-system-local
-require:
-    - git-core
-    - make
-    - skopeo-tests
+test: bash ./test.sh
 duration: 60m
--- a/systemtest/tmt/test.sh
+++ b/systemtest/tmt/test.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -exo pipefail
+
+uname -r
+
+rpm -q \
+    bats \
+    containers-common \
+    skopeo \
+    skopeo-tests \
+
+bats /usr/share/skopeo/test/system
--- a/vendor/cyphar.com/go-pathrs/.golangci.yml
+++ b/vendor/cyphar.com/go-pathrs/.golangci.yml
@@ -1,43 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-#
-# libpathrs: safe path resolution on Linux
-# Copyright (C) 2019-2025 SUSE LLC
-# Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-version: "2"
-linters:
-  enable:
-    - bidichk
-    - cyclop
-    - errname
-    - errorlint
-    - exhaustive
-    - goconst
-    - godot
-    - gomoddirectives
-    - gosec
-    - mirror
-    - misspell
-    - mnd
-    - nilerr
-    - nilnil
-    - perfsprint
-    - prealloc
-    - reassign
-    - revive
-    - unconvert
-    - unparam
-    - usestdlibvars
-    - wastedassign
-formatters:
-  enable:
-    - gofumpt
-    - goimports
-  settings:
-    goimports:
-      local-prefixes:
-        - cyphar.com/go-pathrs
--- a/vendor/cyphar.com/go-pathrs/COPYING
+++ b/vendor/cyphar.com/go-pathrs/COPYING
@@ -1,373 +0,0 @@
-Mozilla Public License Version 2.0
-==================================
-
-1. Definitions
--------------
-
-1.1. "Contributor"
-    means each individual or legal entity that creates, contributes to
-    the creation of, or owns Covered Software.
-
-1.2. "Contributor Version"
-    means the combination of the Contributions of others (if any) used
-    by a Contributor and that particular Contributor's Contribution.
-
-1.3. "Contribution"
-    means Covered Software of a particular Contributor.
-
-1.4. "Covered Software"
-    means Source Code Form to which the initial Contributor has attached
-    the notice in Exhibit A, the Executable Form of such Source Code
-    Form, and Modifications of such Source Code Form, in each case
-    including portions thereof.
-
-1.5. "Incompatible With Secondary Licenses"
-    means
-
-    (a) that the initial Contributor has attached the notice described
-        in Exhibit B to the Covered Software; or
-
-    (b) that the Covered Software was made available under the terms of
-        version 1.1 or earlier of the License, but not also under the
-        terms of a Secondary License.
-
-1.6. "Executable Form"
-    means any form of the work other than Source Code Form.
-
-1.7. "Larger Work"
-    means a work that combines Covered Software with other material, in
-    a separate file or files, that is not Covered Software.
-
-1.8. "License"
-    means this document.
-
-1.9. "Licensable"
-    means having the right to grant, to the maximum extent possible,
-    whether at the time of the initial grant or subsequently, any and
-    all of the rights conveyed by this License.
-
-1.10. "Modifications"
-    means any of the following:
-
-    (a) any file in Source Code Form that results from an addition to,
-        deletion from, or modification of the contents of Covered
-        Software; or
-
-    (b) any new file in Source Code Form that contains any Covered
-        Software.
-
-1.11. "Patent Claims" of a Contributor
-    means any patent claim(s), including without limitation, method,
-    process, and apparatus claims, in any patent Licensable by such
-    Contributor that would be infringed, but for the grant of the
-    License, by the making, using, selling, offering for sale, having
-    made, import, or transfer of either its Contributions or its
-    Contributor Version.
-
-1.12. "Secondary License"
-    means either the GNU General Public License, Version 2.0, the GNU
-    Lesser General Public License, Version 2.1, the GNU Affero General
-    Public License, Version 3.0, or any later versions of those
-    licenses.
-
-1.13. "Source Code Form"
-    means the form of the work preferred for making modifications.
-
-1.14. "You" (or "Your")
-    means an individual or a legal entity exercising rights under this
-    License. For legal entities, "You" includes any entity that
-    controls, is controlled by, or is under common control with You. For
-    purposes of this definition, "control" means (a) the power, direct
-    or indirect, to cause the direction or management of such entity,
-    whether by contract or otherwise, or (b) ownership of more than
-    fifty percent (50%) of the outstanding shares or beneficial
-    ownership of such entity.
-
-2. License Grants and Conditions
--------------------------------
-
-2.1. Grants
-
-Each Contributor hereby grants You a world-wide, royalty-free,
-non-exclusive license:
-
-(a) under intellectual property rights (other than patent or trademark)
-    Licensable by such Contributor to use, reproduce, make available,
-    modify, display, perform, distribute, and otherwise exploit its
-    Contributions, either on an unmodified basis, with Modifications, or
-    as part of a Larger Work; and
-
-(b) under Patent Claims of such Contributor to make, use, sell, offer
-    for sale, have made, import, and otherwise transfer either its
-    Contributions or its Contributor Version.
-
-2.2. Effective Date
-
-The licenses granted in Section 2.1 with respect to any Contribution
-become effective for each Contribution on the date the Contributor first
-distributes such Contribution.
-
-2.3. Limitations on Grant Scope
-
-The licenses granted in this Section 2 are the only rights granted under
-this License. No additional rights or licenses will be implied from the
-distribution or licensing of Covered Software under this License.
-Notwithstanding Section 2.1(b) above, no patent license is granted by a
-Contributor:
-
-(a) for any code that a Contributor has removed from Covered Software;
-    or
-
-(b) for infringements caused by: (i) Your and any other third party's
-    modifications of Covered Software, or (ii) the combination of its
-    Contributions with other software (except as part of its Contributor
-    Version); or
-
-(c) under Patent Claims infringed by Covered Software in the absence of
-    its Contributions.
-
-This License does not grant any rights in the trademarks, service marks,
-or logos of any Contributor (except as may be necessary to comply with
-the notice requirements in Section 3.4).
-
-2.4. Subsequent Licenses
-
-No Contributor makes additional grants as a result of Your choice to
-distribute the Covered Software under a subsequent version of this
-License (see Section 10.2) or under the terms of a Secondary License (if
-permitted under the terms of Section 3.3).
-
-2.5. Representation
-
-Each Contributor represents that the Contributor believes its
-Contributions are its original creation(s) or it has sufficient rights
-to grant the rights to its Contributions conveyed by this License.
-
-2.6. Fair Use
-
-This License is not intended to limit any rights You have under
-applicable copyright doctrines of fair use, fair dealing, or other
-equivalents.
-
-2.7. Conditions
-
-Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
-in Section 2.1.
-
-3. Responsibilities
-------------------
-
-3.1. Distribution of Source Form
-
-All distribution of Covered Software in Source Code Form, including any
-Modifications that You create or to which You contribute, must be under
-the terms of this License. You must inform recipients that the Source
-Code Form of the Covered Software is governed by the terms of this
-License, and how they can obtain a copy of this License. You may not
-attempt to alter or restrict the recipients' rights in the Source Code
-Form.
-
-3.2. Distribution of Executable Form
-
-If You distribute Covered Software in Executable Form then:
-
-(a) such Covered Software must also be made available in Source Code
-    Form, as described in Section 3.1, and You must inform recipients of
-    the Executable Form how they can obtain a copy of such Source Code
-    Form by reasonable means in a timely manner, at a charge no more
-    than the cost of distribution to the recipient; and
-
-(b) You may distribute such Executable Form under the terms of this
-    License, or sublicense it under different terms, provided that the
-    license for the Executable Form does not attempt to limit or alter
-    the recipients' rights in the Source Code Form under this License.
-
-3.3. Distribution of a Larger Work
-
-You may create and distribute a Larger Work under terms of Your choice,
-provided that You also comply with the requirements of this License for
-the Covered Software. If the Larger Work is a combination of Covered
-Software with a work governed by one or more Secondary Licenses, and the
-Covered Software is not Incompatible With Secondary Licenses, this
-License permits You to additionally distribute such Covered Software
-under the terms of such Secondary License(s), so that the recipient of
-the Larger Work may, at their option, further distribute the Covered
-Software under the terms of either this License or such Secondary
-License(s).
-
-3.4. Notices
-
-You may not remove or alter the substance of any license notices
-(including copyright notices, patent notices, disclaimers of warranty,
-or limitations of liability) contained within the Source Code Form of
-the Covered Software, except that You may alter any license notices to
-the extent required to remedy known factual inaccuracies.
-
-3.5. Application of Additional Terms
-
-You may choose to offer, and to charge a fee for, warranty, support,
-indemnity or liability obligations to one or more recipients of Covered
-Software. However, You may do so only on Your own behalf, and not on
-behalf of any Contributor. You must make it absolutely clear that any
-such warranty, support, indemnity, or liability obligation is offered by
