[release-1.4] Bump to v1.4.1

As the title says

Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>

.cirrus.yml

@@ -23,23 +23,26 @@ env:
     ####
     #### Cache-image names to test with (double-quotes around names are critical)
     ####
-    FEDORA_NAME: "fedora-36"
-    PRIOR_FEDORA_NAME: "fedora-35"
-    UBUNTU_NAME: "ubuntu-2110"
+    FEDORA_NAME: "fedora-34"
+    PRIOR_FEDORA_NAME: "fedora-33"
+    UBUNTU_NAME: "ubuntu-2104"
+    PRIOR_UBUNTU_NAME: "ubuntu-2010"
 
     # Google-cloud VM Images
-    IMAGE_SUFFIX: "c4955393725038592"
+    IMAGE_SUFFIX: "c6248193773010944"
     FEDORA_CACHE_IMAGE_NAME: "fedora-${IMAGE_SUFFIX}"
     PRIOR_FEDORA_CACHE_IMAGE_NAME: "prior-fedora-${IMAGE_SUFFIX}"
     UBUNTU_CACHE_IMAGE_NAME: "ubuntu-${IMAGE_SUFFIX}"
+    PRIOR_UBUNTU_CACHE_IMAGE_NAME: "prior-ubuntu-${IMAGE_SUFFIX}"
 
     # Container FQIN's
     FEDORA_CONTAINER_FQIN: "quay.io/libpod/fedora_podman:${IMAGE_SUFFIX}"
     PRIOR_FEDORA_CONTAINER_FQIN: "quay.io/libpod/prior-fedora_podman:${IMAGE_SUFFIX}"
     UBUNTU_CONTAINER_FQIN: "quay.io/libpod/ubuntu_podman:${IMAGE_SUFFIX}"
+    PRIOR_UBUNTU_CONTAINER_FQIN: "quay.io/libpod/prior-ubuntu_podman:${IMAGE_SUFFIX}"
 
-    # Built along with the standard PR-based workflow in c/automation_images
-    SKOPEO_CIDEV_CONTAINER_FQIN: "quay.io/libpod/skopeo_cidev:${IMAGE_SUFFIX}"
+    # Equivilent to image produced by 'make build-container'
+    SKOPEO_CI_CONTAINER_FQIN: "quay.io/skopeo/ci:${DEST_BRANCH}"
 
 
 # Default timeout for each task
@@ -54,8 +57,8 @@ validate_task:
     # under Cirrus-CI, due to challenges obtaining the starting commit ID.
     # Only do validation for PRs.
     only_if: $CIRRUS_PR != ''
-    container:
-        image: '${SKOPEO_CIDEV_CONTAINER_FQIN}'
+    container:  &build_container
+        image: "${SKOPEO_CI_CONTAINER_FQIN}"
         cpu: 4
         memory: 8
     script: |
@@ -90,7 +93,7 @@ osx_task:
         export PATH=$GOPATH/bin:$PATH
         brew update
         brew install gpgme go go-md2man
-        go install golang.org/x/lint/golint@latest
+        go get -u golang.org/x/lint/golint
     test_script: |
         export PATH=$GOPATH/bin:$PATH
         go version
@@ -142,7 +145,7 @@ test_skopeo_task:
         disk: 200
         image_name: ${FEDORA_CACHE_IMAGE_NAME}
     matrix:
-        - name: "Skopeo Test"  # N/B: Name ref. by hack/get_fqin.sh
+        - name: "Skopeo Test"
           env:
               BUILDTAGS: 'btrfs_noversion libdm_no_deferred_remove'
         - name: "Skopeo Test w/ opengpg"
@@ -178,6 +181,7 @@ meta_task:
             ${FEDORA_CACHE_IMAGE_NAME}
             ${PRIOR_FEDORA_CACHE_IMAGE_NAME}
             ${UBUNTU_CACHE_IMAGE_NAME}
+            ${PRIOR_UBUNTU_CACHE_IMAGE_NAME}
         BUILDID: "${CIRRUS_BUILD_ID}"
         REPOREF: "${CIRRUS_REPO_NAME}"
         GCPJSON: ENCRYPTED[6867b5a83e960e7c159a98fe6c8360064567a071c6f4b5e7d532283ecd870aa65c94ccd74bdaa9bf7aadac9d42e20a67]

.github/workflows/check_cirrus_cron.yml

@@ -1,102 +0,0 @@
----
-
-# See also:
-# https://github.com/containers/podman/blob/main/.github/workflows/check_cirrus_cron.yml
-
-# Format Ref: https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions
-
-# Required to un-FUBAR default ${{github.workflow}} value
-name: check_cirrus_cron
-
-on:
-    # Note: This only applies to the default branch.
-    schedule:
-        # N/B: This should correspond to a period slightly after
-        # the last job finishes running.  See job defs. at:
-        # https://cirrus-ci.com/settings/repository/6706677464432640
-        - cron:  '59 23 * * 1-5'
-    # Debug: Allow triggering job manually in github-actions WebUI
-    workflow_dispatch: {}
-
-env:
-    # Debug-mode can reveal secrets, only enable by a secret value.
-    # Ref: https://help.github.com/en/actions/configuring-and-managing-workflows/managing-a-workflow-run#enabling-step-debug-logging
-    ACTIONS_STEP_DEBUG: '${{ secrets.ACTIONS_STEP_DEBUG }}'
-    # CSV listing of e-mail addresses for delivery failure or error notices
-    RCPTCSV: rh.container.bot@gmail.com,podman-monitor@lists.podman.io
-    # Filename for table of cron-name to build-id data
-    # (must be in $GITHUB_WORKSPACE/artifacts/)
-    NAME_ID_FILEPATH: './artifacts/name_id.txt'
-
-jobs:
-    cron_failures:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@v2
-              with:
-                  persist-credentials: false
-
-            # Avoid duplicating cron_failures.sh in skopeo repo.
-            - uses: actions/checkout@v2
-              with:
-                  repository: containers/podman
-                  path: '_podman'
-                  persist-credentials: false
-
-            - name: Get failed cron names and Build IDs
-              id: cron
-              run: './_podman/.github/actions/${{ github.workflow }}/${{ github.job }}.sh'
-
-            - if: steps.cron.outputs.failures > 0
-              shell: bash
-              # Must be inline, since context expressions are used.
-              # Ref: https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions
-              run: |
-                set -eo pipefail
-                (
-                echo "Detected one or more Cirrus-CI cron-triggered jobs have failed recently:"
-                echo ""
-
-                while read -r NAME BID; do
-                    echo "Cron build '$NAME' Failed: https://cirrus-ci.com/build/$BID"
-                done < "$NAME_ID_FILEPATH"
-
-                echo ""
-                echo "# Source: ${{ github.workflow }} workflow on ${{ github.repository }}."
-                # Separate content from sendgrid.com automatic footer.
-                echo ""
-                echo ""
-                ) > ./artifacts/email_body.txt
-
-            - if: steps.cron.outputs.failures > 0
-              name: Send failure notification e-mail
-              # Ref: https://github.com/dawidd6/action-send-mail
-              uses: dawidd6/action-send-mail@v2.2.2
-              with:
-                server_address: ${{secrets.ACTION_MAIL_SERVER}}
-                server_port: 465
-                username: ${{secrets.ACTION_MAIL_USERNAME}}
-                password: ${{secrets.ACTION_MAIL_PASSWORD}}
-                subject: Cirrus-CI cron build failures on ${{github.repository}}
-                to: ${{env.RCPTCSV}}
-                from: ${{secrets.ACTION_MAIL_SENDER}}
-                body: file://./artifacts/email_body.txt
-
-            - if: always()
-              uses: actions/upload-artifact@v2
-              with:
-                  name: ${{ github.job }}_artifacts
-                  path: artifacts/*
-
-            - if: failure()
-              name: Send error notification e-mail
-              uses: dawidd6/action-send-mail@v2.2.2
-              with:
-                server_address: ${{secrets.ACTION_MAIL_SERVER}}
-                server_port: 465
-                username: ${{secrets.ACTION_MAIL_USERNAME}}
-                password: ${{secrets.ACTION_MAIL_PASSWORD}}
-                subject: Github workflow error on ${{github.repository}}
-                to: ${{env.RCPTCSV}}
-                from: ${{secrets.ACTION_MAIL_SENDER}}
-                body: "Job failed: https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}"

Dockerfile

@@ -0,0 +1,56 @@
+FROM registry.fedoraproject.org/fedora:latest
+
+RUN dnf -y update && dnf install -y make git golang golang-github-cpuguy83-md2man \
+	# storage deps
+	btrfs-progs-devel \
+	device-mapper-devel \
+	# gpgme bindings deps
+	libassuan-devel gpgme-devel \
+	gnupg \
+	# htpasswd for system tests
+	httpd-tools \
+	# OpenShift deps
+	which tar wget hostname util-linux bsdtar socat ethtool device-mapper iptables tree findutils nmap-ncat e2fsprogs xfsprogs lsof docker iproute \
+        bats jq podman runc \
+	golint \
+	openssl \
+	&& dnf clean all
+
+# Install two versions of the registry. The first is an older version that
+# only supports schema1 manifests. The second is a newer version that supports
+# both. This allows integration-cli tests to cover push/pull with both schema1
+# and schema2 manifests.
+RUN set -x \
+	&& export GO111MODULE=off \
+	&& REGISTRY_COMMIT_SCHEMA1=ec87e9b6971d831f0eff752ddb54fb64693e51cd \
+	&& REGISTRY_COMMIT=47a064d4195a9b56133891bbb13620c3ac83a827 \
+	&& export GOPATH="$(mktemp -d)" \
+	&& git clone https://github.com/docker/distribution.git "$GOPATH/src/github.com/docker/distribution" \
+	&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT") \
+	&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
+		go build -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \
+	&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT_SCHEMA1") \
+	&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
+		go build -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \
+	&& rm -rf "$GOPATH"
+
+RUN set -x \
+	&& export GO111MODULE=off \
+	&& export GOPATH=$(mktemp -d) \
+	&& git clone --depth 1 -b v1.5.0-alpha.3 git://github.com/openshift/origin "$GOPATH/src/github.com/openshift/origin" \
+	# The sed edits out a "go < 1.5" check which works incorrectly with go ≥ 1.10. \
+	&& sed -i -e 's/\[\[ "\${go_version\[2]}" < "go1.5" ]]/false/' "$GOPATH/src/github.com/openshift/origin/hack/common.sh" \
+	&& (cd "$GOPATH/src/github.com/openshift/origin" && make clean build && make all WHAT=cmd/dockerregistry) \
+	&& cp -a "$GOPATH/src/github.com/openshift/origin/_output/local/bin/linux"/*/* /usr/local/bin \
+	&& cp "$GOPATH/src/github.com/openshift/origin/images/dockerregistry/config.yml" /atomic-registry-config.yml \
+	&& rm -rf "$GOPATH" \
+	&& mkdir /registry
+
+ENV GOPATH /usr/share/gocode:/go
+ENV PATH $GOPATH/bin:/usr/share/gocode/bin:$PATH
+ENV container_magic 85531765-346b-4316-bdb8-358e4cca9e5d
+RUN go version
+WORKDIR /go/src/github.com/containers/skopeo
+COPY . /go/src/github.com/containers/skopeo
+
+#ENTRYPOINT ["hack/dind"]

Dockerfile.build

@@ -0,0 +1,12 @@
+FROM registry.fedoraproject.org/fedora:33
+
+RUN dnf update -y && \
+        dnf install -y \
+        btrfs-progs-devel \
+        device-mapper-devel \
+        golang \
+        gpgme-devel \
+        make
+
+ENV GOPATH=/
+WORKDIR /src/github.com/containers/skopeo

Makefile

@@ -1,8 +1,8 @@
-.PHONY: all binary docs docs-in-container build-local clean install install-binary install-completions shell test-integration .install.vndr vendor vendor-in-container
+.PHONY: all binary build-container docs docs-in-container build-local clean install install-binary install-completions shell test-integration .install.vndr vendor vendor-in-container
 
 export GOPROXY=https://proxy.golang.org
 
-# On some platforms (eg. macOS, FreeBSD) gpgme is installed in /usr/local/ but /usr/local/include/ is
+# On some plaforms (eg. macOS, FreeBSD) gpgme is installed in /usr/local/ but /usr/local/include/ is
 # not in the default search path. Rather than hard-code this directory, use gpgme-config.
 # Sadly that must be done at the top-level user instead of locally in the gpgme subpackage, because cgo
 # supports only pkg-config, not general shell scripts, and gpgme does not install a pkg-config file.
@@ -29,10 +29,12 @@ ifeq ($(GOBIN),)
 GOBIN := $(GOPATH)/bin
 endif
 
-# Multiple scripts are sensitive to this value, make sure it's exported/available
-# N/B: Need to use 'command -v' here for compatibility with MacOS.
-export CONTAINER_RUNTIME ?= $(if $(shell command -v podman),podman,docker)
-GOMD2MAN ?= $(if $(shell command -v go-md2man),go-md2man,$(GOBIN)/go-md2man)
+# Required for integration-tests to detect they are running inside a specific
+# container image.  Env. var defined in image, make does not automatically
+# pass to children unless explicitly exported
+export container_magic
+CONTAINER_RUNTIME := $(shell command -v podman 2> /dev/null || echo docker)
+GOMD2MAN ?= $(shell command -v go-md2man || echo '$(GOBIN)/go-md2man')
 
 # Go module support: set `-mod=vendor` to use the vendored sources.
 # See also hack/make.sh.
@@ -52,32 +54,9 @@ ifeq ($(GOOS), linux)
 endif
 
 GIT_BRANCH := $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null)
-
-# If $TESTFLAGS is set, it is passed as extra arguments to 'go test'.
-# You can increase test output verbosity with the option '-test.vv'.
-# You can select certain tests to run, with `-test.run <regex>` for example:
-#
-#     make test-unit TESTFLAGS='-test.run ^TestManifestDigest$'
-#
-# For integration test, we use [gocheck](https://labix.org/gocheck).
-# You can increase test output verbosity with the option '-check.vv'.
-# You can limit test selection with `-check.f <regex>`, for example:
-#
-#     make test-integration TESTFLAGS='-check.f CopySuite.TestCopy.*'
-export TESTFLAGS ?= -v -check.v -test.timeout=15m
-
-# This is assumed to be set non-empty when operating inside a CI/automation environment
-CI ?=
-
-# This env. var. is interpreted by some tests as a permission to
-# modify local configuration files and services.
-export SKOPEO_CONTAINER_TESTS ?= $(if $(CI),1,0)
-
-# This is a compromise, we either use a container for this or require
-# the local user to have a compatible python3 development environment.
-# Define it as a "resolve on use" variable to avoid calling out when possible
-SKOPEO_CIDEV_CONTAINER_FQIN ?= $(shell hack/get_fqin.sh)
-CONTAINER_CMD ?= ${CONTAINER_RUNTIME} run --rm -i -e TESTFLAGS="$(TESTFLAGS)" -e CI=$(CI) -e SKOPEO_CONTAINER_TESTS=1
+IMAGE := skopeo-dev$(if $(GIT_BRANCH),:$(GIT_BRANCH))
+# set env like gobuildtag?
+CONTAINER_CMD := ${CONTAINER_RUNTIME} run --rm -i -e TESTFLAGS="$(TESTFLAGS)" #$(CONTAINER_ENVS)
 # if this session isn't interactive, then we don't want to allocate a
 # TTY, which would fail, but if it is interactive, we do want to attach
 # so that the user can send e.g. ^C through.
@@ -85,8 +64,7 @@ INTERACTIVE := $(shell [ -t 0 ] && echo 1 || echo 0)
 ifeq ($(INTERACTIVE), 1)
 	CONTAINER_CMD += -t
 endif
-CONTAINER_GOSRC = /src/github.com/containers/skopeo
-CONTAINER_RUN ?= $(CONTAINER_CMD) --security-opt label=disable -v $(CURDIR):$(CONTAINER_GOSRC) -w $(CONTAINER_GOSRC) $(SKOPEO_CIDEV_CONTAINER_FQIN)
+CONTAINER_RUN := $(CONTAINER_CMD) "$(IMAGE)"
 
 GIT_COMMIT := $(shell git rev-parse HEAD 2> /dev/null || true)
 
@@ -98,8 +76,7 @@ MANPAGES ?= $(MANPAGES_MD:%.md=%)
 
 BTRFS_BUILD_TAG = $(shell hack/btrfs_tag.sh) $(shell hack/btrfs_installed_tag.sh)
 LIBDM_BUILD_TAG = $(shell hack/libdm_tag.sh)
-LIBSUBID_BUILD_TAG = $(shell hack/libsubid_tag.sh)
-LOCAL_BUILD_TAGS = $(BTRFS_BUILD_TAG) $(LIBDM_BUILD_TAG) $(LIBSUBID_BUILD_TAG)
+LOCAL_BUILD_TAGS = $(BTRFS_BUILD_TAG) $(LIBDM_BUILD_TAG)
 BUILDTAGS += $(LOCAL_BUILD_TAGS)
 
 ifeq ($(DISABLE_CGO), 1)
@@ -112,9 +89,6 @@ endif
 #           use source debugging tools like delve.
 all: bin/skopeo docs
 
-codespell:
-	codespell -S Makefile,build,buildah,buildah.spec,imgtype,copy,AUTHORS,bin,vendor,.git,go.sum,CHANGELOG.md,changelog.txt,seccomp.json,.cirrus.yml,"*.xz,*.gz,*.tar,*.tgz,*ico,*.png,*.1,*.5,*.orig,*.rej" -L fpr,uint,iff,od,ERRO -w
-
 help:
 	@echo "Usage: make <target>"
 	@echo
@@ -122,6 +96,7 @@ help:
 	@echo
 	@echo " * 'install' - Install binaries and documents to system locations"
 	@echo " * 'binary' - Build skopeo with a container"
+	@echo " * 'static' - Build statically linked binary"
 	@echo " * 'bin/skopeo' - Build skopeo locally"
 	@echo " * 'test-unit' - Execute unit tests"
 	@echo " * 'test-integration' - Execute integration tests"
@@ -130,9 +105,28 @@ help:
 	@echo " * 'shell' - Run the built image and attach to a shell"
 	@echo " * 'clean' - Clean artifacts"
 
-# Do the build and the output (skopeo) should appear in current dir
+# Build a container image (skopeobuild) that has everything we need to build.
+# Then do the build and the output (skopeo) should appear in current dir
 binary: cmd/skopeo
-	$(CONTAINER_RUN) make bin/skopeo $(if $(DEBUG),DEBUG=$(DEBUG)) BUILDTAGS='$(BUILDTAGS)'
+	${CONTAINER_RUNTIME} build ${BUILD_ARGS} -f Dockerfile.build -t skopeobuildimage .
+	${CONTAINER_RUNTIME} run --rm --security-opt label=disable -v $$(pwd):/src/github.com/containers/skopeo \
+		skopeobuildimage make bin/skopeo $(if $(DEBUG),DEBUG=$(DEBUG)) BUILDTAGS='$(BUILDTAGS)'
+
+# Update nix/nixpkgs.json its latest stable commit
+.PHONY: nixpkgs
+nixpkgs:
+	@nix run \
+		-f channel:nixos-21.05 nix-prefetch-git \
+		-c nix-prefetch-git \
+		--no-deepClone \
+		https://github.com/nixos/nixpkgs refs/heads/nixos-21.05 > nix/nixpkgs.json
+
+# Build statically linked binary
+.PHONY: static
+static:
+	@nix build -f nix/
+	mkdir -p ./bin
+	cp -rfp ./result/bin/* ./bin/
 
 # Build w/o using containers
 .PHONY: bin/skopeo
@@ -142,15 +136,18 @@ bin/skopeo.%:
 	GOOS=$(word 2,$(subst ., ,$@)) GOARCH=$(word 3,$(subst ., ,$@)) $(GO) build $(MOD_VENDOR) ${SKOPEO_LDFLAGS} -tags "containers_image_openpgp $(BUILDTAGS)" -o $@ ./cmd/skopeo
 local-cross: bin/skopeo.darwin.amd64 bin/skopeo.linux.arm bin/skopeo.linux.arm64 bin/skopeo.windows.386.exe bin/skopeo.windows.amd64.exe
 
+build-container:
+	${CONTAINER_RUNTIME} build ${BUILD_ARGS} -t "$(IMAGE)" .
+
 $(MANPAGES): %: %.md
-ifneq ($(DISABLE_DOCS), 1)
 	sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' $<  | $(GOMD2MAN) -in /dev/stdin -out $@
-endif
 
 docs: $(MANPAGES)
 
 docs-in-container:
-	${CONTAINER_RUN} $(MAKE) docs $(if $(DEBUG),DEBUG=$(DEBUG))
+	${CONTAINER_RUNTIME} build ${BUILD_ARGS} -f Dockerfile.build -t skopeobuildimage .
+	${CONTAINER_RUNTIME} run --rm --security-opt label=disable -v $$(pwd):/src/github.com/containers/skopeo \
+		skopeobuildimage make docs $(if $(DEBUG),DEBUG=$(DEBUG)) BUILDTAGS='$(BUILDTAGS)'
 
 clean:
 	rm -rf bin docs/*.1
@@ -167,58 +164,54 @@ install-binary: bin/skopeo
 	install -m 755 bin/skopeo ${DESTDIR}${BINDIR}/skopeo
 
 install-docs: docs
-ifneq ($(DISABLE_DOCS), 1)
 	install -d -m 755 ${DESTDIR}${MANDIR}/man1
 	install -m 644 docs/*.1 ${DESTDIR}${MANDIR}/man1
-endif
 
 install-completions:
 	install -m 755 -d ${DESTDIR}${BASHCOMPLETIONSDIR}
 	install -m 644 completions/bash/skopeo ${DESTDIR}${BASHCOMPLETIONSDIR}/skopeo
 
-shell:
+shell: build-container
 	$(CONTAINER_RUN) bash
 
 check: validate test-unit test-integration test-system
 
-test-integration:
-	$(CONTAINER_RUN) $(MAKE) test-integration-local
+# The tests can run out of entropy and block in containers, so replace /dev/random.
+test-integration: build-container
+	$(CONTAINER_RUN) bash -c 'rm -f /dev/random; ln -sf /dev/urandom /dev/random; SKOPEO_CONTAINER_TESTS=1 BUILDTAGS="$(BUILDTAGS)" $(MAKE) test-integration-local'
 
-
-# Intended for CI, assumed to be running in quay.io/libpod/skopeo_cidev container.
-test-integration-local: bin/skopeo
+# Intended for CI, shortcut 'build-container' since already running inside container.
+test-integration-local:
 	hack/make.sh test-integration
 
 # complicated set of options needed to run podman-in-podman
-# TODO: The $(RM) command will likely fail w/o `podman unshare`
-test-system:
+test-system: build-container
 	DTEMP=$(shell mktemp -d --tmpdir=/var/tmp podman-tmp.XXXXXX); \
 	$(CONTAINER_CMD) --privileged \
-		-v $(CURDIR):$(CONTAINER_GOSRC) -w $(CONTAINER_GOSRC) \
-		-v $$DTEMP:/var/lib/containers:Z -v /run/systemd/journal/socket:/run/systemd/journal/socket \
-		"$(SKOPEO_CIDEV_CONTAINER_FQIN)" \
-			$(MAKE) test-system-local; \
+	    -v $$DTEMP:/var/lib/containers:Z -v /run/systemd/journal/socket:/run/systemd/journal/socket \
+            "$(IMAGE)" \
+            bash -c 'BUILDTAGS="$(BUILDTAGS)" $(MAKE) test-system-local'; \
 	rc=$$?; \
-	-$(RM) -rf $$DTEMP; \
+	$(RM) -rf $$DTEMP; \
 	exit $$rc
 
-# Intended for CI, assumed to already be running in quay.io/libpod/skopeo_cidev container.
-test-system-local: bin/skopeo
+# Intended for CI, shortcut 'build-container' since already running inside container.
+test-system-local:
 	hack/make.sh test-system
 
-test-unit:
+test-unit: build-container
 	# Just call (make test unit-local) here instead of worrying about environment differences
-	$(CONTAINER_RUN) $(MAKE) test-unit-local
+	$(CONTAINER_RUN) make test-unit-local BUILDTAGS='$(BUILDTAGS)'
 
-validate:
-	$(CONTAINER_RUN) $(MAKE) validate-local
+validate: build-container
+	$(CONTAINER_RUN) make validate-local
 
 # This target is only intended for development, e.g. executing it from an IDE. Use (make test) for CI or pre-release testing.
 test-all-local: validate-local validate-docs test-unit-local
 
 .PHONY: validate-local
 validate-local:
-	BUILDTAGS="${BUILDTAGS}" hack/make.sh validate-git-marks validate-gofmt validate-lint validate-vet
+	hack/make.sh validate-git-marks validate-gofmt validate-lint validate-vet
 
 # This invokes bin/skopeo, hence cannot be run as part of validate-local
 .PHONY: validate-docs
@@ -226,7 +219,7 @@ validate-docs:
 	hack/man-page-checker
 	hack/xref-helpmsgs-manpages
 
-test-unit-local: bin/skopeo
+test-unit-local:
 	$(GPGME_ENV) $(GO) test $(MOD_VENDOR) -tags "$(BUILDTAGS)" $$($(GO) list $(MOD_VENDOR) -tags "$(BUILDTAGS)" -e ./... | grep -v '^github\.com/containers/skopeo/\(integration\|vendor/.*\)$$')
 
 vendor:
@@ -235,4 +228,4 @@ vendor:
 	$(GO) mod verify
 
 vendor-in-container:
-	podman run --privileged --rm --env HOME=/root -v $(CURDIR):/src -w /src quay.io/libpod/golang:1.16 $(MAKE) vendor
+	podman run --privileged --rm --env HOME=/root -v `pwd`:/src -w /src docker.io/library/golang:1.16 make vendor

OWNERS

@@ -1,17 +0,0 @@
-approvers:
-  - mtrmac
-  - lsm5
-  - TomSweeneyRedHat
-  - rhatdan
-  - vrothberg
-reviewers:
-  - ashley-cui
-  - giuseppe
-  - containers/image-maintainers
-  - lsm5
-  - mtrmac
-  - QiWang19
-  - rhatdan
-  - runcom
-  - TomSweeneyRedHat
-  - vrothberg

cmd/skopeo/cgo_pthread_ordering_workaround.go

@@ -1,4 +1,3 @@
-//go:build !containers_image_openpgp
 // +build !containers_image_openpgp
 
 package main

cmd/skopeo/copy.go

@@ -4,15 +4,13 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os"
+	"io/ioutil"
 	"strings"
 
-	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/common/pkg/retry"
 	"github.com/containers/image/v5/copy"
 	"github.com/containers/image/v5/docker/reference"
 	"github.com/containers/image/v5/manifest"
-	"github.com/containers/image/v5/pkg/cli"
 	"github.com/containers/image/v5/transports"
 	"github.com/containers/image/v5/transports/alltransports"
 	encconfig "github.com/containers/ocicrypt/config"
@@ -26,20 +24,16 @@ type copyOptions struct {
 	srcImage            *imageOptions
 	destImage           *imageDestOptions
 	retryOpts           *retry.RetryOptions
-	additionalTags      []string                  // For docker-archive: destinations, in addition to the name:tag specified as destination, also add these
-	removeSignatures    bool                      // Do not copy signatures from the source image
-	signByFingerprint   string                    // Sign the image using a GPG key with the specified fingerprint
-	signPassphraseFile  string                    // Path pointing to a passphrase file when signing
-	signIdentity        string                    // Identity of the signed image, must be a fully specified docker reference
-	digestFile          string                    // Write digest to this file
-	format              commonFlag.OptionalString // Force conversion of the image to a specified format
-	quiet               bool                      // Suppress output information when copying images
-	all                 bool                      // Copy all of the images if the source is a list
-	multiArch           commonFlag.OptionalString // How to handle multi architecture images
-	preserveDigests     bool                      // Preserve digests during copy
-	encryptLayer        []int                     // The list of layers to encrypt
-	encryptionKeys      []string                  // Keys needed to encrypt the image
-	decryptionKeys      []string                  // Keys needed to decrypt the image
+	additionalTags      []string       // For docker-archive: destinations, in addition to the name:tag specified as destination, also add these
+	removeSignatures    bool           // Do not copy signatures from the source image
+	signByFingerprint   string         // Sign the image using a GPG key with the specified fingerprint
+	digestFile          string         // Write digest to this file
+	format              optionalString // Force conversion of the image to a specified format
+	quiet               bool           // Suppress output information when copying images
+	all                 bool           // Copy all of the images if the source is a list
+	encryptLayer        []int          // The list of layers to encrypt
+	encryptionKeys      []string       // Keys needed to encrypt the image
+	decryptionKeys      []string       // Keys needed to decrypt the image
 }
 
 func copyCmd(global *globalOptions) *cobra.Command {
@@ -77,42 +71,17 @@ See skopeo(1) section "IMAGE NAMES" for the expected format
 	flags.StringSliceVar(&opts.additionalTags, "additional-tag", []string{}, "additional tags (supports docker-archive)")
 	flags.BoolVarP(&opts.quiet, "quiet", "q", false, "Suppress output information when copying images")
 	flags.BoolVarP(&opts.all, "all", "a", false, "Copy all images if SOURCE-IMAGE is a list")
-	flags.Var(commonFlag.NewOptionalStringValue(&opts.multiArch), "multi-arch", `How to handle multi-architecture images (system, all, or index-only)`)
-	flags.BoolVar(&opts.preserveDigests, "preserve-digests", false, "Preserve digests of images and lists")
 	flags.BoolVar(&opts.removeSignatures, "remove-signatures", false, "Do not copy signatures from SOURCE-IMAGE")
 	flags.StringVar(&opts.signByFingerprint, "sign-by", "", "Sign the image using a GPG key with the specified `FINGERPRINT`")
-	flags.StringVar(&opts.signPassphraseFile, "sign-passphrase-file", "", "File that contains a passphrase for the --sign-by key")
-	flags.StringVar(&opts.signIdentity, "sign-identity", "", "Identity of signed image, must be a fully specified docker reference. Defaults to the target docker reference.")
 	flags.StringVar(&opts.digestFile, "digestfile", "", "Write the digest of the pushed image to the specified file")
-	flags.VarP(commonFlag.NewOptionalStringValue(&opts.format), "format", "f", `MANIFEST TYPE (oci, v2s1, or v2s2) to use in the destination (default is manifest type of source, with fallbacks)`)
+	flags.VarP(newOptionalStringValue(&opts.format), "format", "f", `MANIFEST TYPE (oci, v2s1, or v2s2) to use in the destination (default is manifest type of source, with fallbacks)`)
 	flags.StringSliceVar(&opts.encryptionKeys, "encryption-key", []string{}, "*Experimental* key with the encryption protocol to use needed to encrypt the image (e.g. jwe:/path/to/key.pem)")
 	flags.IntSliceVar(&opts.encryptLayer, "encrypt-layer", []int{}, "*Experimental* the 0-indexed layer indices, with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer)")
 	flags.StringSliceVar(&opts.decryptionKeys, "decryption-key", []string{}, "*Experimental* key needed to decrypt the image")
 	return cmd
 }
 
-// parseMultiArch parses the list processing selection
-// It returns the copy.ImageListSelection to use with image.Copy option
-func parseMultiArch(multiArch string) (copy.ImageListSelection, error) {
-	switch multiArch {
-	case "system":
-		return copy.CopySystemImage, nil
-	case "all":
-		return copy.CopyAllImages, nil
-	// There is no CopyNoImages value in copy.ImageListSelection, but because we
-	// don't provide an option to select a set of images to copy, we can use
-	// CopySpecificImages.
-	case "index-only":
-		return copy.CopySpecificImages, nil
-	// We don't expose CopySpecificImages other than index-only above, because
-	// we currently don't provide an option to choose the images to copy. That
-	// could be added in the future.
-	default:
-		return copy.CopySystemImage, fmt.Errorf("unknown multi-arch option %q. Choose one of the supported options: 'system', 'all', or 'index-only'", multiArch)
-	}
-}
-
-func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
+func (opts *copyOptions) run(args []string, stdout io.Writer) error {
 	if len(args) != 2 {
 		return errorShouldDisplayUsage{errors.New("Exactly two arguments expected")}
 	}
@@ -127,11 +96,7 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 	if err != nil {
 		return fmt.Errorf("Error loading trust policy: %v", err)
 	}
-	defer func() {
-		if err := policyContext.Destroy(); err != nil {
-			retErr = fmt.Errorf("(error tearing down policy context: %v): %w", err, retErr)
-		}
-	}()
+	defer policyContext.Destroy()
 
 	srcRef, err := alltransports.ParseImageName(imageNames[0])
 	if err != nil {
@@ -152,8 +117,8 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 	}
 
 	var manifestType string
-	if opts.format.Present() {
-		manifestType, err = parseManifestFormat(opts.format.Value())
+	if opts.format.present {
+		manifestType, err = parseManifestFormat(opts.format.value)
 		if err != nil {
 			return err
 		}
@@ -177,17 +142,7 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 	if opts.quiet {
 		stdout = nil
 	}
-
 	imageListSelection := copy.CopySystemImage
-	if opts.multiArch.Present() && opts.all {
-		return fmt.Errorf("Cannot use --all and --multi-arch flags together")
-	}
-	if opts.multiArch.Present() {
-		imageListSelection, err = parseMultiArch(opts.multiArch.Value())
-		if err != nil {
-			return err
-		}
-	}
 	if opts.all {
 		imageListSelection = copy.CopyAllImages
 	}
@@ -228,31 +183,15 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 		decConfig = cc.DecryptConfig
 	}
 
-	passphrase, err := cli.ReadPassphraseFile(opts.signPassphraseFile)
-	if err != nil {
-		return err
-	}
-
-	var signIdentity reference.Named = nil
-	if opts.signIdentity != "" {
-		signIdentity, err = reference.ParseNamed(opts.signIdentity)
-		if err != nil {
-			return fmt.Errorf("Could not parse --sign-identity: %v", err)
-		}
-	}
-
 	return retry.RetryIfNecessary(ctx, func() error {
 		manifestBytes, err := copy.Image(ctx, policyContext, destRef, srcRef, &copy.Options{
 			RemoveSignatures:      opts.removeSignatures,
 			SignBy:                opts.signByFingerprint,
-			SignPassphrase:        passphrase,
-			SignIdentity:          signIdentity,
 			ReportWriter:          stdout,
 			SourceCtx:             sourceCtx,
 			DestinationCtx:        destinationCtx,
 			ForceManifestMIMEType: manifestType,
 			ImageListSelection:    imageListSelection,
-			PreserveDigests:       opts.preserveDigests,
 			OciDecryptConfig:      decConfig,
 			OciEncryptLayers:      encLayers,
 			OciEncryptConfig:      encConfig,
@@ -265,7 +204,7 @@ func (opts *copyOptions) run(args []string, stdout io.Writer) (retErr error) {
 			if err != nil {
 				return err
 			}
-			if err = os.WriteFile(opts.digestFile, []byte(manifestDigest.String()), 0644); err != nil {
+			if err = ioutil.WriteFile(opts.digestFile, []byte(manifestDigest.String()), 0644); err != nil {
 				return fmt.Errorf("Failed to write digest to file %q: %w", opts.digestFile, err)
 			}
 		}

cmd/skopeo/flag.go

@@ -1,4 +1,4 @@
-package flag
+package main
 
 import (
 	"strconv"
@@ -6,45 +6,31 @@ import (
 	"github.com/spf13/pflag"
 )
 
-// OptionalBool is a boolean with a separate presence flag and value.
-type OptionalBool struct {
+// optionalBool is a boolean with a separate presence flag.
+type optionalBool struct {
 	present bool
 	value   bool
 }
 
-// Present returns the bool's presence flag.
-func (ob *OptionalBool) Present() bool {
-	return ob.present
-}
-
-// Present returns the bool's value. Should only be used if Present() is true.
-func (ob *OptionalBool) Value() bool {
-	return ob.value
-}
-
 // optionalBool is a cli.Generic == flag.Value implementation equivalent to
 // the one underlying flag.Bool, except that it records whether the flag has been set.
 // This is distinct from optionalBool to (pretend to) force callers to use
 // optionalBoolFlag
-type optionalBoolValue OptionalBool
+type optionalBoolValue optionalBool
 
-// OptionalBoolFlag creates new flag for an optional in the specified flag with
-// the specified name and usage.
-func OptionalBoolFlag(fs *pflag.FlagSet, p *OptionalBool, name, usage string) *pflag.Flag {
+func optionalBoolFlag(fs *pflag.FlagSet, p *optionalBool, name, usage string) *pflag.Flag {
 	flag := fs.VarPF(internalNewOptionalBoolValue(p), name, "", usage)
 	flag.NoOptDefVal = "true"
-	flag.DefValue = "false"
 	return flag
 }
 
 // WARNING: Do not directly use this method to define optionalBool flag.
 // Caller should use optionalBoolFlag
-func internalNewOptionalBoolValue(p *OptionalBool) pflag.Value {
+func internalNewOptionalBoolValue(p *optionalBool) pflag.Value {
 	p.present = false
 	return (*optionalBoolValue)(p)
 }
 
-// Set parses the string to a bool and sets it.
 func (ob *optionalBoolValue) Set(s string) error {
 	v, err := strconv.ParseBool(s)
 	if err != nil {
@@ -55,7 +41,6 @@ func (ob *optionalBoolValue) Set(s string) error {
 	return nil
 }
 
-// String returns the string representation of the string.
 func (ob *optionalBoolValue) String() string {
 	if !ob.present {
 		return "" // This is, sadly, not round-trip safe: --flag is interpreted as --flag=true
@@ -63,52 +48,37 @@ func (ob *optionalBoolValue) String() string {
 	return strconv.FormatBool(ob.value)
 }
 
-// Type returns the type.
 func (ob *optionalBoolValue) Type() string {
 	return "bool"
 }
 
-// IsBoolFlag indicates that it's a bool flag.
 func (ob *optionalBoolValue) IsBoolFlag() bool {
 	return true
 }
 
-// OptionalString is a string with a separate presence flag.
-type OptionalString struct {
+// optionalString is a string with a separate presence flag.
+type optionalString struct {
 	present bool
 	value   string
 }
 
-// Present returns the strings's presence flag.
-func (os *OptionalString) Present() bool {
-	return os.present
-}
-
-// Present returns the string's value. Should only be used if Present() is true.
-func (os *OptionalString) Value() string {
-	return os.value
-}
-
 // optionalString is a cli.Generic == flag.Value implementation equivalent to
 // the one underlying flag.String, except that it records whether the flag has been set.
 // This is distinct from optionalString to (pretend to) force callers to use
 // newoptionalString
-type optionalStringValue OptionalString
+type optionalStringValue optionalString
 
-// NewOptionalStringValue returns a pflag.Value for the string.
-func NewOptionalStringValue(p *OptionalString) pflag.Value {
+func newOptionalStringValue(p *optionalString) pflag.Value {
 	p.present = false
 	return (*optionalStringValue)(p)
 }
 
-// Set sets the string.
 func (ob *optionalStringValue) Set(s string) error {
 	ob.value = s
 	ob.present = true
 	return nil
 }
 
-// String returns the string if present.
 func (ob *optionalStringValue) String() string {
 	if !ob.present {
 		return "" // This is, sadly, not round-trip safe: --flag= is interpreted as {present:true, value:""}
@@ -116,40 +86,27 @@ func (ob *optionalStringValue) String() string {
 	return ob.value
 }
 
-// Type returns the string type.
 func (ob *optionalStringValue) Type() string {
 	return "string"
 }
 
-// OptionalInt is a int with a separate presence flag.
-type OptionalInt struct {
+// optionalInt is a int with a separate presence flag.
+type optionalInt struct {
 	present bool
 	value   int
 }
 
-// Present returns the int's presence flag.
-func (oi *OptionalInt) Present() bool {
-	return oi.present
-}
-
-// Present returns the int's value. Should only be used if Present() is true.
-func (oi *OptionalInt) Value() int {
-	return oi.value
-}
-
 // optionalInt is a cli.Generic == flag.Value implementation equivalent to
 // the one underlying flag.Int, except that it records whether the flag has been set.
 // This is distinct from optionalInt to (pretend to) force callers to use
 // newoptionalIntValue
-type optionalIntValue OptionalInt
+type optionalIntValue optionalInt
 
-// NewOptionalIntValue returns the pflag.Value of the int.
-func NewOptionalIntValue(p *OptionalInt) pflag.Value {
+func newOptionalIntValue(p *optionalInt) pflag.Value {
 	p.present = false
 	return (*optionalIntValue)(p)
 }
 
-// Set parses the string to an int and sets it.
 func (ob *optionalIntValue) Set(s string) error {
 	v, err := strconv.ParseInt(s, 0, strconv.IntSize)
 	if err != nil {
@@ -160,7 +117,6 @@ func (ob *optionalIntValue) Set(s string) error {
 	return nil
 }
 
-// String returns the string representation of the int.
 func (ob *optionalIntValue) String() string {
 	if !ob.present {
 		return "" // If the value is not present, just return an empty string, any other value wouldn't make sense.
@@ -168,7 +124,6 @@ func (ob *optionalIntValue) String() string {
 	return strconv.Itoa(int(ob.value))
 }
 
-// Type returns the int's type.
 func (ob *optionalIntValue) Type() string {
 	return "int"
 }

cmd/skopeo/flag_test.go

@@ -0,0 +1,222 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOptionalBoolSet(t *testing.T) {
+	for _, c := range []struct {
+		input    string
+		accepted bool
+		value    bool
+	}{
+		// Valid inputs documented for strconv.ParseBool == flag.BoolVar
+		{"1", true, true},
+		{"t", true, true},
+		{"T", true, true},
+		{"TRUE", true, true},
+		{"true", true, true},
+		{"True", true, true},
+		{"0", true, false},
+		{"f", true, false},
+		{"F", true, false},
+		{"FALSE", true, false},
+		{"false", true, false},
+		{"False", true, false},
+		// A few invalid inputs
+		{"", false, false},
+		{"yes", false, false},
+		{"no", false, false},
+		{"2", false, false},
+	} {
+		var ob optionalBool
+		v := internalNewOptionalBoolValue(&ob)
+		require.False(t, ob.present)
+		err := v.Set(c.input)
+		if c.accepted {
+			assert.NoError(t, err, c.input)
+			assert.Equal(t, c.value, ob.value)
+		} else {
+			assert.Error(t, err, c.input)
+			assert.False(t, ob.present) // Just to be extra paranoid.
+		}
+	}
+
+	// Nothing actually explicitly says that .Set() is never called when the flag is not present on the command line;
+	// so, check that it is not being called, at least in the straightforward case (it's not possible to test that it
+	// is not called in any possible situation).
+	var globalOB, commandOB optionalBool
+	actionRun := false
+	app := &cobra.Command{
+		Use: "app",
+	}
+	optionalBoolFlag(app.PersistentFlags(), &globalOB, "global-OB", "")
+	cmd := &cobra.Command{
+		Use: "cmd",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			assert.False(t, globalOB.present)
+			assert.False(t, commandOB.present)
+			actionRun = true
+			return nil
+		},
+	}
+	optionalBoolFlag(cmd.Flags(), &commandOB, "command-OB", "")
+	app.AddCommand(cmd)
+	app.SetArgs([]string{"cmd"})
+	err := app.Execute()
+	require.NoError(t, err)
+	assert.True(t, actionRun)
+}
+
+func TestOptionalBoolString(t *testing.T) {
+	for _, c := range []struct {
+		input    optionalBool
+		expected string
+	}{
+		{optionalBool{present: true, value: true}, "true"},
+		{optionalBool{present: true, value: false}, "false"},
+		{optionalBool{present: false, value: true}, ""},
+		{optionalBool{present: false, value: false}, ""},
+	} {
+		var ob optionalBool
+		v := internalNewOptionalBoolValue(&ob)
+		ob = c.input
+		res := v.String()
+		assert.Equal(t, c.expected, res)
+	}
+}
+
+func TestOptionalBoolIsBoolFlag(t *testing.T) {
+	// IsBoolFlag means that the argument value must either be part of the same argument, with =;
+	// if there is no =, the value is set to true.
+	// This differs form other flags, where the argument is required and may be either separated with = or supplied in the next argument.
+	for _, c := range []struct {
+		input        []string
+		expectedOB   optionalBool
+		expectedArgs []string
+	}{
+		{[]string{"1", "2"}, optionalBool{present: false}, []string{"1", "2"}},                                       // Flag not present
+		{[]string{"--OB=true", "1", "2"}, optionalBool{present: true, value: true}, []string{"1", "2"}},              // --OB=true
+		{[]string{"--OB=false", "1", "2"}, optionalBool{present: true, value: false}, []string{"1", "2"}},            // --OB=false
+		{[]string{"--OB", "true", "1", "2"}, optionalBool{present: true, value: true}, []string{"true", "1", "2"}},   // --OB true
+		{[]string{"--OB", "false", "1", "2"}, optionalBool{present: true, value: true}, []string{"false", "1", "2"}}, // --OB false
+	} {
+		var ob optionalBool
+		actionRun := false
+		app := &cobra.Command{Use: "app"}
+		cmd := &cobra.Command{
+			Use: "cmd",
+			RunE: func(cmd *cobra.Command, args []string) error {
+				assert.Equal(t, c.expectedOB, ob)
+				assert.Equal(t, c.expectedArgs, args)
+				actionRun = true
+				return nil
+			},
+		}
+		optionalBoolFlag(cmd.Flags(), &ob, "OB", "")
+		app.AddCommand(cmd)
+
+		app.SetArgs(append([]string{"cmd"}, c.input...))
+		err := app.Execute()
+		require.NoError(t, err)
+		assert.True(t, actionRun)
+	}
+}
+
+func TestOptionalStringSet(t *testing.T) {
+	// Really just a smoke test, but differentiating between not present and empty.
+	for _, c := range []string{"", "hello"} {
+		var os optionalString
+		v := newOptionalStringValue(&os)
+		require.False(t, os.present)
+		err := v.Set(c)
+		assert.NoError(t, err, c)
+		assert.Equal(t, c, os.value)
+	}
+
+	// Nothing actually explicitly says that .Set() is never called when the flag is not present on the command line;
+	// so, check that it is not being called, at least in the straightforward case (it's not possible to test that it
+	// is not called in any possible situation).
+	var globalOS, commandOS optionalString
+	actionRun := false
+	app := &cobra.Command{
+		Use: "app",
+	}
+	app.PersistentFlags().Var(newOptionalStringValue(&globalOS), "global-OS", "")
+	cmd := &cobra.Command{
+		Use: "cmd",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			assert.False(t, globalOS.present)
+			assert.False(t, commandOS.present)
+			actionRun = true
+			return nil
+		},
+	}
+	cmd.Flags().Var(newOptionalStringValue(&commandOS), "command-OS", "")
+	app.AddCommand(cmd)
+	app.SetArgs([]string{"cmd"})
+	err := app.Execute()
+	require.NoError(t, err)
+	assert.True(t, actionRun)
+}
+
+func TestOptionalStringString(t *testing.T) {
+	for _, c := range []struct {
+		input    optionalString
+		expected string
+	}{
+		{optionalString{present: true, value: "hello"}, "hello"},
+		{optionalString{present: true, value: ""}, ""},
+		{optionalString{present: false, value: "hello"}, ""},
+		{optionalString{present: false, value: ""}, ""},
+	} {
+		var os optionalString
+		v := newOptionalStringValue(&os)
+		os = c.input
+		res := v.String()
+		assert.Equal(t, c.expected, res)
+	}
+}
+
+func TestOptionalStringIsBoolFlag(t *testing.T) {
+	// NOTE: optionalStringValue does not implement IsBoolFlag!
+	// IsBoolFlag means that the argument value must either be part of the same argument, with =;
+	// if there is no =, the value is set to true.
+	// This differs form other flags, where the argument is required and may be either separated with = or supplied in the next argument.
+	for _, c := range []struct {
+		input        []string
+		expectedOS   optionalString
+		expectedArgs []string
+	}{
+		{[]string{"1", "2"}, optionalString{present: false}, []string{"1", "2"}},                                 // Flag not present
+		{[]string{"--OS=hello", "1", "2"}, optionalString{present: true, value: "hello"}, []string{"1", "2"}},    // --OS=true
+		{[]string{"--OS=", "1", "2"}, optionalString{present: true, value: ""}, []string{"1", "2"}},              // --OS=false
+		{[]string{"--OS", "hello", "1", "2"}, optionalString{present: true, value: "hello"}, []string{"1", "2"}}, // --OS true
+		{[]string{"--OS", "", "1", "2"}, optionalString{present: true, value: ""}, []string{"1", "2"}},           // --OS false
+	} {
+		var os optionalString
+		actionRun := false
+		app := &cobra.Command{
+			Use: "app",
+		}
+		cmd := &cobra.Command{
+			Use: "cmd",
+			RunE: func(cmd *cobra.Command, args []string) error {
+				assert.Equal(t, c.expectedOS, os)
+				assert.Equal(t, c.expectedArgs, args)
+				actionRun = true
+				return nil
+			},
+		}
+		cmd.Flags().Var(newOptionalStringValue(&os), "OS", "")
+		app.AddCommand(cmd)
+		app.SetArgs(append([]string{"cmd"}, c.input...))
+		err := app.Execute()
+		require.NoError(t, err)
+		assert.True(t, actionRun)
+	}
+}

cmd/skopeo/inspect.go

@@ -24,13 +24,12 @@ import (
 )
 
 type inspectOptions struct {
-	global        *globalOptions
-	image         *imageOptions
-	retryOpts     *retry.RetryOptions
-	format        string
-	raw           bool // Output the raw manifest instead of parsing information about the image
-	config        bool // Output the raw config blob instead of parsing information about the image
-	doNotListTags bool // Do not list all tags available in the same repository
+	global    *globalOptions
+	image     *imageOptions
+	retryOpts *retry.RetryOptions
+	format    string
+	raw       bool // Output the raw manifest instead of parsing information about the image
+	config    bool // Output the raw config blob instead of parsing information about the image
 }
 
 func inspectCmd(global *globalOptions) *cobra.Command {
@@ -61,7 +60,6 @@ See skopeo(1) section "IMAGE NAMES" for the expected format
 	flags.BoolVar(&opts.raw, "raw", false, "output raw manifest or configuration")
 	flags.BoolVar(&opts.config, "config", false, "output configuration")
 	flags.StringVarP(&opts.format, "format", "f", "", "Format the output to a Go template")
-	flags.BoolVarP(&opts.doNotListTags, "no-tags", "n", false, "Do not list the available tags from the repository in the output")
 	flags.AddFlagSet(&sharedFlags)
 	flags.AddFlagSet(&imageFlags)
 	flags.AddFlagSet(&retryFlags)
@@ -194,7 +192,7 @@ func (opts *inspectOptions) run(args []string, stdout io.Writer) (retErr error)
 	if dockerRef := img.Reference().DockerReference(); dockerRef != nil {
 		outputData.Name = dockerRef.Name()
 	}
-	if !opts.doNotListTags && img.Reference().Transport() == docker.Transport {
+	if img.Reference().Transport() == docker.Transport {
 		sys, err := opts.image.newSystemContext()
 		if err != nil {
 			return err

cmd/skopeo/layers.go

@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"strings"
 