-You alone, and You hereby agree to indemnify every Contributor for any
-liability incurred by such Contributor as a result of warranty, support,
-indemnity or liability terms You offer. You may include additional
-disclaimers of warranty and limitations of liability specific to any
-jurisdiction.
-
-4. Inability to Comply Due to Statute or Regulation
---------------------------------------------------
-
-If it is impossible for You to comply with any of the terms of this
-License with respect to some or all of the Covered Software due to
-statute, judicial order, or regulation then You must: (a) comply with
-the terms of this License to the maximum extent possible; and (b)
-describe the limitations and the code they affect. Such description must
-be placed in a text file included with all distributions of the Covered
-Software under this License. Except to the extent prohibited by statute
-or regulation, such description must be sufficiently detailed for a
-recipient of ordinary skill to be able to understand it.
-
-5. Termination
--------------
-
-5.1. The rights granted under this License will terminate automatically
-if You fail to comply with any of its terms. However, if You become
-compliant, then the rights granted under this License from a particular
-Contributor are reinstated (a) provisionally, unless and until such
-Contributor explicitly and finally terminates Your grants, and (b) on an
-ongoing basis, if such Contributor fails to notify You of the
-non-compliance by some reasonable means prior to 60 days after You have
-come back into compliance. Moreover, Your grants from a particular
-Contributor are reinstated on an ongoing basis if such Contributor
-notifies You of the non-compliance by some reasonable means, this is the
-first time You have received notice of non-compliance with this License
-from such Contributor, and You become compliant prior to 30 days after
-Your receipt of the notice.
-
-5.2. If You initiate litigation against any entity by asserting a patent
-infringement claim (excluding declaratory judgment actions,
-counter-claims, and cross-claims) alleging that a Contributor Version
-directly or indirectly infringes any patent, then the rights granted to
-You by any and all Contributors for the Covered Software under Section
-2.1 of this License shall terminate.
-
-5.3. In the event of termination under Sections 5.1 or 5.2 above, all
-end user license agreements (excluding distributors and resellers) which
-have been validly granted by You or Your distributors under this License
-prior to termination shall survive termination.
-
-************************************************************************
-*                                                                      *
-*  6. Disclaimer of Warranty                                           *
-*  -------------------------                                           *
-*                                                                      *
-*  Covered Software is provided under this License on an "as is"       *
-*  basis, without warranty of any kind, either expressed, implied, or  *
-*  statutory, including, without limitation, warranties that the       *
-*  Covered Software is free of defects, merchantable, fit for a        *
-*  particular purpose or non-infringing. The entire risk as to the     *
-*  quality and performance of the Covered Software is with You.        *
-*  Should any Covered Software prove defective in any respect, You     *
-*  (not any Contributor) assume the cost of any necessary servicing,   *
-*  repair, or correction. This disclaimer of warranty constitutes an   *
-*  essential part of this License. No use of any Covered Software is   *
-*  authorized under this License except under this disclaimer.         *
-*                                                                      *
-************************************************************************
-
-************************************************************************
-*                                                                      *
-*  7. Limitation of Liability                                          *
-*  --------------------------                                          *
-*                                                                      *
-*  Under no circumstances and under no legal theory, whether tort      *
-*  (including negligence), contract, or otherwise, shall any           *
-*  Contributor, or anyone who distributes Covered Software as          *
-*  permitted above, be liable to You for any direct, indirect,         *
-*  special, incidental, or consequential damages of any character      *
-*  including, without limitation, damages for lost profits, loss of    *
-*  goodwill, work stoppage, computer failure or malfunction, or any    *
-*  and all other commercial damages or losses, even if such party      *
-*  shall have been informed of the possibility of such damages. This   *
-*  limitation of liability shall not apply to liability for death or   *
-*  personal injury resulting from such party's negligence to the       *
-*  extent applicable law prohibits such limitation. Some               *
-*  jurisdictions do not allow the exclusion or limitation of           *
-*  incidental or consequential damages, so this exclusion and          *
-*  limitation may not apply to You.                                    *
-*                                                                      *
-************************************************************************
-
-8. Litigation
-------------
-
-Any litigation relating to this License may be brought only in the
-courts of a jurisdiction where the defendant maintains its principal
-place of business and such litigation shall be governed by laws of that
-jurisdiction, without reference to its conflict-of-law provisions.
-Nothing in this Section shall prevent a party's ability to bring
-cross-claims or counter-claims.
-
-9. Miscellaneous
----------------
-
-This License represents the complete agreement concerning the subject
-matter hereof. If any provision of this License is held to be
-unenforceable, such provision shall be reformed only to the extent
-necessary to make it enforceable. Any law or regulation which provides
-that the language of a contract shall be construed against the drafter
-shall not be used to construe this License against a Contributor.
-
-10. Versions of the License
---------------------------
-
-10.1. New Versions
-
-Mozilla Foundation is the license steward. Except as provided in Section
-10.3, no one other than the license steward has the right to modify or
-publish new versions of this License. Each version will be given a
-distinguishing version number.
-
-10.2. Effect of New Versions
-
-You may distribute the Covered Software under the terms of the version
-of the License under which You originally received the Covered Software,
-or under the terms of any subsequent version published by the license
-steward.
-
-10.3. Modified Versions
-
-If you create software not governed by this License, and you want to
-create a new license for such software, you may create and use a
-modified version of this License if you rename the license and remove
-any references to the name of the license steward (except to note that
-such modified license differs from this License).
-
-10.4. Distributing Source Code Form that is Incompatible With Secondary
-Licenses
-
-If You choose to distribute Source Code Form that is Incompatible With
-Secondary Licenses under the terms of this version of the License, the
-notice described in Exhibit B of this License must be attached.
-
-Exhibit A - Source Code Form License Notice
-------------------------------------------
-
-  This Source Code Form is subject to the terms of the Mozilla Public
-  License, v. 2.0. If a copy of the MPL was not distributed with this
-  file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-If it is not possible or desirable to put the notice in a particular
-file, then You may include the notice in a location (such as a LICENSE
-file in a relevant directory) where a recipient would be likely to look
-for such a notice.
-
-You may add additional accurate notices of copyright ownership.
-
-Exhibit B - "Incompatible With Secondary Licenses" Notice
---------------------------------------------------------
-
-  This Source Code Form is "Incompatible With Secondary Licenses", as
-  defined by the Mozilla Public License, v. 2.0.
--- a/vendor/cyphar.com/go-pathrs/doc.go
+++ b/vendor/cyphar.com/go-pathrs/doc.go
@@ -1,14 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-/*
- * libpathrs: safe path resolution on Linux
- * Copyright (C) 2019-2025 SUSE LLC
- * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/.
- */
-
-// Package pathrs provides bindings for libpathrs, a library for safe path
-// resolution on Linux.
-package pathrs
--- a/vendor/cyphar.com/go-pathrs/handle_linux.go
+++ b/vendor/cyphar.com/go-pathrs/handle_linux.go
@@ -1,110 +0,0 @@
-//go:build linux
-
-// SPDX-License-Identifier: MPL-2.0
-/*
- * libpathrs: safe path resolution on Linux
- * Copyright (C) 2019-2025 SUSE LLC
- * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/.
- */
-
-package pathrs
-
-import (
-	"fmt"
-	"os"
-
-	"cyphar.com/go-pathrs/internal/fdutils"
-	"cyphar.com/go-pathrs/internal/libpathrs"
-)
-
-// Handle is a handle for a path within a given [Root]. This handle references
-// an already-resolved path which can be used for only one purpose -- to
-// "re-open" the handle and get an actual [os.File] which can be used for
-// ordinary operations.
-//
-// If you wish to open a file without having an intermediate [Handle] object,
-// you can try to use [Root.Open] or [Root.OpenFile].