@@ -121,7 +122,7 @@ func (opts *layersOptions) run(args []string, stdout io.Writer) (retErr error) {
 		}
 	}
 
-	tmpDir, err := os.MkdirTemp(".", "layers-")
+	tmpDir, err := ioutil.TempDir(".", "layers-")
 	if err != nil {
 		return err
 	}

cmd/skopeo/list_tags.go

@@ -5,12 +5,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"sort"
 	"strings"
 
 	"github.com/containers/common/pkg/retry"
 	"github.com/containers/image/v5/docker"
-	"github.com/containers/image/v5/docker/archive"
 	"github.com/containers/image/v5/docker/reference"
 	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/containers/image/v5/types"
@@ -20,7 +18,7 @@ import (
 
 // tagListOutput is the output format of (skopeo list-tags), primarily so that we can format it with a simple json.MarshalIndent.
 type tagListOutput struct {
-	Repository string `json:",omitempty"`
+	Repository string
 	Tags       []string
 }
 
@@ -30,21 +28,6 @@ type tagsOptions struct {
 	retryOpts *retry.RetryOptions
 }
 
-var transportHandlers = map[string]func(ctx context.Context, sys *types.SystemContext, opts *tagsOptions, userInput string) (repositoryName string, tagListing []string, err error){
-	docker.Transport.Name():  listDockerRepoTags,
-	archive.Transport.Name(): listDockerArchiveTags,
-}
-
-// supportedTransports returns all the supported transports
-func supportedTransports(joinStr string) string {
-	res := make([]string, 0, len(transportHandlers))
-	for handlerName := range transportHandlers {
-		res = append(res, handlerName)
-	}
-	sort.Strings(res)
-	return strings.Join(res, joinStr)
-}
-
 func tagsCmd(global *globalOptions) *cobra.Command {
 	sharedFlags, sharedOpts := sharedImageFlags()
 	imageFlags, imageOpts := dockerImageFlags(global, sharedOpts, nil, "", "")
@@ -55,14 +38,13 @@ func tagsCmd(global *globalOptions) *cobra.Command {
 		image:     imageOpts,
 		retryOpts: retryOpts,
 	}
-
 	cmd := &cobra.Command{
-		Use:   "list-tags [command options] SOURCE-IMAGE",
-		Short: "List tags in the transport/repository specified by the SOURCE-IMAGE",
-		Long: `Return the list of tags from the transport/repository "SOURCE-IMAGE"
+		Use:   "list-tags [command options] REPOSITORY-NAME",
+		Short: "List tags in the transport/repository specified by the REPOSITORY-NAME",
+		Long: `Return the list of tags from the transport/repository "REPOSITORY-NAME"
 
 Supported transports:
-` + supportedTransports(" ") + `
+docker
 
 See skopeo-list-tags(1) section "REPOSITORY NAMES" for the expected format
 `,
@@ -113,58 +95,6 @@ func listDockerTags(ctx context.Context, sys *types.SystemContext, imgRef types.
 	return repositoryName, tags, nil
 }
 
-// return the tagLists from a docker repo
-func listDockerRepoTags(ctx context.Context, sys *types.SystemContext, opts *tagsOptions, userInput string) (repositoryName string, tagListing []string, err error) {
-	// Do transport-specific parsing and validation to get an image reference
-	imgRef, err := parseDockerRepositoryReference(userInput)
-	if err != nil {
-		return
-	}
-	if err = retry.RetryIfNecessary(ctx, func() error {
-		repositoryName, tagListing, err = listDockerTags(ctx, sys, imgRef)
-		return err
-	}, opts.retryOpts); err != nil {
-		return
-	}
-	return
-}
-
-// return the tagLists from a docker archive file
-func listDockerArchiveTags(ctx context.Context, sys *types.SystemContext, opts *tagsOptions, userInput string) (repositoryName string, tagListing []string, err error) {
-	ref, err := alltransports.ParseImageName(userInput)
-	if err != nil {
-		return
-	}
-
-	tarReader, _, err := archive.NewReaderForReference(sys, ref)
-	if err != nil {
-		return
-	}
-	defer tarReader.Close()
-
-	imageRefs, err := tarReader.List()
-	if err != nil {
-		return
-	}
-
-	var repoTags []string
-	for imageIndex, items := range imageRefs {
-		for _, ref := range items {
-			repoTags, err = tarReader.ManifestTagsForReference(ref)
-			if err != nil {
-				return
-			}
-			// handle for each untagged image
-			if len(repoTags) == 0 {
-				repoTags = []string{fmt.Sprintf("@%d", imageIndex)}
-			}
-			tagListing = append(tagListing, repoTags...)
-		}
-	}
-
-	return
-}
-
 func (opts *tagsOptions) run(args []string, stdout io.Writer) (retErr error) {
 	ctx, cancel := opts.global.commandTimeoutContext()
 	defer cancel()
@@ -183,17 +113,23 @@ func (opts *tagsOptions) run(args []string, stdout io.Writer) (retErr error) {
 		return fmt.Errorf("Invalid %q: does not specify a transport", args[0])
 	}
 
+	if transport.Name() != docker.Transport.Name() {
+		return fmt.Errorf("Unsupported transport '%v' for tag listing. Only '%v' currently supported", transport.Name(), docker.Transport.Name())
+	}
+
+	// Do transport-specific parsing and validation to get an image reference
+	imgRef, err := parseDockerRepositoryReference(args[0])
+	if err != nil {
+		return err
+	}
+
 	var repositoryName string
 	var tagListing []string
-
-	if val, ok := transportHandlers[transport.Name()]; ok {
-		repositoryName, tagListing, err = val(ctx, sys, opts, args[0])
-		if err != nil {
-			return err
-		}
-	} else {
-		return fmt.Errorf("Unsupported transport '%s' for tag listing. Only supported: %s",
-			transport.Name(), supportedTransports(", "))
+	if err = retry.RetryIfNecessary(ctx, func() error {
+		repositoryName, tagListing, err = listDockerTags(ctx, sys, imgRef)
+		return err
+	}, opts.retryOpts); err != nil {
+		return err
 	}
 
 	outputData := tagListOutput{

cmd/skopeo/login.go

@@ -5,7 +5,6 @@ import (
 	"os"
 
 	"github.com/containers/common/pkg/auth"
-	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/image/v5/types"
 	"github.com/spf13/cobra"
 )
@@ -13,7 +12,7 @@ import (
 type loginOptions struct {
 	global    *globalOptions
 	loginOpts auth.LoginOptions
-	tlsVerify commonFlag.OptionalBool
+	tlsVerify optionalBool
 }
 
 func loginCmd(global *globalOptions) *cobra.Command {
@@ -29,7 +28,7 @@ func loginCmd(global *globalOptions) *cobra.Command {
 	}
 	adjustUsage(cmd)
 	flags := cmd.Flags()
-	commonFlag.OptionalBoolFlag(flags, &opts.tlsVerify, "tls-verify", "require HTTPS and verify certificates when accessing the registry")
+	optionalBoolFlag(flags, &opts.tlsVerify, "tls-verify", "require HTTPS and verify certificates when accessing the registry")
 	flags.AddFlagSet(auth.GetLoginFlags(&opts.loginOpts))
 	return cmd
 }
@@ -41,8 +40,8 @@ func (opts *loginOptions) run(args []string, stdout io.Writer) error {
 	opts.loginOpts.Stdin = os.Stdin
 	opts.loginOpts.AcceptRepositories = true
 	sys := opts.global.newSystemContext()
-	if opts.tlsVerify.Present() {
-		sys.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.Value())
+	if opts.tlsVerify.present {
+		sys.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.value)
 	}
 	return auth.Login(ctx, sys, &opts.loginOpts, args)
 }

cmd/skopeo/logout.go

@@ -4,7 +4,6 @@ import (
 	"io"
 
 	"github.com/containers/common/pkg/auth"
-	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/image/v5/types"
 	"github.com/spf13/cobra"
 )
@@ -12,7 +11,7 @@ import (
 type logoutOptions struct {
 	global     *globalOptions
 	logoutOpts auth.LogoutOptions
-	tlsVerify  commonFlag.OptionalBool
+	tlsVerify  optionalBool
 }
 
 func logoutCmd(global *globalOptions) *cobra.Command {
@@ -28,7 +27,7 @@ func logoutCmd(global *globalOptions) *cobra.Command {
 	}
 	adjustUsage(cmd)
 	flags := cmd.Flags()
-	commonFlag.OptionalBoolFlag(flags, &opts.tlsVerify, "tls-verify", "require HTTPS and verify certificates when accessing the registry")
+	optionalBoolFlag(flags, &opts.tlsVerify, "tls-verify", "require HTTPS and verify certificates when accessing the registry")
 	flags.AddFlagSet(auth.GetLogoutFlags(&opts.logoutOpts))
 	return cmd
 }
@@ -37,8 +36,8 @@ func (opts *logoutOptions) run(args []string, stdout io.Writer) error {
 	opts.logoutOpts.Stdout = stdout
 	opts.logoutOpts.AcceptRepositories = true
 	sys := opts.global.newSystemContext()
-	if opts.tlsVerify.Present() {
-		sys.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.Value())
+	if opts.tlsVerify.present {
+		sys.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.value)
 	}
 	return auth.Logout(sys, &opts.logoutOpts, args)
 }

cmd/skopeo/main.go

@@ -3,10 +3,8 @@ package main
 import (
 	"context"
 	"fmt"
-	"strings"
 	"time"
 
-	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/image/v5/signature"
 	"github.com/containers/image/v5/types"
 	"github.com/containers/skopeo/version"
@@ -22,32 +20,17 @@ var gitCommit = ""
 var defaultUserAgent = "skopeo/" + version.Version
 
 type globalOptions struct {
-	debug              bool                    // Enable debug output
-	tlsVerify          commonFlag.OptionalBool // Require HTTPS and verify certificates (for docker: and docker-daemon:)
-	policyPath         string                  // Path to a signature verification policy file
-	insecurePolicy     bool                    // Use an "allow everything" signature verification policy
-	registriesDirPath  string                  // Path to a "registries.d" registry configuration directory
-	overrideArch       string                  // Architecture to use for choosing images, instead of the runtime one
-	overrideOS         string                  // OS to use for choosing images, instead of the runtime one
-	overrideVariant    string                  // Architecture variant to use for choosing images, instead of the runtime one
-	commandTimeout     time.Duration           // Timeout for the command execution
-	registriesConfPath string                  // Path to the "registries.conf" file
-	tmpDir             string                  // Path to use for big temporary files
-}
-
-// requireSubcommand returns an error if no sub command is provided
-// This was copied from podman: `github.com/containers/podman/cmd/podman/validate/args.go
-// Some small style changes to match skopeo were applied, but try to apply any
-// bugfixes there first.
-func requireSubcommand(cmd *cobra.Command, args []string) error {
-	if len(args) > 0 {
-		suggestions := cmd.SuggestionsFor(args[0])
-		if len(suggestions) == 0 {
-			return fmt.Errorf("Unrecognized command `%[1]s %[2]s`\nTry '%[1]s --help' for more information", cmd.CommandPath(), args[0])
-		}
-		return fmt.Errorf("Unrecognized command `%[1]s %[2]s`\n\nDid you mean this?\n\t%[3]s\n\nTry '%[1]s --help' for more information", cmd.CommandPath(), args[0], strings.Join(suggestions, "\n\t"))
-	}
-	return fmt.Errorf("Missing command '%[1]s COMMAND'\nTry '%[1]s --help' for more information", cmd.CommandPath())
+	debug              bool          // Enable debug output
+	tlsVerify          optionalBool  // Require HTTPS and verify certificates (for docker: and docker-daemon:)
+	policyPath         string        // Path to a signature verification policy file
+	insecurePolicy     bool          // Use an "allow everything" signature verification policy
+	registriesDirPath  string        // Path to a "registries.d" registry configuration directory
+	overrideArch       string        // Architecture to use for choosing images, instead of the runtime one
+	overrideOS         string        // OS to use for choosing images, instead of the runtime one
+	overrideVariant    string        // Architecture variant to use for choosing images, instead of the runtime one
+	commandTimeout     time.Duration // Timeout for the command execution
+	registriesConfPath string        // Path to the "registries.conf" file
+	tmpDir             string        // Path to use for big temporary files
 }
 
 // createApp returns a cobra.Command, and the underlying globalOptions object, to be run or tested.
@@ -57,7 +40,6 @@ func createApp() (*cobra.Command, *globalOptions) {
 	rootCommand := &cobra.Command{
 		Use:  "skopeo",
 		Long: "Various operations with container images and container image registries",
-		RunE: requireSubcommand,
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
 			return opts.before(cmd)
 		},
@@ -96,7 +78,7 @@ func createApp() (*cobra.Command, *globalOptions) {
 		logrus.Fatal("unable to mark registries-conf flag as hidden")
 	}
 	rootCommand.PersistentFlags().StringVar(&opts.tmpDir, "tmpdir", "", "directory used to store temporary files")
-	flag := commonFlag.OptionalBoolFlag(rootCommand.Flags(), &opts.tlsVerify, "tls-verify", "Require HTTPS and verify certificates when accessing the registry")
+	flag := optionalBoolFlag(rootCommand.Flags(), &opts.tlsVerify, "tls-verify", "Require HTTPS and verify certificates when accessing the registry")
 	flag.Hidden = true
 	rootCommand.AddCommand(
 		copyCmd(&opts),
@@ -106,7 +88,6 @@ func createApp() (*cobra.Command, *globalOptions) {
 		loginCmd(&opts),
 		logoutCmd(&opts),
 		manifestDigestCmd(),
-		proxyCmd(&opts),
 		syncCmd(&opts),
 		standaloneSignCmd(),
 		standaloneVerifyCmd(),
@@ -121,7 +102,7 @@ func (opts *globalOptions) before(cmd *cobra.Command) error {
 	if opts.debug {
 		logrus.SetLevel(logrus.DebugLevel)
 	}
-	if opts.tlsVerify.Present() {
+	if opts.tlsVerify.present {
 		logrus.Warn("'--tls-verify' is deprecated, please set this on the specific subcommand")
 	}
 	return nil
@@ -178,8 +159,8 @@ func (opts *globalOptions) newSystemContext() *types.SystemContext {
 		DockerRegistryUserAgent:  defaultUserAgent,
 	}
 	// DEPRECATED: We support this for backward compatibility, but override it if a per-image flag is provided.
-	if opts.tlsVerify.Present() {
-		ctx.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.Value())
+	if opts.tlsVerify.present {
+		ctx.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.value)
 	}
 	return ctx
 }

cmd/skopeo/manifest.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os"
+	"io/ioutil"
 
 	"github.com/containers/image/v5/manifest"
 	"github.com/spf13/cobra"
@@ -31,7 +31,7 @@ func (opts *manifestDigestOptions) run(args []string, stdout io.Writer) error {
 	}
 	manifestPath := args[0]
 
-	man, err := os.ReadFile(manifestPath)
+	man, err := ioutil.ReadFile(manifestPath)
 	if err != nil {
 		return fmt.Errorf("Error reading manifest from %s: %v", manifestPath, err)
 	}

cmd/skopeo/proxy.go

@@ -1,738 +0,0 @@
-//go:build !windows
-// +build !windows
-
-package main
-
-/*
-  This code is currently only intended to be used by ostree
-  to fetch content via containers.  The API is subject
-  to change.  A goal however is to stabilize the API
-  eventually as a full out-of-process interface to the
-  core containers/image library functionality.
-
-  To use this command, in a parent process create a
-  `socketpair()` of type `SOCK_SEQPACKET`.  Fork
-  off this command, and pass one half of the socket
-  pair to the child.  Providing it on stdin (fd 0)
-  is the expected default.
-
-  The protocol is JSON for the control layer,
-  and  a read side of a `pipe()` passed for large data.
-
- Base JSON protocol:
-
- request: { method: "MethodName": args: [arguments] }
- reply: { success: bool, value: JSVAL, pipeid: number, error: string }
-
- For any non-metadata i.e. payload data from `GetManifest`
- and `GetBlob` the server will pass back the read half of a `pipe(2)` via FD passing,
- along with a `pipeid` integer.
-
- The expected flow looks like this:
-
-  - Initialize
-    And validate the returned protocol version versus
-	what your client supports.
-  - OpenImage docker://quay.io/someorg/example:latest
-    (returns an imageid)
-  - GetManifest imageid (and associated <pipeid>)
-  (Streaming read data from pipe)
-  - FinishPipe <pipeid>
-  - GetBlob imageid sha256:...
-  (Streaming read data from pipe)
-  - FinishPipe <pipeid>
-  - GetBlob imageid sha256:...
-  (Streaming read data from pipe)
-  - FinishPipe <pipeid>
-  - CloseImage imageid
-
- You may interleave invocations of these methods, e.g. one
- can also invoke `OpenImage` multiple times, as well as
- starting multiple GetBlob requests before calling `FinishPipe`
- on them.  The server will stream data into the pipefd
- until `FinishPipe` is invoked.
-
- Note that the pipe will not be closed by the server until
- the client has invoked `FinishPipe`.  This is to ensure
- that the client checks for errors.  For example, `GetBlob`
- performs digest (e.g. sha256) verification and this must
- be checked after all data has been written.
-*/
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"sync"
-	"syscall"
-
-	"github.com/containers/image/v5/image"
-	"github.com/containers/image/v5/manifest"
-	"github.com/containers/image/v5/pkg/blobinfocache"
-	"github.com/containers/image/v5/transports/alltransports"
-	"github.com/containers/image/v5/types"
-	"github.com/opencontainers/go-digest"
-	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/spf13/cobra"
-)
-
-// protocolVersion is semantic version of the protocol used by this proxy.
-// The first version of the protocol has major version 0.2 to signify a
-// departure from the original code which used HTTP.
-//
-// 0.2.1: Initial version
-// 0.2.2: Added support for fetching image configuration as OCI
-// 0.2.3: Added GetFullConfig
-const protocolVersion = "0.2.3"
-
-// maxMsgSize is the current limit on a packet size.
-// Note that all non-metadata (i.e. payload data) is sent over a pipe.
-const maxMsgSize = 32 * 1024
-
-// maxJSONFloat is ECMA Number.MAX_SAFE_INTEGER
-// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/MAX_SAFE_INTEGER
-// We hard error if the input JSON numbers we expect to be
-// integers are above this.
-const maxJSONFloat = float64(uint64(1)<<53 - 1)
-
-// request is the JSON serialization of a function call
-type request struct {
-	// Method is the name of the function
-	Method string `json:"method"`
-	// Args is the arguments (parsed inside the function)
-	Args []interface{} `json:"args"`
-}
-
-// reply is serialized to JSON as the return value from a function call.
-type reply struct {
-	// Success is true if and only if the call succeeded.
-	Success bool `json:"success"`
-	// Value is an arbitrary value (or values, as array/map) returned from the call.
-	Value interface{} `json:"value"`
-	// PipeID is an index into open pipes, and should be passed to FinishPipe
-	PipeID uint32 `json:"pipeid"`
-	// Error should be non-empty if Success == false
-	Error string `json:"error"`
-}
-
-// replyBuf is our internal deserialization of reply plus optional fd
-type replyBuf struct {
-	// value will be converted to a reply Value
-	value interface{}
-	// fd is the read half of a pipe, passed back to the client
-	fd *os.File
-	// pipeid will be provided to the client as PipeID, an index into our open pipes
-	pipeid uint32
-}
-
-// activePipe is an open pipe to the client.
-// It contains an error value
-type activePipe struct {
-	// w is the write half of the pipe
-	w *os.File
-	// wg is completed when our worker goroutine is done
-	wg sync.WaitGroup
-	// err may be set in our worker goroutine
-	err error
-}
-
-// openImage is an opened image reference
-type openImage struct {
-	// id is an opaque integer handle
-	id        uint32
-	src       types.ImageSource
-	cachedimg types.Image
-}
-
-// proxyHandler is the state associated with our socket.
-type proxyHandler struct {
-	// lock protects everything else in this structure.
-	lock sync.Mutex
-	// opts is CLI options
-	opts   *proxyOptions
-	sysctx *types.SystemContext
-	cache  types.BlobInfoCache
-
-	// imageSerial is a counter for open images
-	imageSerial uint32
-	// images holds our opened images
-	images map[uint32]*openImage
-	// activePipes maps from "pipeid" to a pipe + goroutine pair
-	activePipes map[uint32]*activePipe
-}
-
-// Initialize performs one-time initialization, and returns the protocol version
-func (h *proxyHandler) Initialize(args []interface{}) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	var ret replyBuf
-
-	if len(args) != 0 {
-		return ret, fmt.Errorf("invalid request, expecting zero arguments")
-	}
-
-	if h.sysctx != nil {
-		return ret, fmt.Errorf("already initialized")
-	}
-
-	sysctx, err := h.opts.imageOpts.newSystemContext()
-	if err != nil {
-		return ret, err
-	}
-	h.sysctx = sysctx
-	h.cache = blobinfocache.DefaultCache(sysctx)
-
-	r := replyBuf{
-		value: protocolVersion,
-	}
-	return r, nil
-}
-
-// OpenImage accepts a string image reference i.e. TRANSPORT:REF - like `skopeo copy`.
-// The return value is an opaque integer handle.
-func (h *proxyHandler) OpenImage(args []interface{}) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-	var ret replyBuf
-
-	if h.sysctx == nil {
-		return ret, fmt.Errorf("client error: must invoke Initialize")
-	}
-	if len(args) != 1 {
-		return ret, fmt.Errorf("invalid request, expecting one argument")
-	}
-	imageref, ok := args[0].(string)
-	if !ok {
-		return ret, fmt.Errorf("expecting string imageref, not %T", args[0])
-	}
-
-	imgRef, err := alltransports.ParseImageName(imageref)
-	if err != nil {
-		return ret, err
-	}
-	imgsrc, err := imgRef.NewImageSource(context.Background(), h.sysctx)
-	if err != nil {
-		return ret, err
-	}
-
-	h.imageSerial++
-	openimg := &openImage{
-		id:  h.imageSerial,
-		src: imgsrc,
-	}
-	h.images[openimg.id] = openimg
-	ret.value = openimg.id
-
-	return ret, nil
-}
-
-func (h *proxyHandler) CloseImage(args []interface{}) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-	var ret replyBuf
-
-	if h.sysctx == nil {
-		return ret, fmt.Errorf("client error: must invoke Initialize")
-	}
-	if len(args) != 1 {
-		return ret, fmt.Errorf("invalid request, expecting one argument")
-	}
-	imgref, err := h.parseImageFromID(args[0])
-	if err != nil {
-		return ret, err
-	}
-	imgref.src.Close()
-	delete(h.images, imgref.id)
-
-	return ret, nil
-}
-
-func parseImageID(v interface{}) (uint32, error) {
-	imgidf, ok := v.(float64)
-	if !ok {
-		return 0, fmt.Errorf("expecting integer imageid, not %T", v)
-	}
-	return uint32(imgidf), nil
-}
-
-// parseUint64 validates that a number fits inside a JavaScript safe integer
-func parseUint64(v interface{}) (uint64, error) {
-	f, ok := v.(float64)
-	if !ok {
-		return 0, fmt.Errorf("expecting numeric, not %T", v)
-	}
-	if f > maxJSONFloat {
-		return 0, fmt.Errorf("out of range integer for numeric %f", f)
-	}
-	return uint64(f), nil
-}
-
-func (h *proxyHandler) parseImageFromID(v interface{}) (*openImage, error) {
-	imgid, err := parseImageID(v)
-	if err != nil {
-		return nil, err
-	}
-	imgref, ok := h.images[imgid]
-	if !ok {
-		return nil, fmt.Errorf("no image %v", imgid)
-	}
-	return imgref, nil
-}
-
-func (h *proxyHandler) allocPipe() (*os.File, *activePipe, error) {
-	piper, pipew, err := os.Pipe()
-	if err != nil {
-		return nil, nil, err
-	}
-	f := activePipe{
-		w: pipew,
-	}
-	h.activePipes[uint32(pipew.Fd())] = &f
-	f.wg.Add(1)
-	return piper, &f, nil
-}
-
-// returnBytes generates a return pipe() from a byte array
-// In the future it might be nicer to return this via memfd_create()
-func (h *proxyHandler) returnBytes(retval interface{}, buf []byte) (replyBuf, error) {
-	var ret replyBuf
-	piper, f, err := h.allocPipe()
-	if err != nil {
-		return ret, err
-	}
-
-	go func() {
-		// Signal completion when we return
-		defer f.wg.Done()
-		_, err = io.Copy(f.w, bytes.NewReader(buf))
-		if err != nil {
-			f.err = err
-		}
-	}()
-
-	ret.value = retval
-	ret.fd = piper
-	ret.pipeid = uint32(f.w.Fd())
-	return ret, nil
-}
-
-// cacheTargetManifest is invoked when GetManifest or GetConfig is invoked
-// the first time for a given image.  If the requested image is a manifest
-// list, this function resolves it to the image matching the calling process'
-// operating system and architecture.
-//
-// TODO: Add GetRawManifest or so that exposes manifest lists
-func (h *proxyHandler) cacheTargetManifest(img *openImage) error {
-	ctx := context.Background()
-	if img.cachedimg != nil {
-		return nil
-	}
-	unparsedToplevel := image.UnparsedInstance(img.src, nil)
-	mfest, manifestType, err := unparsedToplevel.Manifest(ctx)
-	if err != nil {
-		return err
-	}
-	var target *image.UnparsedImage
-	if manifest.MIMETypeIsMultiImage(manifestType) {
-		manifestList, err := manifest.ListFromBlob(mfest, manifestType)
-		if err != nil {
-			return err
-		}
-		instanceDigest, err := manifestList.ChooseInstance(h.sysctx)
-		if err != nil {
-			return err
-		}
-		target = image.UnparsedInstance(img.src, &instanceDigest)
-	} else {
-		target = unparsedToplevel
-	}
-	cachedimg, err := image.FromUnparsedImage(ctx, h.sysctx, target)
-	if err != nil {
-		return err
-	}
-	img.cachedimg = cachedimg
-	return nil
-}
-
-// GetManifest returns a copy of the manifest, converted to OCI format, along with the original digest.
-// Manifest lists are resolved to the current operating system and architecture.
-func (h *proxyHandler) GetManifest(args []interface{}) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	var ret replyBuf
-
-	if h.sysctx == nil {
-		return ret, fmt.Errorf("client error: must invoke Initialize")
-	}
-	if len(args) != 1 {
-		return ret, fmt.Errorf("invalid request, expecting one argument")
-	}
-	imgref, err := h.parseImageFromID(args[0])
-	if err != nil {
-		return ret, err
-	}
-
-	err = h.cacheTargetManifest(imgref)
-	if err != nil {
-		return ret, err
-	}
-	img := imgref.cachedimg
-
-	ctx := context.Background()
-	rawManifest, manifestType, err := img.Manifest(ctx)
-	if err != nil {
-		return ret, err
-	}
-
-	// We only support OCI and docker2schema2.  We know docker2schema2 can be easily+cheaply
-	// converted into OCI, so consumers only need to see OCI.
-	switch manifestType {
-	case imgspecv1.MediaTypeImageManifest, manifest.DockerV2Schema2MediaType:
-		break
-	// Explicitly reject e.g. docker schema 1 type with a "legacy" note
-	case manifest.DockerV2Schema1MediaType, manifest.DockerV2Schema1SignedMediaType:
-		return ret, fmt.Errorf("unsupported legacy manifest MIME type: %s", manifestType)
-	default:
-		return ret, fmt.Errorf("unsupported manifest MIME type: %s", manifestType)
-	}
-
-	// We always return the original digest, as that's what clients need to do pull-by-digest
-	// and in general identify the image.
-	digest, err := manifest.Digest(rawManifest)
-	if err != nil {
-		return ret, err
-	}
-	var serialized []byte
-	// But, we convert to OCI format on the wire if it's not already.  The idea here is that by reusing the containers/image
-	// stack, clients to this proxy can pretend the world is OCI only, and not need to care about e.g.
-	// docker schema and MIME types.
-	if manifestType != imgspecv1.MediaTypeImageManifest {
-		manifestUpdates := types.ManifestUpdateOptions{ManifestMIMEType: imgspecv1.MediaTypeImageManifest}
-		ociImage, err := img.UpdatedImage(ctx, manifestUpdates)
-		if err != nil {
-			return ret, err
-		}
-
-		ociSerialized, _, err := ociImage.Manifest(ctx)
-		if err != nil {
-			return ret, err
-		}
-		serialized = ociSerialized
-	} else {
-		serialized = rawManifest
-	}
-	return h.returnBytes(digest, serialized)
-}
-
-// GetFullConfig returns a copy of the image configuration, converted to OCI format.
-// https://github.com/opencontainers/image-spec/blob/main/config.md
-func (h *proxyHandler) GetFullConfig(args []interface{}) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	var ret replyBuf
-
-	if h.sysctx == nil {
-		return ret, fmt.Errorf("client error: must invoke Initialize")
-	}
-	if len(args) != 1 {
-		return ret, fmt.Errorf("invalid request, expecting: [imgid]")
-	}
-	imgref, err := h.parseImageFromID(args[0])
-	if err != nil {
-		return ret, err
-	}
-	err = h.cacheTargetManifest(imgref)
-	if err != nil {
-		return ret, err
-	}
-	img := imgref.cachedimg
-
-	ctx := context.TODO()
-	config, err := img.OCIConfig(ctx)
-	if err != nil {
-		return ret, err
-	}
-	serialized, err := json.Marshal(&config)
-	if err != nil {
-		return ret, err
-	}
-	return h.returnBytes(nil, serialized)
-}
-
-// GetConfig returns a copy of the container runtime configuration, converted to OCI format.
-// Note that due to a historical mistake, this returns not the full image configuration,
-// but just the container runtime configuration.  You should use GetFullConfig instead.
-func (h *proxyHandler) GetConfig(args []interface{}) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	var ret replyBuf
-
-	if h.sysctx == nil {
-		return ret, fmt.Errorf("client error: must invoke Initialize")
-	}
-	if len(args) != 1 {
-		return ret, fmt.Errorf("invalid request, expecting: [imgid]")
-	}
-	imgref, err := h.parseImageFromID(args[0])
-	if err != nil {
-		return ret, err
-	}
-	err = h.cacheTargetManifest(imgref)
-	if err != nil {
-		return ret, err
-	}
-	img := imgref.cachedimg
-
-	ctx := context.TODO()
-	config, err := img.OCIConfig(ctx)
-	if err != nil {
-		return ret, err
-	}
-	serialized, err := json.Marshal(&config.Config)
-	if err != nil {
-		return ret, err
-	}
-	return h.returnBytes(nil, serialized)
-}
-
-// GetBlob fetches a blob, performing digest verification.
-func (h *proxyHandler) GetBlob(args []interface{}) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	var ret replyBuf
-
-	if h.sysctx == nil {
-		return ret, fmt.Errorf("client error: must invoke Initialize")
-	}
-	if len(args) != 3 {
-		return ret, fmt.Errorf("found %d args, expecting (imgid, digest, size)", len(args))
-	}
-	imgref, err := h.parseImageFromID(args[0])
-	if err != nil {
-		return ret, err
-	}
-	digestStr, ok := args[1].(string)
-	if !ok {
-		return ret, fmt.Errorf("expecting string blobid")
-	}
-	size, err := parseUint64(args[2])
-	if err != nil {
-		return ret, err
-	}
-
-	ctx := context.TODO()
-	d, err := digest.Parse(digestStr)
-	if err != nil {
-		return ret, err
-	}
-	blobr, blobSize, err := imgref.src.GetBlob(ctx, types.BlobInfo{Digest: d, Size: int64(size)}, h.cache)
-	if err != nil {
-		return ret, err
-	}
-
-	piper, f, err := h.allocPipe()
-	if err != nil {
-		return ret, err
-	}
-	go func() {
-		// Signal completion when we return
-		defer f.wg.Done()
-		verifier := d.Verifier()
-		tr := io.TeeReader(blobr, verifier)
-		n, err := io.Copy(f.w, tr)
-		if err != nil {
-			f.err = err
-			return
-		}
-		if n != int64(size) {
-			f.err = fmt.Errorf("expected %d bytes in blob, got %d", size, n)
-		}
-		if !verifier.Verified() {
-			f.err = fmt.Errorf("corrupted blob, expecting %s", d.String())
-		}
-	}()
-
-	ret.value = blobSize
-	ret.fd = piper
-	ret.pipeid = uint32(f.w.Fd())
-	return ret, nil
-}
-
-// FinishPipe waits for the worker goroutine to finish, and closes the write side of the pipe.
-func (h *proxyHandler) FinishPipe(args []interface{}) (replyBuf, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	var ret replyBuf
-
-	pipeidv, err := parseUint64(args[0])
-	if err != nil {
-		return ret, err
-	}
-	pipeid := uint32(pipeidv)
-
-	f, ok := h.activePipes[pipeid]
-	if !ok {
-		return ret, fmt.Errorf("finishpipe: no active pipe %d", pipeid)
-	}
-
-	// Wait for the goroutine to complete
-	f.wg.Wait()
-	// And only now do we close the write half; this forces the client to call this API
-	f.w.Close()
-	// Propagate any errors from the goroutine worker
-	err = f.err
-	delete(h.activePipes, pipeid)
-	return ret, err
-}
-
-// send writes a reply buffer to the socket
-func (buf replyBuf) send(conn *net.UnixConn, err error) error {
-	replyToSerialize := reply{
-		Success: err == nil,
-		Value:   buf.value,
-		PipeID:  buf.pipeid,
-	}
-	if err != nil {
-		replyToSerialize.Error = err.Error()
-	}
-	serializedReply, err := json.Marshal(&replyToSerialize)
-	if err != nil {
-		return err
-	}
-	// We took ownership of the FD - close it when we're done.
-	defer func() {
-		if buf.fd != nil {
-			buf.fd.Close()
-		}
-	}()
-	// Copy the FD number to the socket ancillary buffer
-	fds := make([]int, 0)
-	if buf.fd != nil {
-		fds = append(fds, int(buf.fd.Fd()))
-	}
-	oob := syscall.UnixRights(fds...)
-	n, oobn, err := conn.WriteMsgUnix(serializedReply, oob, nil)
-	if err != nil {
-		return err
-	}
-	// Validate that we sent the full packet
-	if n != len(serializedReply) || oobn != len(oob) {
-		return io.ErrShortWrite
-	}
-	return nil
-}
-
-type proxyOptions struct {
-	global    *globalOptions
-	imageOpts *imageOptions
-	sockFd    int
-}
-
-func proxyCmd(global *globalOptions) *cobra.Command {
-	sharedFlags, sharedOpts := sharedImageFlags()
-	imageFlags, imageOpts := imageFlags(global, sharedOpts, nil, "", "")
-	opts := proxyOptions{global: global, imageOpts: imageOpts}
-	cmd := &cobra.Command{
-		Use:   "experimental-image-proxy [command options] IMAGE",
-		Short: "Interactive proxy for fetching container images (EXPERIMENTAL)",
-		Long:  `Run skopeo as a proxy, supporting HTTP requests to fetch manifests and blobs.`,
-		RunE:  commandAction(opts.run),
-		Args:  cobra.ExactArgs(0),
-		// Not stabilized yet
-		Hidden:  true,
-		Example: `skopeo experimental-image-proxy --sockfd 3`,
-	}
-	adjustUsage(cmd)
-	flags := cmd.Flags()
-	flags.AddFlagSet(&sharedFlags)
-	flags.AddFlagSet(&imageFlags)
-	flags.IntVar(&opts.sockFd, "sockfd", 0, "Serve on opened socket pair (default 0/stdin)")
-	return cmd
-}
-
-// processRequest dispatches a remote request.
-// replyBuf is the result of the invocation.
-// terminate should be true if processing of requests should halt.
-func (h *proxyHandler) processRequest(readBytes []byte) (rb replyBuf, terminate bool, err error) {
-	var req request
-
-	// Parse the request JSON
-	if err = json.Unmarshal(readBytes, &req); err != nil {
-		err = fmt.Errorf("invalid request: %v", err)
-		return
-	}
-	// Dispatch on the method
-	switch req.Method {
-	case "Initialize":
-		rb, err = h.Initialize(req.Args)
-	case "OpenImage":
-		rb, err = h.OpenImage(req.Args)
-	case "CloseImage":
-		rb, err = h.CloseImage(req.Args)
-	case "GetManifest":
-		rb, err = h.GetManifest(req.Args)
-	case "GetConfig":
-		rb, err = h.GetConfig(req.Args)
-	case "GetFullConfig":
-		rb, err = h.GetFullConfig(req.Args)
-	case "GetBlob":
-		rb, err = h.GetBlob(req.Args)
-	case "FinishPipe":
-		rb, err = h.FinishPipe(req.Args)
-	case "Shutdown":
-		terminate = true
-	default:
-		err = fmt.Errorf("unknown method: %s", req.Method)
-	}
-	return
-}
-
-// Implementation of podman experimental-image-proxy
-func (opts *proxyOptions) run(args []string, stdout io.Writer) error {
-	handler := &proxyHandler{
-		opts:        opts,
-		images:      make(map[uint32]*openImage),
-		activePipes: make(map[uint32]*activePipe),
-	}
-
-	// Convert the socket FD passed by client into a net.FileConn
-	fd := os.NewFile(uintptr(opts.sockFd), "sock")
-	fconn, err := net.FileConn(fd)
-	if err != nil {
-		return err
-	}
-	conn := fconn.(*net.UnixConn)
-
-	// Allocate a buffer to copy the packet into
-	buf := make([]byte, maxMsgSize)
-	for {
-		n, _, err := conn.ReadFrom(buf)
-		if err != nil {
-			if errors.Is(err, io.EOF) {
-				return nil
-			}
-			return fmt.Errorf("reading socket: %v", err)
-		}
-		readbuf := buf[0:n]
-
-		rb, terminate, err := handler.processRequest(readbuf)
-		if terminate {
-			return nil
-		}
-
-		if err := rb.send(conn, err); err != nil {
-			return fmt.Errorf("writing to socket: %w", err)
-		}
-	}
-}

cmd/skopeo/proxy_windows.go

@@ -1,30 +0,0 @@
-//go:build windows
-// +build windows
-
-package main
-
-import (
-	"fmt"
-	"io"
-
-	"github.com/spf13/cobra"
-)
-
-type proxyOptions struct {
-	global *globalOptions
-}
-
-func proxyCmd(global *globalOptions) *cobra.Command {
-	opts := proxyOptions{global: global}
-	cmd := &cobra.Command{
-		RunE: commandAction(opts.run),
-		Args: cobra.ExactArgs(0),
-		// Not stabilized yet
-		Hidden: true,
-	}
-	return cmd
-}
-
-func (opts *proxyOptions) run(args []string, stdout io.Writer) error {
-	return fmt.Errorf("This command is not supported on Windows")
-}

cmd/skopeo/signing.go

@@ -5,16 +5,14 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os"
+	"io/ioutil"
 
-	"github.com/containers/image/v5/pkg/cli"
 	"github.com/containers/image/v5/signature"
 	"github.com/spf13/cobra"
 )
 
 type standaloneSignOptions struct {
-	output         string // Output file path
-	passphraseFile string // Path pointing to a passphrase file when signing
+	output string // Output file path
 }
 
 func standaloneSignCmd() *cobra.Command {
@@ -27,7 +25,6 @@ func standaloneSignCmd() *cobra.Command {
 	adjustUsage(cmd)
 	flags := cmd.Flags()
 	flags.StringVarP(&opts.output, "output", "o", "", "output the signature to `SIGNATURE`")
-	flags.StringVarP(&opts.passphraseFile, "passphrase-file", "", "", "file that contains a passphrase for the --sign-by key")
 	return cmd
 }
 
@@ -39,7 +36,7 @@ func (opts *standaloneSignOptions) run(args []string, stdout io.Writer) error {
 	dockerReference := args[1]
 	fingerprint := args[2]
 
-	manifest, err := os.ReadFile(manifestPath)
+	manifest, err := ioutil.ReadFile(manifestPath)
 	if err != nil {
 		return fmt.Errorf("Error reading %s: %v", manifestPath, err)
 	}
@@ -49,18 +46,12 @@ func (opts *standaloneSignOptions) run(args []string, stdout io.Writer) error {
 		return fmt.Errorf("Error initializing GPG: %v", err)
 	}
 	defer mech.Close()
-
-	passphrase, err := cli.ReadPassphraseFile(opts.passphraseFile)
-	if err != nil {
-		return err
-	}
-
-	signature, err := signature.SignDockerManifestWithOptions(manifest, dockerReference, mech, fingerprint, &signature.SignOptions{Passphrase: passphrase})
+	signature, err := signature.SignDockerManifest(manifest, dockerReference, mech, fingerprint)
 	if err != nil {
 		return fmt.Errorf("Error creating signature: %v", err)
 	}
 
-	if err := os.WriteFile(opts.output, signature, 0644); err != nil {
+	if err := ioutil.WriteFile(opts.output, signature, 0644); err != nil {
 		return fmt.Errorf("Error writing signature to %s: %v", opts.output, err)
 	}
 	return nil
@@ -89,11 +80,11 @@ func (opts *standaloneVerifyOptions) run(args []string, stdout io.Writer) error
 	expectedFingerprint := args[2]
 	signaturePath := args[3]
 
-	unverifiedManifest, err := os.ReadFile(manifestPath)
+	unverifiedManifest, err := ioutil.ReadFile(manifestPath)
 	if err != nil {
 		return fmt.Errorf("Error reading manifest from %s: %v", manifestPath, err)
 	}
-	unverifiedSignature, err := os.ReadFile(signaturePath)
+	unverifiedSignature, err := ioutil.ReadFile(signaturePath)
 	if err != nil {
 		return fmt.Errorf("Error reading signature from %s: %v", signaturePath, err)
 	}
@@ -139,7 +130,7 @@ func (opts *untrustedSignatureDumpOptions) run(args []string, stdout io.Writer)
 	}
 	untrustedSignaturePath := args[0]
 
-	untrustedSignature, err := os.ReadFile(untrustedSignaturePath)
+	untrustedSignature, err := ioutil.ReadFile(untrustedSignaturePath)
 	if err != nil {
 		return fmt.Errorf("Error reading untrusted signature from %s: %v", untrustedSignaturePath, err)
 	}

cmd/skopeo/signing_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -24,8 +25,9 @@ const (
 // Test that results of runSkopeo failed with nothing on stdout, and substring
 // within the error message.
 func assertTestFailed(t *testing.T, stdout string, err error, substring string) {
-	assert.ErrorContains(t, err, substring)
+	assert.Error(t, err)
 	assert.Empty(t, stdout)
+	assert.Contains(t, err.Error(), substring)
 }
 
 func TestStandaloneSign(t *testing.T) {
@@ -76,7 +78,7 @@ func TestStandaloneSign(t *testing.T) {
 	assertTestFailed(t, out, err, "/dev/full")
 
 	// Success
-	sigOutput, err := os.CreateTemp("", "sig")
+	sigOutput, err := ioutil.TempFile("", "sig")
 	require.NoError(t, err)
 	defer os.Remove(sigOutput.Name())
 	out, err = runSkopeo("standalone-sign", "-o", sigOutput.Name(),
@@ -84,9 +86,9 @@ func TestStandaloneSign(t *testing.T) {
 	require.NoError(t, err)
 	assert.Empty(t, out)
 
-	sig, err := os.ReadFile(sigOutput.Name())
+	sig, err := ioutil.ReadFile(sigOutput.Name())
 	require.NoError(t, err)
-	manifest, err := os.ReadFile(manifestPath)
+	manifest, err := ioutil.ReadFile(manifestPath)
 	require.NoError(t, err)
 	mech, err = signature.NewGPGSigningMechanism()
 	require.NoError(t, err)

cmd/skopeo/sync.go

@@ -4,20 +4,18 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/fs"
+	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
 	"regexp"
 	"strings"
 
-	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/common/pkg/retry"
 	"github.com/containers/image/v5/copy"
 	"github.com/containers/image/v5/directory"
 	"github.com/containers/image/v5/docker"
 	"github.com/containers/image/v5/docker/reference"
-	"github.com/containers/image/v5/pkg/cli"
 	"github.com/containers/image/v5/transports"
 	"github.com/containers/image/v5/types"
 	"github.com/opencontainers/go-digest"
@@ -34,17 +32,13 @@ type syncOptions struct {
 	srcImage            *imageOptions     // Source image options
 	destImage           *imageDestOptions // Destination image options
 	retryOpts           *retry.RetryOptions
-	removeSignatures    bool                      // Do not copy signatures from the source image
-	signByFingerprint   string                    // Sign the image using a GPG key with the specified fingerprint
-	signPassphraseFile  string                    // Path pointing to a passphrase file when signing
-	format              commonFlag.OptionalString // Force conversion of the image to a specified format
-	source              string                    // Source repository name
-	destination         string                    // Destination registry name
-	scoped              bool                      // When true, namespace copied images at destination using the source repository name
-	all                 bool                      // Copy all of the images if an image in the source is a list
-	dryRun              bool                      // Don't actually copy anything, just output what it would have done
-	preserveDigests     bool                      // Preserve digests during sync
-	keepGoing           bool                      // Whether or not to abort the sync if there are any errors during syncing the images
+	removeSignatures    bool           // Do not copy signatures from the source image
+	signByFingerprint   string         // Sign the image using a GPG key with the specified fingerprint
+	format              optionalString // Force conversion of the image to a specified format
+	source              string         // Source repository name
+	destination         string         // Destination registry name
+	scoped              bool           // When true, namespace copied images at destination using the source repository name
+	all                 bool           // Copy all of the images if an image in the source is a list
 }
 
 // repoDescriptor contains information of a single repository used as a sync source.
@@ -105,15 +99,11 @@ See skopeo-sync(1) for details.
 	flags := cmd.Flags()
 	flags.BoolVar(&opts.removeSignatures, "remove-signatures", false, "Do not copy signatures from SOURCE images")
 	flags.StringVar(&opts.signByFingerprint, "sign-by", "", "Sign the image using a GPG key with the specified `FINGERPRINT`")
-	flags.StringVar(&opts.signPassphraseFile, "sign-passphrase-file", "", "File that contains a passphrase for the --sign-by key")
-	flags.VarP(commonFlag.NewOptionalStringValue(&opts.format), "format", "f", `MANIFEST TYPE (oci, v2s1, or v2s2) to use when syncing image(s) to a destination (default is manifest type of source, with fallbacks)`)
+	flags.VarP(newOptionalStringValue(&opts.format), "format", "f", `MANIFEST TYPE (oci, v2s1, or v2s2) to use when syncing image(s) to a destination (default is manifest type of source, with fallbacks)`)
 	flags.StringVarP(&opts.source, "src", "s", "", "SOURCE transport type")
 	flags.StringVarP(&opts.destination, "dest", "d", "", "DESTINATION transport type")
 	flags.BoolVar(&opts.scoped, "scoped", false, "Images at DESTINATION are prefix using the full source image path as scope")
 	flags.BoolVarP(&opts.all, "all", "a", false, "Copy all images if SOURCE-IMAGE is a list")
-	flags.BoolVar(&opts.dryRun, "dry-run", false, "Run without actually copying data")
-	flags.BoolVar(&opts.preserveDigests, "preserve-digests", false, "Preserve digests of images and lists")
-	flags.BoolVarP(&opts.keepGoing, "keep-going", "", false, "Do not abort the sync if any image copy fails")
 	flags.AddFlagSet(&sharedFlags)
 	flags.AddFlagSet(&deprecatedTLSVerifyFlags)
 	flags.AddFlagSet(&srcFlags)
@@ -140,7 +130,7 @@ func (tls *tlsVerifyConfig) UnmarshalYAML(unmarshal func(interface{}) error) err
 // It returns a new unmarshaled sourceConfig object and any error encountered.
 func newSourceConfig(yamlFile string) (sourceConfig, error) {
 	var cfg sourceConfig
-	source, err := os.ReadFile(yamlFile)
+	source, err := ioutil.ReadFile(yamlFile)
 	if err != nil {
 		return cfg, err
 	}
@@ -259,11 +249,11 @@ func imagesToCopyFromRepo(sys *types.SystemContext, repoRef reference.Named) ([]
 // and any error encountered.
 func imagesToCopyFromDir(dirPath string) ([]types.ImageReference, error) {
 	var sourceReferences []types.ImageReference
-	err := filepath.WalkDir(dirPath, func(path string, d fs.DirEntry, err error) error {
+	err := filepath.Walk(dirPath, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
-		if !d.IsDir() && d.Name() == "manifest.json" {
+		if !info.IsDir() && info.Name() == "manifest.json" {
 			dirname := filepath.Dir(path)
 			ref, err := directory.Transport.ParseReference(dirname)
 			if err != nil {
@@ -502,7 +492,7 @@ func imagesToCopy(source string, transport string, sourceCtx *types.SystemContex
 	return descriptors, nil
 }
 
-func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
+func (opts *syncOptions) run(args []string, stdout io.Writer) error {
 	if len(args) != 2 {
 		return errorShouldDisplayUsage{errors.New("Exactly two arguments expected")}
 	}
@@ -512,11 +502,7 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
 	if err != nil {
 		return errors.Wrapf(err, "Error loading trust policy")
 	}
-	defer func() {
-		if err := policyContext.Destroy(); err != nil {
-			retErr = fmt.Errorf("(error tearing down policy context: %v): %w", err, retErr)
-		}
-	}()
+	defer policyContext.Destroy()
 
 	// validate source and destination options
 	contains := func(val string, list []string) (_ bool) {
@@ -557,8 +543,8 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
 	}
 
 	var manifestType string
-	if opts.format.Present() {
-		manifestType, err = parseManifestFormat(opts.format.Value())
+	if opts.format.present {
+		manifestType, err = parseManifestFormat(opts.format.value)
 		if err != nil {
 			return err
 		}
@@ -582,26 +568,16 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
 		return err
 	}
 
-	passphrase, err := cli.ReadPassphraseFile(opts.signPassphraseFile)
-	if err != nil {
-		return err
-	}
+	imagesNumber := 0
 	options := copy.Options{
 		RemoveSignatures:                      opts.removeSignatures,
 		SignBy:                                opts.signByFingerprint,
-		SignPassphrase:                        passphrase,
 		ReportWriter:                          os.Stdout,
 		DestinationCtx:                        destinationCtx,
 		ImageListSelection:                    imageListSelection,
-		PreserveDigests:                       opts.preserveDigests,
 		OptimizeDestinationImageAlreadyExists: true,
 		ForceManifestMIMEType:                 manifestType,
 	}
-	errorsPresent := false
-	imagesNumber := 0
-	if opts.dryRun {
-		logrus.Warn("Running in dry-run mode")
-	}
 
 	for _, srcRepo := range srcRepoList {
 		options.SourceCtx = srcRepo.Context
@@ -629,39 +605,21 @@ func (opts *syncOptions) run(args []string, stdout io.Writer) (retErr error) {
 				return err
 			}
 
-			fromToFields := logrus.Fields{
+			logrus.WithFields(logrus.Fields{
 				"from": transports.ImageName(ref),
 				"to":   transports.ImageName(destRef),
-			}
-			if opts.dryRun {
-				logrus.WithFields(fromToFields).Infof("Would have copied image ref %d/%d", counter+1, len(srcRepo.ImageRefs))
-			} else {
-				logrus.WithFields(fromToFields).Infof("Copying image ref %d/%d", counter+1, len(srcRepo.ImageRefs))
-				if err = retry.RetryIfNecessary(ctx, func() error {
-					_, err = copy.Image(ctx, policyContext, destRef, ref, &options)
-					return err
-				}, opts.retryOpts); err != nil {
-					if !opts.keepGoing {
-						return errors.Wrapf(err, "Error copying ref %q", transports.ImageName(ref))
-					}
-					// log the error, keep a note that there was a failure and move on to the next
-					// image ref
-					errorsPresent = true
-					logrus.WithError(err).Errorf("Error copying ref %q", transports.ImageName(ref))
-					continue
-				}
+			}).Infof("Copying image ref %d/%d", counter+1, len(srcRepo.ImageRefs))
+
+			if err = retry.RetryIfNecessary(ctx, func() error {
+				_, err = copy.Image(ctx, policyContext, destRef, ref, &options)
+				return err
+			}, opts.retryOpts); err != nil {
+				return errors.Wrapf(err, "Error copying ref %q", transports.ImageName(ref))
 			}
 			imagesNumber++
 		}
 	}
 
-	if opts.dryRun {
-		logrus.Infof("Would have synced %d images from %d sources", imagesNumber, len(srcRepoList))
-	} else {
-		logrus.Infof("Synced %d images from %d sources", imagesNumber, len(srcRepoList))
-	}
-	if !errorsPresent {
-		return nil
-	}
-	return errors.New("Sync failed due to previous reported error(s) for one or more images")
+	logrus.Infof("Synced %d images from %d sources", imagesNumber, len(srcRepoList))
+	return nil
 }

cmd/skopeo/unshare.go

@@ -1,4 +1,3 @@
-//go:build !linux
 // +build !linux
 
 package main

cmd/skopeo/utils.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"strings"
 
-	commonFlag "github.com/containers/common/pkg/flag"
 	"github.com/containers/common/pkg/retry"
 	"github.com/containers/image/v5/manifest"
 	"github.com/containers/image/v5/pkg/compression"
@@ -34,7 +33,7 @@ func commandAction(handler func(args []string, stdout io.Writer) error) func(cmd
 	return func(c *cobra.Command, args []string) error {
 		err := handler(args, c.OutOrStdout())
 		if _, ok := err.(errorShouldDisplayUsage); ok {
-			return c.Help()
+			c.Help()
 		}
 		return err
 	}
@@ -46,7 +45,7 @@ func commandAction(handler func(args []string, stdout io.Writer) error) func(cmd
 // whether or not the value actually ends up being used.
 // DO NOT ADD ANY NEW USES OF THIS; just call dockerImageFlags with an appropriate, possibly empty, flagPrefix.
 type deprecatedTLSVerifyOption struct {
-	tlsVerify commonFlag.OptionalBool // FIXME FIXME: Warn if this is used, or even if it is ignored.
+	tlsVerify optionalBool // FIXME FIXME: Warn if this is used, or even if it is ignored.
 }
 
 // warnIfUsed warns if tlsVerify was set by the user, and suggests alternatives (which should
@@ -54,7 +53,7 @@ type deprecatedTLSVerifyOption struct {
 // Every user should call this as part of handling the CLI, whether or not the value actually
 // ends up being used.
 func (opts *deprecatedTLSVerifyOption) warnIfUsed(alternatives []string) {
-	if opts.tlsVerify.Present() {
+	if opts.tlsVerify.present {
 		logrus.Warnf("'--tls-verify' is deprecated, instead use: %s", strings.Join(alternatives, ", "))
 	}
 }
@@ -64,7 +63,7 @@ func (opts *deprecatedTLSVerifyOption) warnIfUsed(alternatives []string) {
 func deprecatedTLSVerifyFlags() (pflag.FlagSet, *deprecatedTLSVerifyOption) {
 	opts := deprecatedTLSVerifyOption{}
 	fs := pflag.FlagSet{}
-	flag := commonFlag.OptionalBoolFlag(&fs, &opts.tlsVerify, "tls-verify", "require HTTPS and verify certificates when accessing the container registry")
+	flag := optionalBoolFlag(&fs, &opts.tlsVerify, "tls-verify", "require HTTPS and verify certificates when accessing the container registry (defaults to true)")
 	flag.Hidden = true
 	return fs, &opts
 }
@@ -90,13 +89,11 @@ type dockerImageOptions struct {
 	global              *globalOptions             // May be shared across several imageOptions instances.
 	shared              *sharedImageOptions        // May be shared across several imageOptions instances.
 	deprecatedTLSVerify *deprecatedTLSVerifyOption // May be shared across several imageOptions instances, or nil.
-	authFilePath        commonFlag.OptionalString  // Path to a */containers/auth.json (prefixed version to override shared image option).
-	credsOption         commonFlag.OptionalString  // username[:password] for accessing a registry
-	userName            commonFlag.OptionalString  // username for accessing a registry
-	password            commonFlag.OptionalString  // password for accessing a registry
-	registryToken       commonFlag.OptionalString  // token to be used directly as a Bearer token when accessing the registry
+	authFilePath        optionalString             // Path to a */containers/auth.json (prefixed version to override shared image option).
+	credsOption         optionalString             // username[:password] for accessing a registry
+	registryToken       optionalString             // token to be used directly as a Bearer token when accessing the registry
 	dockerCertPath      string                     // A directory using Docker-like *.{crt,cert,key} files for connecting to a registry or a daemon
-	tlsVerify           commonFlag.OptionalBool    // Require HTTPS and verify certificates (for docker: and docker-daemon:)
+	tlsVerify           optionalBool               // Require HTTPS and verify certificates (for docker: and docker-daemon:)
 	noCreds             bool                       // Access the registry anonymously
 }
 
@@ -122,20 +119,18 @@ func dockerImageFlags(global *globalOptions, shared *sharedImageOptions, depreca
 	fs := pflag.FlagSet{}
 	if flagPrefix != "" {
 		// the non-prefixed flag is handled by a shared flag.
-		fs.Var(commonFlag.NewOptionalStringValue(&flags.authFilePath), flagPrefix+"authfile", "path of the authentication file. Default is ${XDG_RUNTIME_DIR}/containers/auth.json")
+		fs.Var(newOptionalStringValue(&flags.authFilePath), flagPrefix+"authfile", "path of the authentication file. Default is ${XDG_RUNTIME_DIR}/containers/auth.json")
 	}
-	fs.Var(commonFlag.NewOptionalStringValue(&flags.credsOption), flagPrefix+"creds", "Use `USERNAME[:PASSWORD]` for accessing the registry")
-	fs.Var(commonFlag.NewOptionalStringValue(&flags.userName), flagPrefix+"username", "Username for accessing the registry")
-	fs.Var(commonFlag.NewOptionalStringValue(&flags.password), flagPrefix+"password", "Password for accessing the registry")
+	fs.Var(newOptionalStringValue(&flags.credsOption), flagPrefix+"creds", "Use `USERNAME[:PASSWORD]` for accessing the registry")
 	if credsOptionAlias != "" {
 		// This is horribly ugly, but we need to support the old option forms of (skopeo copy) for compatibility.
 		// Don't add any more cases like this.
-		f := fs.VarPF(commonFlag.NewOptionalStringValue(&flags.credsOption), credsOptionAlias, "", "Use `USERNAME[:PASSWORD]` for accessing the registry")
+		f := fs.VarPF(newOptionalStringValue(&flags.credsOption), credsOptionAlias, "", "Use `USERNAME[:PASSWORD]` for accessing the registry")
 		f.Hidden = true
 	}
-	fs.Var(commonFlag.NewOptionalStringValue(&flags.registryToken), flagPrefix+"registry-token", "Provide a Bearer token for accessing the registry")
+	fs.Var(newOptionalStringValue(&flags.registryToken), flagPrefix+"registry-token", "Provide a Bearer token for accessing the registry")
 	fs.StringVar(&flags.dockerCertPath, flagPrefix+"cert-dir", "", "use certificates at `PATH` (*.crt, *.cert, *.key) to connect to the registry or daemon")
-	commonFlag.OptionalBoolFlag(&fs, &flags.tlsVerify, flagPrefix+"tls-verify", "require HTTPS and verify certificates when talking to the container registry or daemon")
+	optionalBoolFlag(&fs, &flags.tlsVerify, flagPrefix+"tls-verify", "require HTTPS and verify certificates when talking to the container registry or daemon (defaults to true)")
 	fs.BoolVar(&flags.noCreds, flagPrefix+"no-creds", false, "Access the registry anonymously")
 	return fs, &flags
 }
@@ -169,49 +164,31 @@ func (opts *imageOptions) newSystemContext() (*types.SystemContext, error) {
 	ctx.AuthFilePath = opts.shared.authFilePath
 	ctx.DockerDaemonHost = opts.dockerDaemonHost
 	ctx.DockerDaemonCertPath = opts.dockerCertPath
-	if opts.dockerImageOptions.authFilePath.Present() {
-		ctx.AuthFilePath = opts.dockerImageOptions.authFilePath.Value()
+	if opts.dockerImageOptions.authFilePath.present {
+		ctx.AuthFilePath = opts.dockerImageOptions.authFilePath.value
 	}
-	if opts.deprecatedTLSVerify != nil && opts.deprecatedTLSVerify.tlsVerify.Present() {
+	if opts.deprecatedTLSVerify != nil && opts.deprecatedTLSVerify.tlsVerify.present {
 		// If both this deprecated option and a non-deprecated option is present, we use the latter value.
-		ctx.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.deprecatedTLSVerify.tlsVerify.Value())
+		ctx.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.deprecatedTLSVerify.tlsVerify.value)
 	}
-	if opts.tlsVerify.Present() {
-		ctx.DockerDaemonInsecureSkipTLSVerify = !opts.tlsVerify.Value()
+	if opts.tlsVerify.present {
+		ctx.DockerDaemonInsecureSkipTLSVerify = !opts.tlsVerify.value
 	}
-	if opts.tlsVerify.Present() {
-		ctx.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.Value())
+	if opts.tlsVerify.present {
+		ctx.DockerInsecureSkipTLSVerify = types.NewOptionalBool(!opts.tlsVerify.value)
 	}
-	if opts.credsOption.Present() && opts.noCreds {
+	if opts.credsOption.present && opts.noCreds {
 		return nil, errors.New("creds and no-creds cannot be specified at the same time")
 	}
-	if opts.userName.Present() && opts.noCreds {
-		return nil, errors.New("username and no-creds cannot be specified at the same time")
-	}
-	if opts.credsOption.Present() && opts.userName.Present() {
-		return nil, errors.New("creds and username cannot be specified at the same time")
-	}
-	// if any of username or password is present, then both are expected to be present
-	if opts.userName.Present() != opts.password.Present() {
-		if opts.userName.Present() {
-			return nil, errors.New("password must be specified when username is specified")
-		}
-		return nil, errors.New("username must be specified when password is specified")
-	}
-	if opts.credsOption.Present() {
+	if opts.credsOption.present {
 		var err error
-		ctx.DockerAuthConfig, err = getDockerAuth(opts.credsOption.Value())
+		ctx.DockerAuthConfig, err = getDockerAuth(opts.credsOption.value)
 		if err != nil {
 			return nil, err
 		}
-	} else if opts.userName.Present() {
-		ctx.DockerAuthConfig = &types.DockerAuthConfig{
-			Username: opts.userName.Value(),
-			Password: opts.password.Value(),
-		}
 	}
-	if opts.registryToken.Present() {
-		ctx.DockerBearerRegistryToken = opts.registryToken.Value()
+	if opts.registryToken.present {
+		ctx.DockerBearerRegistryToken = opts.registryToken.value
 	}
 	if opts.noCreds {
 		ctx.DockerAuthConfig = &types.DockerAuthConfig{}
@@ -223,12 +200,11 @@ func (opts *imageOptions) newSystemContext() (*types.SystemContext, error) {
 // imageDestOptions is a superset of imageOptions specialized for image destinations.
 type imageDestOptions struct {
 	*imageOptions
-	dirForceCompression         bool                   // Compress layers when saving to the dir: transport
-	dirForceDecompression       bool                   // Decompress layers when saving to the dir: transport
-	ociAcceptUncompressedLayers bool                   // Whether to accept uncompressed layers in the oci: transport
-	compressionFormat           string                 // Format to use for the compression
-	compressionLevel            commonFlag.OptionalInt // Level to use for the compression
-	precomputeDigests           bool                   // Precompute digests to dedup layers when saving to the docker: transport
+	dirForceCompression         bool        // Compress layers when saving to the dir: transport
+	dirForceDecompression       bool        // Decompress layers when saving to the dir: transport
+	ociAcceptUncompressedLayers bool        // Whether to accept uncompressed layers in the oci: transport
+	compressionFormat           string      // Format to use for the compression
+	compressionLevel            optionalInt // Level to use for the compression
 }
 
 // imageDestFlags prepares a collection of CLI flags writing into imageDestOptions, and the managed imageDestOptions structure.
@@ -241,8 +217,7 @@ func imageDestFlags(global *globalOptions, shared *sharedImageOptions, deprecate
 	fs.BoolVar(&opts.dirForceDecompression, flagPrefix+"decompress", false, "Decompress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source)")
 	fs.BoolVar(&opts.ociAcceptUncompressedLayers, flagPrefix+"oci-accept-uncompressed-layers", false, "Allow uncompressed image layers when saving to an OCI image using the 'oci' transport. (default is to compress things that aren't compressed)")
 	fs.StringVar(&opts.compressionFormat, flagPrefix+"compress-format", "", "`FORMAT` to use for the compression")
-	fs.Var(commonFlag.NewOptionalIntValue(&opts.compressionLevel), flagPrefix+"compress-level", "`LEVEL` to use for the compression")
-	fs.BoolVar(&opts.precomputeDigests, flagPrefix+"precompute-digests", false, "Precompute digests to prevent uploading layers already on the registry using the 'docker' transport.")
+	fs.Var(newOptionalIntValue(&opts.compressionLevel), flagPrefix+"compress-level", "`LEVEL` to use for the compression")
 	return fs, &opts
 }
 
@@ -264,11 +239,9 @@ func (opts *imageDestOptions) newSystemContext() (*types.SystemContext, error) {
 		}
 		ctx.CompressionFormat = &cf
 	}
-	if opts.compressionLevel.Present() {
-		value := opts.compressionLevel.Value()
-		ctx.CompressionLevel = &value
+	if opts.compressionLevel.present {
+		ctx.CompressionLevel = &opts.compressionLevel.value
 	}
-	ctx.DockerRegistryPushPrecomputeDigests = opts.precomputeDigests
 	return ctx, err
 }
 

cmd/skopeo/utils_test.go

@@ -167,28 +167,26 @@ func TestImageDestOptionsNewSystemContext(t *testing.T) {
 		"--dest-tls-verify=false",
 		"--dest-creds", "creds-user:creds-password",
 		"--dest-registry-token", "faketoken",
-		"--dest-precompute-digests=true",
 	})
 	res, err = opts.newSystemContext()
 	require.NoError(t, err)
 	assert.Equal(t, &types.SystemContext{
-		RegistriesDirPath:                   "/srv/registries.d",
-		AuthFilePath:                        "/srv/authfile",
-		ArchitectureChoice:                  "overridden-arch",
-		OSChoice:                            "overridden-os",
-		VariantChoice:                       "overridden-variant",
-		OCISharedBlobDirPath:                "/srv/shared-blob-dir",
-		DockerCertPath:                      "/srv/cert-dir",
-		DockerInsecureSkipTLSVerify:         types.OptionalBoolTrue,
-		DockerAuthConfig:                    &types.DockerAuthConfig{Username: "creds-user", Password: "creds-password"},
-		DockerBearerRegistryToken:           "faketoken",
-		DockerDaemonCertPath:                "/srv/cert-dir",
-		DockerDaemonHost:                    "daemon-host.example.com",
-		DockerDaemonInsecureSkipTLSVerify:   true,
-		DockerRegistryUserAgent:             defaultUserAgent,
-		DirForceCompress:                    true,
-		BigFilesTemporaryDir:                "/srv",
-		DockerRegistryPushPrecomputeDigests: true,
+		RegistriesDirPath:                 "/srv/registries.d",
+		AuthFilePath:                      "/srv/authfile",
+		ArchitectureChoice:                "overridden-arch",
+		OSChoice:                          "overridden-os",
+		VariantChoice:                     "overridden-variant",
+		OCISharedBlobDirPath:              "/srv/shared-blob-dir",
+		DockerCertPath:                    "/srv/cert-dir",
+		DockerInsecureSkipTLSVerify:       types.OptionalBoolTrue,
+		DockerAuthConfig:                  &types.DockerAuthConfig{Username: "creds-user", Password: "creds-password"},
+		DockerBearerRegistryToken:         "faketoken",
+		DockerDaemonCertPath:              "/srv/cert-dir",
+		DockerDaemonHost:                  "daemon-host.example.com",
+		DockerDaemonInsecureSkipTLSVerify: true,
+		DockerRegistryUserAgent:           defaultUserAgent,
+		DirForceCompress:                  true,
+		BigFilesTemporaryDir:              "/srv",
 	}, res)
 
 	// Global/per-command tlsVerify behavior is tested in TestTLSVerifyFlags.
@@ -199,54 +197,6 @@ func TestImageDestOptionsNewSystemContext(t *testing.T) {
 	assert.Error(t, err)
 }
 
-// TestImageOptionsUsernamePassword verifies that using the username and password
-// options works as expected
-func TestImageOptionsUsernamePassword(t *testing.T) {
-	for _, command := range []struct {
-		commandArgs        []string
-		expectedAuthConfig *types.DockerAuthConfig // data to expect, or nil if an error is expected
-	}{
-		// Set only username/password (without --creds), expected to pass
-		{
-			commandArgs:        []string{"--dest-username", "foo", "--dest-password", "bar"},
-			expectedAuthConfig: &types.DockerAuthConfig{Username: "foo", Password: "bar"},
-		},
-		// no username but set password, expect error
-		{
-			commandArgs:        []string{"--dest-password", "foo"},
-			expectedAuthConfig: nil,
-		},
-		// set username but no password. expected to fail (we currently don't allow a user without password)
-		{
-			commandArgs:        []string{"--dest-username", "bar"},
-			expectedAuthConfig: nil,
-		},
-		// set username with --creds, expected to fail
-		{
-			commandArgs:        []string{"--dest-username", "bar", "--dest-creds", "hello:world", "--dest-password", "foo"},
-			expectedAuthConfig: nil,
-		},
-		// set username with --no-creds, expected to fail
-		{
-			commandArgs:        []string{"--dest-username", "bar", "--dest-no-creds", "--dest-password", "foo"},
-			expectedAuthConfig: nil,
-		},
-	} {
-		opts := fakeImageDestOptions(t, "dest-", true, []string{}, command.commandArgs)
-		// parse the command options
-		res, err := opts.newSystemContext()
-		if command.expectedAuthConfig == nil {
-			assert.Error(t, err)
-		} else {
-			require.NoError(t, err)
-			assert.Equal(t, &types.SystemContext{
-				DockerRegistryUserAgent: defaultUserAgent,
-				DockerAuthConfig:        command.expectedAuthConfig,
-			}, res)
-		}
-	}
-}
-
 func TestTLSVerifyFlags(t *testing.T) {
 	type systemContextOpts interface { // Either *imageOptions or *imageDestOptions
 		newSystemContext() (*types.SystemContext, error)

completions/bash/skopeo

@@ -40,10 +40,7 @@ _skopeo_copy() {
     --src-authfile
     --dest-authfile
     --format -f
-    --multi-arch
     --sign-by
-    --sign-passphrase-file
-    --sign-identity
     --src-creds --screds
     --src-cert-dir
     --src-tls-verify
@@ -54,10 +51,6 @@ _skopeo_copy() {
     --dest-daemon-host
     --src-registry-token
     --dest-registry-token
-    --src-username
-    --src-password
-    --dest-username
-    --dest-password
     "
 
     local boolean_options="
@@ -68,8 +61,6 @@ _skopeo_copy() {
     --src-no-creds
     --dest-no-creds
     --dest-oci-accept-uncompressed-layers
-    --dest-precompute-digests
-    --preserve-digests
     "
 
     local transports
@@ -91,29 +82,21 @@ _skopeo_sync() {
     --format
     --retry-times
     --sign-by
-    --sign-passphrase-file
     --src
     --src-authfile
     --src-cert-dir
     --src-creds
     --src-registry-token
-    --src-username
-    --src-password
-    --dest-username
-    --dest-password
     "
 
     local boolean_options="
     --all
     --dest-no-creds
     --dest-tls-verify
-    --dry-run
     --remove-signatures
     --scoped
     --src-no-creds
     --src-tls-verify
-    --keep-going
-    --preserve-digests
     "
 
     local transports
@@ -132,15 +115,12 @@ _skopeo_inspect() {
      --format
      --retry-times
      --registry-token
-    --username
-    --password
      "
      local boolean_options="
      --config
      --raw
      --tls-verify
      --no-creds
-     --no-tags -n
     "
 
     local transports
@@ -154,7 +134,6 @@ _skopeo_inspect() {
 _skopeo_standalone_sign() {
      local options_with_args="
        -o --output
-       --passphrase-file
      "
      local boolean_options="
      "
@@ -183,8 +162,6 @@ _skopeo_delete() {
      --creds
      --cert-dir
      --registry-token
-    --username
-    --password
      "
      local boolean_options="
      --tls-verify
@@ -205,8 +182,6 @@ _skopeo_layers() {
        --creds
        --cert-dir
        --registry-token
-      --username
-      --password
      "
      local boolean_options="
        --tls-verify
@@ -221,8 +196,6 @@ _skopeo_list_repository_tags() {
      --creds
      --cert-dir
      --registry-token
-    --username
-    --password
      "
 
      local boolean_options="

contrib/cirrus/runner.sh

@@ -6,19 +6,6 @@
 
 set -e
 
-# BEGIN Global export of all variables
-set -a
-
-# Due to differences across platforms and runtime execution environments,
-# handling of the (otherwise) default shell setup is non-uniform.  Rather
-# than attempt to workaround differences, simply force-load/set required
-# items every time this library is utilized.
-USER="$(whoami)"
-HOME="$(getent passwd $USER | cut -d : -f 6)"
-# Some platforms set and make this read-only
-[[ -n "$UID" ]] || \
-    UID=$(getent passwd $USER | cut -d : -f 3)
-
 if [[ -r "/etc/automation_environment" ]]; then
     source /etc/automation_environment
     source $AUTOMATION_LIB_PATH/common_lib.sh
@@ -30,81 +17,48 @@ else
     ) > /dev/stderr
 fi
 
-# This is the magic interpreted by the tests to allow modifying local config/services.
-SKOPEO_CONTAINER_TESTS=1
+OS_RELEASE_ID="$(source /etc/os-release; echo $ID)"
+# GCE image-name compatible string representation of distribution _major_ version
+OS_RELEASE_VER="$(source /etc/os-release; echo $VERSION_ID | tr -d '.')"
+# Combined to ease some usage
+OS_REL_VER="${OS_RELEASE_ID}-${OS_RELEASE_VER}"
 
-PATH=$PATH:$GOPATH/bin
-
-# END Global export of all variables
-set +a
+export "PATH=$PATH:$GOPATH/bin"
 
+podmanmake() {
+    req_env_vars GOPATH SKOPEO_PATH SKOPEO_CI_CONTAINER_FQIN
+    warn "Accumulated technical-debt requires execution inside a --privileged container.  This is very likely hiding bugs!"
+    showrun podman run -it --rm --privileged \
+        -e GOPATH=$GOPATH \
+        -v $GOPATH:$GOPATH:Z \
+        -w $SKOPEO_PATH \
+        $SKOPEO_CI_CONTAINER_FQIN \
+            make "$@"
+}
 
 _run_setup() {
-    local mnt
-    local errmsg
-    req_env_vars SKOPEO_CIDEV_CONTAINER_FQIN
-    if [[ "$OS_RELEASE_ID" != "fedora" ]]; then
+    if [[ "$OS_RELEASE_ID" == "fedora" ]]; then
+        # This is required as part of the standard Fedora VM setup
+        growpart /dev/sda 1
+        resize2fs /dev/sda1
+
+        # VM's come with the distro. skopeo pre-installed
+        dnf erase -y skopeo
+    else
         die "Unknown/unsupported distro. $OS_REL_VER"
     fi
-
-    if [[ -r "/.ci_setup_complete" ]]; then
-        warn "Thwarted an attempt to execute setup more than once."
-        return
-    fi
-
-    # VM's come with the distro. skopeo package pre-installed
-    dnf erase -y skopeo
-
-    # Required for testing the SIF transport
-    dnf install -y fakeroot squashfs-tools
-
-    msg "Removing systemd-resolved from nsswitch.conf"
-    # /etc/resolv.conf is already set to bypass systemd-resolvd
-    sed -i -r -e 's/^(hosts.+)resolve.+dns/\1dns/' /etc/nsswitch.conf
-
-    # A slew of compiled binaries are pre-built and distributed
-    # within the CI/Dev container image, but we want to run
-    # things directly on the host VM.  Fortunately they're all
-    # located in the container under /usr/local/bin
-    msg "Accessing contents of $SKOPEO_CIDEV_CONTAINER_FQIN"
-    podman pull --quiet $SKOPEO_CIDEV_CONTAINER_FQIN
-    mnt=$(podman mount $(podman create $SKOPEO_CIDEV_CONTAINER_FQIN))
-
-    # The container and VM images are built in tandem in the same repo.
-    # automation, but the sources are in different directories.  It's
-    # possible for a mismatch to happen, but should (hopefully) be unlikely.
-    # Double-check to make sure.
-    if ! fgrep -qx "ID=$OS_RELEASE_ID" $mnt/etc/os-release || \
-       ! fgrep -qx "VERSION_ID=$OS_RELEASE_VER" $mnt/etc/os-release; then
-            die "Somehow $SKOPEO_CIDEV_CONTAINER_FQIN is not based on $OS_REL_VER."
-    fi
-    msg "Copying test binaries from $SKOPEO_CIDEV_CONTAINER_FQIN /usr/local/bin/"
-    cp -a "$mnt/usr/local/bin/"* "/usr/local/bin/"
-    msg "Configuring the openshift registry"
-
-    # TODO: Put directory & yaml into more sensible place + update integration tests
-    mkdir -vp /registry
-    cp -a "$mnt/atomic-registry-config.yml" /
-
-    msg "Cleaning up"
-    podman umount --latest
-    podman rm --latest
-
-    # Ensure setup can only run once
-    touch "/.ci_setup_complete"
 }
 
 _run_vendor() {
-    make vendor BUILDTAGS="$BUILDTAGS"
+    podmanmake vendor BUILDTAGS="$BUILDTAGS"
 }
 
 _run_build() {
     make bin/skopeo BUILDTAGS="$BUILDTAGS"
-    make install PREFIX=/usr/local
 }
 
 _run_cross() {
-    make local-cross BUILDTAGS="$BUILDTAGS"
+    podmanmake local-cross BUILDTAGS="$BUILDTAGS"
 }
 
 _run_doccheck() {
@@ -112,22 +66,18 @@ _run_doccheck() {
 }
 
 _run_unit() {
-    make test-unit-local BUILDTAGS="$BUILDTAGS"
+    podmanmake test-unit-local BUILDTAGS="$BUILDTAGS"
 }
 
 _run_integration() {
-    # Ensure we start with a clean-slate
-    podman system reset --force
-
-    make test-integration-local BUILDTAGS="$BUILDTAGS"
+    podmanmake test-integration-local BUILDTAGS="$BUILDTAGS"
 }
 
 _run_system() {
     # Ensure we start with a clean-slate
     podman system reset --force
-
     # Executes with containers required for testing.
-    make test-system-local BUILDTAGS="$BUILDTAGS"
+    showrun make test-system-local BUILDTAGS="$BUILDTAGS"
 }
 
 req_env_vars SKOPEO_PATH BUILDTAGS

contrib/skopeoimage/README.md

@@ -18,7 +18,7 @@ default to `/`.
 
 The container images are:
 
-  * `quay.io/containers/skopeo:v<version>` and `quay.io/skopeo/stable:v<version>` -
+  * `quay.io/containers/skopeo:<version>` and `quay.io/skopeo/stable:<version>` -
     These images are built when a new Skopeo version becomes available in
     Fedora.  These images are intended to be unchanging and stable, they will
     never be updated by automation once they've been pushed.  For build details,

contrib/skopeoimage/stable/Dockerfile

@@ -6,7 +6,7 @@
 # This image can be used to create a secured container
 # that runs safely with privileges within the container.
 #
-FROM registry.fedoraproject.org/fedora:latest
+FROM registry.fedoraproject.org/fedora:33
 
 # Don't include container-selinux and remove
 # directories used by yum that are just taking

contrib/skopeoimage/testing/Dockerfile

@@ -7,7 +7,7 @@
 # This image can be used to create a secured container
 # that runs safely with privileges within the container.
 #
-FROM registry.fedoraproject.org/fedora:latest
+FROM registry.fedoraproject.org/fedora:33
 
 # Don't include container-selinux and remove
 # directories used by yum that are just taking

contrib/skopeoimage/upstream/Dockerfile

@@ -6,7 +6,7 @@
 # This image can be used to create a secured container
 # that runs safely with privileges within the container.
 #
-FROM registry.fedoraproject.org/fedora:latest
+FROM registry.fedoraproject.org/fedora:33
 
 # Don't include container-selinux and remove
 # directories used by yum that are just taking

docs/skopeo-copy.1.md

@@ -54,10 +54,6 @@ Directory to use to share blobs across OCI repositories.
 
 After copying the image, write the digest of the resulting image to the file.
 
-**--preserve-digests**
-
-Preserve the digests during copying. Fail if the digest cannot be preserved.
-
 **--encrypt-layer** _ints_
 
 *Experimental* the 0-indexed layer indices, with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer)
@@ -70,17 +66,6 @@ MANIFEST TYPE (oci, v2s1, or v2s2) to use in the destination (default is manifes
 
 Print usage statement
 
-**--multi-arch** _option_
-
-Control what is copied if _source-image_ refers to a multi-architecture image. Default is system.
-
-Options:
-- system: Copy only the image that matches the system architecture
-- all: Copy the full multi-architecture image
-- index-only: Copy only the index
-
-The index-only option usually fails unless the referenced per-architecture images are already present in the destination, or the target registry supports sparse indexes.
-
 **--quiet**, **-q**
 
 Suppress output information when copying images.
@@ -89,18 +74,10 @@ Suppress output information when copying images.
 
 Do not copy signatures, if any, from _source-image_. Necessary when copying a signed image to a destination which does not support signatures.
 
-**--sign-by** _key-id_
+**--sign-by**=_key-id_
 
 Add a signature using that key ID for an image name corresponding to _destination-image_
 
-**--sign-passphrase-file** _path_
-
-The passphare to use when signing with the key ID from `--sign-by`. Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.
-
-**--sign-identity** _reference_
-
-The identity to use when signing the image. The identity must be a fully specified docker reference. If the identity is not specified, the target docker reference will be used.
-
 **--src-shared-blob-dir** _directory_
 
 Directory to use to share blobs across OCI repositories.
@@ -117,15 +94,15 @@ Key to be used for decryption of images. Key can point to keys and/or certificat
 
 Credentials for accessing the source registry.
 
-**--dest-compress**
+**--dest-compress** _bool-value_
 
 Compress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source).
 
-**--dest-decompress**
+**--dest-decompress** _bool-value_
 
 Decompress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source).
 
-**--dest-oci-accept-uncompressed-layers**
+**--dest-oci-accept-uncompressed-layers** _bool-value_
 
 Allow uncompressed image layers when saving to an OCI image using the 'oci' transport. (default is to compress things that aren't compressed).
 
@@ -137,25 +114,25 @@ Credentials for accessing the destination registry.
 
 Use certificates at _path_ (*.crt, *.cert, *.key) to connect to the source registry or daemon.
 
-**--src-no-creds**
+**--src-no-creds** _bool-value_
 
 Access the registry anonymously.
 
-**--src-tls-verify**=_bool_
+**--src-tls-verify** _bool-value_
 
-Require HTTPS and verify certificates when talking to container source registry or daemon. Default to source registry setting.
+Require HTTPS and verify certificates when talking to container source registry or daemon (defaults to true).
 
 **--dest-cert-dir** _path_
 
 Use certificates at _path_ (*.crt, *.cert, *.key) to connect to the destination registry or daemon.
 
-**--dest-no-creds**
+**--dest-no-creds** _bool-value_
 
 Access the registry anonymously.
 
-**--dest-tls-verify**=_bool_
+**--dest-tls-verify** _bool-value_
 
-Require HTTPS and verify certificates when talking to container destination registry or daemon. Default to destination registry setting.
+Require HTTPS and verify certificates when talking to container destination registry or daemon (defaults to true).
 
 **--src-daemon-host** _host_
 
@@ -183,30 +160,10 @@ Bearer token for accessing the source registry.
 
 Bearer token for accessing the destination registry.
 
-**--dest-precompute-digests**
-
-Precompute digests to ensure layers are not uploaded that already exist on the destination registry. Layers with initially unknown digests (ex. compressing "on the fly") will be temporarily streamed to disk.
-
 **--retry-times**
 
 The number of times to retry. Retry wait time will be exponentially increased based on the number of failed attempts.
 
-**--src-username**
-
-The username to access the source registry.
-
-**--src-password**
-
-The password to access the source registry.
-
-**--dest-username**
-
-The username to access the destination registry.
-
-**--dest-password**
-
-The password to access the destination registry.
-
 ## EXAMPLES
 
 To just copy an image from one registry to another:

docs/skopeo-delete.1.md

@@ -6,27 +6,17 @@ skopeo\-delete - Mark the _image-name_ for later deletion by the registry's garb
 ## SYNOPSIS
 **skopeo delete** [*options*] _image-name_
 
-## DESCRIPTION
-
-Mark _image-name_ for deletion.
-The effect of this is registry-specific; many registries don’t support this operation, or don’t allow it in some circumstances / configurations.
-
-**WARNING**: If _image-name_ contains a digest, this affects the referenced manifest, and may delete all tags (within the current repository?) pointing to that manifest.
-
-**WARNING**: If _image-name_ contains a tag (but not a digest), in the current version of Skopeo this resolves the tag into a digest, and then deletes the manifest by digest, as described above (possibly deleting all tags pointing to that manifest, not just the provided tag). This behavior may change in the future.
-
-
-When using the github.com/distribution/distribution registry server:
-To release the allocated disk space, you must login to the container registry server and execute the container registry garbage collector. E.g.,
+Mark _image-name_ for deletion.  To release the allocated disk space, you must login to the container registry server and execute the container registry garbage collector. E.g.,
 
 ```
 /usr/bin/registry garbage-collect /etc/docker-distribution/registry/config.yml
-```
+
 Note: sometimes the config.yml is stored in /etc/docker/registry/config.yml
 
 If you are running the container registry inside of a container you would execute something like:
-```
+
 $ docker exec -it registry /usr/bin/registry garbage-collect /etc/docker-distribution/registry/config.yml
+
 ```
 
 ## OPTIONS
@@ -52,7 +42,7 @@ Use docker daemon host at _host_ (`docker-daemon:` transport only)
 
 Print usage statement
 
-**--no-creds**
+**--no-creds** _bool-value_
 
 Access the registry anonymously.
 
@@ -72,21 +62,13 @@ Directory to use to share blobs across OCI repositories.
 
 **--tls-verify**=_bool_
 
-Require HTTPS and verify certificates when talking to the container registry or daemon. Default to registry.conf setting.
-
-**--username**
-
-The username to access the registry.
-
-**--password**
-
-The password to access the registry.
+Require HTTPS and verify certificates when talking to the container registry or daemon (defaults to true)
 
 ## EXAMPLES
 
 Mark image example/pause for deletion from the registry.example.com registry:
 ```sh
-$ skopeo delete docker://registry.example.com/example/pause:latest
+$ skopeo delete --force docker://registry.example.com/example/pause:latest
 ```
 See above for additional details on using the command **delete**.
 

docs/skopeo-inspect.1.md

@@ -8,12 +8,9 @@ skopeo\-inspect - Return low-level information about _image-name_ in a registry.
 
 ## DESCRIPTION
 
-Return low-level information about _image-name_ in a registry.
-See [skopeo(1)](skopeo.1.md) for the format of _image-name_.
+Return low-level information about _image-name_ in a registry
 
-The default output includes data from various sources: user input (**Name**), the remote repository, if any (**RepoTags**), the top-level manifest (**Digest**),
-and a per-architecture/OS image matching the current run-time environment (most other values).
-To see values for a different architecture/OS, use the **--override-os** / **--override-arch** options documented in [skopeo(1)](skopeo.1.md).
+_image-name_ name of image to retrieve information about
 
 ## OPTIONS
 
@@ -70,19 +67,7 @@ Directory to use to share blobs across OCI repositories.
 
 **--tls-verify**=_bool_
 
-Require HTTPS and verify certificates when talking to the container registry or daemon. Default to registry.conf setting.
-
-**--username**
-
-The username to access the registry.
-
-**--password**
-
-The password to access the registry.
-
-**--no-tags**, **-n**
-
-Do not list the available tags from the repository in the output. When `true`, the `RepoTags` array will be empty.  Defaults to `false`, which includes all available tags.
+Require HTTPS and verify certificates when talking to the container registry or daemon (defaults to true)
 
 ## EXAMPLES
 
@@ -113,42 +98,6 @@ $ skopeo inspect docker://docker.io/fedora
 }
 ```
 
-To inspect python from the docker.io registry and not show the available tags:
-```sh
-$ skopeo inspect --no-tags docker://docker.io/library/python
-{
-    "Name": "docker.io/library/python",
-    "Digest": "sha256:5ca194a80ddff913ea49c8154f38da66a41d2b73028c5cf7e46bc3c1d6fda572",
-    "RepoTags": [],
-    "Created": "2021-10-05T23:40:54.936108045Z",
-    "DockerVersion": "20.10.7",
-    "Labels": null,
-    "Architecture": "amd64",
-    "Os": "linux",
-    "Layers": [
-        "sha256:df5590a8898bedd76f02205dc8caa5cc9863267dbcd8aac038bcd212688c1cc7",
-        "sha256:705bb4cb554eb7751fd21a994f6f32aee582fbe5ea43037db6c43d321763992b",
-        "sha256:519df5fceacdeaadeec563397b1d9f4d7c29c9f6eff879739cab6f0c144f49e1",
-        "sha256:ccc287cbeddc96a0772397ca00ec85482a7b7f9a9fac643bfddd87b932f743db",
-        "sha256:e3f8e6af58ed3a502f0c3c15dce636d9d362a742eb5b67770d0cfcb72f3a9884",
-        "sha256:aebed27b2d86a5a3a2cbe186247911047a7e432b9d17daad8f226597c0ea4276",
-        "sha256:54c32182bdcc3041bf64077428467109a70115888d03f7757dcf614ff6d95ebe",
-        "sha256:cc8b7caedab13af07adf4836e13af2d4e9e54d794129b0fd4c83ece6b1112e86",
-        "sha256:462c3718af1d5cdc050cfba102d06c26f78fe3b738ce2ca2eb248034b1738945"
-    ],
-    "Env": [
-        "PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
-        "LANG=C.UTF-8",
-        "GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D",
-        "PYTHON_VERSION=3.10.0",
-        "PYTHON_PIP_VERSION=21.2.4",
-        "PYTHON_SETUPTOOLS_VERSION=57.5.0",
-        "PYTHON_GET_PIP_URL=https://github.com/pypa/get-pip/raw/d781367b97acf0ece7e9e304bf281e99b618bf10/public/get-pip.py",
-        "PYTHON_GET_PIP_SHA256=01249aa3e58ffb3e1686b7141b4e9aac4d398ef4ac3012ed9dff8dd9f685ffe0"
-    ]
-}
-```
-
 ```
 $ /bin/skopeo inspect --config docker://registry.fedoraproject.org/fedora --format "{{ .Architecture }}"
 amd64

docs/skopeo-list-tags.1.md

@@ -1,14 +1,14 @@
 % skopeo-list-tags(1)
 
 ## NAME
-skopeo\-list\-tags - List image names in a transport-specific collection of images.
+skopeo\-list\-tags - List tags in the transport-specific image repository.
 
 ## SYNOPSIS
-**skopeo list-tags** [*options*] _source-image_
+**skopeo list-tags** [*options*] _repository-name_
 
-Return a list of tags from _source-image_ in a registry or a local docker-archive file.
+Return a list of tags from _repository-name_ in a registry.
 
-  _source-image_ name of the repository to retrieve a tag listing from or a local docker-archive file.
+  _repository-name_ name of repository to retrieve tag listing from
 
 ## OPTIONS
 
@@ -27,7 +27,7 @@ Use certificates at _path_ (\*.crt, \*.cert, \*.key) to connect to the registry.
 
 Print usage statement
 
-**--no-creds**
+**--no-creds** _bool-value_
 
 Access the registry anonymously.
 
@@ -41,19 +41,11 @@ The number of times to retry. Retry wait time will be exponentially increased ba
 
 **--tls-verify**=_bool_
 
-Require HTTPS and verify certificates when talking to the container registry or daemon. Default to registry.conf setting.
-
-**--username**
-
-The username to access the registry.
-
-**--password**
-
-The password to access the registry.
+Require HTTPS and verify certificates when talking to the container registry or daemon (defaults to true)
 
 ## REPOSITORY NAMES
 
-Repository names are transport-specific references as each transport may have its own concept of a "repository" and "tags".
+Repository names are transport-specific references as each transport may have its own concept of a "repository" and "tags". Currently, only the Docker transport is supported.
 