-//
-// It is critical that perform all relevant operations through this [Handle]
-// (rather than fetching the underlying [os.File] yourself with [Handle.IntoFile]),
-// because the security properties of libpathrs depend on users doing all
-// relevant filesystem operations through libpathrs.
-type Handle struct {
-	inner *os.File
-}
-
-// HandleFromFile creates a new [Handle] from an existing file handle. The
-// handle will be copied by this method, so the original handle should still be
-// freed by the caller.
-//
-// This is effectively the inverse operation of [Handle.IntoFile], and is used
-// for "deserialising" pathrs root handles.
-func HandleFromFile(file *os.File) (*Handle, error) {
-	newFile, err := fdutils.DupFile(file)
-	if err != nil {
-		return nil, fmt.Errorf("duplicate handle fd: %w", err)
-	}
-	return &Handle{inner: newFile}, nil
-}
-
-// Open creates an "upgraded" file handle to the file referenced by the
-// [Handle]. Note that the original [Handle] is not consumed by this operation,
-// and can be opened multiple times.
-//
-// The handle returned is only usable for reading, and this is method is
-// shorthand for [Handle.OpenFile] with os.O_RDONLY.
-//
-// TODO: Rename these to "Reopen" or something.
-func (h *Handle) Open() (*os.File, error) {
-	return h.OpenFile(os.O_RDONLY)
-}
-
-// OpenFile creates an "upgraded" file handle to the file referenced by the
-// [Handle]. Note that the original [Handle] is not consumed by this operation,
-// and can be opened multiple times.
-//
-// The provided flags indicate which open(2) flags are used to create the new
-// handle.
-//
-// TODO: Rename these to "Reopen" or something.
-func (h *Handle) OpenFile(flags int) (*os.File, error) {
-	return fdutils.WithFileFd(h.inner, func(fd uintptr) (*os.File, error) {
-		newFd, err := libpathrs.Reopen(fd, flags)
-		if err != nil {
-			return nil, err
-		}
-		return os.NewFile(newFd, h.inner.Name()), nil
-	})
-}
-
-// IntoFile unwraps the [Handle] into its underlying [os.File].
-//
-// You almost certainly want to use [Handle.OpenFile] to get a non-O_PATH
-// version of this [Handle].
-//
-// This operation returns the internal [os.File] of the [Handle] directly, so
-// calling [Handle.Close] will also close any copies of the returned [os.File].
-// If you want to get an independent copy, use [Handle.Clone] followed by
-// [Handle.IntoFile] on the cloned [Handle].
-func (h *Handle) IntoFile() *os.File {
-	// TODO: Figure out if we really don't want to make a copy.
-	// TODO: We almost certainly want to clear r.inner here, but we can't do
-	//       that easily atomically (we could use atomic.Value but that'll make
-	//       things quite a bit uglier).
-	return h.inner
-}
-
-// Clone creates a copy of a [Handle], such that it has a separate lifetime to
-// the original (while referring to the same underlying file).
-func (h *Handle) Clone() (*Handle, error) {
-	return HandleFromFile(h.inner)
-}
-
-// Close frees all of the resources used by the [Handle].
-func (h *Handle) Close() error {
-	return h.inner.Close()
-}
--- a/vendor/cyphar.com/go-pathrs/internal/fdutils/fd_linux.go
+++ b/vendor/cyphar.com/go-pathrs/internal/fdutils/fd_linux.go
@@ -1,75 +0,0 @@
-//go:build linux
-
-// SPDX-License-Identifier: MPL-2.0
-/*
- * libpathrs: safe path resolution on Linux
- * Copyright (C) 2019-2025 SUSE LLC
- * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/.
- */
-
-// Package fdutils contains a few helper methods when dealing with *os.File and
-// file descriptors.
-package fdutils
-
-import (
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/unix"
-
-	"cyphar.com/go-pathrs/internal/libpathrs"
-)
-
-// DupFd makes a duplicate of the given fd.
-func DupFd(fd uintptr, name string) (*os.File, error) {
-	newFd, err := unix.FcntlInt(fd, unix.F_DUPFD_CLOEXEC, 0)
-	if err != nil {
-		return nil, fmt.Errorf("fcntl(F_DUPFD_CLOEXEC): %w", err)
-	}
-	return os.NewFile(uintptr(newFd), name), nil
-}
-
-// WithFileFd is a more ergonomic wrapper around file.SyscallConn().Control().
-func WithFileFd[T any](file *os.File, fn func(fd uintptr) (T, error)) (T, error) {
-	conn, err := file.SyscallConn()
-	if err != nil {
-		return *new(T), err
-	}
-	var (
-		ret      T
-		innerErr error
-	)
-	if err := conn.Control(func(fd uintptr) {
-		ret, innerErr = fn(fd)
-	}); err != nil {
-		return *new(T), err
-	}
-	return ret, innerErr
-}
-
-// DupFile makes a duplicate of the given file.
-func DupFile(file *os.File) (*os.File, error) {
-	return WithFileFd(file, func(fd uintptr) (*os.File, error) {
-		return DupFd(fd, file.Name())
-	})
-}
-
-// MkFile creates a new *os.File from the provided file descriptor. However,
-// unlike os.NewFile, the file's Name is based on the real path (provided by
-// /proc/self/fd/$n).
-func MkFile(fd uintptr) (*os.File, error) {
-	fdPath := fmt.Sprintf("fd/%d", fd)
-	fdName, err := libpathrs.ProcReadlinkat(libpathrs.ProcDefaultRootFd, libpathrs.ProcThreadSelf, fdPath)
-	if err != nil {
-		_ = unix.Close(int(fd))
-		return nil, fmt.Errorf("failed to fetch real name of fd %d: %w", fd, err)
-	}
-	// TODO: Maybe we should prefix this name with something to indicate to
-	// users that they must not use this path as a "safe" path. Something like
-	// "//pathrs-handle:/foo/bar"?
-	return os.NewFile(fd, fdName), nil
-}
--- a/vendor/cyphar.com/go-pathrs/internal/libpathrs/error_unix.go
+++ b/vendor/cyphar.com/go-pathrs/internal/libpathrs/error_unix.go
@@ -1,40 +0,0 @@
-//go:build linux
-
-// TODO: Use "go:build unix" once we bump the minimum Go version 1.19.
-
-// SPDX-License-Identifier: MPL-2.0
-/*
- * libpathrs: safe path resolution on Linux
- * Copyright (C) 2019-2025 SUSE LLC
- * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/.
- */
-
-package libpathrs
-
-import (
-	"syscall"
-)
-
-// Error represents an underlying libpathrs error.
-type Error struct {
-	description string
-	errno       syscall.Errno
-}
-
-// Error returns a textual description of the error.
-func (err *Error) Error() string {
-	return err.description
-}
-
-// Unwrap returns the underlying error which was wrapped by this error (if
-// applicable).
-func (err *Error) Unwrap() error {
-	if err.errno != 0 {
-		return err.errno
-	}
-	return nil
-}
--- a/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go
+++ b/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go
@@ -1,337 +0,0 @@
-//go:build linux
-
-// SPDX-License-Identifier: MPL-2.0
-/*
- * libpathrs: safe path resolution on Linux
- * Copyright (C) 2019-2025 SUSE LLC
- * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/.
- */
-
-// Package libpathrs is an internal thin wrapper around the libpathrs C API.
-package libpathrs
-
-import (
-	"fmt"
-	"syscall"
-	"unsafe"
-)
-
-/*
-// TODO: Figure out if we need to add support for linking against libpathrs
-//       statically even if in dynamically linked builds in order to make
-//       packaging a bit easier (using "-Wl,-Bstatic -lpathrs -Wl,-Bdynamic" or
-//       "-l:pathrs.a").
-#cgo pkg-config: pathrs
-#include <pathrs.h>
-
-// This is a workaround for unsafe.Pointer() not working for non-void pointers.
-char *cast_ptr(void *ptr) { return ptr; }
-*/
-import "C"
-
-func fetchError(errID C.int) error {
-	if errID >= C.__PATHRS_MAX_ERR_VALUE {
-		return nil
-	}
-	cErr := C.pathrs_errorinfo(errID)
-	defer C.pathrs_errorinfo_free(cErr)
-
-	var err error
-	if cErr != nil {
-		err = &Error{
-			errno:       syscall.Errno(cErr.saved_errno),
-			description: C.GoString(cErr.description),
-		}
-	}
-	return err
-}
-
-// OpenRoot wraps pathrs_open_root.
-func OpenRoot(path string) (uintptr, error) {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	fd := C.pathrs_open_root(cPath)
-	return uintptr(fd), fetchError(fd)
-}
-
-// Reopen wraps pathrs_reopen.
-func Reopen(fd uintptr, flags int) (uintptr, error) {
-	newFd := C.pathrs_reopen(C.int(fd), C.int(flags))
-	return uintptr(newFd), fetchError(newFd)
-}
-
-// InRootResolve wraps pathrs_inroot_resolve.
-func InRootResolve(rootFd uintptr, path string) (uintptr, error) {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	fd := C.pathrs_inroot_resolve(C.int(rootFd), cPath)
-	return uintptr(fd), fetchError(fd)
-}
-
-// InRootResolveNoFollow wraps pathrs_inroot_resolve_nofollow.
-func InRootResolveNoFollow(rootFd uintptr, path string) (uintptr, error) {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	fd := C.pathrs_inroot_resolve_nofollow(C.int(rootFd), cPath)
-	return uintptr(fd), fetchError(fd)
-}
-
-// InRootOpen wraps pathrs_inroot_open.
-func InRootOpen(rootFd uintptr, path string, flags int) (uintptr, error) {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	fd := C.pathrs_inroot_open(C.int(rootFd), cPath, C.int(flags))
-	return uintptr(fd), fetchError(fd)
-}
-
-// InRootReadlink wraps pathrs_inroot_readlink.
-func InRootReadlink(rootFd uintptr, path string) (string, error) {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	size := 128
-	for {
-		linkBuf := make([]byte, size)
-		n := C.pathrs_inroot_readlink(C.int(rootFd), cPath, C.cast_ptr(unsafe.Pointer(&linkBuf[0])), C.size_t(len(linkBuf)))
-		switch {
-		case int(n) < C.__PATHRS_MAX_ERR_VALUE:
-			return "", fetchError(n)
-		case int(n) <= len(linkBuf):
-			return string(linkBuf[:int(n)]), nil
-		default:
-			// The contents were truncated. Unlike readlinkat, pathrs returns
-			// the size of the link when it checked. So use the returned size
-			// as a basis for the reallocated size (but in order to avoid a DoS
-			// where a magic-link is growing by a single byte each iteration,
-			// make sure we are a fair bit larger).
-			size += int(n)
-		}
-	}
-}
-
-// InRootRmdir wraps pathrs_inroot_rmdir.
-func InRootRmdir(rootFd uintptr, path string) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	err := C.pathrs_inroot_rmdir(C.int(rootFd), cPath)