 This commands refers to repositories using a _transport_`:`_details_ format. The following formats are supported:
 
@@ -72,8 +64,6 @@ This commands refers to repositories using a _transport_`:`_details_ format. The
         "docker.io/myuser/myimage:v1.0"
         "docker.io/myuser/myimage@sha256:f48c4cc192f4c3c6a069cb5cca6d0a9e34d6076ba7c214fd0cc3ca60e0af76bb"
 
-  **docker-archive:path[:docker-reference]
-  more than one images were stored in a docker save-formatted file. 
 
 ## EXAMPLES
 
@@ -123,48 +113,8 @@ $ skopeo list-tags docker://localhost:5000/fedora
 
 ```
 
-### Docker-archive Transport
-
-To list the tags in a local docker-archive file:
-
-```sh
-$ skopeo list-tags docker-archive:/tmp/busybox.tar.gz
-{
-    "Tags": [
-        "busybox:1.28.3"
-    ]
-}
-```
-
-Also supports more than one tags in an archive:
-
-```sh
-$ skopeo list-tags docker-archive:/tmp/docker-two-images.tar.gz
-{
-    "Tags": [
-        "example.com/empty:latest",
-        "example.com/empty/but:different"
-    ]
-}
-```
-
-Will include a source-index entry for each untagged image:
-
-```sh
-$ skopeo list-tags docker-archive:/tmp/four-tags-with-an-untag.tar
-{
-    "Tags": [
-        "image1:tag1",
-        "image2:tag2",
-        "@2",
-        "image4:tag4"
-    ]
-}
-```
-
-
 # SEE ALSO
-skopeo(1), skopeo-login(1), docker-login(1), containers-auth.json(5), containers-transports(1)
+skopeo(1), skopeo-login(1), docker-login(1), containers-auth.json(5)
 
 ## AUTHORS
 

docs/skopeo-login.1.md

@@ -49,7 +49,7 @@ Print usage statement
 
 **--tls-verify**=_bool_
 
-Require HTTPS and verify certificates when talking to the container registry or daemon. Default to registry.conf setting.
+Require HTTPS and verify certificates when talking to the container registry or daemon (defaults to true)
 
 **--verbose**, **-v**
 

docs/skopeo-logout.1.md

@@ -31,7 +31,7 @@ Print usage statement
 
 **--tls-verify**=_bool_
 
-Require HTTPS and verify certificates when talking to the container registry or daemon. Default to registry.conf setting.
+Require HTTPS and verify certificates when talking to the container registry or daemon (defaults to true)
 
 ## EXAMPLES
 

docs/skopeo-standalone-sign.1.md

@@ -25,10 +25,6 @@ Print usage statement
 
 Write signature to _output file_.
 
-**--passphrase-file**=_path_
-
-The passphare to use when signing with the key ID from `--sign-by`. Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.
-
 ## EXAMPLES
 
 ```sh

docs/skopeo-sync.1.md

@@ -50,10 +50,6 @@ Path of the authentication file for the source registry. Uses path given by `--a
 
 Path of the authentication file for the destination registry. Uses path given by `--authfile`, if not provided.
 
-**--dry-run**
-
-Run the sync without actually copying data to the destination.
-
 **--src**, **-s** _transport_ Transport for the source repository.
 
 **--dest**, **-d** _transport_ Destination transport.
@@ -66,29 +62,25 @@ Print usage statement.
 
 **--scoped** Prefix images with the source image path, so that multiple images with the same name can be stored at _destination_.
 
-**--preserve-digests** Preserve the digests during copying. Fail if the digest cannot be preserved.
-
 **--remove-signatures** Do not copy signatures, if any, from _source-image_. This is necessary when copying a signed image to a destination which does not support signatures.
 
 **--sign-by**=_key-id_ Add a signature using that key ID for an image name corresponding to _destination-image_.
 
-**--sign-passphrase-file**=_path_ The passphare to use when signing with the key ID from `--sign-by`. Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.
-
 **--src-creds** _username[:password]_ for accessing the source registry.
 
 **--dest-creds** _username[:password]_ for accessing the destination registry.
 
 **--src-cert-dir** _path_ Use certificates (*.crt, *.cert, *.key) at _path_ to connect to the source registry or daemon.
 
-**--src-no-creds** Access the registry anonymously.
+**--src-no-creds** _bool-value_ Access the registry anonymously.
 
-**--src-tls-verify**=_bool_ Require HTTPS and verify certificates when talking to a container source registry or daemon. Default to source registry entry in registry.conf setting.
+**--src-tls-verify** _bool-value_ Require HTTPS and verify certificates when talking to a container source registry or daemon (defaults to true).
 
 **--dest-cert-dir** _path_ Use certificates (*.crt, *.cert, *.key) at _path_ to connect to the destination registry or daemon.
 
-**--dest-no-creds** Access the registry anonymously.
+**--dest-no-creds** _bool-value_  Access the registry anonymously.
 
-**--dest-tls-verify**=_bool_ Require HTTPS and verify certificates when talking to a container destination registry or daemon. Default to destination registry entry in registry.conf setting.
+**--dest-tls-verify** _bool-value_ Require HTTPS and verify certificates when talking to a container destination registry or daemon (defaults to true).
 
 **--src-registry-token** _Bearer token_ for accessing the source registry.
 
@@ -96,25 +88,6 @@ Print usage statement.
 
 **--retry-times**  the number of times to retry, retry wait time will be exponentially increased based on the number of failed attempts.
 
-**--keep-going**
-If any errors occur during copying of images, those errors are logged and the process continues syncing rest of the images and finally fails at the end.
-
-**--src-username**
-
-The username to access the source registry.
-
-**--src-password**
-
-The password to access the source registry.
-
-**--dest-username**
-
-The username to access the destination registry.
-
-**--dest-password**
-
-The password to access the destination registry.
-
 ## EXAMPLES
 
 ### Synchronizing to a local directory

docs/skopeo.1.md

@@ -102,7 +102,7 @@ Print the version number
 | [skopeo-copy(1)](skopeo-copy.1.md)        | Copy an image (manifest, filesystem layers, signatures) from one location to another. |
 | [skopeo-delete(1)](skopeo-delete.1.md)    | Mark the _image-name_ for later deletion by the registry's garbage collector.  |
 | [skopeo-inspect(1)](skopeo-inspect.1.md)  | Return low-level information about _image-name_ in a registry.                 |
-| [skopeo-list-tags(1)](skopeo-list-tags.1.md)  | List image names in a transport-specific collection of images.|
+| [skopeo-list-tags(1)](skopeo-list-tags.1.md)  | List tags in the transport-specific image repository.                      |
 | [skopeo-login(1)](skopeo-login.1.md)  | Login to a container registry. |
 | [skopeo-logout(1)](skopeo-logout.1.md)  | Logout of a container registry. |
 | [skopeo-manifest-digest(1)](skopeo-manifest-digest.1.md)    | Compute a manifest digest for a manifest-file and write it to standard output. |

go.mod

@@ -1,24 +1,26 @@
 module github.com/containers/skopeo
 
-go 1.16
+go 1.12
 
 require (
-	github.com/containers/common v0.48.0
-	github.com/containers/image/v5 v5.21.1
-	github.com/containers/ocicrypt v1.1.4
-	github.com/containers/storage v1.40.2
-	github.com/docker/docker v20.10.14+incompatible
+	github.com/containers/common v0.42.1
+	github.com/containers/image/v5 v5.15.2
+	github.com/containers/ocicrypt v1.1.2
+	github.com/containers/storage v1.34.1
+	github.com/docker/docker v20.10.8+incompatible
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
+	github.com/go-check/check v0.0.0-20180628173108-788fd7840127
+	github.com/onsi/gomega v1.15.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec v1.0.3-0.20211202193544-a5463b7f9c84
-	github.com/opencontainers/image-tools v1.0.0-rc3
+	github.com/opencontainers/image-spec v1.0.2-0.20190823105129-775207bd45b6
+	github.com/opencontainers/image-tools v0.0.0-20170926011501-6d941547fa1d
 	github.com/pkg/errors v0.9.1
 	github.com/russross/blackfriday v2.0.0+incompatible // indirect
 	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v1.4.0
+	github.com/spf13/cobra v1.2.1
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.7.1
+	github.com/stretchr/testify v1.7.0
 	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
+	go4.org v0.0.0-20190218023631-ce4c26f7be8e // indirect
 	gopkg.in/yaml.v2 v2.4.0
 )

hack/get_fqin.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-
-# This script is intended to be called from the Makefile.  It's purpose
-# is to automation correspondence between the environment used for local
-# development and CI.
-
-set -e
-
-SCRIPT_FILEPATH=$(realpath "${BASH_SOURCE[0]}")
-SCRIPT_DIRPATH=$(dirname "$SCRIPT_FILEPATH")
-REPO_DIRPATH=$(realpath "$SCRIPT_DIRPATH/../")
-
-# When running under CI, we already have the necessary information,
-# simply provide it to the Makefile.
-if [[ -n "$SKOPEO_CIDEV_CONTAINER_FQIN" ]]; then
-    echo "$SKOPEO_CIDEV_CONTAINER_FQIN"
-    exit 0
-fi
-
-if [[ -n $(command -v podman) ]]; then CONTAINER_RUNTIME=podman; fi
-CONTAINER_RUNTIME=${CONTAINER_RUNTIME:-docker}
-
-# Borrow the get_ci_vm container image since it's small, and
-# by necessity contains a script that can accurately interpret
-# env. var. values from any .cirrus.yml runtime context.
-$CONTAINER_RUNTIME run --rm \
-    --security-opt label=disable \
-    -v $REPO_DIRPATH:/src:ro \
-    --entrypoint=/usr/share/automation/bin/cirrus-ci_env.py \
-    quay.io/libpod/get_ci_vm:latest \
-    --envs="Skopeo Test" /src/.cirrus.yml | \
-    egrep -m1 '^SKOPEO_CIDEV_CONTAINER_FQIN' | \
-    awk -F "=" -e '{print $2}' | \
-    tr -d \'\"

hack/libsubid_tag.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-if test $(${GO:-go} env GOOS) != "linux" ; then
-	exit 0
-fi
-tmpdir="$PWD/tmp.$RANDOM"
-mkdir -p "$tmpdir"
-trap 'rm -fr "$tmpdir"' EXIT
-cc -o "$tmpdir"/libsubid_tag -l subid -x c - > /dev/null 2> /dev/null << EOF
-#include <shadow/subid.h>
-int main() {
-	struct subid_range *ranges = NULL;
-	get_subuid_ranges("root", &ranges);
-	free(ranges);
-	return 0;
-}
-EOF
-if test $? -eq 0 ; then
-	echo libsubid
-fi

hack/make.sh

@@ -2,14 +2,15 @@
 set -e
 
 # This script builds various binary from a checkout of the skopeo
-# source code. DO NOT CALL THIS SCRIPT DIRECTLY.
+# source code.
 #
 # Requirements:
 # - The current directory should be a checkout of the skopeo source code
 #   (https://github.com/containers/skopeo). Whatever version is checked out
 #   will be built.
-# - The script is intended to be run inside the container specified
-#   in the output of hack/get_fqin.sh
+# - The script is intended to be run inside the docker container specified
+#   in the Dockerfile at the root of the source. In other words:
+#   DO NOT CALL THIS SCRIPT DIRECTLY.
 # - The right way to call this script is to invoke "make" from
 #   your checkout of the skopeo repository.
 #   the Makefile will do a "docker build -t skopeo ." and then
@@ -22,19 +23,21 @@ export SKOPEO_PKG='github.com/containers/skopeo'
 export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 export MAKEDIR="$SCRIPTDIR/make"
 
-# Set this to 1 to enable installation/modification of environment/services
-export SKOPEO_CONTAINER_TESTS=${SKOPEO_CONTAINER_TESTS:-0}
-
-if [[ "$SKOPEO_CONTAINER_TESTS" == "0" ]] && [[ "$CI" != "true" ]]; then
-    (
-    echo "***************************************************************"
-    echo "WARNING: Executing tests directly on the local development"
-    echo "         host is highly discouraged.  Many important items"
-    echo "         will be skipped.  For manual execution, please utilize"
-    echo "         the Makefile targets WITHOUT the '-local' suffix."
-    echo "***************************************************************"
-    ) > /dev/stderr
-    sleep 5s
+# We're a nice, sexy, little shell script, and people might try to run us;
+# but really, they shouldn't. We want to be in a container!
+# The magic value is defined inside our Dockerfile.
+if [[ "$container_magic" != "85531765-346b-4316-bdb8-358e4cca9e5d" ]]; then
+	{
+		echo "# WARNING! I don't seem to be running in a Docker container."
+		echo "# The result of this command might be an incorrect build, and will not be"
+		echo "# officially supported."
+		echo "#"
+		echo "# Try this instead: make all"
+		echo "#"
+	} >&2
+else
+    echo "# I appear to be running inside my designated container image, good!"
+    export SKOPEO_CONTAINER_TESTS=1
 fi
 
 echo
@@ -53,6 +56,8 @@ DEFAULT_BUNDLES=(
 	test-integration
 )
 
+TESTFLAGS+=" -test.timeout=15m"
+
 # Go module support: set `-mod=vendor` to use the vendored sources
 # See also the top-level Makefile.
 mod_vendor=
@@ -61,6 +66,16 @@ if go help mod >/dev/null 2>&1; then
   mod_vendor='-mod=vendor'
 fi
 
+# If $TESTFLAGS is set in the environment, it is passed as extra arguments to 'go test'.
+# You can use this to select certain tests to run, eg.
+#
+#     TESTFLAGS='-test.run ^TestBuild$' ./hack/make.sh test-unit
+#
+# For integration-cli test, we use [gocheck](https://labix.org/gocheck), if you want
+# to run certain tests on your local host, you should run with command:
+#
+#     TESTFLAGS='-check.f DockerSuite.TestBuild*' ./hack/make.sh binary test-integration-cli
+#
 go_test_dir() {
 	dir=$1
 	(

hack/make/test-integration

@@ -2,11 +2,13 @@
 set -e
 
 bundle_test_integration() {
+	TESTFLAGS="$TESTFLAGS -check.v"
 	go_test_dir ./integration
 }
 
 # subshell so that we can export PATH without breaking other things
 (
+	make bin/skopeo ${BUILDTAGS:+BUILDTAGS="$BUILDTAGS"}
 	make PREFIX=/usr install
 	bundle_test_integration
 ) 2>&1

hack/make/test-system

@@ -1,23 +1,17 @@
 #!/bin/bash
 set -e
 
-# These tests can run in/outside of a container.  However,
-# not all storage drivers are supported in a container
-# environment.  Detect this and setup storage when
-# running in a container.
-if ((SKOPEO_CONTAINER_TESTS)) && [[ -r /etc/containers/storage.conf ]]; then
-    sed -i \
-        -e 's/^driver\s*=.*/driver = "vfs"/' \
-        -e 's/^mountopt/#mountopt/' \
-        /etc/containers/storage.conf
-elif ((SKOPEO_CONTAINER_TESTS)); then
-    cat >> /etc/containers/storage.conf << EOF
-[storage]
-driver = "vfs"
-EOF
-fi
+# Before running podman for the first time, make sure
+# to set storage to vfs (not overlay): podman-in-podman
+# doesn't work with overlay. And, disable mountopt,
+# which causes error with vfs.
+sed -i \
+    -e 's/^driver\s*=.*/driver = "vfs"/' \
+    -e 's/^mountopt/#mountopt/' \
+    /etc/containers/storage.conf
 
 # Build skopeo, install into /usr/bin
+make bin/skopeo ${BUILDTAGS:+BUILDTAGS="$BUILDTAGS"}
 make PREFIX=/usr install
 
 # Run tests

hack/make/validate-vet

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-errors=$(go vet -tags="${BUILDTAGS}" $mod_vendor $(go list $mod_vendor -e ./...))
+errors=$(go vet $mod_vendor $(go list $mod_vendor -e ./...))
 
 if [ -z "$errors" ]; then
 	echo 'Congratulations!  All Go source files have been vetted.'

install.md

@@ -1,8 +1,7 @@
-# Installing Skopeo
+# Installing from packages
 
 ## Distribution Packages
-`skopeo` may already be packaged in your distribution. This document lists the
-installation steps for many distros, along with their information and support links.
+`skopeo` may already be packaged in your distribution.
 
 ### Fedora
 
@@ -10,26 +9,34 @@ installation steps for many distros, along with their information and support li
 sudo dnf -y install skopeo
 ```
 
-[Package Info](https://src.fedoraproject.org/rpms/skopeo) and
-[Bugzilla](https://bugzilla.redhat.com/buglist.cgi?bug_status=__open__&classification=Fedora&component=skopeo&product=Fedora)
-
-Fedora bugs can be reported on the Skopeo GitHub [Issues](https://github.com/containers/skopeo/issues) page.
-
-### RHEL / CentOS Stream ≥ 8
+### RHEL/CentOS ≥ 8 and CentOS Stream
 
 ```sh
 sudo dnf -y install skopeo
 ```
 
-If you are a RHEL customer, please reach out through the official RHEL support
-channels for any issues.
+Newer Skopeo releases may be available on the repositories provided by the
+Kubic project. Beware, these may not be suitable for production environments.
 
-CentOS Stream 9: [Package Info](https://gitlab.com/redhat/centos-stream/rpms/skopeo/-/tree/c9s) and
-[Bugzilla](https://bugzilla.redhat.com/buglist.cgi?bug_status=__open__&classification=Red%20Hat&component=skopeo&product=Red%20Hat%20Enterprise%20Linux%209&version=CentOS%20Stream)
+on CentOS 8:
 
-CentOS Stream 8: [Package Info](https://git.centos.org/rpms/skopeo/tree/c8s-stream-rhel8) and
-[Bugzilla](https://bugzilla.redhat.com/buglist.cgi?bug_status=__open__&classification=Red%20Hat&component=skopeo&product=Red%20Hat%20Enterprise%20Linux%208&version=CentOS%20Stream)
+```sh
+sudo dnf -y module disable container-tools
+sudo dnf -y install 'dnf-command(copr)'
+sudo dnf -y copr enable rhcontainerbot/container-selinux
+sudo curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable.repo https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_8/devel:kubic:libcontainers:stable.repo
+sudo dnf -y install skopeo
+```
 
+on CentOS 8 Stream:
+
+```sh
+sudo dnf -y module disable container-tools
+sudo dnf -y install 'dnf-command(copr)'
+sudo dnf -y copr enable rhcontainerbot/container-selinux
+sudo curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable.repo https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_8_Stream/devel:kubic:libcontainers:stable.repo
+sudo dnf -y install skopeo
+```
 
 ### RHEL/CentOS ≤ 7.x
 
@@ -37,24 +44,18 @@ CentOS Stream 8: [Package Info](https://git.centos.org/rpms/skopeo/tree/c8s-stre
 sudo yum -y install skopeo
 ```
 
-CentOS 7: [Package Repo](https://git.centos.org/rpms/skopeo/tree/c7-extras)
-
 ### openSUSE
 
 ```sh
 sudo zypper install skopeo
 ```
 
-[Package Info](https://software.opensuse.org/package/skopeo)
-
 ### Alpine
 
 ```sh
 sudo apk add skopeo
 ```
 
-[Package Info](https://pkgs.alpinelinux.org/packages?name=skopeo)
-
 ### macOS
 
 ```sh
@@ -66,21 +67,18 @@ brew install skopeo
 $ nix-env -i skopeo
 ```
 
-[Package Info](https://search.nixos.org/packages?&show=skopeo&query=skopeo)
-
 ### Debian
 
-The skopeo package is available on [Bullseye](https://packages.debian.org/bullseye/skopeo),
-and Debian Testing and Unstable.
+The skopeo package is available in
+the [Bullseye (testing) branch](https://packages.debian.org/bullseye/skopeo), which
+will be the next stable release (Debian 11) as well as Debian Unstable/Sid.
 
 ```bash
-# Debian Bullseye, Testing or Unstable/Sid
+# Debian Testing/Bullseye or Unstable/Sid
 sudo apt-get update
 sudo apt-get -y install skopeo
 ```
 
-[Package Info](https://packages.debian.org/stable/skopeo)
-
 ### Raspberry Pi OS arm64 (beta)
 
 Raspberry Pi OS uses the standard Debian's repositories,
@@ -99,27 +97,27 @@ sudo apt-get -y update
 sudo apt-get -y install skopeo
 ```
 
-[Package Info](https://packages.ubuntu.com/jammy/skopeo)
+If you would prefer newer (though not as well-tested) packages,
+the [Kubic project](https://build.opensuse.org/package/show/devel:kubic:libcontainers:stable/skopeo)
+provides packages for active Ubuntu releases 20.04 and newer (it should also work with direct derivatives like Pop!\_OS).
+Checkout the [Kubic project page](https://build.opensuse.org/package/show/devel:kubic:libcontainers:stable/skopeo)
+for a list of supported Ubuntu version and
+architecture combinations. **NOTE:** The command `sudo apt-get -y upgrade`
+maybe required in some cases if Skopeo cannot be installed without it.
+The build sources for the Kubic packages can be found [here](https://gitlab.com/rhcontainerbot/skopeo/-/tree/debian/debian).
 
-### Windows
-Skopeo has not yet been packaged for Windows. There is an [open feature
-request](https://github.com/containers/skopeo/issues/715) and contributions are
-always welcome.
-
-
-## Container Images
-
-Skopeo container images are available at `quay.io/skopeo/stable:latest`.
-For example,
+CAUTION: On Ubuntu 20.10 and newer, we highly recommend you use Buildah, Podman and Skopeo ONLY from EITHER the Kubic repo
+OR the official Ubuntu repos. Mixing and matching may lead to unpredictable situations including installation conflicts.
 
 ```bash
-podman run docker://quay.io/skopeo/stable:latest copy --help
+. /etc/os-release
+echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/ /" | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
+curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/Release.key | sudo apt-key add -
+sudo apt-get update
+sudo apt-get -y upgrade
+sudo apt-get -y install skopeo
 ```
 
-[Read more](./contrib/skopeoimage/README.md).
-
-
-## Building from Source
 
 Otherwise, read on for building and installing it from source:
 
@@ -128,6 +126,8 @@ To build the `skopeo` binary you need at least Go 1.12.
 There are two ways to build skopeo: in a container, or locally without a
 container. Choose the one which better matches your needs and environment.
 
+## Building from Source
+
 ### Building without a container
 
 Building without a container requires a bit more manual work and setup in your
@@ -168,12 +168,6 @@ cd $GOPATH/src/github.com/containers/skopeo && make bin/skopeo
 
 By default the `make` command (make all) will build bin/skopeo and the documentation locally.
 
-Building of documentation requires `go-md2man`. On systems that do not have this tool, the
-document generation can be skipped by passing `DISABLE_DOCS=1`:
-```
-DISABLE_DOCS=1 make
-```
-
 ### Building documentation
 
 To build the manual you will need go-md2man.
@@ -219,41 +213,3 @@ Finally, after the binary and documentation is built:
 ```bash
 sudo make install
 ```
-
-### Building a static binary
-
-There have been efforts in the past to produce and maintain static builds, but the maintainers prefer to run Skopeo using distro packages or within containers. This is because static builds of Skopeo tend to be unreliable and functionally restricted. Specifically:
-- Some features of Skopeo depend on non-Go libraries like `libgpgme` and `libdevmapper`.
-- Generating static Go binaries uses native Go libraries, which don't support e.g. `.local` or LDAP-based name resolution.
-
-That being said, if you would like to build Skopeo statically, you might be able to do it by combining all the following steps.
-- Export environment variable `CGO_ENABLED=0` (disabling CGO causes Go to prefer native libraries when possible, instead of dynamically linking against system libraries).
-- Set the `BUILDTAGS=containers_image_openpgp` Make variable (this remove the dependency on `libgpgme` and its companion libraries).
-- Clear the `GO_DYN_FLAGS` Make variable (which otherwise seems to force the creation of a dynamic executable).
-
-The following command implements these steps to produce a static binary in the `bin` subdirectory of the repository:
-
-```bash
-docker run -v $PWD:/src -w /src -e CGO_ENABLED=0 golang \
-make BUILDTAGS=containers_image_openpgp GO_DYN_FLAGS=
-```
-
-Keep in mind that the resulting binary is unsupported and might crash randomly. Only use if you know what you're doing!
-
-For more information, history, and context about static builds, check the following issues:
-
-- [#391] - Consider distributing statically built binaries as part of release
-- [#669] - Static build fails with segmentation violation
-- [#670] - Fixing static binary build using container
-- [#755] - Remove static and in-container targets from Makefile
-- [#932] - Add nix derivation for static builds
-- [#1336] - Unable to run skopeo on Fedora 30 (due to dyn lib dependency)
-- [#1478] - Publish binary releases to GitHub (request+discussion)
-
-[#391]: https://github.com/containers/skopeo/issues/391
-[#669]: https://github.com/containers/skopeo/issues/669
-[#670]: https://github.com/containers/skopeo/issues/670
-[#755]: https://github.com/containers/skopeo/issues/755
-[#932]: https://github.com/containers/skopeo/issues/932
-[#1336]: https://github.com/containers/skopeo/issues/1336
-[#1478]: https://github.com/containers/skopeo/issues/1478

integration/blocked_test.go

@@ -1,7 +1,7 @@
 package main
 
 import (
-	"gopkg.in/check.v1"
+	"github.com/go-check/check"
 )
 
 const blockedRegistriesConf = "./fixtures/blocked-registries.conf"

integration/check_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 
 	"github.com/containers/skopeo/version"
-	"gopkg.in/check.v1"
+	"github.com/go-check/check"
 )
 
 const (
@@ -36,12 +36,12 @@ func (s *SkopeoSuite) SetUpSuite(c *check.C) {
 
 func (s *SkopeoSuite) TearDownSuite(c *check.C) {
 	if s.regV2 != nil {
-		s.regV2.tearDown(c)
+		s.regV2.Close()
 	}
 	if s.regV2WithAuth != nil {
 		//cmd := exec.Command("docker", "logout", s.regV2WithAuth)
 		//c.Assert(cmd.Run(), check.IsNil)
-		s.regV2WithAuth.tearDown(c)
+		s.regV2WithAuth.Close()
 	}
 }
 

integration/copy_test.go

@@ -6,7 +6,7 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"io/fs"
+	"io/ioutil"
 	"log"
 	"net/http"
 	"net/http/httptest"
@@ -17,10 +17,10 @@ import (
 	"github.com/containers/image/v5/manifest"
 	"github.com/containers/image/v5/signature"
 	"github.com/containers/image/v5/types"
+	"github.com/go-check/check"
 	digest "github.com/opencontainers/go-digest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/opencontainers/image-tools/image"
-	"gopkg.in/check.v1"
 )
 
 func init() {
@@ -64,7 +64,9 @@ func (s *CopySuite) SetUpSuite(c *check.C) {
 	s.registry = setupRegistryV2At(c, v2DockerRegistryURL, false, false)
 	s.s1Registry = setupRegistryV2At(c, v2s1DockerRegistryURL, false, true)
 
-	s.gpgHome = c.MkDir()
+	gpgHome, err := ioutil.TempDir("", "skopeo-gpg")
+	c.Assert(err, check.IsNil)
+	s.gpgHome = gpgHome
 	os.Setenv("GNUPGHOME", s.gpgHome)
 
 	for _, key := range []string{"personal", "official"} {
@@ -73,18 +75,21 @@ func (s *CopySuite) SetUpSuite(c *check.C) {
 		runCommandWithInput(c, batchInput, gpgBinary, "--batch", "--gen-key")
 
 		out := combinedOutputOfCommand(c, gpgBinary, "--armor", "--export", fmt.Sprintf("%s@example.com", key))
-		err := os.WriteFile(filepath.Join(s.gpgHome, fmt.Sprintf("%s-pubkey.gpg", key)),
+		err := ioutil.WriteFile(filepath.Join(s.gpgHome, fmt.Sprintf("%s-pubkey.gpg", key)),
 			[]byte(out), 0600)
 		c.Assert(err, check.IsNil)
 	}
 }
 
 func (s *CopySuite) TearDownSuite(c *check.C) {
+	if s.gpgHome != "" {
+		os.RemoveAll(s.gpgHome)
+	}
 	if s.registry != nil {
-		s.registry.tearDown(c)
+		s.registry.Close()
 	}
 	if s.s1Registry != nil {
-		s.s1Registry.tearDown(c)
+		s.s1Registry.Close()
 	}
 	if s.cluster != nil {
 		s.cluster.tearDown(c)
@@ -92,81 +97,104 @@ func (s *CopySuite) TearDownSuite(c *check.C) {
 }
 
 func (s *CopySuite) TestCopyWithManifestList(c *check.C) {
-	dir := c.MkDir()
+	dir, err := ioutil.TempDir("", "copy-manifest-list")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir)
 	assertSkopeoSucceeds(c, "", "copy", knownListImage, "dir:"+dir)
 }
 
 func (s *CopySuite) TestCopyAllWithManifestList(c *check.C) {
-	dir := c.MkDir()
+	dir, err := ioutil.TempDir("", "copy-all-manifest-list")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir)
 	assertSkopeoSucceeds(c, "", "copy", "--all", knownListImage, "dir:"+dir)
 }
 
 func (s *CopySuite) TestCopyAllWithManifestListRoundTrip(c *check.C) {
-	oci1 := c.MkDir()
-	oci2 := c.MkDir()
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", knownListImage, "oci:"+oci1)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", "oci:"+oci1, "dir:"+dir1)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", "dir:"+dir1, "oci:"+oci2)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", "oci:"+oci2, "dir:"+dir2)
+	oci1, err := ioutil.TempDir("", "copy-all-manifest-list-oci")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci1)
+	oci2, err := ioutil.TempDir("", "copy-all-manifest-list-oci")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci2)
+	dir1, err := ioutil.TempDir("", "copy-all-manifest-list-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-all-manifest-list-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
+	assertSkopeoSucceeds(c, "", "copy", "--all", knownListImage, "oci:"+oci1)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "oci:"+oci1, "dir:"+dir1)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "dir:"+dir1, "oci:"+oci2)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "oci:"+oci2, "dir:"+dir2)
 	assertDirImagesAreEqual(c, dir1, dir2)
 	out := combinedOutputOfCommand(c, "diff", "-urN", oci1, oci2)
 	c.Assert(out, check.Equals, "")
 }
 
 func (s *CopySuite) TestCopyAllWithManifestListConverge(c *check.C) {
-	oci1 := c.MkDir()
-	oci2 := c.MkDir()
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", knownListImage, "oci:"+oci1)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", "oci:"+oci1, "dir:"+dir1)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", "--format", "oci", knownListImage, "dir:"+dir2)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", "dir:"+dir2, "oci:"+oci2)
+	oci1, err := ioutil.TempDir("", "copy-all-manifest-list-oci")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci1)
+	oci2, err := ioutil.TempDir("", "copy-all-manifest-list-oci")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci2)
+	dir1, err := ioutil.TempDir("", "copy-all-manifest-list-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-all-manifest-list-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
+	assertSkopeoSucceeds(c, "", "copy", "--all", knownListImage, "oci:"+oci1)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "oci:"+oci1, "dir:"+dir1)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "--format", "oci", knownListImage, "dir:"+dir2)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "dir:"+dir2, "oci:"+oci2)
 	assertDirImagesAreEqual(c, dir1, dir2)
 	out := combinedOutputOfCommand(c, "diff", "-urN", oci1, oci2)
 	c.Assert(out, check.Equals, "")
 }
 
-func (s *CopySuite) TestCopyNoneWithManifestList(c *check.C) {
-	dir1 := c.MkDir()
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=index-only", knownListImage, "dir:"+dir1)
-
-	manifestPath := filepath.Join(dir1, "manifest.json")
-	readManifest, err := os.ReadFile(manifestPath)
-	c.Assert(err, check.IsNil)
-	mimeType := manifest.GuessMIMEType(readManifest)
-	c.Assert(mimeType, check.Equals, "application/vnd.docker.distribution.manifest.list.v2+json")
-	out := combinedOutputOfCommand(c, "ls", "-1", dir1)
-	c.Assert(out, check.Equals, "manifest.json\nversion\n")
-}
-
 func (s *CopySuite) TestCopyWithManifestListConverge(c *check.C) {
-	oci1 := c.MkDir()
-	oci2 := c.MkDir()
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
+	oci1, err := ioutil.TempDir("", "copy-all-manifest-list-oci")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci1)
+	oci2, err := ioutil.TempDir("", "copy-all-manifest-list-oci")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci2)
+	dir1, err := ioutil.TempDir("", "copy-all-manifest-list-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-all-manifest-list-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
 	assertSkopeoSucceeds(c, "", "copy", knownListImage, "oci:"+oci1)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", "oci:"+oci1, "dir:"+dir1)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "oci:"+oci1, "dir:"+dir1)
 	assertSkopeoSucceeds(c, "", "copy", "--format", "oci", knownListImage, "dir:"+dir2)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", "dir:"+dir2, "oci:"+oci2)
+	assertSkopeoSucceeds(c, "", "copy", "--all", "dir:"+dir2, "oci:"+oci2)
 	assertDirImagesAreEqual(c, dir1, dir2)
 	out := combinedOutputOfCommand(c, "diff", "-urN", oci1, oci2)
 	c.Assert(out, check.Equals, "")
 }
 
 func (s *CopySuite) TestCopyAllWithManifestListStorageFails(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-storage")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	assertSkopeoFails(c, `.*destination transport .* does not support copying multiple images as a group.*`, "copy", "--multi-arch=all", knownListImage, "containers-storage:"+storage+"test")
+	assertSkopeoFails(c, `.*destination transport .* does not support copying multiple images as a group.*`, "copy", "--all", knownListImage, "containers-storage:"+storage+"test")
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorage(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "copy-manifest-list-storage-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-manifest-list-storage-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
 	assertSkopeoSucceeds(c, "", "copy", knownListImage, "containers-storage:"+storage+"test")
 	assertSkopeoSucceeds(c, "", "copy", knownListImage, "dir:"+dir1)
 	assertSkopeoSucceeds(c, "", "copy", "containers-storage:"+storage+"test", "dir:"+dir2)
@@ -175,10 +203,16 @@ func (s *CopySuite) TestCopyWithManifestListStorage(c *check.C) {
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorageMultiple(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage-multiple")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "copy-manifest-list-storage-multiple-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-manifest-list-storage-multiple-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
 	assertSkopeoSucceeds(c, "", "--override-arch", "amd64", "copy", knownListImage, "containers-storage:"+storage+"test")
 	assertSkopeoSucceeds(c, "", "--override-arch", "arm64", "copy", knownListImage, "containers-storage:"+storage+"test")
 	assertSkopeoSucceeds(c, "", "--override-arch", "arm64", "copy", knownListImage, "dir:"+dir1)
@@ -188,16 +222,24 @@ func (s *CopySuite) TestCopyWithManifestListStorageMultiple(c *check.C) {
 }
 
 func (s *CopySuite) TestCopyWithManifestListDigest(c *check.C) {
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
-	oci1 := c.MkDir()
-	oci2 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "copy-manifest-list-digest-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-manifest-list-digest-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
+	oci1, err := ioutil.TempDir("", "copy-manifest-list-digest-oci")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci1)
+	oci2, err := ioutil.TempDir("", "copy-manifest-list-digest-oci")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci2)
 	m := combinedOutputOfCommand(c, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	c.Assert(err, check.IsNil)
 	digest := manifestDigest.String()
 	assertSkopeoSucceeds(c, "", "copy", knownListImage+"@"+digest, "dir:"+dir1)
-	assertSkopeoSucceeds(c, "", "copy", "--multi-arch=all", knownListImage+"@"+digest, "dir:"+dir2)
+	assertSkopeoSucceeds(c, "", "copy", "--all", knownListImage+"@"+digest, "dir:"+dir2)
 	assertSkopeoSucceeds(c, "", "copy", "dir:"+dir1, "oci:"+oci1)
 	assertSkopeoSucceeds(c, "", "copy", "dir:"+dir2, "oci:"+oci2)
 	out := combinedOutputOfCommand(c, "diff", "-urN", oci1, oci2)
@@ -205,21 +247,31 @@ func (s *CopySuite) TestCopyWithManifestListDigest(c *check.C) {
 }
 
 func (s *CopySuite) TestCopyWithDigestfileOutput(c *check.C) {
-	tempdir := c.MkDir()
-	dir1 := c.MkDir()
+	tempdir, err := ioutil.TempDir("", "tempdir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tempdir)
+	dir1, err := ioutil.TempDir("", "copy-manifest-list-digest-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
 	digestOutPath := filepath.Join(tempdir, "digest.txt")
 	assertSkopeoSucceeds(c, "", "copy", "--digestfile="+digestOutPath, knownListImage, "dir:"+dir1)
-	readDigest, err := os.ReadFile(digestOutPath)
+	readDigest, err := ioutil.ReadFile(digestOutPath)
 	c.Assert(err, check.IsNil)
 	_, err = digest.Parse(string(readDigest))
 	c.Assert(err, check.IsNil)
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorageDigest(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage-digest")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
 	m := combinedOutputOfCommand(c, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	c.Assert(err, check.IsNil)
@@ -232,10 +284,16 @@ func (s *CopySuite) TestCopyWithManifestListStorageDigest(c *check.C) {
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArches(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage-digest")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-dir")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
 	m := combinedOutputOfCommand(c, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
 	c.Assert(err, check.IsNil)
@@ -248,7 +306,9 @@ func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArches(c *check
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesBothUseListDigest(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-multiple-arches-both")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	m := combinedOutputOfCommand(c, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
@@ -268,7 +328,9 @@ func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesBothUseLi
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesFirstUsesListDigest(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-multiple-arches-first")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	m := combinedOutputOfCommand(c, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
@@ -302,7 +364,9 @@ func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesFirstUses
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesSecondUsesListDigest(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-multiple-arches-second")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	m := combinedOutputOfCommand(c, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
@@ -336,7 +400,9 @@ func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesSecondUse
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesThirdUsesListDigest(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-multiple-arches-third")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	m := combinedOutputOfCommand(c, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
@@ -370,7 +436,9 @@ func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesThirdUses
 }
 
 func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesTagAndDigest(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-manifest-list-storage-digest-multiple-arches-tag-digest")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	m := combinedOutputOfCommand(c, skopeoBinary, "inspect", "--raw", knownListImage)
 	manifestDigest, err := manifest.Digest([]byte(m))
@@ -413,20 +481,28 @@ func (s *CopySuite) TestCopyWithManifestListStorageDigestMultipleArchesTagAndDig
 }
 
 func (s *CopySuite) TestCopyFailsWhenImageOSDoesNotMatchRuntimeOS(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-fails-image-does-not-match-runtime")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	assertSkopeoFails(c, `.*no image found in manifest list for architecture .*, variant .*, OS .*`, "copy", knownWindowsOnlyImage, "containers-storage:"+storage+"test")
 }
 
 func (s *CopySuite) TestCopySucceedsWhenImageDoesNotMatchRuntimeButWeOverride(c *check.C) {
-	storage := c.MkDir()
+	storage, err := ioutil.TempDir("", "copy-succeeds-image-does-not-match-runtime-but-override")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(storage)
 	storage = fmt.Sprintf("[vfs@%s/root+%s/runroot]", storage, storage)
 	assertSkopeoSucceeds(c, "", "--override-os=windows", "--override-arch=amd64", "copy", knownWindowsOnlyImage, "containers-storage:"+storage+"test")
 }
 
 func (s *CopySuite) TestCopySimpleAtomicRegistry(c *check.C) {
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "copy-1")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-2")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	// "pull": docker: → dir:
@@ -442,8 +518,12 @@ func (s *CopySuite) TestCopySimpleAtomicRegistry(c *check.C) {
 func (s *CopySuite) TestCopySimple(c *check.C) {
 	const ourRegistry = "docker://" + v2DockerRegistryURL + "/"
 
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "copy-1")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "copy-2")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	// "pull": docker: → dir:
@@ -462,7 +542,7 @@ func (s *CopySuite) TestCopySimple(c *check.C) {
 	ociImgName := "pause"
 	defer os.RemoveAll(ociDest)
 	assertSkopeoSucceeds(c, "", "copy", "docker://k8s.gcr.io/pause:latest", "oci:"+ociDest+":"+ociImgName)
-	_, err := os.Stat(ociDest)
+	_, err = os.Stat(ociDest)
 	c.Assert(err, check.IsNil)
 
 	// docker v2s2 -> OCI image layout without image name
@@ -474,14 +554,31 @@ func (s *CopySuite) TestCopySimple(c *check.C) {
 }
 
 func (s *CopySuite) TestCopyEncryption(c *check.C) {
-	originalImageDir := c.MkDir()
-	encryptedImgDir := c.MkDir()
-	decryptedImgDir := c.MkDir()
-	keysDir := c.MkDir()
-	undecryptedImgDir := c.MkDir()
-	multiLayerImageDir := c.MkDir()
-	partiallyEncryptedImgDir := c.MkDir()
-	partiallyDecryptedImgDir := c.MkDir()
+
+	originalImageDir, err := ioutil.TempDir("", "copy-1")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(originalImageDir)
+	encryptedImgDir, err := ioutil.TempDir("", "copy-2")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(encryptedImgDir)
+	decryptedImgDir, err := ioutil.TempDir("", "copy-3")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(decryptedImgDir)
+	keysDir, err := ioutil.TempDir("", "copy-4")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(keysDir)
+	undecryptedImgDir, err := ioutil.TempDir("", "copy-5")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(undecryptedImgDir)
+	multiLayerImageDir, err := ioutil.TempDir("", "copy-6")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(multiLayerImageDir)
+	partiallyEncryptedImgDir, err := ioutil.TempDir("", "copy-7")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(partiallyEncryptedImgDir)
+	partiallyDecryptedImgDir, err := ioutil.TempDir("", "copy-8")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(partiallyDecryptedImgDir)
 
 	// Create RSA key pair
 	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
@@ -490,9 +587,9 @@ func (s *CopySuite) TestCopyEncryption(c *check.C) {
 	privateKeyBytes := x509.MarshalPKCS1PrivateKey(privateKey)
 	publicKeyBytes, err := x509.MarshalPKIXPublicKey(publicKey)
 	c.Assert(err, check.IsNil)
-	err = os.WriteFile(keysDir+"/private.key", privateKeyBytes, 0644)
+	err = ioutil.WriteFile(keysDir+"/private.key", privateKeyBytes, 0644)
 	c.Assert(err, check.IsNil)
-	err = os.WriteFile(keysDir+"/public.key", publicKeyBytes, 0644)
+	err = ioutil.WriteFile(keysDir+"/public.key", publicKeyBytes, 0644)
 	c.Assert(err, check.IsNil)
 
 	// We can either perform encryption or decryption on the image.
@@ -516,7 +613,7 @@ func (s *CopySuite) TestCopyEncryption(c *check.C) {
 	invalidPrivateKey, err := rsa.GenerateKey(rand.Reader, 4096)
 	c.Assert(err, check.IsNil)
 	invalidPrivateKeyBytes := x509.MarshalPKCS1PrivateKey(invalidPrivateKey)
-	err = os.WriteFile(keysDir+"/invalid_private.key", invalidPrivateKeyBytes, 0644)
+	err = ioutil.WriteFile(keysDir+"/invalid_private.key", invalidPrivateKeyBytes, 0644)
 	c.Assert(err, check.IsNil)
 	assertSkopeoFails(c, ".*no suitable key unwrapper found or none of the private keys could be used for decryption.*",
 		"copy", "--decryption-key", keysDir+"/invalid_private.key",
@@ -556,7 +653,7 @@ func (s *CopySuite) TestCopyEncryption(c *check.C) {
 }
 
 func matchLayerBlobBinaryType(c *check.C, ociImageDirPath string, contentType string, matchCount int) {
-	files, err := os.ReadDir(ociImageDirPath)
+	files, err := ioutil.ReadDir(ociImageDirPath)
 	c.Assert(err, check.IsNil)
 
 	foundCount := 0
@@ -592,7 +689,7 @@ func assertDirImagesAreEqual(c *check.C, dir1, dir2 string) {
 	digests := []digest.Digest{}
 	for _, dir := range []string{dir1, dir2} {
 		manifestPath := filepath.Join(dir, "manifest.json")
-		m, err := os.ReadFile(manifestPath)
+		m, err := ioutil.ReadFile(manifestPath)
 		c.Assert(err, check.IsNil)
 		digest, err := manifest.Digest(m)
 		c.Assert(err, check.IsNil)
@@ -610,7 +707,7 @@ func assertSchema1DirImagesAreEqualExceptNames(c *check.C, dir1, ref1, dir2, ref
 	manifests := []map[string]interface{}{}
 	for dir, ref := range map[string]string{dir1: ref1, dir2: ref2} {
 		manifestPath := filepath.Join(dir, "manifest.json")
-		m, err := os.ReadFile(manifestPath)
+		m, err := ioutil.ReadFile(manifestPath)
 		c.Assert(err, check.IsNil)
 		data := map[string]interface{}{}
 		err = json.Unmarshal(m, &data)
@@ -633,8 +730,12 @@ func assertSchema1DirImagesAreEqualExceptNames(c *check.C, dir1, ref1, dir2, ref
 
 // Streaming (skopeo copy)
 func (s *CopySuite) TestCopyStreaming(c *check.C) {
-	dir1 := c.MkDir()
-	dir2 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "streaming-1")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
+	dir2, err := ioutil.TempDir("", "streaming-2")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir2)
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	// streaming: docker: → atomic:
@@ -654,8 +755,12 @@ func (s *CopySuite) TestCopyStreaming(c *check.C) {
 func (s *CopySuite) TestCopyOCIRoundTrip(c *check.C) {
 	const ourRegistry = "docker://" + v2DockerRegistryURL + "/"
 
-	oci1 := c.MkDir()
-	oci2 := c.MkDir()
+	oci1, err := ioutil.TempDir("", "oci-1")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci1)
+	oci2, err := ioutil.TempDir("", "oci-2")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(oci2)
 
 	// Docker -> OCI
 	assertSkopeoSucceeds(c, "", "--tls-verify=false", "--debug", "copy", testFQIN, "oci:"+oci1+":latest")
@@ -678,7 +783,7 @@ func (s *CopySuite) TestCopyOCIRoundTrip(c *check.C) {
 	// Verify using the upstream OCI image validator, this should catch most
 	// non-compliance errors. DO NOT REMOVE THIS TEST UNLESS IT'S ABSOLUTELY
 	// NECESSARY.
-	err := image.ValidateLayout(oci1, nil, logger)
+	err = image.ValidateLayout(oci1, nil, logger)
 	c.Assert(err, check.IsNil)
 	err = image.ValidateLayout(oci2, nil, logger)
 	c.Assert(err, check.IsNil)
@@ -700,7 +805,9 @@ func (s *CopySuite) TestCopySignatures(c *check.C) {
 		c.Skip(fmt.Sprintf("Signing not supported: %v", err))
 	}
 
-	dir := c.MkDir()
+	dir, err := ioutil.TempDir("", "signatures-dest")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir)
 	dirDest := "dir:" + dir
 
 	policy := fileFromFixture(c, "fixtures/policy.json", map[string]string{"@keydir@": s.gpgHome})
@@ -754,7 +861,9 @@ func (s *CopySuite) TestCopyDirSignatures(c *check.C) {
 		c.Skip(fmt.Sprintf("Signing not supported: %v", err))
 	}
 
-	topDir := c.MkDir()
+	topDir, err := ioutil.TempDir("", "dir-signatures-top")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(topDir)
 	topDirDest := "dir:" + topDir
 
 	for _, suffix := range []string{"/dir1", "/dir2", "/restricted/personal", "/restricted/official", "/restricted/badidentity", "/dest"} {
@@ -797,7 +906,9 @@ func (s *CopySuite) TestCopyDirSignatures(c *check.C) {
 func (s *CopySuite) TestCopyCompression(c *check.C) {
 	const uncompresssedLayerFile = "160d823fdc48e62f97ba62df31e55424f8f5eb6b679c865eec6e59adfe304710"
 
-	topDir := c.MkDir()
+	topDir, err := ioutil.TempDir("", "compression-top")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(topDir)
 
 	for i, t := range []struct{ fixture, remote string }{
 		{"uncompressed-image-s1", "docker://" + v2DockerRegistryURL + "/compression/compression:s1"},
@@ -832,15 +943,15 @@ func (s *CopySuite) TestCopyCompression(c *check.C) {
 
 func findRegularFiles(c *check.C, root string) []string {
 	result := []string{}
-	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+	err := filepath.Walk(root, filepath.WalkFunc(func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
-		if d.Type().IsRegular() {
+		if info.Mode().IsRegular() {
 			result = append(result, path)
 		}
 		return nil
-	})
+	}))
 	c.Assert(err, check.IsNil)
 	return result
 }
@@ -856,7 +967,9 @@ func (s *CopySuite) TestCopyDockerSigstore(c *check.C) {
 
 	const ourRegistry = "docker://" + v2DockerRegistryURL + "/"
 
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "signatures-sigstore")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 	copyDest := filepath.Join(tmpDir, "dest")
 	err = os.Mkdir(copyDest, 0755)
 	c.Assert(err, check.IsNil)
@@ -922,7 +1035,9 @@ func (s *CopySuite) TestCopyAtomicExtension(c *check.C) {
 		c.Skip(fmt.Sprintf("Signing not supported: %v", err))
 	}
 
-	topDir := c.MkDir()
+	topDir, err := ioutil.TempDir("", "atomic-extension")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(topDir)
 	for _, subdir := range []string{"dirAA", "dirAD", "dirDA", "dirDD", "registries.d"} {
 		err := os.MkdirAll(filepath.Join(topDir, subdir), 0755)
 		c.Assert(err, check.IsNil)
@@ -969,6 +1084,22 @@ func (s *CopySuite) TestCopyAtomicExtension(c *check.C) {
 	assertDirImagesAreEqual(c, filepath.Join(topDir, "dirDA"), filepath.Join(topDir, "dirDD"))
 }
 
+// copyWithSignedIdentity creates a copy of an unsigned image, adding a signature for an unrelated identity
+// This should be easier than using standalone-sign.
+func copyWithSignedIdentity(c *check.C, src, dest, signedIdentity, signBy, registriesDir string) {
+	topDir, err := ioutil.TempDir("", "copyWithSignedIdentity")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(topDir)
+
+	signingDir := filepath.Join(topDir, "signing-temp")
+	assertSkopeoSucceeds(c, "", "copy", "--src-tls-verify=false", src, "dir:"+signingDir)
+	c.Logf("%s", combinedOutputOfCommand(c, "ls", "-laR", signingDir))
+	assertSkopeoSucceeds(c, "^$", "standalone-sign", "-o", filepath.Join(signingDir, "signature-1"),
+		filepath.Join(signingDir, "manifest.json"), signedIdentity, signBy)
+	c.Logf("%s", combinedOutputOfCommand(c, "ls", "-laR", signingDir))
+	assertSkopeoSucceeds(c, "", "--registries.d", registriesDir, "copy", "--dest-tls-verify=false", "dir:"+signingDir, dest)
+}
+
 // Both mirroring support in registries.conf, and mirrored remapIdentity support in policy.json
 func (s *CopySuite) TestCopyVerifyingMirroredSignatures(c *check.C) {
 	const regPrefix = "docker://localhost:5006/myns/mirroring-"
@@ -980,7 +1111,9 @@ func (s *CopySuite) TestCopyVerifyingMirroredSignatures(c *check.C) {
 		c.Skip(fmt.Sprintf("Signing not supported: %v", err))
 	}
 
-	topDir := c.MkDir()
+	topDir, err := ioutil.TempDir("", "mirrored-signatures")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(topDir)
 	registriesDir := filepath.Join(topDir, "registries.d") // An empty directory to disable sigstore use
 	dirDest := "dir:" + filepath.Join(topDir, "unused-dest")
 
@@ -1012,12 +1145,10 @@ func (s *CopySuite) TestCopyVerifyingMirroredSignatures(c *check.C) {
 	assertSkopeoFails(c, ".*Source image rejected: None of the signatures were accepted, reasons: Signature for identity localhost:5006/myns/mirroring-primary:direct is not accepted; Signature for identity localhost:5006/myns/mirroring-mirror:mirror-signed is not accepted.*",
 		"--policy", policy, "--registries.d", registriesDir, "--registries-conf", "fixtures/registries.conf", "copy", "--src-tls-verify=false", regPrefix+"primary:mirror-signed", dirDest)
 
-	// Fail if we specify an unqualified identity
-	assertSkopeoFails(c, ".*Could not parse --sign-identity: repository name must be canonical.*",
-		"--registries.d", registriesDir, "copy", "--src-tls-verify=false", "--dest-tls-verify=false", "--sign-by=personal@example.com", "--sign-identity=this-is-not-fully-specified", regPrefix+"primary:unsigned", regPrefix+"mirror:primary-signed")
-
 	// Create a signature for mirroring-primary:primary-signed without pushing there.
-	assertSkopeoSucceeds(c, "", "--registries.d", registriesDir, "copy", "--src-tls-verify=false", "--dest-tls-verify=false", "--sign-by=personal@example.com", "--sign-identity=localhost:5006/myns/mirroring-primary:primary-signed", regPrefix+"primary:unsigned", regPrefix+"mirror:primary-signed")
+	copyWithSignedIdentity(c, regPrefix+"primary:unsigned", regPrefix+"mirror:primary-signed",
+		"localhost:5006/myns/mirroring-primary:primary-signed", "personal@example.com",
+		registriesDir)
 	// Verify that a correctly signed image for the primary is accessible using the primary's reference
 	assertSkopeoSucceeds(c, "", "--policy", policy, "--registries.d", registriesDir, "--registries-conf", "fixtures/registries.conf", "copy", "--src-tls-verify=false", regPrefix+"primary:primary-signed", dirDest)
 	// … but verify that while it is accessible using the mirror location
@@ -1032,7 +1163,9 @@ func (s *CopySuite) TestCopyVerifyingMirroredSignatures(c *check.C) {
 	// … it is NOT accessible when requiring a signature …
 	assertSkopeoFails(c, ".*Source image rejected: None of the signatures were accepted, reasons: Signature for identity localhost:5006/myns/mirroring-primary:direct is not accepted; Signature for identity localhost:5006/myns/mirroring-mirror:mirror-signed is not accepted; Signature for identity localhost:5006/myns/mirroring-primary:primary-signed is not accepted.*", "--policy", policy, "--registries.d", registriesDir, "--registries-conf", "fixtures/registries.conf", "copy", "--src-tls-verify=false", regPrefix+"remap:remapped", dirDest)
 	// … until signed.
-	assertSkopeoSucceeds(c, "", "--registries.d", registriesDir, "copy", "--src-tls-verify=false", "--dest-tls-verify=false", "--sign-by=personal@example.com", "--sign-identity=localhost:5006/myns/mirroring-primary:remapped", regPrefix+"remap:remapped", regPrefix+"remap:remapped")
+	copyWithSignedIdentity(c, regPrefix+"remap:remapped", regPrefix+"remap:remapped",
+		"localhost:5006/myns/mirroring-primary:remapped", "personal@example.com",
+		registriesDir)
 	assertSkopeoSucceeds(c, "", "--policy", policy, "--registries.d", registriesDir, "--registries-conf", "fixtures/registries.conf", "copy", "--src-tls-verify=false", regPrefix+"remap:remapped", dirDest)
 	// To be extra clear about the semantics, verify that the signedPrefix (primary) location never exists
 	// and only the remapped prefix (mirror) is accessed.
@@ -1041,7 +1174,9 @@ func (s *CopySuite) TestCopyVerifyingMirroredSignatures(c *check.C) {
 
 func (s *SkopeoSuite) TestCopySrcWithAuth(c *check.C) {
 	assertSkopeoSucceeds(c, "", "--tls-verify=false", "copy", "--dest-creds=testuser:testpassword", testFQIN, fmt.Sprintf("docker://%s/busybox:latest", s.regV2WithAuth.url))
-	dir1 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "copy-1")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(dir1)
 	assertSkopeoSucceeds(c, "", "--tls-verify=false", "copy", "--src-creds=testuser:testpassword", fmt.Sprintf("docker://%s/busybox:latest", s.regV2WithAuth.url), "dir:"+dir1)
 }
 
@@ -1055,12 +1190,12 @@ func (s *SkopeoSuite) TestCopySrcAndDestWithAuth(c *check.C) {
 }
 
 func (s *CopySuite) TestCopyNoPanicOnHTTPResponseWithoutTLSVerifyFalse(c *check.C) {
-	topDir := c.MkDir()
-
 	const ourRegistry = "docker://" + v2DockerRegistryURL + "/"
 
+	// dir:test isn't created beforehand just because we already know this could
+	// just fail when evaluating the src
 	assertSkopeoFails(c, ".*server gave HTTP response to HTTPS client.*",
-		"copy", ourRegistry+"foobar", "dir:"+topDir)
+		"copy", ourRegistry+"foobar", "dir:test")
 }
 
 func (s *CopySuite) TestCopySchemaConversion(c *check.C) {
@@ -1071,7 +1206,9 @@ func (s *CopySuite) TestCopySchemaConversion(c *check.C) {
 }
 
 func (s *CopySuite) TestCopyManifestConversion(c *check.C) {
-	topDir := c.MkDir()
+	topDir, err := ioutil.TempDir("", "manifest-conversion")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(topDir)
 	srcDir := filepath.Join(topDir, "source")
 	destDir1 := filepath.Join(topDir, "dest1")
 	destDir2 := filepath.Join(topDir, "dest2")
@@ -1094,15 +1231,10 @@ func (s *CopySuite) TestCopyManifestConversion(c *check.C) {
 	verifyManifestMIMEType(c, destDir2, manifest.DockerV2Schema2MediaType)
 }
 
-func (s *CopySuite) TestCopyPreserveDigests(c *check.C) {
-	topDir := c.MkDir()
-
-	assertSkopeoSucceeds(c, "", "copy", knownListImage, "--multi-arch=all", "--preserve-digests", "dir:"+topDir)
-	assertSkopeoFails(c, ".*Instructed to preserve digests.*", "copy", knownListImage, "--multi-arch=all", "--preserve-digests", "--format=oci", "dir:"+topDir)
-}
-
 func (s *CopySuite) testCopySchemaConversionRegistries(c *check.C, schema1Registry, schema2Registry string) {
-	topDir := c.MkDir()
+	topDir, err := ioutil.TempDir("", "schema-conversion")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(topDir)
 	for _, subdir := range []string{"input1", "input2", "dest2"} {
 		err := os.MkdirAll(filepath.Join(topDir, subdir), 0755)
 		c.Assert(err, check.IsNil)
@@ -1136,35 +1268,35 @@ func (s *CopySuite) testCopySchemaConversionRegistries(c *check.C, schema1Regist
 const regConfFixture = "./fixtures/registries.conf"
 
 func (s *SkopeoSuite) TestSuccessCopySrcWithMirror(c *check.C) {
-	dir := c.MkDir()
+	dir, err := ioutil.TempDir("", "copy-mirror")
+	c.Assert(err, check.IsNil)
 
 	assertSkopeoSucceeds(c, "", "--registries-conf="+regConfFixture, "copy",
 		"docker://mirror.invalid/busybox", "dir:"+dir)
 }
 
 func (s *SkopeoSuite) TestFailureCopySrcWithMirrorsUnavailable(c *check.C) {
-	dir := c.MkDir()
+	dir, err := ioutil.TempDir("", "copy-mirror")
+	c.Assert(err, check.IsNil)
 
-	// .invalid domains are, per RFC 6761, supposed to result in NXDOMAIN.
-	// With systemd-resolved (used only via NSS?), we instead seem to get “Temporary failure in name resolution”
-	assertSkopeoFails(c, ".*(no such host|Temporary failure in name resolution).*",
-		"--registries-conf="+regConfFixture, "copy", "docker://invalid.invalid/busybox", "dir:"+dir)
+	assertSkopeoFails(c, ".*no such host.*", "--registries-conf="+regConfFixture, "copy",
+		"docker://invalid.invalid/busybox", "dir:"+dir)
 }
 
 func (s *SkopeoSuite) TestSuccessCopySrcWithMirrorAndPrefix(c *check.C) {
-	dir := c.MkDir()
+	dir, err := ioutil.TempDir("", "copy-mirror")
+	c.Assert(err, check.IsNil)
 
 	assertSkopeoSucceeds(c, "", "--registries-conf="+regConfFixture, "copy",
 		"docker://gcr.invalid/foo/bar/busybox", "dir:"+dir)
 }
 
 func (s *SkopeoSuite) TestFailureCopySrcWithMirrorAndPrefixUnavailable(c *check.C) {
-	dir := c.MkDir()
+	dir, err := ioutil.TempDir("", "copy-mirror")
+	c.Assert(err, check.IsNil)
 
-	// .invalid domains are, per RFC 6761, supposed to result in NXDOMAIN.
-	// With systemd-resolved (used only via NSS?), we instead seem to get “Temporary failure in name resolution”
-	assertSkopeoFails(c, ".*(no such host|Temporary failure in name resolution).*",
-		"--registries-conf="+regConfFixture, "copy", "docker://gcr.invalid/wrong/prefix/busybox", "dir:"+dir)
+	assertSkopeoFails(c, ".*no such host.*", "--registries-conf="+regConfFixture, "copy",
+		"docker://gcr.invalid/wrong/prefix/busybox", "dir:"+dir)
 }
 
 func (s *CopySuite) TestCopyFailsWhenReferenceIsInvalid(c *check.C) {

integration/openshift.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -12,7 +13,7 @@ import (
 	"time"
 
 	"github.com/docker/docker/pkg/homedir"
-	"gopkg.in/check.v1"
+	"github.com/go-check/check"
 )
 
 var adminKUBECONFIG = map[string]string{
@@ -32,7 +33,10 @@ type openshiftCluster struct {
 // in isolated test environment.
 func startOpenshiftCluster(c *check.C) *openshiftCluster {
 	cluster := &openshiftCluster{}
-	cluster.workingDir = c.MkDir()
+
+	dir, err := ioutil.TempDir("", "openshift-cluster")
+	c.Assert(err, check.IsNil)
+	cluster.workingDir = dir
 
 	cluster.startMaster(c)
 	cluster.prepareRegistryConfig(c)
@@ -192,7 +196,7 @@ func (cluster *openshiftCluster) startRegistry(c *check.C) {
 		// The default configuration currently already contains acceptschema2: false
 	})
 	// Make sure the configuration contains "acceptschema2: false", because eventually it will be enabled upstream and this function will need to be updated.
-	configContents, err := os.ReadFile(schema1Config)
+	configContents, err := ioutil.ReadFile(schema1Config)
 	c.Assert(err, check.IsNil)
 	c.Assert(string(configContents), check.Matches, "(?s).*acceptschema2: false.*")
 	cluster.processes = append(cluster.processes, cluster.startRegistryProcess(c, 5005, schema1Config))
@@ -236,7 +240,7 @@ func (cluster *openshiftCluster) dockerLogin(c *check.C) {
 			}`, port, authValue))
 	}
 	configJSON := `{"auths": {` + strings.Join(auths, ",") + `}}`
-	err = os.WriteFile(filepath.Join(cluster.dockerDir, "config.json"), []byte(configJSON), 0600)
+	err = ioutil.WriteFile(filepath.Join(cluster.dockerDir, "config.json"), []byte(configJSON), 0600)
 	c.Assert(err, check.IsNil)
 }
 
@@ -254,12 +258,12 @@ func (cluster *openshiftCluster) relaxImageSignerPermissions(c *check.C) {
 // tearDown stops the cluster services and deletes (only some!) of the state.
 func (cluster *openshiftCluster) tearDown(c *check.C) {
 	for i := len(cluster.processes) - 1; i >= 0; i-- {
-		// It’s undocumented what Kill() returns if the process has terminated,
-		// so we couldn’t check just for that. This is running in a container anyway…
-		_ = cluster.processes[i].Process.Kill()
+		cluster.processes[i].Process.Kill()
+	}
+	if cluster.workingDir != "" {
+		os.RemoveAll(cluster.workingDir)
 	}
 	if cluster.dockerDir != "" {
-		err := os.RemoveAll(cluster.dockerDir)
-		c.Assert(err, check.IsNil)
+		os.RemoveAll(cluster.dockerDir)
 	}
 }

integration/openshift_shell_test.go

@@ -1,4 +1,3 @@
-//go:build openshift_shell
 // +build openshift_shell
 
 package main
@@ -7,7 +6,7 @@ import (
 	"os"
 	"os/exec"
 
-	"gopkg.in/check.v1"
+	"github.com/go-check/check"
 )
 
 /*

integration/procutils.go

@@ -1,12 +0,0 @@
-//go:build !linux
-// +build !linux
-
-package main
-
-import (
-	"os/exec"
-)
-
-// cmdLifecycleToParentIfPossible tries to exit if the parent process exits (only works on Linux)
-func cmdLifecycleToParentIfPossible(c *exec.Cmd) {
-}

integration/procutils_linux.go

@@ -1,14 +0,0 @@
-package main
-
-import (
-	"os/exec"
-	"syscall"
-)
-
-// cmdLifecyleToParentIfPossible is a thin wrapper around prctl(PR_SET_PDEATHSIG)
-// on Linux.
-func cmdLifecycleToParentIfPossible(c *exec.Cmd) {
-	c.SysProcAttr = &syscall.SysProcAttr{
-		Pdeathsig: syscall.SIGTERM,
-	}
-}

integration/proxy_test.go

@@ -1,310 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"os/exec"
-	"strings"
-	"syscall"
-	"time"
-
-	"gopkg.in/check.v1"
-
-	"github.com/containers/image/v5/manifest"
-	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-// This image is known to be x86_64 only right now
-const knownNotManifestListedImage_x8664 = "docker://quay.io/coreos/11bot"
-
-const expectedProxySemverMajor = "0.2"
-
-// request is copied from proxy.go
-// We intentionally copy to ensure that we catch any unexpected "API" changes
-// in the JSON.
-type request struct {
-	// Method is the name of the function
-	Method string `json:"method"`
-	// Args is the arguments (parsed inside the function)
-	Args []interface{} `json:"args"`
-}
-
-// reply is copied from proxy.go
-type reply struct {
-	// Success is true if and only if the call succeeded.
-	Success bool `json:"success"`
-	// Value is an arbitrary value (or values, as array/map) returned from the call.
-	Value interface{} `json:"value"`
-	// PipeID is an index into open pipes, and should be passed to FinishPipe
-	PipeID uint32 `json:"pipeid"`
-	// Error should be non-empty if Success == false
-	Error string `json:"error"`
-}
-
-// maxMsgSize is also copied from proxy.go
-const maxMsgSize = 32 * 1024
-
-type proxy struct {
-	c *net.UnixConn
-}
-
-type pipefd struct {
-	// id is the remote identifier "pipeid"