-	return fetchError(err)
-}
-
-// InRootUnlink wraps pathrs_inroot_unlink.
-func InRootUnlink(rootFd uintptr, path string) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	err := C.pathrs_inroot_unlink(C.int(rootFd), cPath)
-	return fetchError(err)
-}
-
-// InRootRemoveAll wraps pathrs_inroot_remove_all.
-func InRootRemoveAll(rootFd uintptr, path string) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	err := C.pathrs_inroot_remove_all(C.int(rootFd), cPath)
-	return fetchError(err)
-}
-
-// InRootCreat wraps pathrs_inroot_creat.
-func InRootCreat(rootFd uintptr, path string, flags int, mode uint32) (uintptr, error) {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	fd := C.pathrs_inroot_creat(C.int(rootFd), cPath, C.int(flags), C.uint(mode))
-	return uintptr(fd), fetchError(fd)
-}
-
-// InRootRename wraps pathrs_inroot_rename.
-func InRootRename(rootFd uintptr, src, dst string, flags uint) error {
-	cSrc := C.CString(src)
-	defer C.free(unsafe.Pointer(cSrc))
-
-	cDst := C.CString(dst)
-	defer C.free(unsafe.Pointer(cDst))
-
-	err := C.pathrs_inroot_rename(C.int(rootFd), cSrc, cDst, C.uint(flags))
-	return fetchError(err)
-}
-
-// InRootMkdir wraps pathrs_inroot_mkdir.
-func InRootMkdir(rootFd uintptr, path string, mode uint32) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	err := C.pathrs_inroot_mkdir(C.int(rootFd), cPath, C.uint(mode))
-	return fetchError(err)
-}
-
-// InRootMkdirAll wraps pathrs_inroot_mkdir_all.
-func InRootMkdirAll(rootFd uintptr, path string, mode uint32) (uintptr, error) {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	fd := C.pathrs_inroot_mkdir_all(C.int(rootFd), cPath, C.uint(mode))
-	return uintptr(fd), fetchError(fd)
-}
-
-// InRootMknod wraps pathrs_inroot_mknod.
-func InRootMknod(rootFd uintptr, path string, mode uint32, dev uint64) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	err := C.pathrs_inroot_mknod(C.int(rootFd), cPath, C.uint(mode), C.dev_t(dev))
-	return fetchError(err)
-}
-
-// InRootSymlink wraps pathrs_inroot_symlink.
-func InRootSymlink(rootFd uintptr, path, target string) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	cTarget := C.CString(target)
-	defer C.free(unsafe.Pointer(cTarget))
-
-	err := C.pathrs_inroot_symlink(C.int(rootFd), cPath, cTarget)
-	return fetchError(err)
-}
-
-// InRootHardlink wraps pathrs_inroot_hardlink.
-func InRootHardlink(rootFd uintptr, path, target string) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	cTarget := C.CString(target)
-	defer C.free(unsafe.Pointer(cTarget))
-
-	err := C.pathrs_inroot_hardlink(C.int(rootFd), cPath, cTarget)
-	return fetchError(err)
-}
-
-// ProcBase is pathrs_proc_base_t (uint64_t).
-type ProcBase C.pathrs_proc_base_t
-
-// FIXME: We need to open-code the constants because CGo unfortunately will
-// implicitly convert any non-literal constants (i.e. those resolved using gcc)
-// to signed integers. See <https://github.com/golang/go/issues/39136> for some
-// more information on the underlying issue (though.
-const (
-	// ProcRoot is PATHRS_PROC_ROOT.
-	ProcRoot ProcBase = 0xFFFF_FFFE_7072_6F63 // C.PATHRS_PROC_ROOT
-	// ProcSelf is PATHRS_PROC_SELF.
-	ProcSelf ProcBase = 0xFFFF_FFFE_091D_5E1F // C.PATHRS_PROC_SELF
-	// ProcThreadSelf is PATHRS_PROC_THREAD_SELF.
-	ProcThreadSelf ProcBase = 0xFFFF_FFFE_3EAD_5E1F // C.PATHRS_PROC_THREAD_SELF
-
-	// ProcBaseTypeMask is __PATHRS_PROC_TYPE_MASK.
-	ProcBaseTypeMask ProcBase = 0xFFFF_FFFF_0000_0000 // C.__PATHRS_PROC_TYPE_MASK
-	// ProcBaseTypePid is __PATHRS_PROC_TYPE_PID.
-	ProcBaseTypePid ProcBase = 0x8000_0000_0000_0000 // C.__PATHRS_PROC_TYPE_PID
-
-	// ProcDefaultRootFd is PATHRS_PROC_DEFAULT_ROOTFD.
-	ProcDefaultRootFd = -int(syscall.EBADF) // C.PATHRS_PROC_DEFAULT_ROOTFD
-)
-
-func assertEqual[T comparable](a, b T, msg string) {
-	if a != b {
-		panic(fmt.Sprintf("%s ((%T) %#v != (%T) %#v)", msg, a, a, b, b))
-	}
-}
-
-// Verify that the values above match the actual C values. Unfortunately, Go
-// only allows us to forcefully cast int64 to uint64 if you use a temporary
-// variable, which means we cannot do it in a const context and thus need to do
-// it at runtime (even though it is a check that fundamentally could be done at
-// compile-time)...
-func init() {
-	var (
-		actualProcRoot       int64 = C.PATHRS_PROC_ROOT
-		actualProcSelf       int64 = C.PATHRS_PROC_SELF
-		actualProcThreadSelf int64 = C.PATHRS_PROC_THREAD_SELF
-	)
-
-	assertEqual(ProcRoot, ProcBase(actualProcRoot), "PATHRS_PROC_ROOT")
-	assertEqual(ProcSelf, ProcBase(actualProcSelf), "PATHRS_PROC_SELF")
-	assertEqual(ProcThreadSelf, ProcBase(actualProcThreadSelf), "PATHRS_PROC_THREAD_SELF")
-
-	var (
-		actualProcBaseTypeMask uint64 = C.__PATHRS_PROC_TYPE_MASK
-		actualProcBaseTypePid  uint64 = C.__PATHRS_PROC_TYPE_PID
-	)
-
-	assertEqual(ProcBaseTypeMask, ProcBase(actualProcBaseTypeMask), "__PATHRS_PROC_TYPE_MASK")
-	assertEqual(ProcBaseTypePid, ProcBase(actualProcBaseTypePid), "__PATHRS_PROC_TYPE_PID")
-
-	assertEqual(ProcDefaultRootFd, int(C.PATHRS_PROC_DEFAULT_ROOTFD), "PATHRS_PROC_DEFAULT_ROOTFD")
-}
-
-// ProcPid reimplements the PROC_PID(x) conversion.
-func ProcPid(pid uint32) ProcBase { return ProcBaseTypePid | ProcBase(pid) }
-
-// ProcOpenat wraps pathrs_proc_openat.
-func ProcOpenat(procRootFd int, base ProcBase, path string, flags int) (uintptr, error) {
-	cBase := C.pathrs_proc_base_t(base)
-
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	fd := C.pathrs_proc_openat(C.int(procRootFd), cBase, cPath, C.int(flags))
-	return uintptr(fd), fetchError(fd)
-}
-
-// ProcReadlinkat wraps pathrs_proc_readlinkat.
-func ProcReadlinkat(procRootFd int, base ProcBase, path string) (string, error) {
-	// TODO: See if we can unify this code with InRootReadlink.
-
-	cBase := C.pathrs_proc_base_t(base)
-
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
-
-	size := 128
-	for {
-		linkBuf := make([]byte, size)
-		n := C.pathrs_proc_readlinkat(
-			C.int(procRootFd), cBase, cPath,
-			C.cast_ptr(unsafe.Pointer(&linkBuf[0])), C.size_t(len(linkBuf)))
-		switch {
-		case int(n) < C.__PATHRS_MAX_ERR_VALUE:
-			return "", fetchError(n)
-		case int(n) <= len(linkBuf):
-			return string(linkBuf[:int(n)]), nil
-		default:
-			// The contents were truncated. Unlike readlinkat, pathrs returns
-			// the size of the link when it checked. So use the returned size
-			// as a basis for the reallocated size (but in order to avoid a DoS
-			// where a magic-link is growing by a single byte each iteration,
-			// make sure we are a fair bit larger).
-			size += int(n)
-		}
-	}
-}
-
-// ProcfsOpenHow is pathrs_procfs_open_how (struct).
-type ProcfsOpenHow C.pathrs_procfs_open_how
-
-const (
-	// ProcfsNewUnmasked is PATHRS_PROCFS_NEW_UNMASKED.
-	ProcfsNewUnmasked = C.PATHRS_PROCFS_NEW_UNMASKED
-)
-
-// Flags returns a pointer to the internal flags field to allow other packages
-// to modify structure fields that are internal due to Go's visibility model.
-func (how *ProcfsOpenHow) Flags() *C.uint64_t { return &how.flags }
-
-// ProcfsOpen is pathrs_procfs_open (sizeof(*how) is passed automatically).
-func ProcfsOpen(how *ProcfsOpenHow) (uintptr, error) {
-	fd := C.pathrs_procfs_open((*C.pathrs_procfs_open_how)(how), C.size_t(unsafe.Sizeof(*how)))
-	return uintptr(fd), fetchError(fd)
-}
--- a/vendor/cyphar.com/go-pathrs/procfs/procfs_linux.go
+++ b/vendor/cyphar.com/go-pathrs/procfs/procfs_linux.go
@@ -1,239 +0,0 @@
-//go:build linux
-
-// SPDX-License-Identifier: MPL-2.0
-/*
- * libpathrs: safe path resolution on Linux
- * Copyright (C) 2019-2025 SUSE LLC
- * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/.
- */
-
-// Package procfs provides a safe API for operating on /proc on Linux.
-package procfs
-
-import (
-	"os"
-	"runtime"
-
-	"cyphar.com/go-pathrs/internal/fdutils"
-	"cyphar.com/go-pathrs/internal/libpathrs"
-)
-
-// ProcBase is used with [ProcReadlink] and related functions to indicate what
-// /proc subpath path operations should be done relative to.
-type ProcBase struct {
-	inner libpathrs.ProcBase
-}
-
-var (
-	// ProcRoot indicates to use /proc. Note that this mode may be more
-	// expensive because we have to take steps to try to avoid leaking unmasked
-	// procfs handles, so you should use [ProcBaseSelf] if you can.
-	ProcRoot = ProcBase{inner: libpathrs.ProcRoot}
-	// ProcSelf indicates to use /proc/self. For most programs, this is the
-	// standard choice.
-	ProcSelf = ProcBase{inner: libpathrs.ProcSelf}
-	// ProcThreadSelf indicates to use /proc/thread-self. In multi-threaded
-	// programs where one thread has a different CLONE_FS, it is possible for
-	// /proc/self to point the wrong thread and so /proc/thread-self may be
-	// necessary.
-	ProcThreadSelf = ProcBase{inner: libpathrs.ProcThreadSelf}
-)
-
-// ProcPid returns a ProcBase which indicates to use /proc/$pid for the given
-// PID (or TID). Be aware that due to PID recycling, using this is generally
-// not safe except in certain circumstances. Namely:
-//
-//   - PID 1 (the init process), as that PID cannot ever get recycled.
-//   - Your current PID (though you should just use [ProcBaseSelf]).
-//   - Your current TID if you have used [runtime.LockOSThread] (though you
-//     should just use [ProcBaseThreadSelf]).
-//   - PIDs of child processes (as long as you are sure that no other part of
-//     your program incorrectly catches or ignores SIGCHLD, and that you do it
-//     *before* you call wait(2)or any equivalent method that could reap
-//     zombies).
-func ProcPid(pid int) ProcBase {
-	if pid < 0 || uint64(pid) >= 1<<31 {
-		panic("invalid ProcBasePid value") // TODO: should this be an error?
-	}
-	pid32 := uint32(pid) //nolint:gosec // G115 false positive <https://github.com/securego/gosec/issues/1212>
-	return ProcBase{inner: libpathrs.ProcPid(pid32)}