-	id uint
-	fd *os.File
-}
-
-func (p *proxy) call(method string, args []interface{}) (rval interface{}, fd *pipefd, err error) {
-	req := request{
-		Method: method,
-		Args:   args,
-	}
-	reqbuf, err := json.Marshal(&req)
-	if err != nil {
-		return
-	}
-	n, err := p.c.Write(reqbuf)
-	if err != nil {
-		return
-	}
-	if n != len(reqbuf) {
-		err = fmt.Errorf("short write during call of %d bytes", n)
-		return
-	}
-	oob := make([]byte, syscall.CmsgSpace(1))
-	replybuf := make([]byte, maxMsgSize)
-	n, oobn, _, _, err := p.c.ReadMsgUnix(replybuf, oob)
-	if err != nil {
-		err = fmt.Errorf("reading reply: %v", err)
-		return
-	}
-	var reply reply
-	err = json.Unmarshal(replybuf[0:n], &reply)
-	if err != nil {
-		err = fmt.Errorf("Failed to parse reply: %w", err)
-		return
-	}
-	if !reply.Success {
-		err = fmt.Errorf("remote error: %s", reply.Error)
-		return
-	}
-
-	if reply.PipeID > 0 {
-		var scms []syscall.SocketControlMessage
-		scms, err = syscall.ParseSocketControlMessage(oob[:oobn])
-		if err != nil {
-			err = fmt.Errorf("failed to parse control message: %v", err)
-			return
-		}
-		if len(scms) != 1 {
-			err = fmt.Errorf("Expected 1 received fd, found %d", len(scms))
-			return
-		}
-		var fds []int
-		fds, err = syscall.ParseUnixRights(&scms[0])
-		if err != nil {
-			err = fmt.Errorf("failed to parse unix rights: %v", err)
-			return
-		}
-		fd = &pipefd{
-			fd: os.NewFile(uintptr(fds[0]), "replyfd"),
-			id: uint(reply.PipeID),
-		}
-	}
-
-	rval = reply.Value
-	return
-}
-
-func (p *proxy) callNoFd(method string, args []interface{}) (rval interface{}, err error) {
-	var fd *pipefd
-	rval, fd, err = p.call(method, args)
-	if err != nil {
-		return
-	}
-	if fd != nil {
-		err = fmt.Errorf("Unexpected fd from method %s", method)
-		return
-	}
-	return rval, nil
-}
-
-func (p *proxy) callReadAllBytes(method string, args []interface{}) (rval interface{}, buf []byte, err error) {
-	var fd *pipefd
-	rval, fd, err = p.call(method, args)
-	if err != nil {
-		return
-	}
-	if fd == nil {
-		err = fmt.Errorf("Expected fd from method %s", method)
-		return
-	}
-	fetchchan := make(chan byteFetch)
-	go func() {
-		manifestBytes, err := io.ReadAll(fd.fd)
-		fetchchan <- byteFetch{
-			content: manifestBytes,
-			err:     err,
-		}
-	}()
-	_, err = p.callNoFd("FinishPipe", []interface{}{fd.id})
-	if err != nil {
-		return
-	}
-	select {
-	case fetchRes := <-fetchchan:
-		err = fetchRes.err
-		if err != nil {
-			return
-		}
-
-		buf = fetchRes.content
-	case <-time.After(5 * time.Minute):
-		err = fmt.Errorf("timed out during proxy fetch")
-	}
-	return
-}
-
-func newProxy() (*proxy, error) {
-	fds, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET, 0)
-	if err != nil {
-		return nil, err
-	}
-	myfd := os.NewFile(uintptr(fds[0]), "myfd")
-	defer myfd.Close()
-	theirfd := os.NewFile(uintptr(fds[1]), "theirfd")
-	defer theirfd.Close()
-
-	mysock, err := net.FileConn(myfd)
-	if err != nil {
-		return nil, err
-	}
-
-	// Note ExtraFiles starts at 3
-	proc := exec.Command("skopeo", "experimental-image-proxy", "--sockfd", "3")
-	proc.Stderr = os.Stderr
-	cmdLifecycleToParentIfPossible(proc)
-	proc.ExtraFiles = append(proc.ExtraFiles, theirfd)
-
-	if err = proc.Start(); err != nil {
-		return nil, err
-	}
-
-	p := &proxy{
-		c: mysock.(*net.UnixConn),
-	}
-
-	v, err := p.callNoFd("Initialize", nil)
-	if err != nil {
-		return nil, err
-	}
-	semver, ok := v.(string)
-	if !ok {
-		return nil, fmt.Errorf("proxy Initialize: Unexpected value %T", v)
-	}
-	if !strings.HasPrefix(semver, expectedProxySemverMajor) {
-		return nil, fmt.Errorf("Unexpected semver %s", semver)
-	}
-	return p, nil
-}
-
-func init() {
-	check.Suite(&ProxySuite{})
-}
-
-type ProxySuite struct {
-}
-
-func (s *ProxySuite) SetUpSuite(c *check.C) {
-}
-
-func (s *ProxySuite) TearDownSuite(c *check.C) {
-}
-
-type byteFetch struct {
-	content []byte
-	err     error
-}
-
-func runTestGetManifestAndConfig(p *proxy, img string) error {
-	v, err := p.callNoFd("OpenImage", []interface{}{knownNotManifestListedImage_x8664})
-	if err != nil {
-		return err
-	}
-
-	imgidv, ok := v.(float64)
-	if !ok {
-		return fmt.Errorf("OpenImage return value is %T", v)
-	}
-	imgid := uint32(imgidv)
-
-	_, manifestBytes, err := p.callReadAllBytes("GetManifest", []interface{}{imgid})
-	if err != nil {
-		return err
-	}
-	_, err = manifest.OCI1FromManifest(manifestBytes)
-	if err != nil {
-		return err
-	}
-
-	_, configBytes, err := p.callReadAllBytes("GetFullConfig", []interface{}{imgid})
-	if err != nil {
-		return err
-	}
-	var config imgspecv1.Image
-	err = json.Unmarshal(configBytes, &config)
-	if err != nil {
-		return err
-	}
-
-	// Validate that the image config seems sane
-	if config.Architecture == "" {
-		return fmt.Errorf("No architecture found")
-	}
-	if len(config.Config.Cmd) == 0 && len(config.Config.Entrypoint) == 0 {
-		return fmt.Errorf("No CMD or ENTRYPOINT set")
-	}
-
-	// Also test this legacy interface
-	_, ctrconfigBytes, err := p.callReadAllBytes("GetConfig", []interface{}{imgid})
-	if err != nil {
-		return err
-	}
-	var ctrconfig imgspecv1.ImageConfig
-	err = json.Unmarshal(ctrconfigBytes, &ctrconfig)
-	if err != nil {
-		return err
-	}
-
-	// Validate that the config seems sane
-	if len(ctrconfig.Cmd) == 0 && len(ctrconfig.Entrypoint) == 0 {
-		return fmt.Errorf("No CMD or ENTRYPOINT set")
-	}
-
-	_, err = p.callNoFd("CloseImage", []interface{}{imgid})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *ProxySuite) TestProxy(c *check.C) {
-	p, err := newProxy()
-	c.Assert(err, check.IsNil)
-
-	err = runTestGetManifestAndConfig(p, knownNotManifestListedImage_x8664)
-	if err != nil {
-		err = fmt.Errorf("Testing image %s: %v", knownNotManifestListedImage_x8664, err)
-	}
-	c.Assert(err, check.IsNil)
-
-	err = runTestGetManifestAndConfig(p, knownListImage)
-	if err != nil {
-		err = fmt.Errorf("Testing image %s: %v", knownListImage, err)
-	}
-	c.Assert(err, check.IsNil)
-}

integration/registry.go

@@ -2,13 +2,14 @@ package main
 
 import (
 	"fmt"
+	"io/ioutil"
 	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"time"
 
-	"gopkg.in/check.v1"
+	"github.com/go-check/check"
 )
 
 const (
@@ -19,6 +20,7 @@ const (
 type testRegistryV2 struct {
 	cmd      *exec.Cmd
 	url      string
+	dir      string
 	username string
 	password string
 	email    string
@@ -43,7 +45,10 @@ func setupRegistryV2At(c *check.C, url string, auth, schema1 bool) *testRegistry
 }
 
 func newTestRegistryV2At(c *check.C, url string, auth, schema1 bool) (*testRegistryV2, error) {
-	tmp := c.MkDir()
+	tmp, err := ioutil.TempDir("", "registry-test-")
+	if err != nil {
+		return nil, err
+	}
 	template := `version: 0.1
 loglevel: debug
 storage:
@@ -66,7 +71,7 @@ http:
 		username = "testuser"
 		password = "testpassword"
 		email = "test@test.org"
-		if err := os.WriteFile(htpasswdPath, []byte(userpasswd), os.FileMode(0644)); err != nil {
+		if err := ioutil.WriteFile(htpasswdPath, []byte(userpasswd), os.FileMode(0644)); err != nil {
 			return nil, err
 		}
 		htpasswd = fmt.Sprintf(`auth:
@@ -81,6 +86,7 @@ http:
 		return nil, err
 	}
 	if _, err := fmt.Fprintf(config, template, tmp, url, htpasswd); err != nil {
+		os.RemoveAll(tmp)
 		return nil, err
 	}
 
@@ -92,6 +98,7 @@ http:
 	cmd := exec.Command(binary, confPath)
 	consumeAndLogOutputs(c, fmt.Sprintf("registry-%s", url), cmd)
 	if err := cmd.Start(); err != nil {
+		os.RemoveAll(tmp)
 		if os.IsNotExist(err) {
 			c.Skip(err.Error())
 		}
@@ -100,6 +107,7 @@ http:
 	return &testRegistryV2{
 		cmd:      cmd,
 		url:      url,
+		dir:      tmp,
 		username: username,
 		password: password,
 		email:    email,
@@ -118,8 +126,7 @@ func (t *testRegistryV2) Ping() error {
 	return nil
 }
 
-func (t *testRegistryV2) tearDown(c *check.C) {
-	// It’s undocumented what Kill() returns if the process has terminated,
-	// so we couldn’t check just for that. This is running in a container anyway…
-	_ = t.cmd.Process.Kill()
+func (t *testRegistryV2) Close() {
+	t.cmd.Process.Kill()
+	os.RemoveAll(t.dir)
 }

integration/signing_test.go

@@ -3,12 +3,13 @@ package main
 import (
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"strings"
 
 	"github.com/containers/image/v5/signature"
-	"gopkg.in/check.v1"
+	"github.com/go-check/check"
 )
 
 const (
@@ -20,6 +21,7 @@ func init() {
 }
 
 type SigningSuite struct {
+	gpgHome     string
 	fingerprint string
 }
 
@@ -38,18 +40,25 @@ func (s *SigningSuite) SetUpSuite(c *check.C) {
 	_, err := exec.LookPath(skopeoBinary)
 	c.Assert(err, check.IsNil)
 
-	gpgHome := c.MkDir()
-	os.Setenv("GNUPGHOME", gpgHome)
+	s.gpgHome, err = ioutil.TempDir("", "skopeo-gpg")
+	c.Assert(err, check.IsNil)
+	os.Setenv("GNUPGHOME", s.gpgHome)
 
-	runCommandWithInput(c, "Key-Type: RSA\nName-Real: Testing user\n%no-protection\n%commit\n", gpgBinary, "--homedir", gpgHome, "--batch", "--gen-key")
+	runCommandWithInput(c, "Key-Type: RSA\nName-Real: Testing user\n%no-protection\n%commit\n", gpgBinary, "--homedir", s.gpgHome, "--batch", "--gen-key")
 
-	lines, err := exec.Command(gpgBinary, "--homedir", gpgHome, "--with-colons", "--no-permission-warning", "--fingerprint").Output()
+	lines, err := exec.Command(gpgBinary, "--homedir", s.gpgHome, "--with-colons", "--no-permission-warning", "--fingerprint").Output()
 	c.Assert(err, check.IsNil)
 	s.fingerprint, err = findFingerprint(lines)
 	c.Assert(err, check.IsNil)
 }
 
 func (s *SigningSuite) TearDownSuite(c *check.C) {
+	if s.gpgHome != "" {
+		err := os.RemoveAll(s.gpgHome)
+		c.Assert(err, check.IsNil)
+	}
+	s.gpgHome = ""
+
 	os.Unsetenv("GNUPGHOME")
 }
 
@@ -64,7 +73,7 @@ func (s *SigningSuite) TestSignVerifySmoke(c *check.C) {
 	manifestPath := "fixtures/image.manifest.json"
 	dockerReference := "testing/smoketest"
 
-	sigOutput, err := os.CreateTemp("", "sig")
+	sigOutput, err := ioutil.TempFile("", "sig")
 	c.Assert(err, check.IsNil)
 	defer os.Remove(sigOutput.Name())
 	assertSkopeoSucceeds(c, "^$", "standalone-sign", "-o", sigOutput.Name(),

integration/sync_test.go

@@ -3,7 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
-	"io/fs"
+	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
@@ -14,8 +14,8 @@ import (
 	"github.com/containers/image/v5/docker/reference"
 	"github.com/containers/image/v5/manifest"
 	"github.com/containers/image/v5/types"
+	"github.com/go-check/check"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
-	"gopkg.in/check.v1"
 )
 
 const (
@@ -40,6 +40,7 @@ func init() {
 type SyncSuite struct {
 	cluster  *openshiftCluster
 	registry *testRegistryV2
+	gpgHome  string
 }
 
 func (s *SyncSuite) SetUpSuite(c *check.C) {
@@ -73,8 +74,10 @@ func (s *SyncSuite) SetUpSuite(c *check.C) {
 	// FIXME: Set up TLS for the docker registry port instead of using "--tls-verify=false" all over the place.
 	s.registry = setupRegistryV2At(c, v2DockerRegistryURL, registryAuth, registrySchema1)
 
-	gpgHome := c.MkDir()
-	os.Setenv("GNUPGHOME", gpgHome)
+	gpgHome, err := ioutil.TempDir("", "skopeo-gpg")
+	c.Assert(err, check.IsNil)
+	s.gpgHome = gpgHome
+	os.Setenv("GNUPGHOME", s.gpgHome)
 
 	for _, key := range []string{"personal", "official"} {
 		batchInput := fmt.Sprintf("Key-Type: RSA\nName-Real: Test key - %s\nName-email: %s@example.com\n%%no-protection\n%%commit\n",
@@ -82,7 +85,7 @@ func (s *SyncSuite) SetUpSuite(c *check.C) {
 		runCommandWithInput(c, batchInput, gpgBinary, "--batch", "--gen-key")
 
 		out := combinedOutputOfCommand(c, gpgBinary, "--armor", "--export", fmt.Sprintf("%s@example.com", key))
-		err := os.WriteFile(filepath.Join(gpgHome, fmt.Sprintf("%s-pubkey.gpg", key)),
+		err := ioutil.WriteFile(filepath.Join(s.gpgHome, fmt.Sprintf("%s-pubkey.gpg", key)),
 			[]byte(out), 0600)
 		c.Assert(err, check.IsNil)
 	}
@@ -93,32 +96,21 @@ func (s *SyncSuite) TearDownSuite(c *check.C) {
 		return
 	}
 
+	if s.gpgHome != "" {
+		os.RemoveAll(s.gpgHome)
+	}
 	if s.registry != nil {
-		s.registry.tearDown(c)
+		s.registry.Close()
 	}
 	if s.cluster != nil {
 		s.cluster.tearDown(c)
 	}
 }
 
-func assertNumberOfManifestsInSubdirs(c *check.C, dir string, expectedCount int) {
-	nManifests := 0
-	err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if !d.IsDir() && d.Name() == "manifest.json" {
-			nManifests++
-			return filepath.SkipDir
-		}
-		return nil
-	})
-	c.Assert(err, check.IsNil)
-	c.Assert(nManifests, check.Equals, expectedCount)
-}
-
 func (s *SyncSuite) TestDocker2DirTagged(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedImage
@@ -144,7 +136,9 @@ func (s *SyncSuite) TestDocker2DirTagged(c *check.C) {
 }
 
 func (s *SyncSuite) TestDocker2DirTaggedAll(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedManifestList
@@ -169,20 +163,6 @@ func (s *SyncSuite) TestDocker2DirTaggedAll(c *check.C) {
 	c.Assert(out, check.Equals, "")
 }
 
-func (s *SyncSuite) TestPreserveDigests(c *check.C) {
-	tmpDir := c.MkDir()
-
-	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
-	image := pullableTaggedManifestList
-
-	// copy docker => dir
-	assertSkopeoSucceeds(c, "", "copy", "--all", "--preserve-digests", "docker://"+image, "dir:"+tmpDir)
-	_, err := os.Stat(path.Join(tmpDir, "manifest.json"))
-	c.Assert(err, check.IsNil)
-
-	assertSkopeoFails(c, ".*Instructed to preserve digests.*", "copy", "--all", "--preserve-digests", "--format=oci", "docker://"+image, "dir:"+tmpDir)
-}
-
 func (s *SyncSuite) TestScoped(c *check.C) {
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedImage
@@ -190,7 +170,8 @@ func (s *SyncSuite) TestScoped(c *check.C) {
 	c.Assert(err, check.IsNil)
 	imagePath := imageRef.DockerReference().String()
 
-	dir1 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
 	assertSkopeoSucceeds(c, "", "sync", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, path.Base(imagePath), "manifest.json"))
 	c.Assert(err, check.IsNil)
@@ -198,6 +179,8 @@ func (s *SyncSuite) TestScoped(c *check.C) {
 	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
 	c.Assert(err, check.IsNil)
+
+	os.RemoveAll(dir1)
 }
 
 func (s *SyncSuite) TestDirIsNotOverwritten(c *check.C) {
@@ -211,7 +194,8 @@ func (s *SyncSuite) TestDirIsNotOverwritten(c *check.C) {
 	assertSkopeoSucceeds(c, "", "copy", "--dest-tls-verify=false", "docker://"+image, "docker://"+path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())))
 
 	//sync upstream image to dir, not scoped
-	dir1 := c.MkDir()
+	dir1, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
 	assertSkopeoSucceeds(c, "", "sync", "--src", "docker", "--dest", "dir", image, dir1)
 	_, err = os.Stat(path.Join(dir1, path.Base(imagePath), "manifest.json"))
 	c.Assert(err, check.IsNil)
@@ -226,10 +210,14 @@ func (s *SyncSuite) TestDirIsNotOverwritten(c *check.C) {
 	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src-tls-verify=false", "--src", "docker", "--dest", "dir", path.Join(v2DockerRegistryURL, reference.Path(imageRef.DockerReference())), dir1)
 	_, err = os.Stat(path.Join(dir1, imagePath, "manifest.json"))
 	c.Assert(err, check.IsNil)
+	os.RemoveAll(dir1)
 }
 
 func (s *SyncSuite) TestDocker2DirUntagged(c *check.C) {
-	tmpDir := c.MkDir()
+
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableRepo
@@ -251,7 +239,9 @@ func (s *SyncSuite) TestDocker2DirUntagged(c *check.C) {
 }
 
 func (s *SyncSuite) TestYamlUntagged(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 	dir1 := path.Join(tmpDir, "dir1")
 
 	image := pullableRepo
@@ -272,8 +262,7 @@ func (s *SyncSuite) TestYamlUntagged(c *check.C) {
 
 	// sync to the local registry
 	yamlFile := path.Join(tmpDir, "registries.yaml")
-	err = os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	c.Assert(err, check.IsNil)
+	ioutil.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "docker", "--dest-tls-verify=false", yamlFile, v2DockerRegistryURL)
 	// sync back from local registry to a folder
 	os.Remove(yamlFile)
@@ -284,8 +273,7 @@ func (s *SyncSuite) TestYamlUntagged(c *check.C) {
     %s: []
 `, v2DockerRegistryURL, imagePath)
 
-	err = os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	c.Assert(err, check.IsNil)
+	ioutil.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
 
 	sysCtx = types.SystemContext{
@@ -297,11 +285,27 @@ func (s *SyncSuite) TestYamlUntagged(c *check.C) {
 	c.Assert(err, check.IsNil)
 	c.Check(len(localTags), check.Not(check.Equals), 0)
 	c.Assert(len(localTags), check.Equals, len(tags))
-	assertNumberOfManifestsInSubdirs(c, dir1, len(tags))
+
+	nManifests := 0
+	//count the number of manifest.json in dir1
+	err = filepath.Walk(dir1, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() && info.Name() == "manifest.json" {
+			nManifests++
+			return filepath.SkipDir
+		}
+		return nil
+	})
+	c.Assert(err, check.IsNil)
+	c.Assert(nManifests, check.Equals, len(tags))
 }
 
 func (s *SyncSuite) TestYamlRegex2Dir(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 	dir1 := path.Join(tmpDir, "dir1")
 
 	yamlConfig := `
@@ -314,14 +318,28 @@ k8s.gcr.io:
 	c.Assert(nTags, check.Not(check.Equals), 0)
 
 	yamlFile := path.Join(tmpDir, "registries.yaml")
-	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	c.Assert(err, check.IsNil)
+	ioutil.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
-	assertNumberOfManifestsInSubdirs(c, dir1, nTags)
+
+	nManifests := 0
+	err = filepath.Walk(dir1, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() && info.Name() == "manifest.json" {
+			nManifests++
+			return filepath.SkipDir
+		}
+		return nil
+	})
+	c.Assert(err, check.IsNil)
+	c.Assert(nManifests, check.Equals, nTags)
 }
 
 func (s *SyncSuite) TestYamlDigest2Dir(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 	dir1 := path.Join(tmpDir, "dir1")
 
 	yamlConfig := `
@@ -331,14 +349,28 @@ k8s.gcr.io:
     - sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610
 `
 	yamlFile := path.Join(tmpDir, "registries.yaml")
-	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	c.Assert(err, check.IsNil)
+	ioutil.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
-	assertNumberOfManifestsInSubdirs(c, dir1, 1)
+
+	nManifests := 0
+	err = filepath.Walk(dir1, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() && info.Name() == "manifest.json" {
+			nManifests++
+			return filepath.SkipDir
+		}
+		return nil
+	})
+	c.Assert(err, check.IsNil)
+	c.Assert(nManifests, check.Equals, 1)
 }
 
 func (s *SyncSuite) TestYaml2Dir(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 	dir1 := path.Join(tmpDir, "dir1")
 
 	yamlConfig := `
@@ -369,15 +401,29 @@ quay.io:
 	c.Assert(nTags, check.Not(check.Equals), 0)
 
 	yamlFile := path.Join(tmpDir, "registries.yaml")
-	err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-	c.Assert(err, check.IsNil)
+	ioutil.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 	assertSkopeoSucceeds(c, "", "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
-	assertNumberOfManifestsInSubdirs(c, dir1, nTags)
+
+	nManifests := 0
+	err = filepath.Walk(dir1, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() && info.Name() == "manifest.json" {
+			nManifests++
+			return filepath.SkipDir
+		}
+		return nil
+	})
+	c.Assert(err, check.IsNil)
+	c.Assert(nManifests, check.Equals, nTags)
 }
 
 func (s *SyncSuite) TestYamlTLSVerify(c *check.C) {
 	const localRegURL = "docker://" + v2DockerRegistryURL + "/"
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 	dir1 := path.Join(tmpDir, "dir1")
 	image := pullableRepoWithLatestTag
 	tag := "latest"
@@ -419,8 +465,7 @@ func (s *SyncSuite) TestYamlTLSVerify(c *check.C) {
 	for _, cfg := range testCfg {
 		yamlConfig := fmt.Sprintf(yamlTemplate, v2DockerRegistryURL, cfg.tlsVerify, image, tag)
 		yamlFile := path.Join(tmpDir, "registries.yaml")
-		err := os.WriteFile(yamlFile, []byte(yamlConfig), 0644)
-		c.Assert(err, check.IsNil)
+		ioutil.WriteFile(yamlFile, []byte(yamlConfig), 0644)
 
 		cfg.checker(c, cfg.msg, "sync", "--scoped", "--src", "yaml", "--dest", "dir", yamlFile, dir1)
 		os.Remove(yamlFile)
@@ -430,7 +475,9 @@ func (s *SyncSuite) TestYamlTLSVerify(c *check.C) {
 }
 
 func (s *SyncSuite) TestSyncManifestOutput(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "sync-manifest-output")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	destDir1 := filepath.Join(tmpDir, "dest1")
 	destDir2 := filepath.Join(tmpDir, "dest2")
@@ -450,7 +497,9 @@ func (s *SyncSuite) TestSyncManifestOutput(c *check.C) {
 func (s *SyncSuite) TestDocker2DockerTagged(c *check.C) {
 	const localRegURL = "docker://" + v2DockerRegistryURL + "/"
 
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableTaggedImage
@@ -481,13 +530,15 @@ func (s *SyncSuite) TestDocker2DockerTagged(c *check.C) {
 func (s *SyncSuite) TestDir2DockerTagged(c *check.C) {
 	const localRegURL = "docker://" + v2DockerRegistryURL + "/"
 
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	// FIXME: It would be nice to use one of the local Docker registries instead of needing an Internet connection.
 	image := pullableRepoWithLatestTag
 
 	dir1 := path.Join(tmpDir, "dir1")
-	err := os.Mkdir(dir1, 0755)
+	err = os.Mkdir(dir1, 0755)
 	c.Assert(err, check.IsNil)
 	dir2 := path.Join(tmpDir, "dir2")
 	err = os.Mkdir(dir2, 0755)
@@ -519,7 +570,9 @@ func (s *SyncSuite) TestDir2DockerTagged(c *check.C) {
 }
 
 func (s *SyncSuite) TestFailsWithDir2Dir(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	dir1 := path.Join(tmpDir, "dir1")
 	dir2 := path.Join(tmpDir, "dir2")
@@ -529,7 +582,9 @@ func (s *SyncSuite) TestFailsWithDir2Dir(c *check.C) {
 }
 
 func (s *SyncSuite) TestFailsNoSourceImages(c *check.C) {
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	assertSkopeoFails(c, ".*No images to sync found in .*",
 		"sync", "--scoped", "--dest-tls-verify=false", "--src", "dir", "--dest", "docker", tmpDir, v2DockerRegistryURL)
@@ -541,7 +596,9 @@ func (s *SyncSuite) TestFailsNoSourceImages(c *check.C) {
 func (s *SyncSuite) TestFailsWithDockerSourceNoRegistry(c *check.C) {
 	const regURL = "google.com/namespace/imagename"
 
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	//untagged
 	assertSkopeoFails(c, ".*invalid status code from registry 404.*",
@@ -554,7 +611,9 @@ func (s *SyncSuite) TestFailsWithDockerSourceNoRegistry(c *check.C) {
 
 func (s *SyncSuite) TestFailsWithDockerSourceUnauthorized(c *check.C) {
 	const repo = "privateimagenamethatshouldnotbepublic"
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	//untagged
 	assertSkopeoFails(c, ".*Registry disallows tag list retrieval.*",
@@ -567,7 +626,9 @@ func (s *SyncSuite) TestFailsWithDockerSourceUnauthorized(c *check.C) {
 
 func (s *SyncSuite) TestFailsWithDockerSourceNotExisting(c *check.C) {
 	repo := path.Join(v2DockerRegistryURL, "imagedoesnotexist")
-	tmpDir := c.MkDir()
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmpDir)
 
 	//untagged
 	assertSkopeoFails(c, ".*invalid status code from registry 404.*",
@@ -580,9 +641,9 @@ func (s *SyncSuite) TestFailsWithDockerSourceNotExisting(c *check.C) {
 
 func (s *SyncSuite) TestFailsWithDirSourceNotExisting(c *check.C) {
 	// Make sure the dir does not exist!
-	tmpDir := c.MkDir()
-	tmpDir = filepath.Join(tmpDir, "this-does-not-exist")
-	err := os.RemoveAll(tmpDir)
+	tmpDir, err := ioutil.TempDir("", "skopeo-sync-test")
+	c.Assert(err, check.IsNil)
+	err = os.RemoveAll(tmpDir)
 	c.Assert(err, check.IsNil)
 	_, err = os.Stat(path.Join(tmpDir))
 	c.Check(os.IsNotExist(err), check.Equals, true)

integration/utils.go

@@ -3,15 +3,15 @@ package main
 import (
 	"bytes"
 	"io"
+	"io/ioutil"
 	"net"
-	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"time"
 
 	"github.com/containers/image/v5/manifest"
-	"gopkg.in/check.v1"
+	"github.com/go-check/check"
 )
 
 const skopeoBinary = "skopeo"
@@ -163,7 +163,7 @@ func modifyEnviron(env []string, name, value string) []string {
 // fileFromFixtureFixture applies edits to inputPath and returns a path to the temporary file.
 // Callers should defer os.Remove(the_returned_path)
 func fileFromFixture(c *check.C, inputPath string, edits map[string]string) string {
-	contents, err := os.ReadFile(inputPath)
+	contents, err := ioutil.ReadFile(inputPath)
 	c.Assert(err, check.IsNil)
 	for template, value := range edits {
 		updated := bytes.Replace(contents, []byte(template), []byte(value), -1)
@@ -171,7 +171,7 @@ func fileFromFixture(c *check.C, inputPath string, edits map[string]string) stri
 		contents = updated
 	}
 
-	file, err := os.CreateTemp("", "policy.json")
+	file, err := ioutil.TempFile("", "policy.json")
 	c.Assert(err, check.IsNil)
 	path := file.Name()
 
@@ -187,7 +187,7 @@ func fileFromFixture(c *check.C, inputPath string, edits map[string]string) stri
 func runDecompressDirs(c *check.C, regexp string, args ...string) {
 	c.Logf("Running %s %s", decompressDirsBinary, strings.Join(args, " "))
 	for i, dir := range args {
-		m, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
+		m, err := ioutil.ReadFile(filepath.Join(dir, "manifest.json"))
 		c.Assert(err, check.IsNil)
 		c.Logf("manifest %d before: %s", i+1, string(m))
 	}
@@ -197,7 +197,7 @@ func runDecompressDirs(c *check.C, regexp string, args ...string) {
 		if len(out) > 0 {
 			c.Logf("output: %s", out)
 		}
-		m, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
+		m, err := ioutil.ReadFile(filepath.Join(dir, "manifest.json"))
 		c.Assert(err, check.IsNil)
 		c.Logf("manifest %d after: %s", i+1, string(m))
 	}
@@ -208,7 +208,7 @@ func runDecompressDirs(c *check.C, regexp string, args ...string) {
 
 // Verify manifest in a dir: image at dir is expectedMIMEType.
 func verifyManifestMIMEType(c *check.C, dir string, expectedMIMEType string) {
-	manifestBlob, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
+	manifestBlob, err := ioutil.ReadFile(filepath.Join(dir, "manifest.json"))
 	c.Assert(err, check.IsNil)
 	mimeType := manifest.GuessMIMEType(manifestBlob)
 	c.Assert(mimeType, check.Equals, expectedMIMEType)

nix/default-arm64.nix

@@ -0,0 +1,85 @@
+let
+  pkgs = (import ./nixpkgs.nix {
+    crossSystem = {
+      config = "aarch64-unknown-linux-gnu";
+    };
+    config = {
+      packageOverrides = pkg: {
+        gpgme = (static pkg.gpgme);
+        libassuan = (static pkg.libassuan);
+        libgpgerror = (static pkg.libgpgerror);
+        libseccomp = (static pkg.libseccomp);
+        glib = (static pkg.glib).overrideAttrs (x: {
+          outputs = [ "bin" "out" "dev" ];
+          mesonFlags = [
+            "-Ddefault_library=static"
+            "-Ddevbindir=${placeholder ''dev''}/bin"
+            "-Dgtk_doc=false"
+            "-Dnls=disabled"
+          ];
+          postInstall = ''
+            moveToOutput "share/glib-2.0" "$dev"
+            substituteInPlace "$dev/bin/gdbus-codegen" --replace "$out" "$dev"
+            sed -i "$dev/bin/glib-gettextize" -e "s|^gettext_dir=.*|gettext_dir=$dev/share/glib-2.0/gettext|"
+            sed '1i#line 1 "${x.pname}-${x.version}/include/glib-2.0/gobject/gobjectnotifyqueue.c"' \
+              -i "$dev"/include/glib-2.0/gobject/gobjectnotifyqueue.c
+          '';
+        });
+        pcsclite = (static pkg.pcsclite).overrideAttrs (x: {
+          configureFlags = [
+            "--enable-confdir=/etc"
+            "--enable-usbdropdir=/var/lib/pcsc/drivers"
+            "--disable-libsystemd"
+            "--disable-libudev"
+            "--disable-libusb"
+          ];
+          buildInputs = [ pkgs.python3 pkgs.dbus ];
+        });
+        systemd = (static pkg.systemd).overrideAttrs (x: {
+          outputs = [ "out" "dev" ];
+          mesonFlags = x.mesonFlags ++ [
+            "-Dglib=false"
+            "-Dstatic-libsystemd=true"
+          ];
+        });
+      };
+    };
+  });
+
+  static = pkg: pkg.overrideAttrs (x: {
+    doCheck = false;
+    configureFlags = (x.configureFlags or [ ]) ++ [
+      "--without-shared"
+      "--disable-shared"
+    ];
+    dontDisableStatic = true;
+    enableSharedExecutables = false;
+    enableStatic = true;
+  });
+
+  self = with pkgs; buildGoModule rec {
+    name = "skopeo";
+    src = ./..;
+    vendorSha256 = null;
+    doCheck = false;
+    enableParallelBuilding = true;
+    outputs = [ "out" ];
+    nativeBuildInputs = [ bash gitMinimal go-md2man pkg-config which ];
+    buildInputs = [ glibc glibc.static glib gpgme libassuan libgpgerror libseccomp ];
+    prePatch = ''
+      export CFLAGS='-static -pthread'
+      export LDFLAGS='-s -w -static-libgcc -static'
+      export EXTRA_LDFLAGS='-s -w -linkmode external -extldflags "-static -lm"'
+      export BUILDTAGS='static netgo osusergo exclude_graphdriver_btrfs exclude_graphdriver_devicemapper'
+      export CGO_ENABLED=1
+    '';
+    buildPhase = ''
+      patchShebangs .
+      make bin/skopeo
+    '';
+    installPhase = ''
+      install -Dm755 bin/skopeo $out/bin/skopeo
+    '';
+  };
+in
+self

nix/default.nix

@@ -0,0 +1,83 @@
+{ system ? builtins.currentSystem }:
+let
+  pkgs = (import ./nixpkgs.nix {
+    config = {
+      packageOverrides = pkg: {
+        gpgme = (static pkg.gpgme);
+        libassuan = (static pkg.libassuan);
+        libgpgerror = (static pkg.libgpgerror);
+        libseccomp = (static pkg.libseccomp);
+        glib = (static pkg.glib).overrideAttrs (x: {
+          outputs = [ "bin" "out" "dev" ];
+          mesonFlags = [
+            "-Ddefault_library=static"
+            "-Ddevbindir=${placeholder ''dev''}/bin"
+            "-Dgtk_doc=false"
+            "-Dnls=disabled"
+          ];
+          postInstall = ''
+            moveToOutput "share/glib-2.0" "$dev"
+            substituteInPlace "$dev/bin/gdbus-codegen" --replace "$out" "$dev"
+            sed -i "$dev/bin/glib-gettextize" -e "s|^gettext_dir=.*|gettext_dir=$dev/share/glib-2.0/gettext|"
+            sed '1i#line 1 "${x.pname}-${x.version}/include/glib-2.0/gobject/gobjectnotifyqueue.c"' \
+              -i "$dev"/include/glib-2.0/gobject/gobjectnotifyqueue.c
+          '';
+        });
+        pcsclite = (static pkg.pcsclite).overrideAttrs (x: {
+          configureFlags = [
+            "--enable-confdir=/etc"
+            "--enable-usbdropdir=/var/lib/pcsc/drivers"
+            "--disable-libsystemd"
+            "--disable-libudev"
+            "--disable-libusb"
+          ];
+          buildInputs = [ pkgs.python3 pkgs.dbus ];
+        });
+        systemd = (static pkg.systemd).overrideAttrs (x: {
+          outputs = [ "out" "dev" ];
+          mesonFlags = x.mesonFlags ++ [
+            "-Dglib=false"
+            "-Dstatic-libsystemd=true"
+          ];
+        });
+      };
+    };
+  });
+
+  static = pkg: pkg.overrideAttrs (x: {
+    doCheck = false;
+    configureFlags = (x.configureFlags or [ ]) ++ [
+      "--without-shared"
+      "--disable-shared"
+    ];
+    dontDisableStatic = true;
+    enableSharedExecutables = false;
+    enableStatic = true;
+  });
+
+  self = with pkgs; buildGoModule rec {
+    name = "skopeo";
+    src = ./..;
+    vendorSha256 = null;
+    doCheck = false;
+    enableParallelBuilding = true;
+    outputs = [ "out" ];
+    nativeBuildInputs = [ bash gitMinimal go-md2man pkg-config which ];
+    buildInputs = [ glibc glibc.static glib gpgme libassuan libgpgerror libseccomp ];
+    prePatch = ''
+      export CFLAGS='-static -pthread'
+      export LDFLAGS='-s -w -static-libgcc -static'
+      export EXTRA_LDFLAGS='-s -w -linkmode external -extldflags "-static -lm"'
+      export BUILDTAGS='static netgo osusergo exclude_graphdriver_btrfs exclude_graphdriver_devicemapper'
+      export CGO_ENABLED=1
+    '';
+    buildPhase = ''
+      patchShebangs .
+      make bin/skopeo
+    '';
+    installPhase = ''
+      install -Dm755 bin/skopeo $out/bin/skopeo
+    '';
+  };
+in
+self

nix/nixpkgs.json

@@ -0,0 +1,10 @@
+{
+  "url": "https://github.com/nixos/nixpkgs",
+  "rev": "2a96414d7e350160a33ed0978449c9ff5b5a6eb3",
+  "date": "2021-07-13T18:21:47+02:00",
+  "path": "/nix/store/2ai9q8ac6vxb2rrngdz82y8jxnk15cvm-nixpkgs",
+  "sha256": "1dzrfqdjq3yq5jjskiqflzy58l2xx6059gay9p1k07zrlm1wigy5",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}

nix/nixpkgs.nix

@@ -0,0 +1,9 @@
+let
+  json = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+  nixpkgs = import (builtins.fetchTarball {
+    name = "nixos-unstable";
+    url = "${json.url}/archive/${json.rev}.tar.gz";
+    inherit (json) sha256;
+  });
+in
+nixpkgs

systemtest/010-inspect.bats

@@ -27,20 +27,11 @@ load helpers
     # Now run inspect locally
     run_skopeo inspect dir:$workdir
     inspect_local=$output
-    run_skopeo inspect --raw dir:$workdir
-    inspect_local_raw=$output
-    config_digest=$(jq -r '.config.digest' <<<"$inspect_local_raw")
 
-    # Each SHA-named layer file (but not the config) must be listed in the output of 'inspect'.
-    # In all existing versions of Skopeo (with 1.6 being the current as of this comment),
-    # the output of 'inspect' lists layer digests,
-    # but not the digest of the config blob ($config_digest), if any.
-    layers=$(jq -r '.Layers' <<<"$inspect_local")
+    # Each SHA-named file must be listed in the output of 'inspect'
     for sha in $(find $workdir -type f | xargs -l1 basename | egrep '^[0-9a-f]{64}$'); do
-        if [ "sha256:$sha" != "$config_digest" ]; then
-            expect_output --from="$layers" --substring "sha256:$sha" \
-                        "Locally-extracted SHA file is present in 'inspect'"
-        fi
+        expect_output --from="$inspect_local" --substring "sha256:$sha" \
+                      "Locally-extracted SHA file is present in 'inspect'"
     done
 
     # Simple sanity check on 'inspect' output.
@@ -117,15 +108,4 @@ END_EXPECT
                   "os - variant - architecture of $img"
 }
 
-@test "inspect: don't list tags" {
-    remote_image=docker://quay.io/fedora/fedora
-    # use --no-tags to not list any tags
-    run_skopeo inspect --no-tags $remote_image
-    inspect_output=$output
-    # extract the content of "RepoTags" property from the JSON output
-    repo_tags=$(jq '.RepoTags[]' <<<"$inspect_output")
-    # verify that the RepoTags was empty
-    expect_output --from="$repo_tags" "" "inspect --no-tags was expected to return empty RepoTags[]"
-}
-
 # vim: filetype=sh

systemtest/020-copy.bats

@@ -125,10 +125,6 @@ function setup() {
     run podman --root $TESTDIR/podmanroot images
     expect_output --substring "mine"
 
-    # rootless cleanup needs to be done with unshare due to subuids
-    if [[ "$(id -u)" != "0" ]]; then
-        run podman unshare rm -rf $TESTDIR/podmanroot
-    fi
 }
 
 # shared blob directory
@@ -148,16 +144,6 @@ function setup() {
     diff -urN $shareddir $dir2/blobs
 }
 
-@test "copy: sif image" {
-    type -path fakeroot || skip "'fakeroot' tool not available"
-
-    local localimg=dir:$TESTDIR/dir
-
-    run_skopeo copy sif:${TEST_SOURCE_DIR}/testdata/busybox_latest.sif $localimg
-    run_skopeo inspect $localimg --format "{{.Architecture}}"
-    expect_output "amd64"
-}
-
 teardown() {
     podman rm -f reg
 

systemtest/050-signing.bats

@@ -12,13 +12,6 @@ function setup() {
     export GNUPGHOME=$TESTDIR/skopeo-gpg
     mkdir --mode=0700 $GNUPGHOME
 
-    PASSPHRASE_FILE=$TESTDIR/passphrase-file
-    passphrase=$(random_string 20)
-    echo $passphrase > $PASSPHRASE_FILE
-
-    PASSPHRASE_FILE_WRONG=$TESTDIR/passphrase-file-wrong
-    echo $(random_string 10) > $PASSPHRASE_FILE_WRONG
-
     # gpg on f30 needs this, otherwise:
     #   gpg: agent_genkey failed: Inappropriate ioctl for device
     # ...but gpg on f29 (and, probably, Ubuntu) doesn't grok this
@@ -28,7 +21,7 @@ function setup() {
     fi
 
     for k in alice bob;do
-        gpg --batch $GPGOPTS --gen-key --passphrase $passphrase <<END_GPG
+        gpg --batch $GPGOPTS --gen-key --passphrase '' <<END_GPG
 Key-Type: RSA
 Name-Real: Test key - $k
 Name-email: $k@test.redhat.com
@@ -88,18 +81,8 @@ END_POLICY_JSON
     start_registry reg
 }
 
-function kill_gpg_agent {
-    # Kill the running gpg-agent to drop unlocked keys. This allows for testing
-    # handling of invalid passphrases.
-    run gpgconf --kill gpg-agent
-    if [ "$status" -ne 0 ]; then
-        die "could not restart gpg-agent: $output"
-    fi
-}
-
 @test "signing" {
-    kill_gpg_agent
-    run_skopeo '?' standalone-sign /dev/null busybox alice@test.redhat.com -o /dev/null --passphrase-file $PASSPHRASE_FILE
+    run_skopeo '?' standalone-sign /dev/null busybox alice@test.redhat.com -o /dev/null
     if [[ "$output" =~ 'signing is not supported' ]]; then
         skip "skopeo built without support for creating signatures"
         return 1
@@ -117,8 +100,7 @@ function kill_gpg_agent {
     while read path sig comments; do
         local sign_opt=
         if [[ $sig != '-' ]]; then
-            kill_gpg_agent
-            sign_opt=" --sign-passphrase-file=$PASSPHRASE_FILE --sign-by=${sig}@test.redhat.com"
+            sign_opt="--sign-by=${sig}@test.redhat.com"
         fi
         run_skopeo --registries.d $REGISTRIES_D \
                    copy --dest-tls-verify=false \
@@ -162,8 +144,7 @@ END_TESTS
 }
 
 @test "signing: remove signature" {
-    kill_gpg_agent
-    run_skopeo '?' standalone-sign /dev/null busybox alice@test.redhat.com -o /dev/null --passphrase-file $PASSPHRASE_FILE
+    run_skopeo '?' standalone-sign /dev/null busybox alice@test.redhat.com -o /dev/null
     if [[ "$output" =~ 'signing is not supported' ]]; then
         skip "skopeo built without support for creating signatures"
         return 1
@@ -176,24 +157,11 @@ END_TESTS
     run_skopeo copy docker://quay.io/libpod/busybox:latest \
                dir:$TESTDIR/busybox
     # Push a signed image
-    kill_gpg_agent
     run_skopeo --registries.d $REGISTRIES_D \
                copy --dest-tls-verify=false \
                --sign-by=alice@test.redhat.com \
-               --sign-passphrase-file $PASSPHRASE_FILE \
                dir:$TESTDIR/busybox \
                docker://localhost:5000/myns/alice:signed
-
-    # Wrong passphrase file
-    kill_gpg_agent
-    run_skopeo 1 --registries.d $REGISTRIES_D \
-               copy --dest-tls-verify=false \
-               --sign-by=alice@test.redhat.com \
-               --sign-passphrase-file $PASSPHRASE_FILE_WRONG \
-               dir:$TESTDIR/busybox \
-               docker://localhost:5000/myns/alice:signed
-    expect_output --substring "Bad passphrase"
-
     # Fetch the image with signature
     run_skopeo  --registries.d $REGISTRIES_D \
                 --policy $POLICY_JSON \
@@ -212,8 +180,7 @@ END_TESTS
 }
 
 @test "signing: standalone" {
-    kill_gpg_agent
-    run_skopeo '?' standalone-sign /dev/null busybox alice@test.redhat.com -o /dev/null --passphrase-file $PASSPHRASE_FILE
+    run_skopeo '?' standalone-sign /dev/null busybox alice@test.redhat.com -o /dev/null
     if [[ "$output" =~ 'signing is not supported' ]]; then
         skip "skopeo built without support for creating signatures"
         return 1
@@ -229,9 +196,7 @@ END_TESTS
                docker://localhost:5000/busybox:latest \
                dir:$TESTDIR/busybox
     # Standalone sign
-    kill_gpg_agent
     run_skopeo standalone-sign -o $TESTDIR/busybox.signature \
-               --passphrase-file $PASSPHRASE_FILE \
                $TESTDIR/busybox/manifest.json \
                localhost:5000/busybox:latest \
                alice@test.redhat.com

systemtest/070-list-tags.bats

@@ -1,28 +0,0 @@
-#!/usr/bin/env bats
-#
-# list-tags tests
-#
-
-load helpers
-
-# list from registry
-@test "list-tags: remote repository on a registry" {
-    local remote_image=quay.io/libpod/alpine_labels
-
-    run_skopeo list-tags "docker://${remote_image}"
-    expect_output --substring "quay.io/libpod/alpine_labels"
-    expect_output --substring "latest"
-}
-
-# list from a local docker-archive file
-@test "list-tags: from a docker-archive file" {
-    local file_name=${TEST_SOURCE_DIR}/testdata/docker-two-images.tar.xz
-
-    run_skopeo list-tags docker-archive:$file_name
-    expect_output --substring "example.com/empty:latest"
-    expect_output --substring "example.com/empty/but:different"
-
-}
-
-
-# vim: filetype=sh

systemtest/080-sync.bats

@@ -1,26 +0,0 @@
-#!/usr/bin/env bats
-#
-# Sync tests
-#
-
-load helpers
-
-function setup() {
-    standard_setup
-}
-
-@test "sync: --dry-run" {
-    local remote_image=quay.io/libpod/busybox:latest
-    local dir=$TESTDIR/dir
-
-    run_skopeo sync --dry-run --src docker --dest dir --scoped $remote_image $dir
-    expect_output --substring "Would have copied image"
-    expect_output --substring "from=\"docker://${remote_image}\" to=\"dir:${dir}/${remote_image}\""
-    expect_output --substring "Would have synced 1 images from 1 sources"
-}
-
-teardown() {
-    standard_teardown
-}
-
-# vim: filetype=sh

systemtest/helpers.bash

@@ -1,10 +1,6 @@
 #!/bin/bash
 
-# Directory containing system test sources
-TEST_SOURCE_DIR=${TEST_SOURCE_DIR:-$(dirname ${BASH_SOURCE})}
-
-# Skopeo executable
-SKOPEO_BINARY=${SKOPEO_BINARY:-${TEST_SOURCE_DIR}/../bin/skopeo}
+SKOPEO_BINARY=${SKOPEO_BINARY:-$(dirname ${BASH_SOURCE})/../skopeo}
 
 # Default timeout for a skopeo command.
 SKOPEO_TIMEOUT=${SKOPEO_TIMEOUT:-300}
@@ -360,10 +356,9 @@ start_registry() {
             return
         fi
 
-        timeout=$(( timeout - 1 ))
+        timeout=$(expr $timeout - 1)
         sleep 1
     done
-    log_and_run $PODMAN logs $name
     die "Timed out waiting for registry container to respond on :$port"
 }
 

vendor/github.com/BurntSushi/toml/README.md

@@ -1,6 +1,10 @@
+## TOML parser and encoder for Go with reflection
+
 TOML stands for Tom's Obvious, Minimal Language. This Go package provides a
 reflection interface similar to Go's standard library `json` and `xml`
-packages.
+packages. This package also supports the `encoding.TextUnmarshaler` and
+`encoding.TextMarshaler` interfaces so that you can define custom data
+representations. (There is an example of this below.)
 
 Compatible with TOML version [v1.0.0](https://toml.io/en/v1.0.0).
 
@@ -12,25 +16,26 @@ v0.4.0`).
 
 This library requires Go 1.13 or newer; install it with:
 
-    % go get github.com/BurntSushi/toml@latest
+    $ go get github.com/BurntSushi/toml
 
 It also comes with a TOML validator CLI tool:
 
-    % go install github.com/BurntSushi/toml/cmd/tomlv@latest
-    % tomlv some-toml-file.toml
+    $ go get github.com/BurntSushi/toml/cmd/tomlv
+    $ tomlv some-toml-file.toml
 
 ### Testing
-This package passes all tests in [toml-test] for both the decoder and the
-encoder.
 
-[toml-test]: https://github.com/BurntSushi/toml-test
+This package passes all tests in
+[toml-test](https://github.com/BurntSushi/toml-test) for both the decoder
+and the encoder.
 
 ### Examples
-This package works similar to how the Go standard library handles XML and JSON.
-Namely, data is loaded into Go values via reflection.
 
-For the simplest example, consider some TOML file as just a list of keys and
-values:
+This package works similarly to how the Go standard library handles XML and
+JSON. Namely, data is loaded into Go values via reflection.
+
+For the simplest example, consider some TOML file as just a list of keys
+and values:
 