-}
-
-// ThreadCloser is a callback that needs to be called when you are done
-// operating on an [os.File] fetched using [Handle.OpenThreadSelf].
-type ThreadCloser func()
-
-// Handle is a wrapper around an *os.File handle to "/proc", which can be
-// used to do further procfs-related operations in a safe way.
-type Handle struct {
-	inner *os.File
-}
-
-// Close releases all internal resources for this [Handle].
-//
-// Note that if the handle is actually the global cached handle, this operation
-// is a no-op.
-func (proc *Handle) Close() error {
-	var err error
-	if proc.inner != nil {
-		err = proc.inner.Close()
-	}
-	return err
-}
-
-// OpenOption is a configuration function passed as an argument to [Open].
-type OpenOption func(*libpathrs.ProcfsOpenHow) error
-
-// UnmaskedProcRoot can be passed to [Open] to request an unmasked procfs
-// handle be created.
-//
-//	procfs, err := procfs.OpenRoot(procfs.UnmaskedProcRoot)
-func UnmaskedProcRoot(how *libpathrs.ProcfsOpenHow) error {
-	*how.Flags() |= libpathrs.ProcfsNewUnmasked
-	return nil
-}
-
-// Open creates a new [Handle] to a safe "/proc", based on the passed
-// configuration options (in the form of a series of [OpenOption]s).
-func Open(opts ...OpenOption) (*Handle, error) {
-	var how libpathrs.ProcfsOpenHow
-	for _, opt := range opts {
-		if err := opt(&how); err != nil {
-			return nil, err
-		}
-	}
-	fd, err := libpathrs.ProcfsOpen(&how)
-	if err != nil {
-		return nil, err
-	}
-	var procFile *os.File
-	if int(fd) >= 0 {
-		procFile = os.NewFile(fd, "/proc")
-	}
-	// TODO: Check that fd == PATHRS_PROC_DEFAULT_ROOTFD in the <0 case?
-	return &Handle{inner: procFile}, nil
-}
-
-// TODO: Switch to something fdutils.WithFileFd-like.
-func (proc *Handle) fd() int {
-	if proc.inner != nil {
-		return int(proc.inner.Fd())
-	}
-	return libpathrs.ProcDefaultRootFd
-}
-
-// TODO: Should we expose open?
-func (proc *Handle) open(base ProcBase, path string, flags int) (_ *os.File, Closer ThreadCloser, Err error) {
-	var closer ThreadCloser
-	if base == ProcThreadSelf {
-		runtime.LockOSThread()
-		closer = runtime.UnlockOSThread
-	}
-	defer func() {
-		if closer != nil && Err != nil {
-			closer()
-			Closer = nil
-		}
-	}()
-
-	fd, err := libpathrs.ProcOpenat(proc.fd(), base.inner, path, flags)
-	if err != nil {
-		return nil, nil, err
-	}
-	file, err := fdutils.MkFile(fd)
-	return file, closer, err
-}
-
-// OpenRoot safely opens a given path from inside /proc/.
-//
-// This function must only be used for accessing global information from procfs
-// (such as /proc/cpuinfo) or information about other processes (such as
-// /proc/1). Accessing your own process information should be done using
-// [Handle.OpenSelf] or [Handle.OpenThreadSelf].
-func (proc *Handle) OpenRoot(path string, flags int) (*os.File, error) {
-	file, closer, err := proc.open(ProcRoot, path, flags)
-	if closer != nil {
-		// should not happen
-		panic("non-zero closer returned from procOpen(ProcRoot)")
-	}
-	return file, err
-}
-
-// OpenSelf safely opens a given path from inside /proc/self/.
-//
-// This method is recommend for getting process information about the current
-// process for almost all Go processes *except* for cases where there are
-// [runtime.LockOSThread] threads that have changed some aspect of their state
-// (such as through unshare(CLONE_FS) or changing namespaces).
-//
-// For such non-heterogeneous processes, /proc/self may reference to a task
-// that has different state from the current goroutine and so it may be
-// preferable to use [Handle.OpenThreadSelf]. The same is true if a user
-// really wants to inspect the current OS thread's information (such as
-// /proc/thread-self/stack or /proc/thread-self/status which is always uniquely
-// per-thread).
-//
-// Unlike [Handle.OpenThreadSelf], this method does not involve locking
-// the goroutine to the current OS thread and so is simpler to use and
-// theoretically has slightly less overhead.
-func (proc *Handle) OpenSelf(path string, flags int) (*os.File, error) {
-	file, closer, err := proc.open(ProcSelf, path, flags)
-	if closer != nil {
-		// should not happen
-		panic("non-zero closer returned from procOpen(ProcSelf)")
-	}
-	return file, err
-}
-
-// OpenPid safely opens a given path from inside /proc/$pid/, where pid can be
-// either a PID or TID.
-//
-// This is effectively equivalent to calling [Handle.OpenRoot] with the
-// pid prefixed to the subpath.
-//
-// Be aware that due to PID recycling, using this is generally not safe except
-// in certain circumstances. See the documentation of [ProcPid] for more
-// details.
-func (proc *Handle) OpenPid(pid int, path string, flags int) (*os.File, error) {
-	file, closer, err := proc.open(ProcPid(pid), path, flags)
-	if closer != nil {
-		// should not happen
-		panic("non-zero closer returned from procOpen(ProcPidOpen)")
-	}
-	return file, err
-}
-
-// OpenThreadSelf safely opens a given path from inside /proc/thread-self/.
-//
-// Most Go processes have heterogeneous threads (all threads have most of the
-// same kernel state such as CLONE_FS) and so [Handle.OpenSelf] is
-// preferable for most users.
-//
-// For non-heterogeneous threads, or users that actually want thread-specific
-// information (such as /proc/thread-self/stack or /proc/thread-self/status),
-// this method is necessary.
-//
-// Because Go can change the running OS thread of your goroutine without notice
-// (and then subsequently kill the old thread), this method will lock the
-// current goroutine to the OS thread (with [runtime.LockOSThread]) and the
-// caller is responsible for unlocking the the OS thread with the
-// [ThreadCloser] callback once they are done using the returned file. This
-// callback MUST be called AFTER you have finished using the returned
-// [os.File]. This callback is completely separate to [os.File.Close], so it
-// must be called regardless of how you close the handle.
-func (proc *Handle) OpenThreadSelf(path string, flags int) (*os.File, ThreadCloser, error) {
-	return proc.open(ProcThreadSelf, path, flags)
-}
-
-// Readlink safely reads the contents of a symlink from the given procfs base.
-//
-// This is effectively equivalent to doing an Open*(O_PATH|O_NOFOLLOW) of the
-// path and then doing unix.Readlinkat(fd, ""), but with the benefit that
-// thread locking is not necessary for [ProcThreadSelf].
-func (proc *Handle) Readlink(base ProcBase, path string) (string, error) {
-	return libpathrs.ProcReadlinkat(proc.fd(), base.inner, path)
-}
--- a/vendor/cyphar.com/go-pathrs/root_linux.go
+++ b/vendor/cyphar.com/go-pathrs/root_linux.go
@@ -1,341 +0,0 @@
-//go:build linux
-
-// SPDX-License-Identifier: MPL-2.0
-/*
- * libpathrs: safe path resolution on Linux
- * Copyright (C) 2019-2025 SUSE LLC
- * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/.
- */
-
-package pathrs
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"syscall"
-
-	"cyphar.com/go-pathrs/internal/fdutils"
-	"cyphar.com/go-pathrs/internal/libpathrs"
-)
-
-// Root is a handle to the root of a directory tree to resolve within. The only
-// purpose of this "root handle" is to perform operations within the directory
-// tree, or to get a [Handle] to inodes within the directory tree.
-//
-// At time of writing, it is considered a *VERY BAD IDEA* to open a [Root]
-// inside a possibly-attacker-controlled directory tree. While we do have
-// protections that should defend against it, it's far more dangerous than just
-// opening a directory tree which is not inside a potentially-untrusted
-// directory.
-type Root struct {
-	inner *os.File
-}
-
-// OpenRoot creates a new [Root] handle to the directory at the given path.
-func OpenRoot(path string) (*Root, error) {
-	fd, err := libpathrs.OpenRoot(path)
-	if err != nil {
-		return nil, err
-	}
-	file, err := fdutils.MkFile(fd)
-	if err != nil {
-		return nil, err
-	}
-	return &Root{inner: file}, nil
-}
-
-// RootFromFile creates a new [Root] handle from an [os.File] referencing a
-// directory. The provided file will be duplicated, so the original file should
-// still be closed by the caller.
-//
-// This is effectively the inverse operation of [Root.IntoFile].
-func RootFromFile(file *os.File) (*Root, error) {
-	newFile, err := fdutils.DupFile(file)
-	if err != nil {
-		return nil, fmt.Errorf("duplicate root fd: %w", err)
-	}
-	return &Root{inner: newFile}, nil
-}
-
-// Resolve resolves the given path within the [Root]'s directory tree, and
-// returns a [Handle] to the resolved path. The path must already exist,
-// otherwise an error will occur.
-//
-// All symlinks (including trailing symlinks) are followed, but they are
-// resolved within the rootfs. If you wish to open a handle to the symlink
-// itself, use [ResolveNoFollow].
-func (r *Root) Resolve(path string) (*Handle, error) {
-	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (*Handle, error) {
-		handleFd, err := libpathrs.InRootResolve(rootFd, path)
-		if err != nil {
-			return nil, err
-		}
-		handleFile, err := fdutils.MkFile(handleFd)
-		if err != nil {
-			return nil, err
-		}
-		return &Handle{inner: handleFile}, nil
-	})
-}
-
-// ResolveNoFollow is effectively an O_NOFOLLOW version of [Resolve]. Their
-// behaviour is identical, except that *trailing* symlinks will not be
-// followed. If the final component is a trailing symlink, an O_PATH|O_NOFOLLOW
-// handle to the symlink itself is returned.
-func (r *Root) ResolveNoFollow(path string) (*Handle, error) {
-	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (*Handle, error) {
-		handleFd, err := libpathrs.InRootResolveNoFollow(rootFd, path)
-		if err != nil {
-			return nil, err
-		}
-		handleFile, err := fdutils.MkFile(handleFd)
-		if err != nil {
-			return nil, err
-		}
-		return &Handle{inner: handleFile}, nil
-	})
-}
-
-// Open is effectively shorthand for [Resolve] followed by [Handle.Open], but
-// can be slightly more efficient (it reduces CGo overhead and the number of
-// syscalls used when using the openat2-based resolver) and is arguably more
-// ergonomic to use.
-//
-// This is effectively equivalent to [os.Open].
-func (r *Root) Open(path string) (*os.File, error) {
-	return r.OpenFile(path, os.O_RDONLY)
-}
-
-// OpenFile is effectively shorthand for [Resolve] followed by
-// [Handle.OpenFile], but can be slightly more efficient (it reduces CGo
-// overhead and the number of syscalls used when using the openat2-based
-// resolver) and is arguably more ergonomic to use.
-//
-// However, if flags contains os.O_NOFOLLOW and the path is a symlink, then
-// OpenFile's behaviour will match that of openat2. In most cases an error will
-// be returned, but if os.O_PATH is provided along with os.O_NOFOLLOW then a
-// file equivalent to [ResolveNoFollow] will be returned instead.
-//
-// This is effectively equivalent to [os.OpenFile], except that os.O_CREAT is
-// not supported.
-func (r *Root) OpenFile(path string, flags int) (*os.File, error) {
-	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (*os.File, error) {
-		fd, err := libpathrs.InRootOpen(rootFd, path, flags)
-		if err != nil {
-			return nil, err
-		}
-		return fdutils.MkFile(fd)
-	})
-}
-
-// Create creates a file within the [Root]'s directory tree at the given path,
-// and returns a handle to the file. The provided mode is used for the new file
-// (the process's umask applies).
-//
-// Unlike [os.Create], if the file already exists an error is created rather
-// than the file being opened and truncated.
-func (r *Root) Create(path string, flags int, mode os.FileMode) (*os.File, error) {
-	unixMode, err := toUnixMode(mode, false)
-	if err != nil {
-		return nil, err
-	}
-	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (*os.File, error) {
-		handleFd, err := libpathrs.InRootCreat(rootFd, path, flags, unixMode)
-		if err != nil {
-			return nil, err
-		}
-		return fdutils.MkFile(handleFd)
-	})
-}
-
-// Rename two paths within a [Root]'s directory tree. The flags argument is
-// identical to the RENAME_* flags to the renameat2(2) system call.
-func (r *Root) Rename(src, dst string, flags uint) error {
-	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootRename(rootFd, src, dst, flags)
-		return struct{}{}, err
-	})
-	return err
-}
-
-// RemoveDir removes the named empty directory within a [Root]'s directory
-// tree.
-func (r *Root) RemoveDir(path string) error {
-	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootRmdir(rootFd, path)
-		return struct{}{}, err
-	})
-	return err
-}
-
-// RemoveFile removes the named file within a [Root]'s directory tree.
-func (r *Root) RemoveFile(path string) error {
-	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootUnlink(rootFd, path)
-		return struct{}{}, err
-	})
-	return err
-}
-
-// Remove removes the named file or (empty) directory within a [Root]'s
-// directory tree.
-//
-// This is effectively equivalent to [os.Remove].
-func (r *Root) Remove(path string) error {
-	// In order to match os.Remove's implementation we need to also do both
-	// syscalls unconditionally and adjust the error based on whether
-	// pathrs_inroot_rmdir() returned ENOTDIR.
-	unlinkErr := r.RemoveFile(path)
-	if unlinkErr == nil {
-		return nil
-	}
-	rmdirErr := r.RemoveDir(path)
-	if rmdirErr == nil {
-		return nil
-	}
-	// Both failed, adjust the error in the same way that os.Remove does.
-	err := rmdirErr
-	if errors.Is(err, syscall.ENOTDIR) {
-		err = unlinkErr
-	}
-	return err
-}
-
-// RemoveAll recursively deletes a path and all of its children.
-//
-// This is effectively equivalent to [os.RemoveAll].
-func (r *Root) RemoveAll(path string) error {
-	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootRemoveAll(rootFd, path)
-		return struct{}{}, err
-	})
-	return err
-}
-
-// Mkdir creates a directory within a [Root]'s directory tree. The provided
-// mode is used for the new directory (the process's umask applies).
-//
-// This is effectively equivalent to [os.Mkdir].
-func (r *Root) Mkdir(path string, mode os.FileMode) error {
-	unixMode, err := toUnixMode(mode, false)
-	if err != nil {
-		return err
-	}
-
-	_, err = fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootMkdir(rootFd, path, unixMode)
-		return struct{}{}, err
-	})
-	return err
-}
-
-// MkdirAll creates a directory (and any parent path components if they don't
-// exist) within a [Root]'s directory tree. The provided mode is used for any
-// directories created by this function (the process's umask applies).
-//
-// This is effectively equivalent to [os.MkdirAll].
-func (r *Root) MkdirAll(path string, mode os.FileMode) (*Handle, error) {
-	unixMode, err := toUnixMode(mode, false)
-	if err != nil {
-		return nil, err
-	}
-
-	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (*Handle, error) {
-		handleFd, err := libpathrs.InRootMkdirAll(rootFd, path, unixMode)
-		if err != nil {
-			return nil, err
-		}
-		handleFile, err := fdutils.MkFile(handleFd)
-		if err != nil {
-			return nil, err
-		}
-		return &Handle{inner: handleFile}, err
-	})
-}
-
-// Mknod creates a new device inode of the given type within a [Root]'s
-// directory tree. The provided mode is used for the new directory (the
-// process's umask applies).
-//
-// This is effectively equivalent to [golang.org/x/sys/unix.Mknod].
-func (r *Root) Mknod(path string, mode os.FileMode, dev uint64) error {
-	unixMode, err := toUnixMode(mode, true)
-	if err != nil {
-		return err
-	}
-
-	_, err = fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootMknod(rootFd, path, unixMode, dev)
-		return struct{}{}, err
-	})
-	return err
-}
-
-// Symlink creates a symlink within a [Root]'s directory tree. The symlink is
-// created at path and is a link to target.
-//
-// This is effectively equivalent to [os.Symlink].
-func (r *Root) Symlink(path, target string) error {
-	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootSymlink(rootFd, path, target)
-		return struct{}{}, err
-	})
-	return err
-}
-
-// Hardlink creates a hardlink within a [Root]'s directory tree. The hardlink
-// is created at path and is a link to target. Both paths are within the
-// [Root]'s directory tree (you cannot hardlink to a different [Root] or the
-// host).
-//
-// This is effectively equivalent to [os.Link].
-func (r *Root) Hardlink(path, target string) error {
-	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootHardlink(rootFd, path, target)
-		return struct{}{}, err
-	})
-	return err
-}
-
-// Readlink returns the target of a symlink with a [Root]'s directory tree.
-//
-// This is effectively equivalent to [os.Readlink].
-func (r *Root) Readlink(path string) (string, error) {
-	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (string, error) {
-		return libpathrs.InRootReadlink(rootFd, path)
-	})
-}
-
-// IntoFile unwraps the [Root] into its underlying [os.File].
-//
-// It is critical that you do not operate on this file descriptor yourself,
-// because the security properties of libpathrs depend on users doing all
-// relevant filesystem operations through libpathrs.
-//
-// This operation returns the internal [os.File] of the [Root] directly, so
-// calling [Root.Close] will also close any copies of the returned [os.File].
-// If you want to get an independent copy, use [Root.Clone] followed by
-// [Root.IntoFile] on the cloned [Root].
-func (r *Root) IntoFile() *os.File {
-	// TODO: Figure out if we really don't want to make a copy.
-	// TODO: We almost certainly want to clear r.inner here, but we can't do
-	//       that easily atomically (we could use atomic.Value but that'll make
-	//       things quite a bit uglier).
-	return r.inner
-}
-
-// Clone creates a copy of a [Root] handle, such that it has a separate
-// lifetime to the original (while referring to the same underlying directory).
-func (r *Root) Clone() (*Root, error) {
-	return RootFromFile(r.inner)
-}
-
-// Close frees all of the resources used by the [Root] handle.
-func (r *Root) Close() error {
-	return r.inner.Close()
-}
--- a/vendor/cyphar.com/go-pathrs/utils_linux.go
+++ b/vendor/cyphar.com/go-pathrs/utils_linux.go
@@ -1,56 +0,0 @@
-//go:build linux
-
-// SPDX-License-Identifier: MPL-2.0
-/*
- * libpathrs: safe path resolution on Linux
- * Copyright (C) 2019-2025 SUSE LLC
- * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/.
- */
-
-package pathrs
-
-import (
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/unix"
-)
-
-//nolint:cyclop // this function needs to handle a lot of cases
-func toUnixMode(mode os.FileMode, needsType bool) (uint32, error) {
-	sysMode := uint32(mode.Perm())
-	switch mode & os.ModeType { //nolint:exhaustive // we only care about ModeType bits
-	case 0:
-		if needsType {
-			sysMode |= unix.S_IFREG
-		}
-	case os.ModeDir:
-		sysMode |= unix.S_IFDIR
-	case os.ModeSymlink:
-		sysMode |= unix.S_IFLNK
-	case os.ModeCharDevice | os.ModeDevice:
-		sysMode |= unix.S_IFCHR
-	case os.ModeDevice:
-		sysMode |= unix.S_IFBLK
-	case os.ModeNamedPipe:
-		sysMode |= unix.S_IFIFO
-	case os.ModeSocket:
-		sysMode |= unix.S_IFSOCK
-	default:
-		return 0, fmt.Errorf("invalid mode filetype %+o", mode)
-	}
-	if mode&os.ModeSetuid != 0 {
-		sysMode |= unix.S_ISUID
-	}
-	if mode&os.ModeSetgid != 0 {
-		sysMode |= unix.S_ISGID
-	}
-	if mode&os.ModeSticky != 0 {
-		sysMode |= unix.S_ISVTX
-	}
-	return sysMode, nil
-}
--- a/vendor/github.com/BurntSushi/toml/README.md
+++ b/vendor/github.com/BurntSushi/toml/README.md
@@ -1,7 +1,7 @@
 TOML stands for Tom's Obvious, Minimal Language. This Go package provides a
 reflection interface similar to Go's standard library `json` and `xml` packages.