 ```toml
 Age = 25
@@ -56,8 +61,9 @@ And then decoded with:
 
 ```go
 var conf Config
-_, err := toml.Decode(tomlData, &conf)
-// handle error
+if _, err := toml.Decode(tomlData, &conf); err != nil {
+  // handle error
+}
 ```
 
 You can also use struct tags if your struct field name doesn't map to a TOML
@@ -69,14 +75,15 @@ some_key_NAME = "wat"
 
 ```go
 type TOML struct {
-    ObscureKey string `toml:"some_key_NAME"`
+  ObscureKey string `toml:"some_key_NAME"`
 }
 ```
 
 Beware that like other most other decoders **only exported fields** are
 considered when encoding and decoding; private fields are silently ignored.
 
-### Using the `Marshaler` and `encoding.TextUnmarshaler` interfaces
+### Using the `encoding.TextUnmarshaler` interface
+
 Here's an example that automatically parses duration strings into
 `time.Duration` values:
 
@@ -129,6 +136,7 @@ To target TOML specifically you can implement `UnmarshalTOML` TOML interface in
 a similar way.
 
 ### More complex usage
+
 Here's an example of how to load the example from the official spec page:
 
 ```toml
@@ -208,4 +216,5 @@ type clients struct {
 Note that a case insensitive match will be tried if an exact match can't be
 found.
 
-A working example of the above can be found in `_example/example.{go,toml}`.
+A working example of the above can be found in `_examples/example.{go,toml}`.
+

vendor/github.com/BurntSushi/toml/decode.go

@@ -1,7 +1,6 @@
 package toml
 
 import (
-	"bytes"
 	"encoding"
 	"fmt"
 	"io"
@@ -10,6 +9,7 @@ import (
 	"os"
 	"reflect"
 	"strings"
+	"time"
 )
 
 // Unmarshaler is the interface implemented by objects that can unmarshal a
@@ -19,29 +19,11 @@ type Unmarshaler interface {
 }
 
 // Unmarshal decodes the contents of `p` in TOML format into a pointer `v`.
-func Unmarshal(data []byte, v interface{}) error {
-	_, err := NewDecoder(bytes.NewReader(data)).Decode(v)
+func Unmarshal(p []byte, v interface{}) error {
+	_, err := Decode(string(p), v)
 	return err
 }
 
-// Decode the TOML data in to the pointer v.
-//
-// See the documentation on Decoder for a description of the decoding process.
-func Decode(data string, v interface{}) (MetaData, error) {
-	return NewDecoder(strings.NewReader(data)).Decode(v)
-}
-
-// DecodeFile is just like Decode, except it will automatically read the
-// contents of the file at path and decode it for you.
-func DecodeFile(path string, v interface{}) (MetaData, error) {
-	fp, err := os.Open(path)
-	if err != nil {
-		return MetaData{}, err
-	}
-	defer fp.Close()
-	return NewDecoder(fp).Decode(v)
-}
-
 // Primitive is a TOML value that hasn't been decoded into a Go value.
 //
 // This type can be used for any value, which will cause decoding to be delayed.
@@ -58,12 +40,22 @@ type Primitive struct {
 	context   Key
 }
 
-// The significand precision for float32 and float64 is 24 and 53 bits; this is
-// the range a natural number can be stored in a float without loss of data.
-const (
-	maxSafeFloat32Int = 16777215                // 2^24-1
-	maxSafeFloat64Int = int64(9007199254740991) // 2^53-1
-)
+// PrimitiveDecode is just like the other `Decode*` functions, except it
+// decodes a TOML value that has already been parsed. Valid primitive values
+// can *only* be obtained from values filled by the decoder functions,
+// including this method. (i.e., `v` may contain more `Primitive`
+// values.)
+//
+// Meta data for primitive values is included in the meta data returned by
+// the `Decode*` functions with one exception: keys returned by the Undecoded
+// method will only reflect keys that were decoded. Namely, any keys hidden
+// behind a Primitive will be considered undecoded. Executing this method will
+// update the undecoded keys in the meta data. (See the example.)
+func (md *MetaData) PrimitiveDecode(primValue Primitive, v interface{}) error {
+	md.context = primValue.context
+	defer func() { md.context = nil }()
+	return md.unify(primValue.undecoded, rvalue(v))
+}
 
 // Decoder decodes TOML data.
 //
@@ -108,38 +100,18 @@ func NewDecoder(r io.Reader) *Decoder {
 	return &Decoder{r: r}
 }
 
-var (
-	unmarshalToml = reflect.TypeOf((*Unmarshaler)(nil)).Elem()
-	unmarshalText = reflect.TypeOf((*encoding.TextUnmarshaler)(nil)).Elem()
-)
-
 // Decode TOML data in to the pointer `v`.
 func (dec *Decoder) Decode(v interface{}) (MetaData, error) {
 	rv := reflect.ValueOf(v)
 	if rv.Kind() != reflect.Ptr {
-		s := "%q"
-		if reflect.TypeOf(v) == nil {
-			s = "%v"
-		}
-
-		return MetaData{}, e("cannot decode to non-pointer "+s, reflect.TypeOf(v))
+		return MetaData{}, e("Decode of non-pointer %s", reflect.TypeOf(v))
 	}
 	if rv.IsNil() {
-		return MetaData{}, e("cannot decode to nil value of %q", reflect.TypeOf(v))
+		return MetaData{}, e("Decode of nil %s", reflect.TypeOf(v))
 	}
 
-	// Check if this is a supported type: struct, map, interface{}, or something
-	// that implements UnmarshalTOML or UnmarshalText.
-	rv = indirect(rv)
-	rt := rv.Type()
-	if rv.Kind() != reflect.Struct && rv.Kind() != reflect.Map &&
-		!(rv.Kind() == reflect.Interface && rv.NumMethod() == 0) &&
-		!rt.Implements(unmarshalToml) && !rt.Implements(unmarshalText) {
-		return MetaData{}, e("cannot decode to type %s", rt)
-	}
-
-	// TODO: parser should read from io.Reader? Or at the very least, make it
-	// read from []byte rather than string
+	// TODO: have parser should read from io.Reader? Or at the very least, make
+	// it read from []byte rather than string
 	data, err := ioutil.ReadAll(dec.r)
 	if err != nil {
 		return MetaData{}, err
@@ -149,32 +121,29 @@ func (dec *Decoder) Decode(v interface{}) (MetaData, error) {
 	if err != nil {
 		return MetaData{}, err
 	}
-
 	md := MetaData{
-		mapping: p.mapping,
-		types:   p.types,
-		keys:    p.ordered,
-		decoded: make(map[string]struct{}, len(p.ordered)),
-		context: nil,
+		p.mapping, p.types, p.ordered,
+		make(map[string]bool, len(p.ordered)), nil,
 	}
-	return md, md.unify(p.mapping, rv)
+	return md, md.unify(p.mapping, indirect(rv))
 }
 
-// PrimitiveDecode is just like the other `Decode*` functions, except it
-// decodes a TOML value that has already been parsed. Valid primitive values
-// can *only* be obtained from values filled by the decoder functions,
-// including this method. (i.e., `v` may contain more `Primitive`
-// values.)
+// Decode the TOML data in to the pointer v.
 //
-// Meta data for primitive values is included in the meta data returned by
-// the `Decode*` functions with one exception: keys returned by the Undecoded
-// method will only reflect keys that were decoded. Namely, any keys hidden
-// behind a Primitive will be considered undecoded. Executing this method will
-// update the undecoded keys in the meta data. (See the example.)
-func (md *MetaData) PrimitiveDecode(primValue Primitive, v interface{}) error {
-	md.context = primValue.context
-	defer func() { md.context = nil }()
-	return md.unify(primValue.undecoded, rvalue(v))
+// See the documentation on Decoder for a description of the decoding process.
+func Decode(data string, v interface{}) (MetaData, error) {
+	return NewDecoder(strings.NewReader(data)).Decode(v)
+}
+
+// DecodeFile is just like Decode, except it will automatically read the
+// contents of the file at path and decode it for you.
+func DecodeFile(path string, v interface{}) (MetaData, error) {
+	fp, err := os.Open(path)
+	if err != nil {
+		return MetaData{}, err
+	}
+	defer fp.Close()
+	return NewDecoder(fp).Decode(v)
 }
 
 // unify performs a sort of type unification based on the structure of `rv`,
@@ -249,7 +218,9 @@ func (md *MetaData) unify(data interface{}, rv reflect.Value) error {
 			return e("unsupported type %s", rv.Type())
 		}
 		return md.unifyAnything(data, rv)
-	case reflect.Float32, reflect.Float64:
+	case reflect.Float32:
+		fallthrough
+	case reflect.Float64:
 		return md.unifyFloat64(data, rv)
 	}
 	return e("unsupported type %s", rv.Kind())
@@ -283,17 +254,17 @@ func (md *MetaData) unifyStruct(mapping interface{}, rv reflect.Value) error {
 			for _, i := range f.index {
 				subv = indirect(subv.Field(i))
 			}
-
 			if isUnifiable(subv) {
-				md.decoded[md.context.add(key).String()] = struct{}{}
+				md.decoded[md.context.add(key).String()] = true
 				md.context = append(md.context, key)
-				err := md.unify(datum, subv)
-				if err != nil {
+				if err := md.unify(datum, subv); err != nil {
 					return err
 				}
 				md.context = md.context[0 : len(md.context)-1]
 			} else if f.name != "" {
-				return e("cannot write unexported field %s.%s", rv.Type().String(), f.name)
+				// Bad user! No soup for you!
+				return e("cannot write unexported field %s.%s",
+					rv.Type().String(), f.name)
 			}
 		}
 	}
@@ -312,22 +283,22 @@ func (md *MetaData) unifyMap(mapping interface{}, rv reflect.Value) error {
 		if tmap == nil {
 			return nil
 		}
-		return md.badtype("map", mapping)
+		return badtype("map", mapping)
 	}
 	if rv.IsNil() {
 		rv.Set(reflect.MakeMap(rv.Type()))
 	}
 	for k, v := range tmap {
-		md.decoded[md.context.add(k).String()] = struct{}{}
+		md.decoded[md.context.add(k).String()] = true
 		md.context = append(md.context, k)
 
+		rvkey := indirect(reflect.New(rv.Type().Key()))
 		rvval := reflect.Indirect(reflect.New(rv.Type().Elem()))
 		if err := md.unify(v, rvval); err != nil {
 			return err
 		}
 		md.context = md.context[0 : len(md.context)-1]
 
-		rvkey := indirect(reflect.New(rv.Type().Key()))
 		rvkey.SetString(k)
 		rv.SetMapIndex(rvkey, rvval)
 	}
@@ -340,7 +311,7 @@ func (md *MetaData) unifyArray(data interface{}, rv reflect.Value) error {
 		if !datav.IsValid() {
 			return nil
 		}
-		return md.badtype("slice", data)
+		return badtype("slice", data)
 	}
 	if l := datav.Len(); l != rv.Len() {
 		return e("expected array length %d; got TOML array of length %d", rv.Len(), l)
@@ -354,7 +325,7 @@ func (md *MetaData) unifySlice(data interface{}, rv reflect.Value) error {
 		if !datav.IsValid() {
 			return nil
 		}
-		return md.badtype("slice", data)
+		return badtype("slice", data)
 	}
 	n := datav.Len()
 	if rv.IsNil() || rv.Cap() < n {
@@ -375,21 +346,26 @@ func (md *MetaData) unifySliceArray(data, rv reflect.Value) error {
 	return nil
 }
 
+func (md *MetaData) unifyDatetime(data interface{}, rv reflect.Value) error {
+	if _, ok := data.(time.Time); ok {
+		rv.Set(reflect.ValueOf(data))
+		return nil
+	}
+	return badtype("time.Time", data)
+}
+
 func (md *MetaData) unifyString(data interface{}, rv reflect.Value) error {
 	if s, ok := data.(string); ok {
 		rv.SetString(s)
 		return nil
 	}
-	return md.badtype("string", data)
+	return badtype("string", data)
 }
 
 func (md *MetaData) unifyFloat64(data interface{}, rv reflect.Value) error {
 	if num, ok := data.(float64); ok {
 		switch rv.Kind() {
 		case reflect.Float32:
-			if num < -math.MaxFloat32 || num > math.MaxFloat32 {
-				return e("value %f is out of range for float32", num)
-			}
 			fallthrough
 		case reflect.Float64:
 			rv.SetFloat(num)
@@ -398,26 +374,7 @@ func (md *MetaData) unifyFloat64(data interface{}, rv reflect.Value) error {
 		}
 		return nil
 	}
-
-	if num, ok := data.(int64); ok {
-		switch rv.Kind() {
-		case reflect.Float32:
-			if num < -maxSafeFloat32Int || num > maxSafeFloat32Int {
-				return e("value %d is out of range for float32", num)
-			}
-			fallthrough
-		case reflect.Float64:
-			if num < -maxSafeFloat64Int || num > maxSafeFloat64Int {
-				return e("value %d is out of range for float64", num)
-			}
-			rv.SetFloat(float64(num))
-		default:
-			panic("bug")
-		}
-		return nil
-	}
-
-	return md.badtype("float", data)
+	return badtype("float", data)
 }
 
 func (md *MetaData) unifyInt(data interface{}, rv reflect.Value) error {
@@ -464,7 +421,7 @@ func (md *MetaData) unifyInt(data interface{}, rv reflect.Value) error {
 		}
 		return nil
 	}
-	return md.badtype("integer", data)
+	return badtype("integer", data)
 }
 
 func (md *MetaData) unifyBool(data interface{}, rv reflect.Value) error {
@@ -472,7 +429,7 @@ func (md *MetaData) unifyBool(data interface{}, rv reflect.Value) error {
 		rv.SetBool(b)
 		return nil
 	}
-	return md.badtype("boolean", data)
+	return badtype("boolean", data)
 }
 
 func (md *MetaData) unifyAnything(data interface{}, rv reflect.Value) error {
@@ -483,12 +440,6 @@ func (md *MetaData) unifyAnything(data interface{}, rv reflect.Value) error {
 func (md *MetaData) unifyText(data interface{}, v encoding.TextUnmarshaler) error {
 	var s string
 	switch sdata := data.(type) {
-	case Marshaler:
-		text, err := sdata.MarshalTOML()
-		if err != nil {
-			return err
-		}
-		s = string(text)
 	case TextMarshaler:
 		text, err := sdata.MarshalText()
 		if err != nil {
@@ -506,7 +457,7 @@ func (md *MetaData) unifyText(data interface{}, v encoding.TextUnmarshaler) erro
 	case float64:
 		s = fmt.Sprintf("%f", sdata)
 	default:
-		return md.badtype("primitive (string-like)", data)
+		return badtype("primitive (string-like)", data)
 	}
 	if err := v.UnmarshalText([]byte(s)); err != nil {
 		return err
@@ -514,22 +465,17 @@ func (md *MetaData) unifyText(data interface{}, v encoding.TextUnmarshaler) erro
 	return nil
 }
 
-func (md *MetaData) badtype(dst string, data interface{}) error {
-	return e("incompatible types: TOML key %q has type %T; destination has type %s", md.context, data, dst)
-}
-
 // rvalue returns a reflect.Value of `v`. All pointers are resolved.
 func rvalue(v interface{}) reflect.Value {
 	return indirect(reflect.ValueOf(v))
 }
 
 // indirect returns the value pointed to by a pointer.
+// Pointers are followed until the value is not a pointer.
+// New values are allocated for each nil pointer.
 //
-// Pointers are followed until the value is not a pointer. New values are
-// allocated for each nil pointer.
-//
-// An exception to this rule is if the value satisfies an interface of interest
-// to us (like encoding.TextUnmarshaler).
+// An exception to this rule is if the value satisfies an interface of
+// interest to us (like encoding.TextUnmarshaler).
 func indirect(v reflect.Value) reflect.Value {
 	if v.Kind() != reflect.Ptr {
 		if v.CanSet() {
@@ -559,3 +505,7 @@ func isUnifiable(rv reflect.Value) bool {
 func e(format string, args ...interface{}) error {
 	return fmt.Errorf("toml: "+format, args...)
 }
+
+func badtype(expected string, data interface{}) error {
+	return e("cannot load TOML value of type %T into a Go %s", data, expected)
+}

vendor/github.com/BurntSushi/toml/decode_go116.go

@@ -1,4 +1,3 @@
-//go:build go1.16
 // +build go1.16
 
 package toml

vendor/github.com/BurntSushi/toml/decode_meta.go

@@ -1,39 +1,34 @@
 package toml
 
-import (
-	"strings"
-)
+import "strings"
 
-// MetaData allows access to meta information about TOML data that's not
-// accessible otherwise.
-//
-// It allows checking if a key is defined in the TOML data, whether any keys
-// were undecoded, and the TOML type of a key.
+// MetaData allows access to meta information about TOML data that may not be
+// inferable via reflection. In particular, whether a key has been defined and
+// the TOML type of a key.
 type MetaData struct {
-	context Key // Used only during decoding.
-
 	mapping map[string]interface{}
 	types   map[string]tomlType
 	keys    []Key
-	decoded map[string]struct{}
+	decoded map[string]bool
+	context Key // Used only during decoding.
 }
 
 // IsDefined reports if the key exists in the TOML data.
 //
 // The key should be specified hierarchically, for example to access the TOML
-// key "a.b.c" you would use IsDefined("a", "b", "c"). Keys are case sensitive.
+// key "a.b.c" you would use:
 //
-// Returns false for an empty key.
+//	IsDefined("a", "b", "c")
+//
+// IsDefined will return false if an empty key given. Keys are case sensitive.
 func (md *MetaData) IsDefined(key ...string) bool {
 	if len(key) == 0 {
 		return false
 	}
 
-	var (
-		hash      map[string]interface{}
-		ok        bool
-		hashOrVal interface{} = md.mapping
-	)
+	var hash map[string]interface{}
+	var ok bool
+	var hashOrVal interface{} = md.mapping
 	for _, k := range key {
 		if hash, ok = hashOrVal.(map[string]interface{}); !ok {
 			return false
@@ -50,12 +45,51 @@ func (md *MetaData) IsDefined(key ...string) bool {
 // Type will return the empty string if given an empty key or a key that does
 // not exist. Keys are case sensitive.
 func (md *MetaData) Type(key ...string) string {
-	if typ, ok := md.types[Key(key).String()]; ok {
+	fullkey := strings.Join(key, ".")
+	if typ, ok := md.types[fullkey]; ok {
 		return typ.typeString()
 	}
 	return ""
 }
 
+// Key represents any TOML key, including key groups. Use (MetaData).Keys to get
+// values of this type.
+type Key []string
+
+func (k Key) String() string { return strings.Join(k, ".") }
+
+func (k Key) maybeQuotedAll() string {
+	var ss []string
+	for i := range k {
+		ss = append(ss, k.maybeQuoted(i))
+	}
+	return strings.Join(ss, ".")
+}
+
+func (k Key) maybeQuoted(i int) string {
+	if k[i] == "" {
+		return `""`
+	}
+	quote := false
+	for _, c := range k[i] {
+		if !isBareKeyChar(c) {
+			quote = true
+			break
+		}
+	}
+	if quote {
+		return `"` + quotedReplacer.Replace(k[i]) + `"`
+	}
+	return k[i]
+}
+
+func (k Key) add(piece string) Key {
+	newKey := make(Key, len(k)+1)
+	copy(newKey, k)
+	newKey[len(k)] = piece
+	return newKey
+}
+
 // Keys returns a slice of every key in the TOML data, including key groups.
 //
 // Each key is itself a slice, where the first element is the top of the
@@ -81,40 +115,9 @@ func (md *MetaData) Keys() []Key {
 func (md *MetaData) Undecoded() []Key {
 	undecoded := make([]Key, 0, len(md.keys))
 	for _, key := range md.keys {
-		if _, ok := md.decoded[key.String()]; !ok {
+		if !md.decoded[key.String()] {
 			undecoded = append(undecoded, key)
 		}
 	}
 	return undecoded
 }
-
-// Key represents any TOML key, including key groups. Use (MetaData).Keys to get
-// values of this type.
-type Key []string
-
-func (k Key) String() string {
-	ss := make([]string, len(k))
-	for i := range k {
-		ss[i] = k.maybeQuoted(i)
-	}
-	return strings.Join(ss, ".")
-}
-
-func (k Key) maybeQuoted(i int) string {
-	if k[i] == "" {
-		return `""`
-	}
-	for _, c := range k[i] {
-		if !isBareKeyChar(c) {
-			return `"` + dblQuotedReplacer.Replace(k[i]) + `"`
-		}
-	}
-	return k[i]
-}
-
-func (k Key) add(piece string) Key {
-	newKey := make(Key, len(k)+1)
-	copy(newKey, k)
-	newKey[len(k)] = piece
-	return newKey
-}

vendor/github.com/BurntSushi/toml/deprecated.go

@@ -5,17 +5,29 @@ import (
 	"io"
 )
 
-// Deprecated: use encoding.TextMarshaler
+// DEPRECATED!
+//
+// Use the identical encoding.TextMarshaler instead. It is defined here to
+// support Go 1.1 and older.
 type TextMarshaler encoding.TextMarshaler
 
-// Deprecated: use encoding.TextUnmarshaler
+// DEPRECATED!
+//
+// Use the identical encoding.TextUnmarshaler instead. It is defined here to
+// support Go 1.1 and older.
 type TextUnmarshaler encoding.TextUnmarshaler
 
-// Deprecated: use MetaData.PrimitiveDecode.
+// DEPRECATED!
+//
+// Use MetaData.PrimitiveDecode instead.
 func PrimitiveDecode(primValue Primitive, v interface{}) error {
-	md := MetaData{decoded: make(map[string]struct{})}
+	md := MetaData{decoded: make(map[string]bool)}
 	return md.unify(primValue.undecoded, rvalue(v))
 }
 
-// Deprecated: use NewDecoder(reader).Decode(&value).
-func DecodeReader(r io.Reader, v interface{}) (MetaData, error) { return NewDecoder(r).Decode(v) }
+// DEPRECATED!
+//
+// Use NewDecoder(reader).Decode(&v) instead.
+func DecodeReader(r io.Reader, v interface{}) (MetaData, error) {
+	return NewDecoder(r).Decode(v)
+}

vendor/github.com/BurntSushi/toml/encode.go

@@ -21,11 +21,12 @@ type tomlEncodeError struct{ error }
 var (
 	errArrayNilElement = errors.New("toml: cannot encode array with nil element")
 	errNonString       = errors.New("toml: cannot encode a map with non-string key type")
+	errAnonNonStruct   = errors.New("toml: cannot encode an anonymous field that is not a struct")
 	errNoKey           = errors.New("toml: top-level values must be Go maps or structs")
 	errAnything        = errors.New("") // used in testing
 )
 
-var dblQuotedReplacer = strings.NewReplacer(
+var quotedReplacer = strings.NewReplacer(
 	"\"", "\\\"",
 	"\\", "\\\\",
 	"\x00", `\u0000`,
@@ -63,22 +64,13 @@ var dblQuotedReplacer = strings.NewReplacer(
 	"\x7f", `\u007f`,
 )
 
-// Marshaler is the interface implemented by types that can marshal themselves
-// into valid TOML.
-type Marshaler interface {
-	MarshalTOML() ([]byte, error)
-}
-
 // Encoder encodes a Go to a TOML document.
 //
 // The mapping between Go values and TOML values should be precisely the same as
-// for the Decode* functions.
-//
-// The toml.Marshaler and encoder.TextMarshaler interfaces are supported to
-// encoding the value as custom TOML.
-//
-// If you want to write arbitrary binary data then you will need to use
-// something like base64 since TOML does not have any binary types.
+// for the Decode* functions. Similarly, the TextMarshaler interface is
+// supported by encoding the resulting bytes as strings. If you want to write
+// arbitrary binary data then you will need to use something like base64 since
+// TOML does not have any binary types.
 //
 // When encoding TOML hashes (Go maps or structs), keys without any sub-hashes
 // are encoded first.
@@ -91,14 +83,16 @@ type Marshaler interface {
 // structs. (e.g. [][]map[string]string is not allowed but []map[string]string
 // is okay, as is []map[string][]string).
 //
-// NOTE: only exported keys are encoded due to the use of reflection. Unexported
+// NOTE: Only exported keys are encoded due to the use of reflection. Unexported
 // keys are silently discarded.
 type Encoder struct {
-	// String to use for a single indentation level; default is two spaces.
+	// The string to use for a single indentation level. The default is two
+	// spaces.
 	Indent string
 
+	// hasWritten is whether we have written any output to w yet.
+	hasWritten bool
 	w          *bufio.Writer
-	hasWritten bool // written any output to w yet?
 }
 
 // NewEncoder create a new Encoder.
@@ -136,13 +130,12 @@ func (enc *Encoder) safeEncode(key Key, rv reflect.Value) (err error) {
 }
 
 func (enc *Encoder) encode(key Key, rv reflect.Value) {
-	// Special case: time needs to be in ISO8601 format.
-	//
-	// Special case: if we can marshal the type to text, then we used that. This
-	// prevents the encoder for handling these types as generic structs (or
-	// whatever the underlying type of a TextMarshaler is).
+	// Special case. Time needs to be in ISO8601 format.
+	// Special case. If we can marshal the type to text, then we used that.
+	// Basically, this prevents the encoder for handling these types as
+	// generic structs (or whatever the underlying type of a TextMarshaler is).
 	switch t := rv.Interface().(type) {
-	case time.Time, encoding.TextMarshaler, Marshaler:
+	case time.Time, encoding.TextMarshaler:
 		enc.writeKeyValue(key, rv, false)
 		return
 	// TODO: #76 would make this superfluous after implemented.
@@ -207,19 +200,13 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 			enc.wf(v.In(time.UTC).Format(format))
 		}
 		return
-	case Marshaler:
-		s, err := v.MarshalTOML()
-		if err != nil {
-			encPanic(err)
-		}
-		enc.w.Write(s)
-		return
 	case encoding.TextMarshaler:
-		s, err := v.MarshalText()
-		if err != nil {
+		// Use text marshaler if it's available for this value.
+		if s, err := v.MarshalText(); err != nil {
 			encPanic(err)
+		} else {
+			enc.writeQuoted(string(s))
 		}
-		enc.writeQuoted(string(s))
 		return
 	}
 
@@ -273,7 +260,7 @@ func floatAddDecimal(fstr string) string {
 }
 
 func (enc *Encoder) writeQuoted(s string) {
-	enc.wf("\"%s\"", dblQuotedReplacer.Replace(s))
+	enc.wf("\"%s\"", quotedReplacer.Replace(s))
 }
 
 func (enc *Encoder) eArrayOrSliceElement(rv reflect.Value) {
@@ -299,7 +286,7 @@ func (enc *Encoder) eArrayOfTables(key Key, rv reflect.Value) {
 			continue
 		}
 		enc.newline()
-		enc.wf("%s[[%s]]", enc.indentStr(key), key)
+		enc.wf("%s[[%s]]", enc.indentStr(key), key.maybeQuotedAll())
 		enc.newline()
 		enc.eMapOrStruct(key, trv, false)
 	}
@@ -312,7 +299,7 @@ func (enc *Encoder) eTable(key Key, rv reflect.Value) {
 		enc.newline()
 	}
 	if len(key) > 0 {
-		enc.wf("%s[%s]", enc.indentStr(key), key)
+		enc.wf("%s[%s]", enc.indentStr(key), key.maybeQuotedAll())
 		enc.newline()
 	}
 	enc.eMapOrStruct(key, rv, false)
@@ -341,7 +328,7 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 	var mapKeysDirect, mapKeysSub []string
 	for _, mapKey := range rv.MapKeys() {
 		k := mapKey.String()
-		if typeIsTable(tomlTypeOfGo(rv.MapIndex(mapKey))) {
+		if typeIsHash(tomlTypeOfGo(rv.MapIndex(mapKey))) {
 			mapKeysSub = append(mapKeysSub, k)
 		} else {
 			mapKeysDirect = append(mapKeysDirect, k)
@@ -377,8 +364,6 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 	}
 }
 
-const is32Bit = (32 << (^uint(0) >> 63)) == 32
-
 func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	// Write keys for fields directly under this key first, because if we write
 	// a field that creates a new table then all keys under it will be in that
@@ -398,10 +383,6 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 			if f.PkgPath != "" && !f.Anonymous { /// Skip unexported fields.
 				continue
 			}
-			opts := getOptions(f.Tag)
-			if opts.skip {
-				continue
-			}
 
 			frv := rv.Field(i)
 
@@ -427,20 +408,10 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 				}
 			}
 
-			if typeIsTable(tomlTypeOfGo(frv)) {
+			if typeIsHash(tomlTypeOfGo(frv)) {
 				fieldsSub = append(fieldsSub, append(start, f.Index...))
 			} else {
-				// Copy so it works correct on 32bit archs; not clear why this
-				// is needed. See #314, and https://www.reddit.com/r/golang/comments/pnx8v4
-				// This also works fine on 64bit, but 32bit archs are somewhat
-				// rare and this is a wee bit faster.
-				if is32Bit {
-					copyStart := make([]int, len(start))
-					copy(copyStart, start)
-					fieldsDirect = append(fieldsDirect, append(copyStart, f.Index...))
-				} else {
-					fieldsDirect = append(fieldsDirect, append(start, f.Index...))
-				}
+				fieldsDirect = append(fieldsDirect, append(start, f.Index...))
 			}
 		}
 	}
@@ -491,13 +462,13 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	}
 }
 
-// tomlTypeOfGo returns the TOML type name of the Go value's type.
-//
-// It is used to determine whether the types of array elements are mixed (which
-// is forbidden). If the Go value is nil, then it is illegal for it to be an
-// array element, and valueIsNil is returned as true.
-//
-// The type may be `nil`, which means no concrete TOML type could be found.
+// tomlTypeName returns the TOML type name of the Go value's type. It is
+// used to determine whether the types of array elements are mixed (which is
+// forbidden). If the Go value is nil, then it is illegal for it to be an array
+// element, and valueIsNil is returned as true.
+
+// Returns the TOML type of a Go value. The type may be `nil`, which means
+// no concrete TOML type could be found.
 func tomlTypeOfGo(rv reflect.Value) tomlType {
 	if isNil(rv) || !rv.IsValid() {
 		return nil
@@ -524,43 +495,32 @@ func tomlTypeOfGo(rv reflect.Value) tomlType {
 	case reflect.Map:
 		return tomlHash
 	case reflect.Struct:
-		if _, ok := rv.Interface().(time.Time); ok {
+		switch rv.Interface().(type) {
+		case time.Time:
 			return tomlDatetime
-		}
-		if isMarshaler(rv) {
+		case encoding.TextMarshaler:
 			return tomlString
+		default:
+			// Someone used a pointer receiver: we can make it work for pointer
+			// values.
+			if rv.CanAddr() {
+				_, ok := rv.Addr().Interface().(encoding.TextMarshaler)
+				if ok {
+					return tomlString
+				}
+			}
+			return tomlHash
 		}
-		return tomlHash
 	default:
-		if isMarshaler(rv) {
+		_, ok := rv.Interface().(encoding.TextMarshaler)
+		if ok {
 			return tomlString
 		}
-
 		encPanic(errors.New("unsupported type: " + rv.Kind().String()))
-		panic("unreachable")
+		panic("") // Need *some* return value
 	}
 }
 
-func isMarshaler(rv reflect.Value) bool {
-	switch rv.Interface().(type) {
-	case encoding.TextMarshaler:
-		return true
-	case Marshaler:
-		return true
-	}
-
-	// Someone used a pointer receiver: we can make it work for pointer values.
-	if rv.CanAddr() {
-		if _, ok := rv.Addr().Interface().(encoding.TextMarshaler); ok {
-			return true
-		}
-		if _, ok := rv.Addr().Interface().(Marshaler); ok {
-			return true
-		}
-	}
-	return false
-}
-
 // tomlArrayType returns the element type of a TOML array. The type returned
 // may be nil if it cannot be determined (e.g., a nil slice or a zero length
 // slize). This function may also panic if it finds a type that cannot be
@@ -644,14 +604,7 @@ func (enc *Encoder) newline() {
 //
 //   key = <any value>
 //
-// This is also used for "k = v" in inline tables; so something like this will
-// be written in three calls:
-//
-//     ┌────────────────────┐
-//     │      ┌───┐  ┌─────┐│
-//     v      v   v  v     vv
-//     key = {k = v, k2 = v2}
-//
+// If inline is true it won't add a newline at the end.
 func (enc *Encoder) writeKeyValue(key Key, val reflect.Value, inline bool) {
 	if len(key) == 0 {
 		encPanic(errNoKey)
@@ -664,8 +617,7 @@ func (enc *Encoder) writeKeyValue(key Key, val reflect.Value, inline bool) {
 }
 
 func (enc *Encoder) wf(format string, v ...interface{}) {
-	_, err := fmt.Fprintf(enc.w, format, v...)
-	if err != nil {
+	if _, err := fmt.Fprintf(enc.w, format, v...); err != nil {
 		encPanic(err)
 	}
 	enc.hasWritten = true

vendor/github.com/BurntSushi/toml/error.go

@@ -1,229 +0,0 @@
-package toml
-
-import (
-	"fmt"
-	"strings"
-)
-
-// ParseError is returned when there is an error parsing the TOML syntax.
-//
-// For example invalid syntax, duplicate keys, etc.
-//
-// In addition to the error message itself, you can also print detailed location
-// information with context by using ErrorWithPosition():
-//
-//     toml: error: Key 'fruit' was already created and cannot be used as an array.
-//
-//     At line 4, column 2-7:
-//
-//           2 | fruit = []
-//           3 |
-//           4 | [[fruit]] # Not allowed
-//                 ^^^^^
-//
-// Furthermore, the ErrorWithUsage() can be used to print the above with some
-// more detailed usage guidance:
-//
-//    toml: error: newlines not allowed within inline tables
-//
-//    At line 1, column 18:
-//
-//          1 | x = [{ key = 42 #
-//                               ^
-//
-//    Error help:
-//
-//      Inline tables must always be on a single line:
-//
-//          table = {key = 42, second = 43}
-//
-//      It is invalid to split them over multiple lines like so:
-//
-//          # INVALID
-//          table = {
-//              key    = 42,
-//              second = 43
-//          }
-//
-//      Use regular for this:
-//
-//          [table]
-//          key    = 42
-//          second = 43
-type ParseError struct {
-	Message  string   // Short technical message.
-	Usage    string   // Longer message with usage guidance; may be blank.
-	Position Position // Position of the error
-	LastKey  string   // Last parsed key, may be blank.
-	Line     int      // Line the error occurred. Deprecated: use Position.
-
-	err   error
-	input string
-}
-
-// Position of an error.
-type Position struct {
-	Line  int // Line number, starting at 1.
-	Start int // Start of error, as byte offset starting at 0.
-	Len   int // Lenght in bytes.
-}
-
-func (pe ParseError) Error() string {
-	msg := pe.Message
-	if msg == "" { // Error from errorf()
-		msg = pe.err.Error()
-	}
-
-	if pe.LastKey == "" {
-		return fmt.Sprintf("toml: line %d: %s", pe.Position.Line, msg)
-	}
-	return fmt.Sprintf("toml: line %d (last key %q): %s",
-		pe.Position.Line, pe.LastKey, msg)
-}
-
-// ErrorWithUsage() returns the error with detailed location context.
-//
-// See the documentation on ParseError.
-func (pe ParseError) ErrorWithPosition() string {
-	if pe.input == "" { // Should never happen, but just in case.
-		return pe.Error()
-	}
-
-	var (
-		lines = strings.Split(pe.input, "\n")
-		col   = pe.column(lines)
-		b     = new(strings.Builder)
-	)
-
-	msg := pe.Message
-	if msg == "" {
-		msg = pe.err.Error()
-	}
-
-	// TODO: don't show control characters as literals? This may not show up
-	// well everywhere.
-
-	if pe.Position.Len == 1 {
-		fmt.Fprintf(b, "toml: error: %s\n\nAt line %d, column %d:\n\n",
-			msg, pe.Position.Line, col+1)
-	} else {
-		fmt.Fprintf(b, "toml: error: %s\n\nAt line %d, column %d-%d:\n\n",
-			msg, pe.Position.Line, col, col+pe.Position.Len)
-	}
-	if pe.Position.Line > 2 {
-		fmt.Fprintf(b, "% 7d | %s\n", pe.Position.Line-2, lines[pe.Position.Line-3])
-	}
-	if pe.Position.Line > 1 {
-		fmt.Fprintf(b, "% 7d | %s\n", pe.Position.Line-1, lines[pe.Position.Line-2])
-	}
-	fmt.Fprintf(b, "% 7d | %s\n", pe.Position.Line, lines[pe.Position.Line-1])
-	fmt.Fprintf(b, "% 10s%s%s\n", "", strings.Repeat(" ", col), strings.Repeat("^", pe.Position.Len))
-	return b.String()
-}
-
-// ErrorWithUsage() returns the error with detailed location context and usage
-// guidance.
-//
-// See the documentation on ParseError.
-func (pe ParseError) ErrorWithUsage() string {
-	m := pe.ErrorWithPosition()
-	if u, ok := pe.err.(interface{ Usage() string }); ok && u.Usage() != "" {
-		return m + "Error help:\n\n    " +
-			strings.ReplaceAll(strings.TrimSpace(u.Usage()), "\n", "\n    ") +
-			"\n"
-	}
-	return m
-}
-
-func (pe ParseError) column(lines []string) int {
-	var pos, col int
-	for i := range lines {
-		ll := len(lines[i]) + 1 // +1 for the removed newline
-		if pos+ll >= pe.Position.Start {
-			col = pe.Position.Start - pos
-			if col < 0 { // Should never happen, but just in case.
-				col = 0
-			}
-			break
-		}
-		pos += ll
-	}
-
-	return col
-}
-
-type (
-	errLexControl       struct{ r rune }
-	errLexEscape        struct{ r rune }
-	errLexUTF8          struct{ b byte }
-	errLexInvalidNum    struct{ v string }
-	errLexInvalidDate   struct{ v string }
-	errLexInlineTableNL struct{}
-	errLexStringNL      struct{}
-)
-
-func (e errLexControl) Error() string {
-	return fmt.Sprintf("TOML files cannot contain control characters: '0x%02x'", e.r)
-}
-func (e errLexControl) Usage() string { return "" }
-
-func (e errLexEscape) Error() string        { return fmt.Sprintf(`invalid escape in string '\%c'`, e.r) }
-func (e errLexEscape) Usage() string        { return usageEscape }
-func (e errLexUTF8) Error() string          { return fmt.Sprintf("invalid UTF-8 byte: 0x%02x", e.b) }
-func (e errLexUTF8) Usage() string          { return "" }
-func (e errLexInvalidNum) Error() string    { return fmt.Sprintf("invalid number: %q", e.v) }
-func (e errLexInvalidNum) Usage() string    { return "" }
-func (e errLexInvalidDate) Error() string   { return fmt.Sprintf("invalid date: %q", e.v) }
-func (e errLexInvalidDate) Usage() string   { return "" }
-func (e errLexInlineTableNL) Error() string { return "newlines not allowed within inline tables" }
-func (e errLexInlineTableNL) Usage() string { return usageInlineNewline }
-func (e errLexStringNL) Error() string      { return "strings cannot contain newlines" }
-func (e errLexStringNL) Usage() string      { return usageStringNewline }
-
-const usageEscape = `
-A '\' inside a "-delimited string is interpreted as an escape character.
-
-The following escape sequences are supported:
-\b, \t, \n, \f, \r, \", \\, \uXXXX, and \UXXXXXXXX
-
-To prevent a '\' from being recognized as an escape character, use either:
-
-- a ' or '''-delimited string; escape characters aren't processed in them; or
-- write two backslashes to get a single backslash: '\\'.
-
-If you're trying to add a Windows path (e.g. "C:\Users\martin") then using '/'
-instead of '\' will usually also work: "C:/Users/martin".
-`
-
-const usageInlineNewline = `
-Inline tables must always be on a single line:
-
-    table = {key = 42, second = 43}
-
-It is invalid to split them over multiple lines like so:
-
-    # INVALID
-    table = {
-        key    = 42,
-        second = 43
-    }
-
-Use regular for this:
-
-    [table]
-    key    = 42
-    second = 43
-`
-
-const usageStringNewline = `
-Strings must always be on a single line, and cannot span more than one line:
-
-    # INVALID
-    string = "Hello,
-    world!"
-
-Instead use """ or ''' to split strings over multiple lines:
-
-    string = """Hello,
-    world!"""
-`

vendor/github.com/BurntSushi/toml/lex.go

@@ -37,14 +37,28 @@ const (
 	itemInlineTableEnd
 )
 
-const eof = 0
+const (
+	eof              = 0
+	comma            = ','
+	tableStart       = '['
+	tableEnd         = ']'
+	arrayTableStart  = '['
+	arrayTableEnd    = ']'
+	tableSep         = '.'
+	keySep           = '='
+	arrayStart       = '['
+	arrayEnd         = ']'
+	commentStart     = '#'
+	stringStart      = '"'
+	stringEnd        = '"'
+	rawStringStart   = '\''
+	rawStringEnd     = '\''
+	inlineTableStart = '{'
+	inlineTableEnd   = '}'
+)
 
 type stateFn func(lx *lexer) stateFn
 
-func (p Position) String() string {
-	return fmt.Sprintf("at line %d; start %d; length %d", p.Line, p.Start, p.Len)
-}
-
 type lexer struct {
 	input string
 	start int
@@ -53,26 +67,26 @@ type lexer struct {
 	state stateFn
 	items chan item
 
-	// Allow for backing up up to 4 runes. This is necessary because TOML
-	// contains 3-rune tokens (""" and ''').
+	// Allow for backing up up to four runes.
+	// This is necessary because TOML contains 3-rune tokens (""" and ''').
 	prevWidths [4]int
-	nprev      int  // how many of prevWidths are in use
-	atEOF      bool // If we emit an eof, we can still back up, but it is not OK to call next again.
+	nprev      int // how many of prevWidths are in use
+	// If we emit an eof, we can still back up, but it is not OK to call
+	// next again.
+	atEOF bool
 
 	// A stack of state functions used to maintain context.
-	//
-	// The idea is to reuse parts of the state machine in various places. For
-	// example, values can appear at the top level or within arbitrarily nested
-	// arrays. The last state on the stack is used after a value has been lexed.
-	// Similarly for comments.
+	// The idea is to reuse parts of the state machine in various places.
+	// For example, values can appear at the top level or within arbitrarily
+	// nested arrays. The last state on the stack is used after a value has
+	// been lexed. Similarly for comments.
 	stack []stateFn
 }
 
 type item struct {
-	typ itemType
-	val string
-	err error
-	pos Position
+	typ  itemType
+	val  string
+	line int
 }
 
 func (lx *lexer) nextItem() item {
@@ -82,7 +96,7 @@ func (lx *lexer) nextItem() item {
 			return item
 		default:
 			lx.state = lx.state(lx)
-			//fmt.Printf("     STATE %-24s  current: %-10q	stack: %s\n", lx.state, lx.current(), lx.stack)
+			//fmt.Printf("     STATE %-24s   current: %-10q   stack: %s\n", lx.state, lx.current(), lx.stack)
 		}
 	}
 }
@@ -91,9 +105,9 @@ func lex(input string) *lexer {
 	lx := &lexer{
 		input: input,
 		state: lexTop,
+		line:  1,
 		items: make(chan item, 10),
 		stack: make([]stateFn, 0, 10),
-		line:  1,
 	}
 	return lx
 }
@@ -115,30 +129,13 @@ func (lx *lexer) current() string {
 	return lx.input[lx.start:lx.pos]
 }
 
-func (lx lexer) getPos() Position {
-	p := Position{
-		Line:  lx.line,
-		Start: lx.start,
-		Len:   lx.pos - lx.start,
-	}
-	if p.Len <= 0 {
-		p.Len = 1
-	}
-	return p
-}
-
 func (lx *lexer) emit(typ itemType) {
-	// Needed for multiline strings ending with an incomplete UTF-8 sequence.
-	if lx.start > lx.pos {
-		lx.error(errLexUTF8{lx.input[lx.pos]})
-		return
-	}
-	lx.items <- item{typ: typ, pos: lx.getPos(), val: lx.current()}
+	lx.items <- item{typ, lx.current(), lx.line}
 	lx.start = lx.pos
 }
 
 func (lx *lexer) emitTrim(typ itemType) {
-	lx.items <- item{typ: typ, pos: lx.getPos(), val: strings.TrimSpace(lx.current())}
+	lx.items <- item{typ, strings.TrimSpace(lx.current()), lx.line}
 	lx.start = lx.pos
 }
 
@@ -163,13 +160,7 @@ func (lx *lexer) next() (r rune) {
 
 	r, w := utf8.DecodeRuneInString(lx.input[lx.pos:])
 	if r == utf8.RuneError {
-		lx.error(errLexUTF8{lx.input[lx.pos]})
-		return utf8.RuneError
-	}
-
-	// Note: don't use peek() here, as this calls next().
-	if isControl(r) || (r == '\r' && (len(lx.input)-1 == lx.pos || lx.input[lx.pos+1] != '\n')) {
-		lx.errorControlChar(r)
+		lx.errorf("invalid UTF-8 byte at position %d (line %d): 0x%02x", lx.pos, lx.line, lx.input[lx.pos])
 		return utf8.RuneError
 	}
 
@@ -197,7 +188,6 @@ func (lx *lexer) backup() {
 	lx.prevWidths[1] = lx.prevWidths[2]
 	lx.prevWidths[2] = lx.prevWidths[3]
 	lx.nprev--
-
 	lx.pos -= w
 	if lx.pos < len(lx.input) && lx.input[lx.pos] == '\n' {
 		lx.line--
@@ -233,58 +223,18 @@ func (lx *lexer) skip(pred func(rune) bool) {
 	}
 }
 
-// error stops all lexing by emitting an error and returning `nil`.
-//
+// errorf stops all lexing by emitting an error and returning `nil`.
 // Note that any value that is a character is escaped if it's a special
 // character (newlines, tabs, etc.).
-func (lx *lexer) error(err error) stateFn {
-	if lx.atEOF {
-		return lx.errorPrevLine(err)
-	}
-	lx.items <- item{typ: itemError, pos: lx.getPos(), err: err}
-	return nil
-}
-
-// errorfPrevline is like error(), but sets the position to the last column of
-// the previous line.
-//
-// This is so that unexpected EOF or NL errors don't show on a new blank line.
-func (lx *lexer) errorPrevLine(err error) stateFn {
-	pos := lx.getPos()
-	pos.Line--
-	pos.Len = 1
-	pos.Start = lx.pos - 1
-	lx.items <- item{typ: itemError, pos: pos, err: err}
-	return nil
-}
-
-// errorPos is like error(), but allows explicitly setting the position.
-func (lx *lexer) errorPos(start, length int, err error) stateFn {
-	pos := lx.getPos()
-	pos.Start = start
-	pos.Len = length
-	lx.items <- item{typ: itemError, pos: pos, err: err}
-	return nil
-}
-
-// errorf is like error, and creates a new error.
 func (lx *lexer) errorf(format string, values ...interface{}) stateFn {
-	if lx.atEOF {
-		pos := lx.getPos()
-		pos.Line--
-		pos.Len = 1
-		pos.Start = lx.pos - 1
-		lx.items <- item{typ: itemError, pos: pos, err: fmt.Errorf(format, values...)}
-		return nil
+	lx.items <- item{
+		itemError,
+		fmt.Sprintf(format, values...),
+		lx.line,
 	}
-	lx.items <- item{typ: itemError, pos: lx.getPos(), err: fmt.Errorf(format, values...)}
 	return nil
 }
 
-func (lx *lexer) errorControlChar(cc rune) stateFn {
-	return lx.errorPos(lx.pos-1, 1, errLexControl{cc})
-}
-
 // lexTop consumes elements at the top level of TOML data.
 func lexTop(lx *lexer) stateFn {
 	r := lx.next()
@@ -292,10 +242,10 @@ func lexTop(lx *lexer) stateFn {
 		return lexSkip(lx, lexTop)
 	}
 	switch r {
-	case '#':
+	case commentStart:
 		lx.push(lexTop)
 		return lexCommentStart
-	case '[':
+	case tableStart:
 		return lexTableStart
 	case eof:
 		if lx.pos > lx.start {
@@ -318,7 +268,7 @@ func lexTop(lx *lexer) stateFn {
 func lexTopEnd(lx *lexer) stateFn {
 	r := lx.next()
 	switch {
-	case r == '#':
+	case r == commentStart:
 		// a comment will read to a newline for us.
 		lx.push(lexTop)
 		return lexCommentStart
@@ -342,7 +292,7 @@ func lexTopEnd(lx *lexer) stateFn {
 // It also handles the case that this is an item in an array of tables.
 // e.g., '[[name]]'.
 func lexTableStart(lx *lexer) stateFn {
-	if lx.peek() == '[' {
+	if lx.peek() == arrayTableStart {
 		lx.next()
 		lx.emit(itemArrayTableStart)
 		lx.push(lexArrayTableEnd)
@@ -359,8 +309,10 @@ func lexTableEnd(lx *lexer) stateFn {
 }
 
 func lexArrayTableEnd(lx *lexer) stateFn {
-	if r := lx.next(); r != ']' {
-		return lx.errorf("expected end of table array name delimiter ']', but got %q instead", r)
+	if r := lx.next(); r != arrayTableEnd {
+		return lx.errorf(
+			"expected end of table array name delimiter %q, but got %q instead",
+			arrayTableEnd, r)
 	}
 	lx.emit(itemArrayTableEnd)
 	return lexTopEnd
@@ -369,11 +321,11 @@ func lexArrayTableEnd(lx *lexer) stateFn {
 func lexTableNameStart(lx *lexer) stateFn {
 	lx.skip(isWhitespace)
 	switch r := lx.peek(); {
-	case r == ']' || r == eof:
+	case r == tableEnd || r == eof:
 		return lx.errorf("unexpected end of table name (table names cannot be empty)")
-	case r == '.':
+	case r == tableSep:
 		return lx.errorf("unexpected table separator (table names cannot be empty)")
-	case r == '"' || r == '\'':
+	case r == stringStart || r == rawStringStart:
 		lx.ignore()
 		lx.push(lexTableNameEnd)
 		return lexQuotedName
@@ -390,10 +342,10 @@ func lexTableNameEnd(lx *lexer) stateFn {
 	switch r := lx.next(); {
 	case isWhitespace(r):
 		return lexTableNameEnd
-	case r == '.':
+	case r == tableSep:
 		lx.ignore()
 		return lexTableNameStart
-	case r == ']':
+	case r == tableEnd:
 		return lx.pop()
 	default:
 		return lx.errorf("expected '.' or ']' to end table name, but got %q instead", r)
@@ -427,10 +379,10 @@ func lexQuotedName(lx *lexer) stateFn {
 	switch {
 	case isWhitespace(r):
 		return lexSkip(lx, lexValue)
-	case r == '"':
+	case r == stringStart:
 		lx.ignore() // ignore the '"'
 		return lexString
-	case r == '\'':
+	case r == rawStringStart:
 		lx.ignore() // ignore the "'"
 		return lexRawString
 	case r == eof:
@@ -448,7 +400,7 @@ func lexKeyStart(lx *lexer) stateFn {
 		return lx.errorf("unexpected '=': key name appears blank")
 	case r == '.':
 		return lx.errorf("unexpected '.': keys cannot start with a '.'")
-	case r == '"' || r == '\'':
+	case r == stringStart || r == rawStringStart:
 		lx.ignore()
 		fallthrough
 	default: // Bare key
@@ -464,7 +416,7 @@ func lexKeyNameStart(lx *lexer) stateFn {
 		return lx.errorf("unexpected '='")
 	case r == '.':
 		return lx.errorf("unexpected '.'")
-	case r == '"' || r == '\'':
+	case r == stringStart || r == rawStringStart:
 		lx.ignore()
 		lx.push(lexKeyEnd)
 		return lexQuotedName
@@ -482,7 +434,7 @@ func lexKeyEnd(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexKeyEnd)
 	case r == eof:
-		return lx.errorf("unexpected EOF; expected key separator '='")
+		return lx.errorf("unexpected EOF; expected key separator %q", keySep)
 	case r == '.':
 		lx.ignore()
 		return lexKeyNameStart
@@ -509,17 +461,17 @@ func lexValue(lx *lexer) stateFn {
 		return lexNumberOrDateStart
 	}
 	switch r {
-	case '[':
+	case arrayStart:
 		lx.ignore()
 		lx.emit(itemArray)
 		return lexArrayValue
-	case '{':
+	case inlineTableStart:
 		lx.ignore()
 		lx.emit(itemInlineTableStart)
 		return lexInlineTableValue
-	case '"':
-		if lx.accept('"') {
-			if lx.accept('"') {
+	case stringStart:
+		if lx.accept(stringStart) {
+			if lx.accept(stringStart) {
 				lx.ignore() // Ignore """
 				return lexMultilineString
 			}
@@ -527,9 +479,9 @@ func lexValue(lx *lexer) stateFn {
 		}
 		lx.ignore() // ignore the '"'
 		return lexString
-	case '\'':
-		if lx.accept('\'') {
-			if lx.accept('\'') {
+	case rawStringStart:
+		if lx.accept(rawStringStart) {
+			if lx.accept(rawStringStart) {
 				lx.ignore() // Ignore """
 				return lexMultilineRawString
 			}
@@ -568,12 +520,14 @@ func lexArrayValue(lx *lexer) stateFn {
 	switch {
 	case isWhitespace(r) || isNL(r):
 		return lexSkip(lx, lexArrayValue)
-	case r == '#':
+	case r == commentStart:
 		lx.push(lexArrayValue)
 		return lexCommentStart
-	case r == ',':
+	case r == comma:
 		return lx.errorf("unexpected comma")
-	case r == ']':
+	case r == arrayEnd:
+		// NOTE(caleb): The spec isn't clear about whether you can have
+		// a trailing comma or not, so we'll allow it.
 		return lexArrayEnd
 	}
 
@@ -586,20 +540,22 @@ func lexArrayValue(lx *lexer) stateFn {
 // the next value (or the end of the array): it ignores whitespace and newlines
 // and expects either a ',' or a ']'.
 func lexArrayValueEnd(lx *lexer) stateFn {
-	switch r := lx.next(); {
+	r := lx.next()
+	switch {
 	case isWhitespace(r) || isNL(r):
 		return lexSkip(lx, lexArrayValueEnd)
-	case r == '#':
+	case r == commentStart:
 		lx.push(lexArrayValueEnd)
 		return lexCommentStart
-	case r == ',':
+	case r == comma:
 		lx.ignore()
 		return lexArrayValue // move on to the next value
-	case r == ']':
+	case r == arrayEnd:
 		return lexArrayEnd
-	default:
-		return lx.errorf("expected a comma (',') or array terminator (']'), but got %s", runeOrEOF(r))
 	}
+	return lx.errorf(
+		"expected a comma or array terminator %q, but got %s instead",
+		arrayEnd, runeOrEOF(r))
 }
 
 // lexArrayEnd finishes the lexing of an array.
@@ -618,13 +574,13 @@ func lexInlineTableValue(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexInlineTableValue)
 	case isNL(r):
-		return lx.errorPrevLine(errLexInlineTableNL{})
-	case r == '#':
+		return lx.errorf("newlines not allowed within inline tables")
+	case r == commentStart:
 		lx.push(lexInlineTableValue)
 		return lexCommentStart
-	case r == ',':
+	case r == comma:
 		return lx.errorf("unexpected comma")
-	case r == '}':
+	case r == inlineTableEnd:
 		return lexInlineTableEnd
 	}
 	lx.backup()
@@ -640,21 +596,23 @@ func lexInlineTableValueEnd(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexInlineTableValueEnd)
 	case isNL(r):
-		return lx.errorPrevLine(errLexInlineTableNL{})
-	case r == '#':
+		return lx.errorf("newlines not allowed within inline tables")
+	case r == commentStart:
 		lx.push(lexInlineTableValueEnd)
 		return lexCommentStart
-	case r == ',':
+	case r == comma:
 		lx.ignore()
 		lx.skip(isWhitespace)
 		if lx.peek() == '}' {
 			return lx.errorf("trailing comma not allowed in inline tables")
 		}
 		return lexInlineTableValue
-	case r == '}':
+	case r == inlineTableEnd:
 		return lexInlineTableEnd
 	default:
-		return lx.errorf("expected a comma or an inline table terminator '}', but got %s instead", runeOrEOF(r))
+		return lx.errorf(
+			"expected a comma or an inline table terminator %q, but got %s instead",
+			inlineTableEnd, runeOrEOF(r))
 	}
 }
 
@@ -680,12 +638,14 @@ func lexString(lx *lexer) stateFn {
 	switch {
 	case r == eof:
 		return lx.errorf(`unexpected EOF; expected '"'`)
+	case isControl(r) || r == '\r':
+		return lx.errorf("control characters are not allowed inside strings: '0x%02x'", r)
 	case isNL(r):
-		return lx.errorPrevLine(errLexStringNL{})
+		return lx.errorf("strings cannot contain newlines")
 	case r == '\\':
 		lx.push(lexString)
 		return lexStringEscape
-	case r == '"':
+	case r == stringEnd:
 		lx.backup()
 		lx.emit(itemString)
 		lx.next()
@@ -700,20 +660,23 @@ func lexString(lx *lexer) stateFn {
 func lexMultilineString(lx *lexer) stateFn {
 	r := lx.next()
 	switch r {
-	default:
-		return lexMultilineString
 	case eof:
 		return lx.errorf(`unexpected EOF; expected '"""'`)
+	case '\r':
+		if lx.peek() != '\n' {
+			return lx.errorf("control characters are not allowed inside strings: '0x%02x'", r)
+		}
+		return lexMultilineString
 	case '\\':
 		return lexMultilineStringEscape
-	case '"':
+	case stringEnd:
 		/// Found " → try to read two more "".
-		if lx.accept('"') {
-			if lx.accept('"') {
+		if lx.accept(stringEnd) {
+			if lx.accept(stringEnd) {
 				/// Peek ahead: the string can contain " and "", including at the
 				/// end: """str"""""
 				/// 6 or more at the end, however, is an error.
-				if lx.peek() == '"' {
+				if lx.peek() == stringEnd {
 					/// Check if we already lexed 5 's; if so we have 6 now, and
 					/// that's just too many man!
 					if strings.HasSuffix(lx.current(), `"""""`) {
@@ -736,8 +699,12 @@ func lexMultilineString(lx *lexer) stateFn {
 			}
 			lx.backup()
 		}
-		return lexMultilineString
 	}
+
+	if isControl(r) {
+		return lx.errorf("control characters are not allowed inside strings: '0x%02x'", r)
+	}
+	return lexMultilineString
 }
 
 // lexRawString consumes a raw string. Nothing can be escaped in such a string.
@@ -745,19 +712,20 @@ func lexMultilineString(lx *lexer) stateFn {
 func lexRawString(lx *lexer) stateFn {
 	r := lx.next()
 	switch {
-	default:
-		return lexRawString
 	case r == eof:
 		return lx.errorf(`unexpected EOF; expected "'"`)
+	case isControl(r) || r == '\r':
+		return lx.errorf("control characters are not allowed inside strings: '0x%02x'", r)
 	case isNL(r):
-		return lx.errorPrevLine(errLexStringNL{})
-	case r == '\'':
+		return lx.errorf("strings cannot contain newlines")
+	case r == rawStringEnd:
 		lx.backup()
 		lx.emit(itemRawString)
 		lx.next()
 		lx.ignore()
 		return lx.pop()
 	}
+	return lexRawString
 }
 
 // lexMultilineRawString consumes a raw string. Nothing can be escaped in such
@@ -766,18 +734,21 @@ func lexRawString(lx *lexer) stateFn {
 func lexMultilineRawString(lx *lexer) stateFn {
 	r := lx.next()
 	switch r {
-	default:
-		return lexMultilineRawString
 	case eof:
 		return lx.errorf(`unexpected EOF; expected "'''"`)
-	case '\'':
+	case '\r':
+		if lx.peek() != '\n' {
+			return lx.errorf("control characters are not allowed inside strings: '0x%02x'", r)
+		}
+		return lexMultilineRawString
+	case rawStringEnd:
 		/// Found ' → try to read two more ''.
-		if lx.accept('\'') {
-			if lx.accept('\'') {
+		if lx.accept(rawStringEnd) {
+			if lx.accept(rawStringEnd) {
 				/// Peek ahead: the string can contain ' and '', including at the
 				/// end: '''str'''''
 				/// 6 or more at the end, however, is an error.
-				if lx.peek() == '\'' {
+				if lx.peek() == rawStringEnd {
 					/// Check if we already lexed 5 's; if so we have 6 now, and
 					/// that's just too many man!
 					if strings.HasSuffix(lx.current(), "'''''") {
@@ -800,8 +771,12 @@ func lexMultilineRawString(lx *lexer) stateFn {
 			}
 			lx.backup()
 		}
-		return lexMultilineRawString
 	}
+
+	if isControl(r) {
+		return lx.errorf("control characters are not allowed inside strings: '0x%02x'", r)
+	}
+	return lexMultilineRawString
 }
 
 // lexMultilineStringEscape consumes an escaped character. It assumes that the