-Compatible with TOML version [v1.1.0](https://toml.io/en/v1.1.0).
+Compatible with TOML version [v1.0.0](https://toml.io/en/v1.0.0).

 Documentation: https://pkg.go.dev/github.com/BurntSushi/toml

--- a/vendor/github.com/BurntSushi/toml/decode.go
+++ b/vendor/github.com/BurntSushi/toml/decode.go
@@ -206,13 +206,6 @@ func markDecodedRecursive(md *MetaData, tmap map[string]any) {
 			markDecodedRecursive(md, tmap)
 			md.context = md.context[0 : len(md.context)-1]
 		}
-		if tarr, ok := tmap[key].([]map[string]any); ok {
-			for _, elm := range tarr {
-				md.context = append(md.context, key)
-				markDecodedRecursive(md, elm)
-				md.context = md.context[0 : len(md.context)-1]
-			}
-		}
 	}
 }

@@ -430,7 +423,7 @@ func (md *MetaData) unifyString(data any, rv reflect.Value) error {
 		if i, ok := data.(int64); ok {
 			rv.SetString(strconv.FormatInt(i, 10))
 		} else if f, ok := data.(float64); ok {
-			rv.SetString(strconv.FormatFloat(f, 'g', -1, 64))
+			rv.SetString(strconv.FormatFloat(f, 'f', -1, 64))
 		} else {
 			return md.badtype("string", data)
 		}
--- a/vendor/github.com/BurntSushi/toml/encode.go
+++ b/vendor/github.com/BurntSushi/toml/encode.go
@@ -228,9 +228,9 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 		}
 		switch v.Location() {
 		default:
-			enc.write(v.Format(format))
+			enc.wf(v.Format(format))
 		case internal.LocalDatetime, internal.LocalDate, internal.LocalTime:
-			enc.write(v.In(time.UTC).Format(format))
+			enc.wf(v.In(time.UTC).Format(format))
 		}
 		return
 	case Marshaler:
@@ -279,40 +279,40 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 	case reflect.String:
 		enc.writeQuoted(rv.String())
 	case reflect.Bool:
-		enc.write(strconv.FormatBool(rv.Bool()))
+		enc.wf(strconv.FormatBool(rv.Bool()))
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		enc.write(strconv.FormatInt(rv.Int(), 10))
+		enc.wf(strconv.FormatInt(rv.Int(), 10))
 	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		enc.write(strconv.FormatUint(rv.Uint(), 10))
+		enc.wf(strconv.FormatUint(rv.Uint(), 10))
 	case reflect.Float32:
 		f := rv.Float()
 		if math.IsNaN(f) {
 			if math.Signbit(f) {
-				enc.write("-")
+				enc.wf("-")
 			}
-			enc.write("nan")
+			enc.wf("nan")
 		} else if math.IsInf(f, 0) {
 			if math.Signbit(f) {
-				enc.write("-")
+				enc.wf("-")
 			}
-			enc.write("inf")
+			enc.wf("inf")
 		} else {
-			enc.write(floatAddDecimal(strconv.FormatFloat(f, 'g', -1, 32)))
+			enc.wf(floatAddDecimal(strconv.FormatFloat(f, 'f', -1, 32)))
 		}
 	case reflect.Float64:
 		f := rv.Float()
 		if math.IsNaN(f) {
 			if math.Signbit(f) {
-				enc.write("-")
+				enc.wf("-")
 			}
-			enc.write("nan")
+			enc.wf("nan")
 		} else if math.IsInf(f, 0) {
 			if math.Signbit(f) {
-				enc.write("-")
+				enc.wf("-")
 			}
-			enc.write("inf")
+			enc.wf("inf")
 		} else {
-			enc.write(floatAddDecimal(strconv.FormatFloat(f, 'g', -1, 64)))
+			enc.wf(floatAddDecimal(strconv.FormatFloat(f, 'f', -1, 64)))
 		}
 	case reflect.Array, reflect.Slice:
 		enc.eArrayOrSliceElement(rv)
@@ -330,32 +330,27 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 // By the TOML spec, all floats must have a decimal with at least one number on
 // either side.
 func floatAddDecimal(fstr string) string {
-	for _, c := range fstr {
-		if c == 'e' { // Exponent syntax
-			return fstr
-		}
-		if c == '.' {
-			return fstr
-		}
+	if !strings.Contains(fstr, ".") {
+		return fstr + ".0"
 	}
-	return fstr + ".0"
+	return fstr
 }

 func (enc *Encoder) writeQuoted(s string) {
-	enc.write(`"` + dblQuotedReplacer.Replace(s) + `"`)
+	enc.wf("\"%s\"", dblQuotedReplacer.Replace(s))
 }

 func (enc *Encoder) eArrayOrSliceElement(rv reflect.Value) {
 	length := rv.Len()
-	enc.write("[")
+	enc.wf("[")
 	for i := 0; i < length; i++ {
 		elem := eindirect(rv.Index(i))
 		enc.eElement(elem)
 		if i != length-1 {
-			enc.write(", ")
+			enc.wf(", ")
 		}
 	}
-	enc.write("]")
+	enc.wf("]")
 }

 func (enc *Encoder) eArrayOfTables(key Key, rv reflect.Value) {
@@ -368,7 +363,7 @@ func (enc *Encoder) eArrayOfTables(key Key, rv reflect.Value) {
 			continue
 		}
 		enc.newline()
-		enc.writef("%s[[%s]]", enc.indentStr(key), key)
+		enc.wf("%s[[%s]]", enc.indentStr(key), key)
 		enc.newline()
 		enc.eMapOrStruct(key, trv, false)
 	}
@@ -381,7 +376,7 @@ func (enc *Encoder) eTable(key Key, rv reflect.Value) {
 		enc.newline()
 	}
 	if len(key) > 0 {
-		enc.writef("%s[%s]", enc.indentStr(key), key)
+		enc.wf("%s[%s]", enc.indentStr(key), key)
 		enc.newline()
 	}
 	enc.eMapOrStruct(key, rv, false)
@@ -427,7 +422,7 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 			if inline {
 				enc.writeKeyValue(Key{mapKey.String()}, val, true)
 				if trailC || i != len(mapKeys)-1 {
-					enc.write(", ")
+					enc.wf(", ")
 				}
 			} else {
 				enc.encode(key.add(mapKey.String()), val)
@@ -436,12 +431,12 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 	}

 	if inline {
-		enc.write("{")
+		enc.wf("{")
 	}
 	writeMapKeys(mapKeysDirect, len(mapKeysSub) > 0)
 	writeMapKeys(mapKeysSub, false)
 	if inline {
-		enc.write("}")
+		enc.wf("}")
 	}
 }

@@ -539,7 +534,7 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 			if inline {
 				enc.writeKeyValue(Key{keyName}, fieldVal, true)
 				if fieldIndex[0] != totalFields-1 {
-					enc.write(", ")
+					enc.wf(", ")
 				}
 			} else {
 				enc.encode(key.add(keyName), fieldVal)
@@ -548,14 +543,14 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	}

 	if inline {
-		enc.write("{")
+		enc.wf("{")
 	}

 	l := len(fieldsDirect) + len(fieldsSub)
 	writeFields(fieldsDirect, l)
 	writeFields(fieldsSub, l)
 	if inline {
-		enc.write("}")
+		enc.wf("}")
 	}
 }

@@ -705,7 +700,7 @@ func isEmpty(rv reflect.Value) bool {

 func (enc *Encoder) newline() {
 	if enc.hasWritten {
-		enc.write("\n")
+		enc.wf("\n")
 	}
 }

@@ -727,22 +722,14 @@ func (enc *Encoder) writeKeyValue(key Key, val reflect.Value, inline bool) {
 		enc.eElement(val)
 		return
 	}
-	enc.writef("%s%s = ", enc.indentStr(key), key.maybeQuoted(len(key)-1))
+	enc.wf("%s%s = ", enc.indentStr(key), key.maybeQuoted(len(key)-1))
 	enc.eElement(val)
 	if !inline {
 		enc.newline()
 	}
 }

-func (enc *Encoder) write(s string) {
-	_, err := enc.w.WriteString(s)
-	if err != nil {
-		encPanic(err)
-	}
-	enc.hasWritten = true
-}
-
-func (enc *Encoder) writef(format string, v ...any) {
+func (enc *Encoder) wf(format string, v ...any) {
 	_, err := fmt.Fprintf(enc.w, format, v...)
 	if err != nil {
 		encPanic(err)
--- a/vendor/github.com/BurntSushi/toml/lex.go
+++ b/vendor/github.com/BurntSushi/toml/lex.go
@@ -13,6 +13,7 @@ type itemType int

 const (
 	itemError itemType = iota
+	itemNIL            // used in the parser to indicate no type
 	itemEOF
 	itemText
 	itemString
@@ -46,13 +47,14 @@ func (p Position) String() string {
 }

 type lexer struct {
-	input string
-	start int
-	pos   int
-	line  int
-	state stateFn
-	items chan item
-	esc   bool
+	input    string
+	start    int
+	pos      int
+	line     int
+	state    stateFn
+	items    chan item
+	tomlNext bool
+	esc      bool

 	// Allow for backing up up to 4 runes. This is necessary because TOML
 	// contains 3-rune tokens (""" and ''').
@@ -88,13 +90,14 @@ func (lx *lexer) nextItem() item {
 	}
 }

-func lex(input string) *lexer {
+func lex(input string, tomlNext bool) *lexer {
 	lx := &lexer{
-		input: input,
-		state: lexTop,
-		items: make(chan item, 10),
-		stack: make([]stateFn, 0, 10),
-		line:  1,
+		input:    input,
+		state:    lexTop,
+		items:    make(chan item, 10),
+		stack:    make([]stateFn, 0, 10),
+		line:     1,
+		tomlNext: tomlNext,
 	}
 	return lx
 }
@@ -105,7 +108,7 @@ func (lx *lexer) push(state stateFn) {

 func (lx *lexer) pop() stateFn {
 	if len(lx.stack) == 0 {
-		panic("BUG in lexer: no states to pop")
+		return lx.errorf("BUG in lexer: no states to pop")
 	}
 	last := lx.stack[len(lx.stack)-1]
 	lx.stack = lx.stack[0 : len(lx.stack)-1]
@@ -302,8 +305,6 @@ func lexTop(lx *lexer) stateFn {
 		return lexTableStart
 	case eof:
 		if lx.pos > lx.start {
-			// TODO: never reached? I think this can only occur on a bug in the
-			// lexer(?)
 			return lx.errorf("unexpected EOF")
 		}
 		lx.emit(itemEOF)
@@ -391,6 +392,8 @@ func lexTableNameStart(lx *lexer) stateFn {
 func lexTableNameEnd(lx *lexer) stateFn {
 	lx.skip(isWhitespace)
 	switch r := lx.next(); {
+	case isWhitespace(r):
+		return lexTableNameEnd
 	case r == '.':
 		lx.ignore()
 		return lexTableNameStart
@@ -409,7 +412,7 @@ func lexTableNameEnd(lx *lexer) stateFn {
 // Lexes only one part, e.g. only 'a' inside 'a.b'.
 func lexBareName(lx *lexer) stateFn {
 	r := lx.next()
-	if isBareKeyChar(r) {
+	if isBareKeyChar(r, lx.tomlNext) {
 		return lexBareName
 	}
 	lx.backup()
@@ -417,23 +420,23 @@ func lexBareName(lx *lexer) stateFn {
 	return lx.pop()
 }

-// lexQuotedName lexes one part of a quoted key or table name. It assumes that
-// it starts lexing at the quote itself (" or ').
+// lexBareName lexes one part of a key or table.
+//
+// It assumes that at least one valid character for the table has already been
+// read.
 //
 // Lexes only one part, e.g. only '"a"' inside '"a".b'.
 func lexQuotedName(lx *lexer) stateFn {
 	r := lx.next()
 	switch {
+	case isWhitespace(r):
+		return lexSkip(lx, lexValue)
 	case r == '"':
 		lx.ignore() // ignore the '"'
 		return lexString
 	case r == '\'':
 		lx.ignore() // ignore the "'"
 		return lexRawString
-
-	// TODO: I don't think any of the below conditions can ever be reached?
-	case isWhitespace(r):
-		return lexSkip(lx, lexValue)
 	case r == eof:
 		return lx.errorf("unexpected EOF; expected value")
 	default:
@@ -461,19 +464,17 @@ func lexKeyStart(lx *lexer) stateFn {
 func lexKeyNameStart(lx *lexer) stateFn {
 	lx.skip(isWhitespace)
 	switch r := lx.peek(); {
-	default:
-		lx.push(lexKeyEnd)
-		return lexBareName
-	case r == '"' || r == '\'':
-		lx.ignore()
-		lx.push(lexKeyEnd)
-		return lexQuotedName
-
-	// TODO: I think these can never be reached?
 	case r == '=' || r == eof:
 		return lx.errorf("unexpected '='")
 	case r == '.':
 		return lx.errorf("unexpected '.'")
+	case r == '"' || r == '\'':
+		lx.ignore()
+		lx.push(lexKeyEnd)
+		return lexQuotedName
+	default:
+		lx.push(lexKeyEnd)
+		return lexBareName
 	}
 }

@@ -484,7 +485,7 @@ func lexKeyEnd(lx *lexer) stateFn {
 	switch r := lx.next(); {
 	case isWhitespace(r):
 		return lexSkip(lx, lexKeyEnd)
-	case r == eof: // TODO: never reached
+	case r == eof:
 		return lx.errorf("unexpected EOF; expected key separator '='")
 	case r == '.':
 		lx.ignore()
@@ -627,7 +628,10 @@ func lexInlineTableValue(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexInlineTableValue)
 	case isNL(r):
-		return lexSkip(lx, lexInlineTableValue)
+		if lx.tomlNext {
+			return lexSkip(lx, lexInlineTableValue)
+		}
+		return lx.errorPrevLine(errLexInlineTableNL{})
 	case r == '#':
 		lx.push(lexInlineTableValue)
 		return lexCommentStart
@@ -649,7 +653,10 @@ func lexInlineTableValueEnd(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexInlineTableValueEnd)
 	case isNL(r):
-		return lexSkip(lx, lexInlineTableValueEnd)
+		if lx.tomlNext {
+			return lexSkip(lx, lexInlineTableValueEnd)
+		}
+		return lx.errorPrevLine(errLexInlineTableNL{})
 	case r == '#':
 		lx.push(lexInlineTableValueEnd)
 		return lexCommentStart
@@ -657,7 +664,10 @@ func lexInlineTableValueEnd(lx *lexer) stateFn {
 		lx.ignore()
 		lx.skip(isWhitespace)
 		if lx.peek() == '}' {
-			return lexInlineTableValueEnd
+			if lx.tomlNext {
+				return lexInlineTableValueEnd
+			}
+			return lx.errorf("trailing comma not allowed in inline tables")
 		}
 		return lexInlineTableValue
 	case r == '}':
@@ -845,6 +855,9 @@ func lexStringEscape(lx *lexer) stateFn {
 	r := lx.next()
 	switch r {
 	case 'e':
+		if !lx.tomlNext {
+			return lx.error(errLexEscape{r})
+		}
 		fallthrough
 	case 'b':
 		fallthrough
@@ -865,6 +878,9 @@ func lexStringEscape(lx *lexer) stateFn {
 	case '\\':
 		return lx.pop()
 	case 'x':
+		if !lx.tomlNext {
+			return lx.error(errLexEscape{r})
+		}
 		return lexHexEscape
 	case 'u':
 		return lexShortUnicodeEscape
@@ -912,9 +928,19 @@ func lexLongUnicodeEscape(lx *lexer) stateFn {
 // lexBaseNumberOrDate can differentiate base prefixed integers from other
 // types.
 func lexNumberOrDateStart(lx *lexer) stateFn {
-	if lx.next() == '0' {
+	r := lx.next()
+	switch r {
+	case '0':
 		return lexBaseNumberOrDate
 	}
+
+	if !isDigit(r) {
+		// The only way to reach this state is if the value starts
+		// with a digit, so specifically treat anything else as an
+		// error.
+		return lx.errorf("expected a digit but got %q", r)
+	}
+
 	return lexNumberOrDate
 }

@@ -1170,13 +1196,13 @@ func lexSkip(lx *lexer, nextState stateFn) stateFn {
 }

 func (s stateFn) String() string {
-	if s == nil {
-		return "<nil>"
-	}
 	name := runtime.FuncForPC(reflect.ValueOf(s).Pointer()).Name()
 	if i := strings.LastIndexByte(name, '.'); i > -1 {
 		name = name[i+1:]
 	}
+	if s == nil {
+		name = "<nil>"
+	}
 	return name + "()"
 }

@@ -1184,6 +1210,8 @@ func (itype itemType) String() string {
 	switch itype {
 	case itemError:
 		return "Error"
+	case itemNIL:
+		return "NIL"
 	case itemEOF:
 		return "EOF"
 	case itemText:
@@ -1198,22 +1226,18 @@ func (itype itemType) String() string {
 		return "Float"
 	case itemDatetime:
 		return "DateTime"
-	case itemArray:
-		return "Array"
-	case itemArrayEnd:
-		return "ArrayEnd"
 	case itemTableStart:
 		return "TableStart"
 	case itemTableEnd:
 		return "TableEnd"
-	case itemArrayTableStart:
-		return "ArrayTableStart"
-	case itemArrayTableEnd:
-		return "ArrayTableEnd"
 	case itemKeyStart:
 		return "KeyStart"
 	case itemKeyEnd:
 		return "KeyEnd"
+	case itemArray:
+		return "Array"
+	case itemArrayEnd:
+		return "ArrayEnd"
 	case itemCommentStart:
 		return "CommentStart"
 	case itemInlineTableStart:
@@ -1242,7 +1266,7 @@ func isDigit(r rune) bool  { return r >= '0' && r <= '9' }
 func isBinary(r rune) bool { return r == '0' || r == '1' }
 func isOctal(r rune) bool  { return r >= '0' && r <= '7' }
 func isHex(r rune) bool    { return (r >= '0' && r <= '9') || (r|0x20 >= 'a' && r|0x20 <= 'f') }
-func isBareKeyChar(r rune) bool {
+func isBareKeyChar(r rune, tomlNext bool) bool {
 	return (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') ||
 		(r >= '0' && r <= '9') || r == '_' || r == '-'
 }
--- a/vendor/github.com/BurntSushi/toml/parse.go
+++ b/vendor/github.com/BurntSushi/toml/parse.go
@@ -3,6 +3,7 @@ package toml
 import (
 	"fmt"
 	"math"
+	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -16,6 +17,7 @@ type parser struct {
 	context    Key      // Full key for the current hash in scope.
 	currentKey string   // Base key name for everything except hashes.
 	pos        Position // Current position in the TOML file.
+	tomlNext   bool

 	ordered []Key // List of keys in the order that they appear in the TOML data.

@@ -30,6 +32,8 @@ type keyInfo struct {
 }

 func parse(data string) (p *parser, err error) {
+	_, tomlNext := os.LookupEnv("BURNTSUSHI_TOML_110")
+
 	defer func() {
 		if r := recover(); r != nil {
 			if pErr, ok := r.(ParseError); ok {
@@ -69,9 +73,10 @@ func parse(data string) (p *parser, err error) {
 	p = &parser{
 		keyInfo:   make(map[string]keyInfo),
 		mapping:   make(map[string]any),
-		lx:        lex(data),
+		lx:        lex(data, tomlNext),
 		ordered:   make([]Key, 0),
 		implicits: make(map[string]struct{}),
+		tomlNext:  tomlNext,
 	}
 	for {
 		item := p.next()
@@ -345,14 +350,17 @@ func (p *parser) valueFloat(it item) (any, tomlType) {
 var dtTypes = []struct {
 	fmt  string
 	zone *time.Location
+	next bool
 }{
-	{time.RFC3339Nano, time.Local},
-	{"2006-01-02T15:04:05.999999999", internal.LocalDatetime},
-	{"2006-01-02", internal.LocalDate},
-	{"15:04:05.999999999", internal.LocalTime},
-	{"2006-01-02T15:04Z07:00", time.Local},
-	{"2006-01-02T15:04", internal.LocalDatetime},
-	{"15:04", internal.LocalTime},
+	{time.RFC3339Nano, time.Local, false},
+	{"2006-01-02T15:04:05.999999999", internal.LocalDatetime, false},
+	{"2006-01-02", internal.LocalDate, false},
+	{"15:04:05.999999999", internal.LocalTime, false},
+
+	// tomlNext
+	{"2006-01-02T15:04Z07:00", time.Local, true},
+	{"2006-01-02T15:04", internal.LocalDatetime, true},
+	{"15:04", internal.LocalTime, true},
 }

 func (p *parser) valueDatetime(it item) (any, tomlType) {
@@ -363,6 +371,9 @@ func (p *parser) valueDatetime(it item) (any, tomlType) {
 		err error
 	)
 	for _, dt := range dtTypes {
+		if dt.next && !p.tomlNext {
+			continue
+		}
 		t, err = time.ParseInLocation(dt.fmt, it.val, dt.zone)
 		if err == nil {
 			if missingLeadingZero(it.val, dt.fmt) {
@@ -633,11 +644,6 @@ func (p *parser) setValue(key string, value any) {
 		// Note that since it has already been defined (as a hash), we don't
 		// want to overwrite it. So our business is done.
 		if p.isArray(keyContext) {
-			if !p.isImplicit(keyContext) {
-				if _, ok := hash[key]; ok {
-					p.panicf("Key '%s' has already been defined.", keyContext)
-				}
-			}
 			p.removeImplicit(keyContext)
 			hash[key] = value
 			return
@@ -796,8 +802,10 @@ func (p *parser) replaceEscapes(it item, str string) string {
 			b.WriteByte(0x0d)
 			skip = 1
 		case 'e':
-			b.WriteByte(0x1b)
-			skip = 1
+			if p.tomlNext {
+				b.WriteByte(0x1b)
+				skip = 1
+			}
 		case '"':
 			b.WriteByte(0x22)
 			skip = 1
@@ -807,9 +815,11 @@ func (p *parser) replaceEscapes(it item, str string) string {
 		// The lexer guarantees the correct number of characters are present;
 		// don't need to check here.
 		case 'x':
-			escaped := p.asciiEscapeToUnicode(it, str[i+2:i+4])
-			b.WriteRune(escaped)
-			skip = 3
+			if p.tomlNext {
+				escaped := p.asciiEscapeToUnicode(it, str[i+2:i+4])
+				b.WriteRune(escaped)
+				skip = 3
+			}
 		case 'u':
 			escaped := p.asciiEscapeToUnicode(it, str[i+2:i+6])
 			b.WriteRune(escaped)
--- a/Show More
+++ b/Show More