@@ -842,7 +817,8 @@ func lexStringEscape(lx *lexer) stateFn {
 	case 'U':
 		return lexLongUnicodeEscape
 	}
-	return lx.error(errLexEscape{r})
+	return lx.errorf("invalid escape character %q; only the following escape characters are allowed: "+
+		`\b, \t, \n, \f, \r, \", \\, \uXXXX, and \UXXXXXXXX`, r)
 }
 
 func lexShortUnicodeEscape(lx *lexer) stateFn {
@@ -1132,6 +1108,8 @@ func lexComment(lx *lexer) stateFn {
 		lx.backup()
 		lx.emit(itemText)
 		return lx.pop()
+	case isControl(r):
+		return lx.errorf("control characters are not allowed inside comments: '0x%02x'", r)
 	default:
 		return lexComment
 	}
@@ -1143,6 +1121,52 @@ func lexSkip(lx *lexer, nextState stateFn) stateFn {
 	return nextState
 }
 
+// isWhitespace returns true if `r` is a whitespace character according
+// to the spec.
+func isWhitespace(r rune) bool {
+	return r == '\t' || r == ' '
+}
+
+func isNL(r rune) bool {
+	return r == '\n' || r == '\r'
+}
+
+// Control characters except \n, \t
+func isControl(r rune) bool {
+	switch r {
+	case '\t', '\r', '\n':
+		return false
+	default:
+		return (r >= 0x00 && r <= 0x1f) || r == 0x7f
+	}
+}
+
+func isDigit(r rune) bool {
+	return r >= '0' && r <= '9'
+}
+
+func isHexadecimal(r rune) bool {
+	return (r >= '0' && r <= '9') ||
+		(r >= 'a' && r <= 'f') ||
+		(r >= 'A' && r <= 'F')
+}
+
+func isOctal(r rune) bool {
+	return r >= '0' && r <= '7'
+}
+
+func isBinary(r rune) bool {
+	return r == '0' || r == '1'
+}
+
+func isBareKeyChar(r rune) bool {
+	return (r >= 'A' && r <= 'Z') ||
+		(r >= 'a' && r <= 'z') ||
+		(r >= '0' && r <= '9') ||
+		r == '_' ||
+		r == '-'
+}
+
 func (s stateFn) String() string {
 	name := runtime.FuncForPC(reflect.ValueOf(s).Pointer()).Name()
 	if i := strings.LastIndexByte(name, '.'); i > -1 {
@@ -1199,26 +1223,3 @@ func (itype itemType) String() string {
 func (item item) String() string {
 	return fmt.Sprintf("(%s, %s)", item.typ.String(), item.val)
 }
-
-func isWhitespace(r rune) bool { return r == '\t' || r == ' ' }
-func isNL(r rune) bool         { return r == '\n' || r == '\r' }
-func isControl(r rune) bool { // Control characters except \t, \r, \n
-	switch r {
-	case '\t', '\r', '\n':
-		return false
-	default:
-		return (r >= 0x00 && r <= 0x1f) || r == 0x7f
-	}
-}
-func isDigit(r rune) bool  { return r >= '0' && r <= '9' }
-func isBinary(r rune) bool { return r == '0' || r == '1' }
-func isOctal(r rune) bool  { return r >= '0' && r <= '7' }
-func isHexadecimal(r rune) bool {
-	return (r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F')
-}
-func isBareKeyChar(r rune) bool {
-	return (r >= 'A' && r <= 'Z') ||
-		(r >= 'a' && r <= 'z') ||
-		(r >= '0' && r <= '9') ||
-		r == '_' || r == '-'
-}

vendor/github.com/BurntSushi/toml/parse.go

@@ -1,6 +1,7 @@
 package toml
 
 import (
+	"errors"
 	"fmt"
 	"strconv"
 	"strings"
@@ -11,23 +12,35 @@ import (
 )
 
 type parser struct {
-	lx         *lexer
-	context    Key      // Full key for the current hash in scope.
-	currentKey string   // Base key name for everything except hashes.
-	pos        Position // Current position in the TOML file.
+	mapping map[string]interface{}
+	types   map[string]tomlType
+	lx      *lexer
 
-	ordered   []Key                  // List of keys in the order that they appear in the TOML data.
-	mapping   map[string]interface{} // Map keyname → key value.
-	types     map[string]tomlType    // Map keyname → TOML type.
-	implicits map[string]struct{}    // Record implicit keys (e.g. "key.group.names").
+	ordered    []Key           // List of keys in the order that they appear in the TOML data.
+	context    Key             // Full key for the current hash in scope.
+	currentKey string          // Base key name for everything except hashes.
+	approxLine int             // Rough approximation of line number
+	implicits  map[string]bool // Record implied keys (e.g. 'key.group.names').
+}
+
+// ParseError is used when a file can't be parsed: for example invalid integer
+// literals, duplicate keys, etc.
+type ParseError struct {
+	Message string
+	Line    int
+	LastKey string
+}
+
+func (pe ParseError) Error() string {
+	return fmt.Sprintf("Near line %d (last key parsed '%s'): %s",
+		pe.Line, pe.LastKey, pe.Message)
 }
 
 func parse(data string) (p *parser, err error) {
 	defer func() {
 		if r := recover(); r != nil {
-			if pErr, ok := r.(ParseError); ok {
-				pErr.input = data
-				err = pErr
+			var ok bool
+			if err, ok = r.(ParseError); ok {
 				return
 			}
 			panic(r)
@@ -47,13 +60,8 @@ func parse(data string) (p *parser, err error) {
 	if len(data) < 6 {
 		ex = len(data)
 	}
-	if i := strings.IndexRune(data[:ex], 0); i > -1 {
-		return nil, ParseError{
-			Message:  "files cannot contain NULL bytes; probably using UTF-16; TOML files must be UTF-8",
-			Position: Position{Line: 1, Start: i, Len: 1},
-			Line:     1,
-			input:    data,
-		}
+	if strings.ContainsRune(data[:ex], 0) {
+		return nil, errors.New("files cannot contain NULL bytes; probably using UTF-16; TOML files must be UTF-8")
 	}
 
 	p = &parser{
@@ -61,7 +69,7 @@ func parse(data string) (p *parser, err error) {
 		types:     make(map[string]tomlType),
 		lx:        lex(data),
 		ordered:   make([]Key, 0),
-		implicits: make(map[string]struct{}),
+		implicits: make(map[string]bool),
 	}
 	for {
 		item := p.next()
@@ -74,21 +82,12 @@ func parse(data string) (p *parser, err error) {
 	return p, nil
 }
 
-func (p *parser) panicItemf(it item, format string, v ...interface{}) {
-	panic(ParseError{
-		Message:  fmt.Sprintf(format, v...),
-		Position: it.pos,
-		Line:     it.pos.Len,
-		LastKey:  p.current(),
-	})
-}
-
 func (p *parser) panicf(format string, v ...interface{}) {
+	msg := fmt.Sprintf(format, v...)
 	panic(ParseError{
-		Message:  fmt.Sprintf(format, v...),
-		Position: p.pos,
-		Line:     p.pos.Line,
-		LastKey:  p.current(),
+		Message: msg,
+		Line:    p.approxLine,
+		LastKey: p.current(),
 	})
 }
 
@@ -96,26 +95,11 @@ func (p *parser) next() item {
 	it := p.lx.nextItem()
 	//fmt.Printf("ITEM %-18s line %-3d │ %q\n", it.typ, it.line, it.val)
 	if it.typ == itemError {
-		if it.err != nil {
-			panic(ParseError{
-				Position: it.pos,
-				Line:     it.pos.Line,
-				LastKey:  p.current(),
-				err:      it.err,
-			})
-		}
-
-		p.panicItemf(it, "%s", it.val)
+		p.panicf("%s", it.val)
 	}
 	return it
 }
 
-func (p *parser) nextPos() item {
-	it := p.next()
-	p.pos = it.pos
-	return it
-}
-
 func (p *parser) bug(format string, v ...interface{}) {
 	panic(fmt.Sprintf("BUG: "+format+"\n\n", v...))
 }
@@ -135,9 +119,11 @@ func (p *parser) assertEqual(expected, got itemType) {
 func (p *parser) topLevel(item item) {
 	switch item.typ {
 	case itemCommentStart: // # ..
+		p.approxLine = item.line
 		p.expect(itemText)
 	case itemTableStart: // [ .. ]
-		name := p.nextPos()
+		name := p.next()
+		p.approxLine = name.line
 
 		var key Key
 		for ; name.typ != itemTableEnd && name.typ != itemEOF; name = p.next() {
@@ -149,7 +135,8 @@ func (p *parser) topLevel(item item) {
 		p.setType("", tomlHash)
 		p.ordered = append(p.ordered, key)
 	case itemArrayTableStart: // [[ .. ]]
-		name := p.nextPos()
+		name := p.next()
+		p.approxLine = name.line
 
 		var key Key
 		for ; name.typ != itemArrayTableEnd && name.typ != itemEOF; name = p.next() {
@@ -163,7 +150,8 @@ func (p *parser) topLevel(item item) {
 	case itemKeyStart: // key = ..
 		outerContext := p.context
 		/// Read all the key parts (e.g. 'a' and 'b' in 'a.b')
-		k := p.nextPos()
+		k := p.next()
+		p.approxLine = k.line
 		var key Key
 		for ; k.typ != itemKeyEnd && k.typ != itemEOF; k = p.next() {
 			key = append(key, p.keyString(k))
@@ -218,9 +206,9 @@ var datetimeRepl = strings.NewReplacer(
 func (p *parser) value(it item, parentIsArray bool) (interface{}, tomlType) {
 	switch it.typ {
 	case itemString:
-		return p.replaceEscapes(it, it.val), p.typeOfPrimitive(it)
+		return p.replaceEscapes(it.val), p.typeOfPrimitive(it)
 	case itemMultilineString:
-		return p.replaceEscapes(it, stripFirstNewline(p.stripEscapedNewlines(it.val))), p.typeOfPrimitive(it)
+		return p.replaceEscapes(stripFirstNewline(stripEscapedNewlines(it.val))), p.typeOfPrimitive(it)
 	case itemRawString:
 		return it.val, p.typeOfPrimitive(it)
 	case itemRawMultilineString:
@@ -252,10 +240,10 @@ func (p *parser) value(it item, parentIsArray bool) (interface{}, tomlType) {
 
 func (p *parser) valueInteger(it item) (interface{}, tomlType) {
 	if !numUnderscoresOK(it.val) {
-		p.panicItemf(it, "Invalid integer %q: underscores must be surrounded by digits", it.val)
+		p.panicf("Invalid integer %q: underscores must be surrounded by digits", it.val)
 	}
 	if numHasLeadingZero(it.val) {
-		p.panicItemf(it, "Invalid integer %q: cannot have leading zeroes", it.val)
+		p.panicf("Invalid integer %q: cannot have leading zeroes", it.val)
 	}
 
 	num, err := strconv.ParseInt(it.val, 0, 64)
@@ -266,7 +254,7 @@ func (p *parser) valueInteger(it item) (interface{}, tomlType) {
 		// So mark the former as a bug but the latter as a legitimate user
 		// error.
 		if e, ok := err.(*strconv.NumError); ok && e.Err == strconv.ErrRange {
-			p.panicItemf(it, "Integer '%s' is out of the range of 64-bit signed integers.", it.val)
+			p.panicf("Integer '%s' is out of the range of 64-bit signed integers.", it.val)
 		} else {
 			p.bug("Expected integer value, but got '%s'.", it.val)
 		}
@@ -284,18 +272,18 @@ func (p *parser) valueFloat(it item) (interface{}, tomlType) {
 	})
 	for _, part := range parts {
 		if !numUnderscoresOK(part) {
-			p.panicItemf(it, "Invalid float %q: underscores must be surrounded by digits", it.val)
+			p.panicf("Invalid float %q: underscores must be surrounded by digits", it.val)
 		}
 	}
 	if len(parts) > 0 && numHasLeadingZero(parts[0]) {
-		p.panicItemf(it, "Invalid float %q: cannot have leading zeroes", it.val)
+		p.panicf("Invalid float %q: cannot have leading zeroes", it.val)
 	}
 	if !numPeriodsOK(it.val) {
 		// As a special case, numbers like '123.' or '1.e2',
 		// which are valid as far as Go/strconv are concerned,
 		// must be rejected because TOML says that a fractional
 		// part consists of '.' followed by 1+ digits.
-		p.panicItemf(it, "Invalid float %q: '.' must be followed by one or more digits", it.val)
+		p.panicf("Invalid float %q: '.' must be followed by one or more digits", it.val)
 	}
 	val := strings.Replace(it.val, "_", "", -1)
 	if val == "+nan" || val == "-nan" { // Go doesn't support this, but TOML spec does.
@@ -304,9 +292,9 @@ func (p *parser) valueFloat(it item) (interface{}, tomlType) {
 	num, err := strconv.ParseFloat(val, 64)
 	if err != nil {
 		if e, ok := err.(*strconv.NumError); ok && e.Err == strconv.ErrRange {
-			p.panicItemf(it, "Float '%s' is out of the range of 64-bit IEEE-754 floating-point numbers.", it.val)
+			p.panicf("Float '%s' is out of the range of 64-bit IEEE-754 floating-point numbers.", it.val)
 		} else {
-			p.panicItemf(it, "Invalid float value: %q", it.val)
+			p.panicf("Invalid float value: %q", it.val)
 		}
 	}
 	return num, p.typeOfPrimitive(it)
@@ -337,7 +325,7 @@ func (p *parser) valueDatetime(it item) (interface{}, tomlType) {
 		}
 	}
 	if !ok {
-		p.panicItemf(it, "Invalid TOML Datetime: %q.", it.val)
+		p.panicf("Invalid TOML Datetime: %q.", it.val)
 	}
 	return t, p.typeOfPrimitive(it)
 }
@@ -347,12 +335,8 @@ func (p *parser) valueArray(it item) (interface{}, tomlType) {
 
 	// p.setType(p.currentKey, typ)
 	var (
+		array []interface{}
 		types []tomlType
-
-		// Initialize to a non-nil empty slice. This makes it consistent with
-		// how S = [] decodes into a non-nil slice inside something like struct
-		// { S []string }. See #338
-		array = []interface{}{}
 	)
 	for it = p.next(); it.typ != itemArrayEnd; it = p.next() {
 		if it.typ == itemCommentStart {
@@ -363,12 +347,6 @@ func (p *parser) valueArray(it item) (interface{}, tomlType) {
 		val, typ := p.value(it, true)
 		array = append(array, val)
 		types = append(types, typ)
-
-		// XXX: types isn't used here, we need it to record the accurate type
-		// information.
-		//
-		// Not entirely sure how to best store this; could use "key[0]",
-		// "key[1]" notation, or maybe store it on the Array type?
 	}
 	return array, tomlArray
 }
@@ -395,7 +373,8 @@ func (p *parser) valueInlineTable(it item, parentIsArray bool) (interface{}, tom
 		}
 
 		/// Read all key parts.
-		k := p.nextPos()
+		k := p.next()
+		p.approxLine = k.line
 		var key Key
 		for ; k.typ != itemKeyEnd && k.typ != itemEOF; k = p.next() {
 			key = append(key, p.keyString(k))
@@ -429,7 +408,7 @@ func (p *parser) valueInlineTable(it item, parentIsArray bool) (interface{}, tom
 // numHasLeadingZero checks if this number has leading zeroes, allowing for '0',
 // +/- signs, and base prefixes.
 func numHasLeadingZero(s string) bool {
-	if len(s) > 1 && s[0] == '0' && !(s[1] == 'b' || s[1] == 'o' || s[1] == 'x') { // Allow 0b, 0o, 0x
+	if len(s) > 1 && s[0] == '0' && isDigit(rune(s[1])) { // >1 to allow "0" and isDigit to allow 0x
 		return true
 	}
 	if len(s) > 2 && (s[0] == '-' || s[0] == '+') && s[1] == '0' {
@@ -524,7 +503,7 @@ func (p *parser) addContext(key Key, array bool) {
 		if hash, ok := hashContext[k].([]map[string]interface{}); ok {
 			hashContext[k] = append(hash, make(map[string]interface{}))
 		} else {
-			p.panicf("Key '%s' was already created and cannot be used as an array.", key)
+			p.panicf("Key '%s' was already created and cannot be used as an array.", keyContext)
 		}
 	} else {
 		p.setValue(key[len(key)-1], make(map[string]interface{}))
@@ -534,8 +513,8 @@ func (p *parser) addContext(key Key, array bool) {
 
 // set calls setValue and setType.
 func (p *parser) set(key string, val interface{}, typ tomlType) {
-	p.setValue(key, val)
-	p.setType(key, typ)
+	p.setValue(p.currentKey, val)
+	p.setType(p.currentKey, typ)
 }
 
 // setValue sets the given key to the given value in the current context.
@@ -594,31 +573,27 @@ func (p *parser) setValue(key string, value interface{}) {
 	hash[key] = value
 }
 
-// setType sets the type of a particular value at a given key. It should be
-// called immediately AFTER setValue.
+// setType sets the type of a particular value at a given key.
+// It should be called immediately AFTER setValue.
 //
 // Note that if `key` is empty, then the type given will be applied to the
 // current context (which is either a table or an array of tables).
 func (p *parser) setType(key string, typ tomlType) {
 	keyContext := make(Key, 0, len(p.context)+1)
-	keyContext = append(keyContext, p.context...)
+	for _, k := range p.context {
+		keyContext = append(keyContext, k)
+	}
 	if len(key) > 0 { // allow type setting for hashes
 		keyContext = append(keyContext, key)
 	}
-	// Special case to make empty keys ("" = 1) work.
-	// Without it it will set "" rather than `""`.
-	// TODO: why is this needed? And why is this only needed here?
-	if len(keyContext) == 0 {
-		keyContext = Key{""}
-	}
 	p.types[keyContext.String()] = typ
 }
 
 // Implicit keys need to be created when tables are implied in "a.b.c.d = 1" and
 // "[a.b.c]" (the "a", "b", and "c" hashes are never created explicitly).
-func (p *parser) addImplicit(key Key)     { p.implicits[key.String()] = struct{}{} }
-func (p *parser) removeImplicit(key Key)  { delete(p.implicits, key.String()) }
-func (p *parser) isImplicit(key Key) bool { _, ok := p.implicits[key.String()]; return ok }
+func (p *parser) addImplicit(key Key)     { p.implicits[key.String()] = true }
+func (p *parser) removeImplicit(key Key)  { p.implicits[key.String()] = false }
+func (p *parser) isImplicit(key Key) bool { return p.implicits[key.String()] }
 func (p *parser) isArray(key Key) bool    { return p.types[key.String()] == tomlArray }
 func (p *parser) addImplicitContext(key Key) {
 	p.addImplicit(key)
@@ -647,7 +622,7 @@ func stripFirstNewline(s string) string {
 }
 
 // Remove newlines inside triple-quoted strings if a line ends with "\".
-func (p *parser) stripEscapedNewlines(s string) string {
+func stripEscapedNewlines(s string) string {
 	split := strings.Split(s, "\n")
 	if len(split) < 1 {
 		return s
@@ -679,10 +654,6 @@ func (p *parser) stripEscapedNewlines(s string) string {
 			continue
 		}
 
-		if i == len(split)-1 {
-			p.panicf("invalid escape: '\\ '")
-		}
-
 		split[i] = line[:len(line)-1] // Remove \
 		if len(split)-1 > i {
 			split[i+1] = strings.TrimLeft(split[i+1], " \t\r")
@@ -691,8 +662,8 @@ func (p *parser) stripEscapedNewlines(s string) string {
 	return strings.Join(split, "")
 }
 
-func (p *parser) replaceEscapes(it item, str string) string {
-	replaced := make([]rune, 0, len(str))
+func (p *parser) replaceEscapes(str string) string {
+	var replaced []rune
 	s := []byte(str)
 	r := 0
 	for r < len(s) {
@@ -712,7 +683,7 @@ func (p *parser) replaceEscapes(it item, str string) string {
 			p.bug("Expected valid escape code after \\, but got %q.", s[r])
 			return ""
 		case ' ', '\t':
-			p.panicItemf(it, "invalid escape: '\\%c'", s[r])
+			p.panicf("invalid escape: '\\%c'", s[r])
 			return ""
 		case 'b':
 			replaced = append(replaced, rune(0x0008))
@@ -739,14 +710,14 @@ func (p *parser) replaceEscapes(it item, str string) string {
 			// At this point, we know we have a Unicode escape of the form
 			// `uXXXX` at [r, r+5). (Because the lexer guarantees this
 			// for us.)
-			escaped := p.asciiEscapeToUnicode(it, s[r+1:r+5])
+			escaped := p.asciiEscapeToUnicode(s[r+1 : r+5])
 			replaced = append(replaced, escaped)
 			r += 5
 		case 'U':
 			// At this point, we know we have a Unicode escape of the form
 			// `uXXXX` at [r, r+9). (Because the lexer guarantees this
 			// for us.)
-			escaped := p.asciiEscapeToUnicode(it, s[r+1:r+9])
+			escaped := p.asciiEscapeToUnicode(s[r+1 : r+9])
 			replaced = append(replaced, escaped)
 			r += 9
 		}
@@ -754,14 +725,15 @@ func (p *parser) replaceEscapes(it item, str string) string {
 	return string(replaced)
 }
 
-func (p *parser) asciiEscapeToUnicode(it item, bs []byte) rune {
+func (p *parser) asciiEscapeToUnicode(bs []byte) rune {
 	s := string(bs)
 	hex, err := strconv.ParseUint(strings.ToLower(s), 16, 32)
 	if err != nil {
-		p.bug("Could not parse '%s' as a hexadecimal number, but the lexer claims it's OK: %s", s, err)
+		p.bug("Could not parse '%s' as a hexadecimal number, but the "+
+			"lexer claims it's OK: %s", s, err)
 	}
 	if !utf8.ValidRune(rune(hex)) {
-		p.panicItemf(it, "Escaped character '\\u%s' is not valid UTF-8.", s)
+		p.panicf("Escaped character '\\u%s' is not valid UTF-8.", s)
 	}
 	return rune(hex)
 }

vendor/github.com/BurntSushi/toml/type_check.go

@@ -16,7 +16,7 @@ func typeEqual(t1, t2 tomlType) bool {
 	return t1.typeString() == t2.typeString()
 }
 
-func typeIsTable(t tomlType) bool {
+func typeIsHash(t tomlType) bool {
 	return typeEqual(t, tomlHash) || typeEqual(t, tomlArrayHash)
 }
 

vendor/github.com/BurntSushi/toml/type_fields.go

@@ -70,8 +70,8 @@ func typeFields(t reflect.Type) []field {
 	next := []field{{typ: t}}
 
 	// Count of queued names for current level and the next.
-	var count map[reflect.Type]int
-	var nextCount map[reflect.Type]int
+	count := map[reflect.Type]int{}
+	nextCount := map[reflect.Type]int{}
 
 	// Types already visited at an earlier level.
 	visited := map[reflect.Type]bool{}

vendor/github.com/Microsoft/go-winio/README.md

@@ -11,27 +11,12 @@ package.
 
 Please see the LICENSE file for licensing information.
 
-## Contributing
+This project has adopted the [Microsoft Open Source Code of
+Conduct](https://opensource.microsoft.com/codeofconduct/). For more information
+see the [Code of Conduct
+FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact
+[opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional
+questions or comments.
 
-This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA)
-declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
-
-When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR
-appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
-
-We also require that contributors sign their commits using git commit -s or git commit --signoff to certify they either authored the work themselves
-or otherwise have permission to use it in this project. Please see https://developercertificate.org/ for more info, as well as to make sure that you can
-attest to the rules listed. Our CI uses the DCO Github app to ensure that all commits in a given PR are signed-off.
-
-
-## Code of Conduct
-
-This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
-For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
-contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
-
-
-
-## Special Thanks
 Thanks to natefinch for the inspiration for this library. See https://github.com/natefinch/npipe
 for another named pipe implementation.

vendor/github.com/Microsoft/go-winio/backuptar/tar.go

@@ -5,6 +5,7 @@ package backuptar
 import (
 	"archive/tar"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -41,14 +42,19 @@ const (
 	hdrCreationTime = "LIBARCHIVE.creationtime"
 )
 
-// zeroReader is an io.Reader that always returns 0s.
-type zeroReader struct{}
-
-func (zr zeroReader) Read(b []byte) (int, error) {
-	for i := range b {
-		b[i] = 0
+func writeZeroes(w io.Writer, count int64) error {
+	buf := make([]byte, 8192)
+	c := len(buf)
+	for i := int64(0); i < count; i += int64(c) {
+		if int64(c) > count-i {
+			c = int(count - i)
+		}
+		_, err := w.Write(buf[:c])
+		if err != nil {
+			return err
+		}
 	}
-	return len(b), nil
+	return nil
 }
 
 func copySparse(t *tar.Writer, br *winio.BackupStreamReader) error {
@@ -65,26 +71,16 @@ func copySparse(t *tar.Writer, br *winio.BackupStreamReader) error {
 			return fmt.Errorf("unexpected stream %d", bhdr.Id)
 		}
 
-		// We can't seek backwards, since we have already written that data to the tar.Writer.
-		if bhdr.Offset < curOffset {
-			return fmt.Errorf("cannot seek back from %d to %d", curOffset, bhdr.Offset)
-		}
 		// archive/tar does not support writing sparse files
 		// so just write zeroes to catch up to the current offset.
-		if _, err := io.CopyN(t, zeroReader{}, bhdr.Offset-curOffset); err != nil {
-			return fmt.Errorf("seek to offset %d: %s", bhdr.Offset, err)
-		}
+		err = writeZeroes(t, bhdr.Offset-curOffset)
 		if bhdr.Size == 0 {
-			// A sparse block with size = 0 is used to mark the end of the sparse blocks.
 			break
 		}
 		n, err := io.Copy(t, br)
 		if err != nil {
 			return err
 		}
-		if n != bhdr.Size {
-			return fmt.Errorf("copied %d bytes instead of %d at offset %d", n, bhdr.Size, bhdr.Offset)
-		}
 		curOffset = bhdr.Offset + n
 	}
 	return nil
@@ -113,69 +109,6 @@ func BasicInfoHeader(name string, size int64, fileInfo *winio.FileBasicInfo) *ta
 	return hdr
 }
 
-// SecurityDescriptorFromTarHeader reads the SDDL associated with the header of the current file
-// from the tar header and returns the security descriptor into a byte slice.
-func SecurityDescriptorFromTarHeader(hdr *tar.Header) ([]byte, error) {
-	// Maintaining old SDDL-based behavior for backward
-	// compatibility.  All new tar headers written by this library
-	// will have raw binary for the security descriptor.
-	var sd []byte
-	var err error
-	if sddl, ok := hdr.PAXRecords[hdrSecurityDescriptor]; ok {
-		sd, err = winio.SddlToSecurityDescriptor(sddl)
-		if err != nil {
-			return nil, err
-		}
-	}
-	if sdraw, ok := hdr.PAXRecords[hdrRawSecurityDescriptor]; ok {
-		sd, err = base64.StdEncoding.DecodeString(sdraw)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return sd, nil
-}
-
-// ExtendedAttributesFromTarHeader reads the EAs associated with the header of the
-// current file from the tar header and returns it as a byte slice.
-func ExtendedAttributesFromTarHeader(hdr *tar.Header) ([]byte, error) {
-	var eas []winio.ExtendedAttribute
-	var eadata []byte
-	var err error
-	for k, v := range hdr.PAXRecords {
-		if !strings.HasPrefix(k, hdrEaPrefix) {
-			continue
-		}
-		data, err := base64.StdEncoding.DecodeString(v)
-		if err != nil {
-			return nil, err
-		}
-		eas = append(eas, winio.ExtendedAttribute{
-			Name:  k[len(hdrEaPrefix):],
-			Value: data,
-		})
-	}
-	if len(eas) != 0 {
-		eadata, err = winio.EncodeExtendedAttributes(eas)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return eadata, nil
-}
-
-// EncodeReparsePointFromTarHeader reads the ReparsePoint structure from the tar header
-// and encodes it into a byte slice. The file for which this function is called must be a
-// symlink.
-func EncodeReparsePointFromTarHeader(hdr *tar.Header) []byte {
-	_, isMountPoint := hdr.PAXRecords[hdrMountPoint]
-	rp := winio.ReparsePoint{
-		Target:       filepath.FromSlash(hdr.Linkname),
-		IsMountPoint: isMountPoint,
-	}
-	return winio.EncodeReparsePoint(&rp)
-}
-
 // WriteTarFileFromBackupStream writes a file to a tar writer using data from a Win32 backup stream.
 //
 // This encodes Win32 metadata as tar pax vendor extensions starting with MSWINDOWS.
@@ -288,44 +221,20 @@ func WriteTarFileFromBackupStream(t *tar.Writer, r io.Reader, name string, size
 		}
 	}
 
-	// The logic for copying file contents is fairly complicated due to the need for handling sparse files,
-	// and the weird ways they are represented by BackupRead. A normal file will always either have a data stream
-	// with size and content, or no data stream at all (if empty). However, for a sparse file, the content can also
-	// be represented using a series of sparse block streams following the data stream. Additionally, the way sparse
-	// files are handled by BackupRead has changed in the OS recently. The specifics of the representation are described
-	// in the list at the bottom of this block comment.
-	//
-	// Sparse files can be represented in four different ways, based on the specifics of the file.
-	// - Size = 0:
-	//     Previously: BackupRead yields no data stream and no sparse block streams.
-	//     Recently: BackupRead yields a data stream with size = 0. There are no following sparse block streams.
-	// - Size > 0, no allocated ranges:
-	//     BackupRead yields a data stream with size = 0. Following is a single sparse block stream with
-	//     size = 0 and offset = <file size>.
-	// - Size > 0, one allocated range:
-	//     BackupRead yields a data stream with size = <file size> containing the file contents. There are no
-	//     sparse block streams. This is the case if you take a normal file with contents and simply set the
-	//     sparse flag on it.
-	// - Size > 0, multiple allocated ranges:
-	//     BackupRead yields a data stream with size = 0. Following are sparse block streams for each allocated
-	//     range of the file containing the range contents. Finally there is a sparse block stream with
-	//     size = 0 and offset = <file size>.
-
 	if dataHdr != nil {
 		// A data stream was found. Copy the data.
-		// We assume that we will either have a data stream size > 0 XOR have sparse block streams.
-		if dataHdr.Size > 0 || (dataHdr.Attributes&winio.StreamSparseAttributes) == 0 {
+		if (dataHdr.Attributes & winio.StreamSparseAttributes) == 0 {
 			if size != dataHdr.Size {
 				return fmt.Errorf("%s: mismatch between file size %d and header size %d", name, size, dataHdr.Size)
 			}
-			if _, err = io.Copy(t, br); err != nil {
-				return fmt.Errorf("%s: copying contents from data stream: %s", name, err)
+			_, err = io.Copy(t, br)
+			if err != nil {
+				return err
 			}
-		} else if size > 0 {
-			// As of a recent OS change, BackupRead now returns a data stream for empty sparse files.
-			// These files have no sparse block streams, so skip the copySparse call if file size = 0.
-			if err = copySparse(t, br); err != nil {
-				return fmt.Errorf("%s: copying contents from sparse block stream: %s", name, err)
+		} else {
+			err = copySparse(t, br)
+			if err != nil {
+				return err
 			}
 		}
 	}
@@ -370,7 +279,7 @@ func WriteTarFileFromBackupStream(t *tar.Writer, r io.Reader, name string, size
 			} else {
 				// Unsupported for now, since the size of the alternate stream is not present
 				// in the backup stream until after the data has been read.
-				return fmt.Errorf("%s: tar of sparse alternate data streams is unsupported", name)
+				return errors.New("tar of sparse alternate data streams is unsupported")
 			}
 		case winio.BackupEaData, winio.BackupLink, winio.BackupPropertyData, winio.BackupObjectId, winio.BackupTxfsData:
 			// ignore these streams
@@ -421,10 +330,21 @@ func FileInfoFromHeader(hdr *tar.Header) (name string, size int64, fileInfo *win
 // tar file that was not processed, or io.EOF is there are no more.
 func WriteBackupStreamFromTarFile(w io.Writer, t *tar.Reader, hdr *tar.Header) (*tar.Header, error) {
 	bw := winio.NewBackupStreamWriter(w)
-
-	sd, err := SecurityDescriptorFromTarHeader(hdr)
-	if err != nil {
-		return nil, err
+	var sd []byte
+	var err error
+	// Maintaining old SDDL-based behavior for backward compatibility.  All new tar headers written
+	// by this library will have raw binary for the security descriptor.
+	if sddl, ok := hdr.PAXRecords[hdrSecurityDescriptor]; ok {
+		sd, err = winio.SddlToSecurityDescriptor(sddl)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if sdraw, ok := hdr.PAXRecords[hdrRawSecurityDescriptor]; ok {
+		sd, err = base64.StdEncoding.DecodeString(sdraw)
+		if err != nil {
+			return nil, err
+		}
 	}
 	if len(sd) != 0 {
 		bhdr := winio.BackupHeader{
@@ -440,12 +360,25 @@ func WriteBackupStreamFromTarFile(w io.Writer, t *tar.Reader, hdr *tar.Header) (
 			return nil, err
 		}
 	}
-
-	eadata, err := ExtendedAttributesFromTarHeader(hdr)
-	if err != nil {
-		return nil, err
+	var eas []winio.ExtendedAttribute
+	for k, v := range hdr.PAXRecords {
+		if !strings.HasPrefix(k, hdrEaPrefix) {
+			continue
+		}
+		data, err := base64.StdEncoding.DecodeString(v)
+		if err != nil {
+			return nil, err
+		}
+		eas = append(eas, winio.ExtendedAttribute{
+			Name:  k[len(hdrEaPrefix):],
+			Value: data,
+		})
 	}
-	if len(eadata) != 0 {
+	if len(eas) != 0 {
+		eadata, err := winio.EncodeExtendedAttributes(eas)
+		if err != nil {
+			return nil, err
+		}
 		bhdr := winio.BackupHeader{
 			Id:   winio.BackupEaData,
 			Size: int64(len(eadata)),
@@ -459,9 +392,13 @@ func WriteBackupStreamFromTarFile(w io.Writer, t *tar.Reader, hdr *tar.Header) (
 			return nil, err
 		}
 	}
-
 	if hdr.Typeflag == tar.TypeSymlink {
-		reparse := EncodeReparsePointFromTarHeader(hdr)
+		_, isMountPoint := hdr.PAXRecords[hdrMountPoint]
+		rp := winio.ReparsePoint{
+			Target:       filepath.FromSlash(hdr.Linkname),
+			IsMountPoint: isMountPoint,
+		}
+		reparse := winio.EncodeReparsePoint(&rp)
 		bhdr := winio.BackupHeader{
 			Id:   winio.BackupReparseData,
 			Size: int64(len(reparse)),
@@ -474,9 +411,7 @@ func WriteBackupStreamFromTarFile(w io.Writer, t *tar.Reader, hdr *tar.Header) (
 		if err != nil {
 			return nil, err
 		}
-
 	}
-
 	if hdr.Typeflag == tar.TypeReg || hdr.Typeflag == tar.TypeRegA {
 		bhdr := winio.BackupHeader{
 			Id:   winio.BackupData,

vendor/github.com/Microsoft/go-winio/file.go

@@ -1,4 +1,3 @@
-//go:build windows
 // +build windows
 
 package winio
@@ -144,11 +143,6 @@ func (f *win32File) Close() error {
 	return nil
 }
 
-// IsClosed checks if the file has been closed
-func (f *win32File) IsClosed() bool {
-	return f.closing.isSet()
-}
-
 // prepareIo prepares for a new IO operation.
 // The caller must call f.wg.Done() when the IO is finished, prior to Close() returning.
 func (f *win32File) prepareIo() (*ioOperation, error) {

vendor/github.com/Microsoft/go-winio/go.mod

@@ -1,8 +1,9 @@
 module github.com/Microsoft/go-winio
 
-go 1.13
+go 1.12
 
 require (
+	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.7.0
 	golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c
 )

vendor/github.com/Microsoft/go-winio/go.sum

@@ -1,11 +1,14 @@
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/sirupsen/logrus v1.7.0 h1:ShrD1U9pZB12TX0cVy0DtePoCH97K8EtX+mg7ZARUtM=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c h1:VwygUrnw9jn88c4u8GD3rZQbqrP/tgas88tPUbBxQrk=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

vendor/github.com/Microsoft/go-winio/hvsock.go

@@ -1,4 +1,3 @@
-//go:build windows
 // +build windows
 
 package winio
@@ -253,23 +252,15 @@ func (conn *HvsockConn) Close() error {
 	return conn.sock.Close()
 }
 
-func (conn *HvsockConn) IsClosed() bool {
-	return conn.sock.IsClosed()
-}
-
 func (conn *HvsockConn) shutdown(how int) error {
-	if conn.IsClosed() {
-		return ErrFileClosed
-	}
-
-	err := syscall.Shutdown(conn.sock.handle, how)
+	err := syscall.Shutdown(conn.sock.handle, syscall.SHUT_RD)
 	if err != nil {
 		return os.NewSyscallError("shutdown", err)
 	}
 	return nil
 }
 
-// CloseRead shuts down the read end of the socket, preventing future read operations.
+// CloseRead shuts down the read end of the socket.
 func (conn *HvsockConn) CloseRead() error {
 	err := conn.shutdown(syscall.SHUT_RD)
 	if err != nil {
@@ -278,8 +269,8 @@ func (conn *HvsockConn) CloseRead() error {
 	return nil
 }
 
-// CloseWrite shuts down the write end of the socket, preventing future write operations and
-// notifying the other endpoint that no more data will be written.
+// CloseWrite shuts down the write end of the socket, notifying the other endpoint that
+// no more data will be written.
 func (conn *HvsockConn) CloseWrite() error {
 	err := conn.shutdown(syscall.SHUT_WR)
 	if err != nil {

vendor/github.com/Microsoft/go-winio/pkg/guid/guid.go

@@ -14,6 +14,8 @@ import (
 	"encoding/binary"
 	"fmt"
 	"strconv"
+
+	"golang.org/x/sys/windows"
 )
 
 // Variant specifies which GUID variant (or "type") of the GUID. It determines
@@ -39,6 +41,13 @@ type Version uint8
 var _ = (encoding.TextMarshaler)(GUID{})
 var _ = (encoding.TextUnmarshaler)(&GUID{})
 
+// GUID represents a GUID/UUID. It has the same structure as
+// golang.org/x/sys/windows.GUID so that it can be used with functions expecting
+// that type. It is defined as its own type so that stringification and
+// marshaling can be supported. The representation matches that used by native
+// Windows code.
+type GUID windows.GUID
+
 // NewV4 returns a new version 4 (pseudorandom) GUID, as defined by RFC 4122.
 func NewV4() (GUID, error) {
 	var b [16]byte

vendor/github.com/Microsoft/go-winio/pkg/guid/guid_nonwindows.go

@@ -1,15 +0,0 @@
-// +build !windows
-
-package guid
-
-// GUID represents a GUID/UUID. It has the same structure as
-// golang.org/x/sys/windows.GUID so that it can be used with functions expecting
-// that type. It is defined as its own type as that is only available to builds
-// targeted at `windows`. The representation matches that used by native Windows
-// code.
-type GUID struct {
-	Data1 uint32
-	Data2 uint16
-	Data3 uint16
-	Data4 [8]byte
-}

vendor/github.com/Microsoft/go-winio/pkg/guid/guid_windows.go

@@ -1,10 +0,0 @@
-package guid
-
-import "golang.org/x/sys/windows"
-
-// GUID represents a GUID/UUID. It has the same structure as
-// golang.org/x/sys/windows.GUID so that it can be used with functions expecting
-// that type. It is defined as its own type so that stringification and
-// marshaling can be supported. The representation matches that used by native
-// Windows code.
-type GUID windows.GUID

vendor/github.com/Microsoft/go-winio/pkg/security/grantvmgroupaccess.go

@@ -3,10 +3,11 @@
 package security
 
 import (
-	"fmt"
 	"os"
 	"syscall"
 	"unsafe"
+
+	"github.com/pkg/errors"
 )
 
 type (
@@ -71,7 +72,7 @@ func GrantVmGroupAccess(name string) error {
 	// Stat (to determine if `name` is a directory).
 	s, err := os.Stat(name)
 	if err != nil {
-		return fmt.Errorf("%s os.Stat %s: %w", gvmga, name, err)
+		return errors.Wrapf(err, "%s os.Stat %s", gvmga, name)
 	}
 
 	// Get a handle to the file/directory. Must defer Close on success.
@@ -87,7 +88,7 @@ func GrantVmGroupAccess(name string) error {
 	sd := uintptr(0)
 	origDACL := uintptr(0)
 	if err := getSecurityInfo(fd, uint32(ot), uint32(si), nil, nil, &origDACL, nil, &sd); err != nil {
-		return fmt.Errorf("%s GetSecurityInfo %s: %w", gvmga, name, err)
+		return errors.Wrapf(err, "%s GetSecurityInfo %s", gvmga, name)
 	}
 	defer syscall.LocalFree((syscall.Handle)(unsafe.Pointer(sd)))
 
@@ -101,7 +102,7 @@ func GrantVmGroupAccess(name string) error {
 
 	// And finally use SetSecurityInfo to apply the updated DACL.
 	if err := setSecurityInfo(fd, uint32(ot), uint32(si), uintptr(0), uintptr(0), newDACL, uintptr(0)); err != nil {
-		return fmt.Errorf("%s SetSecurityInfo %s: %w", gvmga, name, err)
+		return errors.Wrapf(err, "%s SetSecurityInfo %s", gvmga, name)
 	}
 
 	return nil
@@ -119,7 +120,7 @@ func createFile(name string, isDir bool) (syscall.Handle, error) {
 	}
 	fd, err := syscall.CreateFile(&namep[0], da, sm, nil, syscall.OPEN_EXISTING, fa, 0)
 	if err != nil {
-		return 0, fmt.Errorf("%s syscall.CreateFile %s: %w", gvmga, name, err)
+		return 0, errors.Wrapf(err, "%s syscall.CreateFile %s", gvmga, name)
 	}
 	return fd, nil
 }
@@ -130,7 +131,7 @@ func generateDACLWithAcesAdded(name string, isDir bool, origDACL uintptr) (uintp
 	// Generate pointers to the SIDs based on the string SIDs
 	sid, err := syscall.StringToSid(sidVmGroup)
 	if err != nil {
-		return 0, fmt.Errorf("%s syscall.StringToSid %s %s: %w", gvmga, name, sidVmGroup, err)
+		return 0, errors.Wrapf(err, "%s syscall.StringToSid %s %s", gvmga, name, sidVmGroup)
 	}
 
 	inheritance := inheritModeNoInheritance
@@ -153,7 +154,7 @@ func generateDACLWithAcesAdded(name string, isDir bool, origDACL uintptr) (uintp
 
 	modifiedDACL := uintptr(0)
 	if err := setEntriesInAcl(uintptr(uint32(1)), uintptr(unsafe.Pointer(&eaArray[0])), origDACL, &modifiedDACL); err != nil {
-		return 0, fmt.Errorf("%s SetEntriesInAcl %s: %w", gvmga, name, err)
+		return 0, errors.Wrapf(err, "%s SetEntriesInAcl %s", gvmga, name)
 	}
 
 	return modifiedDACL, nil

vendor/github.com/Microsoft/go-winio/pkg/security/syscall_windows.go

@@ -2,6 +2,6 @@ package security
 
 //go:generate go run mksyscall_windows.go -output zsyscall_windows.go syscall_windows.go
 
-//sys getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (win32err error) = advapi32.GetSecurityInfo
-//sys setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (win32err error) = advapi32.SetSecurityInfo
-//sys setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (win32err error) = advapi32.SetEntriesInAclW
+//sys getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (err error) [failretval!=0] = advapi32.GetSecurityInfo
+//sys setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (err error) [failretval!=0] = advapi32.SetSecurityInfo
+//sys setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (err error) [failretval!=0] = advapi32.SetEntriesInAclW

vendor/github.com/Microsoft/go-winio/pkg/security/zsyscall_windows.go

@@ -45,26 +45,26 @@ var (
 	procSetSecurityInfo  = modadvapi32.NewProc("SetSecurityInfo")
 )
 
-func getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (win32err error) {
-	r0, _, _ := syscall.Syscall9(procGetSecurityInfo.Addr(), 8, uintptr(handle), uintptr(objectType), uintptr(si), uintptr(unsafe.Pointer(ppsidOwner)), uintptr(unsafe.Pointer(ppsidGroup)), uintptr(unsafe.Pointer(ppDacl)), uintptr(unsafe.Pointer(ppSacl)), uintptr(unsafe.Pointer(ppSecurityDescriptor)), 0)
-	if r0 != 0 {
-		win32err = syscall.Errno(r0)
+func getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(procGetSecurityInfo.Addr(), 8, uintptr(handle), uintptr(objectType), uintptr(si), uintptr(unsafe.Pointer(ppsidOwner)), uintptr(unsafe.Pointer(ppsidGroup)), uintptr(unsafe.Pointer(ppDacl)), uintptr(unsafe.Pointer(ppSacl)), uintptr(unsafe.Pointer(ppSecurityDescriptor)), 0)
+	if r1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (win32err error) {
-	r0, _, _ := syscall.Syscall6(procSetEntriesInAclW.Addr(), 4, uintptr(count), uintptr(pListOfEEs), uintptr(oldAcl), uintptr(unsafe.Pointer(newAcl)), 0, 0)
-	if r0 != 0 {
-		win32err = syscall.Errno(r0)
+func setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetEntriesInAclW.Addr(), 4, uintptr(count), uintptr(pListOfEEs), uintptr(oldAcl), uintptr(unsafe.Pointer(newAcl)), 0, 0)
+	if r1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (win32err error) {
-	r0, _, _ := syscall.Syscall9(procSetSecurityInfo.Addr(), 7, uintptr(handle), uintptr(objectType), uintptr(si), uintptr(psidOwner), uintptr(psidGroup), uintptr(pDacl), uintptr(pSacl), 0, 0)
-	if r0 != 0 {
-		win32err = syscall.Errno(r0)
+func setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(procSetSecurityInfo.Addr(), 7, uintptr(handle), uintptr(objectType), uintptr(si), uintptr(psidOwner), uintptr(psidGroup), uintptr(pDacl), uintptr(pSacl), 0, 0)
+	if r1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }

vendor/github.com/Microsoft/go-winio/vhd/vhd.go

@@ -1,4 +1,3 @@
-//go:build windows
 // +build windows
 
 package vhd
@@ -8,16 +7,17 @@ import (
 	"syscall"
 
 	"github.com/Microsoft/go-winio/pkg/guid"
+	"github.com/pkg/errors"
 	"golang.org/x/sys/windows"
 )
 
 //go:generate go run mksyscall_windows.go -output zvhd_windows.go vhd.go
 
-//sys createVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, securityDescriptor *uintptr, createVirtualDiskFlags uint32, providerSpecificFlags uint32, parameters *CreateVirtualDiskParameters, overlapped *syscall.Overlapped, handle *syscall.Handle) (win32err error) = virtdisk.CreateVirtualDisk
-//sys openVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, openVirtualDiskFlags uint32, parameters *openVirtualDiskParameters, handle *syscall.Handle) (win32err error) = virtdisk.OpenVirtualDisk
-//sys attachVirtualDisk(handle syscall.Handle, securityDescriptor *uintptr, attachVirtualDiskFlag uint32, providerSpecificFlags uint32, parameters *AttachVirtualDiskParameters, overlapped *syscall.Overlapped) (win32err error) = virtdisk.AttachVirtualDisk
-//sys detachVirtualDisk(handle syscall.Handle, detachVirtualDiskFlags uint32, providerSpecificFlags uint32) (win32err error) = virtdisk.DetachVirtualDisk
-//sys getVirtualDiskPhysicalPath(handle syscall.Handle, diskPathSizeInBytes *uint32, buffer *uint16) (win32err error) = virtdisk.GetVirtualDiskPhysicalPath
+//sys createVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, securityDescriptor *uintptr, createVirtualDiskFlags uint32, providerSpecificFlags uint32, parameters *CreateVirtualDiskParameters, overlapped *syscall.Overlapped, handle *syscall.Handle) (err error) [failretval != 0] = virtdisk.CreateVirtualDisk
+//sys openVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, openVirtualDiskFlags uint32, parameters *OpenVirtualDiskParameters, handle *syscall.Handle) (err error) [failretval != 0] = virtdisk.OpenVirtualDisk
+//sys attachVirtualDisk(handle syscall.Handle, securityDescriptor *uintptr, attachVirtualDiskFlag uint32, providerSpecificFlags uint32, parameters *AttachVirtualDiskParameters, overlapped *syscall.Overlapped) (err error) [failretval != 0] = virtdisk.AttachVirtualDisk
+//sys detachVirtualDisk(handle syscall.Handle, detachVirtualDiskFlags uint32, providerSpecificFlags uint32) (err error) [failretval != 0] = virtdisk.DetachVirtualDisk
+//sys getVirtualDiskPhysicalPath(handle syscall.Handle, diskPathSizeInBytes *uint32, buffer *uint16) (err error) [failretval != 0] = virtdisk.GetVirtualDiskPhysicalPath
 
 type (
 	CreateVirtualDiskFlag uint32
@@ -62,27 +62,13 @@ type OpenVirtualDiskParameters struct {
 	Version2 OpenVersion2
 }
 
-// The higher level `OpenVersion2` struct uses bools to refer to `GetInfoOnly` and `ReadOnly` for ease of use. However,
-// the internal windows structure uses `BOOLS` aka int32s for these types. `openVersion2` is used for translating
-// `OpenVersion2` fields to the correct windows internal field types on the `Open____` methods.
-type openVersion2 struct {
-	getInfoOnly    int32
-	readOnly       int32
-	resiliencyGUID guid.GUID
-}
-
-type openVirtualDiskParameters struct {
-	version  uint32
-	version2 openVersion2
-}
-
 type AttachVersion2 struct {
 	RestrictedOffset uint64
 	RestrictedLength uint64
 }
 
 type AttachVirtualDiskParameters struct {
-	Version  uint32
+	Version  uint32 // Must always be set to 2
 	Version2 AttachVersion2
 }
 
@@ -160,13 +146,16 @@ func CreateVhdx(path string, maxSizeInGb, blockSizeInMb uint32) error {
 		return err
 	}
 
-	return syscall.CloseHandle(handle)
+	if err := syscall.CloseHandle(handle); err != nil {
+		return err
+	}
+	return nil
 }
 
 // DetachVirtualDisk detaches a virtual hard disk by handle.
 func DetachVirtualDisk(handle syscall.Handle) (err error) {
 	if err := detachVirtualDisk(handle, 0, 0); err != nil {
-		return fmt.Errorf("failed to detach virtual disk: %w", err)
+		return errors.Wrap(err, "failed to detach virtual disk")
 	}
 	return nil
 }
@@ -196,7 +185,7 @@ func AttachVirtualDisk(handle syscall.Handle, attachVirtualDiskFlag AttachVirtua
 		parameters,
 		nil,
 	); err != nil {
-		return fmt.Errorf("failed to attach virtual disk: %w", err)
+		return errors.Wrap(err, "failed to attach virtual disk")
 	}
 	return nil
 }
@@ -220,7 +209,7 @@ func AttachVhd(path string) (err error) {
 		AttachVirtualDiskFlagNone,
 		&params,
 	); err != nil {
-		return fmt.Errorf("failed to attach virtual disk: %w", err)
+		return errors.Wrap(err, "failed to attach virtual disk")
 	}
 	return nil
 }
@@ -245,35 +234,19 @@ func OpenVirtualDiskWithParameters(vhdPath string, virtualDiskAccessMask Virtual
 	var (
 		handle      syscall.Handle
 		defaultType VirtualStorageType
-		getInfoOnly int32
-		readOnly    int32
 	)
 	if parameters.Version != 2 {
 		return handle, fmt.Errorf("only version 2 VHDs are supported, found version: %d", parameters.Version)
 	}
-	if parameters.Version2.GetInfoOnly {
-		getInfoOnly = 1
-	}
-	if parameters.Version2.ReadOnly {
-		readOnly = 1
-	}
-	params := &openVirtualDiskParameters{
-		version: parameters.Version,
-		version2: openVersion2{
-			getInfoOnly,
-			readOnly,
-			parameters.Version2.ResiliencyGUID,
-		},
-	}
 	if err := openVirtualDisk(
 		&defaultType,
 		vhdPath,
 		uint32(virtualDiskAccessMask),
 		uint32(openVirtualDiskFlags),
-		params,
+		parameters,
 		&handle,
 	); err != nil {
-		return 0, fmt.Errorf("failed to open virtual disk: %w", err)
+		return 0, errors.Wrap(err, "failed to open virtual disk")
 	}
 	return handle, nil
 }
@@ -299,7 +272,7 @@ func CreateVirtualDisk(path string, virtualDiskAccessMask VirtualDiskAccessMask,
 		nil,
 		&handle,
 	); err != nil {
-		return handle, fmt.Errorf("failed to create virtual disk: %w", err)
+		return handle, errors.Wrap(err, "failed to create virtual disk")
 	}
 	return handle, nil
 }
@@ -317,7 +290,7 @@ func GetVirtualDiskPhysicalPath(handle syscall.Handle) (_ string, err error) {
 		&diskPathSizeInBytes,
 		&diskPhysicalPathBuf[0],
 	); err != nil {
-		return "", fmt.Errorf("failed to get disk physical path: %w", err)
+		return "", errors.Wrap(err, "failed to get disk physical path")
 	}
 	return windows.UTF16ToString(diskPhysicalPathBuf[:]), nil
 }
@@ -341,10 +314,10 @@ func CreateDiffVhd(diffVhdPath, baseVhdPath string, blockSizeInMB uint32) error
 		createParams,
 	)
 	if err != nil {
-		return fmt.Errorf("failed to create differencing vhd: %w", err)
+		return fmt.Errorf("failed to create differencing vhd: %s", err)
 	}
 	if err := syscall.CloseHandle(vhdHandle); err != nil {
-		return fmt.Errorf("failed to close differencing vhd handle: %w", err)
+		return fmt.Errorf("failed to close differencing vhd handle: %s", err)
 	}
 	return nil
 }

vendor/github.com/Microsoft/go-winio/vhd/zvhd_windows.go

@@ -47,60 +47,60 @@ var (
 	procOpenVirtualDisk            = modvirtdisk.NewProc("OpenVirtualDisk")
 )
 
-func attachVirtualDisk(handle syscall.Handle, securityDescriptor *uintptr, attachVirtualDiskFlag uint32, providerSpecificFlags uint32, parameters *AttachVirtualDiskParameters, overlapped *syscall.Overlapped) (win32err error) {
-	r0, _, _ := syscall.Syscall6(procAttachVirtualDisk.Addr(), 6, uintptr(handle), uintptr(unsafe.Pointer(securityDescriptor)), uintptr(attachVirtualDiskFlag), uintptr(providerSpecificFlags), uintptr(unsafe.Pointer(parameters)), uintptr(unsafe.Pointer(overlapped)))
-	if r0 != 0 {
-		win32err = syscall.Errno(r0)
+func attachVirtualDisk(handle syscall.Handle, securityDescriptor *uintptr, attachVirtualDiskFlag uint32, providerSpecificFlags uint32, parameters *AttachVirtualDiskParameters, overlapped *syscall.Overlapped) (err error) {
+	r1, _, e1 := syscall.Syscall6(procAttachVirtualDisk.Addr(), 6, uintptr(handle), uintptr(unsafe.Pointer(securityDescriptor)), uintptr(attachVirtualDiskFlag), uintptr(providerSpecificFlags), uintptr(unsafe.Pointer(parameters)), uintptr(unsafe.Pointer(overlapped)))
+	if r1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func createVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, securityDescriptor *uintptr, createVirtualDiskFlags uint32, providerSpecificFlags uint32, parameters *CreateVirtualDiskParameters, overlapped *syscall.Overlapped, handle *syscall.Handle) (win32err error) {
+func createVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, securityDescriptor *uintptr, createVirtualDiskFlags uint32, providerSpecificFlags uint32, parameters *CreateVirtualDiskParameters, overlapped *syscall.Overlapped, handle *syscall.Handle) (err error) {
 	var _p0 *uint16
-	_p0, win32err = syscall.UTF16PtrFromString(path)
-	if win32err != nil {
+	_p0, err = syscall.UTF16PtrFromString(path)
+	if err != nil {
 		return
 	}
 	return _createVirtualDisk(virtualStorageType, _p0, virtualDiskAccessMask, securityDescriptor, createVirtualDiskFlags, providerSpecificFlags, parameters, overlapped, handle)
 }
 
-func _createVirtualDisk(virtualStorageType *VirtualStorageType, path *uint16, virtualDiskAccessMask uint32, securityDescriptor *uintptr, createVirtualDiskFlags uint32, providerSpecificFlags uint32, parameters *CreateVirtualDiskParameters, overlapped *syscall.Overlapped, handle *syscall.Handle) (win32err error) {
-	r0, _, _ := syscall.Syscall9(procCreateVirtualDisk.Addr(), 9, uintptr(unsafe.Pointer(virtualStorageType)), uintptr(unsafe.Pointer(path)), uintptr(virtualDiskAccessMask), uintptr(unsafe.Pointer(securityDescriptor)), uintptr(createVirtualDiskFlags), uintptr(providerSpecificFlags), uintptr(unsafe.Pointer(parameters)), uintptr(unsafe.Pointer(overlapped)), uintptr(unsafe.Pointer(handle)))
-	if r0 != 0 {
-		win32err = syscall.Errno(r0)
+func _createVirtualDisk(virtualStorageType *VirtualStorageType, path *uint16, virtualDiskAccessMask uint32, securityDescriptor *uintptr, createVirtualDiskFlags uint32, providerSpecificFlags uint32, parameters *CreateVirtualDiskParameters, overlapped *syscall.Overlapped, handle *syscall.Handle) (err error) {
+	r1, _, e1 := syscall.Syscall9(procCreateVirtualDisk.Addr(), 9, uintptr(unsafe.Pointer(virtualStorageType)), uintptr(unsafe.Pointer(path)), uintptr(virtualDiskAccessMask), uintptr(unsafe.Pointer(securityDescriptor)), uintptr(createVirtualDiskFlags), uintptr(providerSpecificFlags), uintptr(unsafe.Pointer(parameters)), uintptr(unsafe.Pointer(overlapped)), uintptr(unsafe.Pointer(handle)))
+	if r1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func detachVirtualDisk(handle syscall.Handle, detachVirtualDiskFlags uint32, providerSpecificFlags uint32) (win32err error) {
-	r0, _, _ := syscall.Syscall(procDetachVirtualDisk.Addr(), 3, uintptr(handle), uintptr(detachVirtualDiskFlags), uintptr(providerSpecificFlags))
-	if r0 != 0 {
-		win32err = syscall.Errno(r0)
+func detachVirtualDisk(handle syscall.Handle, detachVirtualDiskFlags uint32, providerSpecificFlags uint32) (err error) {
+	r1, _, e1 := syscall.Syscall(procDetachVirtualDisk.Addr(), 3, uintptr(handle), uintptr(detachVirtualDiskFlags), uintptr(providerSpecificFlags))
+	if r1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func getVirtualDiskPhysicalPath(handle syscall.Handle, diskPathSizeInBytes *uint32, buffer *uint16) (win32err error) {
-	r0, _, _ := syscall.Syscall(procGetVirtualDiskPhysicalPath.Addr(), 3, uintptr(handle), uintptr(unsafe.Pointer(diskPathSizeInBytes)), uintptr(unsafe.Pointer(buffer)))
-	if r0 != 0 {
-		win32err = syscall.Errno(r0)
+func getVirtualDiskPhysicalPath(handle syscall.Handle, diskPathSizeInBytes *uint32, buffer *uint16) (err error) {
+	r1, _, e1 := syscall.Syscall(procGetVirtualDiskPhysicalPath.Addr(), 3, uintptr(handle), uintptr(unsafe.Pointer(diskPathSizeInBytes)), uintptr(unsafe.Pointer(buffer)))
+	if r1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func openVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, openVirtualDiskFlags uint32, parameters *openVirtualDiskParameters, handle *syscall.Handle) (win32err error) {
+func openVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, openVirtualDiskFlags uint32, parameters *OpenVirtualDiskParameters, handle *syscall.Handle) (err error) {
 	var _p0 *uint16
-	_p0, win32err = syscall.UTF16PtrFromString(path)
-	if win32err != nil {
+	_p0, err = syscall.UTF16PtrFromString(path)
+	if err != nil {
 		return
 	}
 	return _openVirtualDisk(virtualStorageType, _p0, virtualDiskAccessMask, openVirtualDiskFlags, parameters, handle)
 }
 
-func _openVirtualDisk(virtualStorageType *VirtualStorageType, path *uint16, virtualDiskAccessMask uint32, openVirtualDiskFlags uint32, parameters *openVirtualDiskParameters, handle *syscall.Handle) (win32err error) {
-	r0, _, _ := syscall.Syscall6(procOpenVirtualDisk.Addr(), 6, uintptr(unsafe.Pointer(virtualStorageType)), uintptr(unsafe.Pointer(path)), uintptr(virtualDiskAccessMask), uintptr(openVirtualDiskFlags), uintptr(unsafe.Pointer(parameters)), uintptr(unsafe.Pointer(handle)))
-	if r0 != 0 {
-		win32err = syscall.Errno(r0)
+func _openVirtualDisk(virtualStorageType *VirtualStorageType, path *uint16, virtualDiskAccessMask uint32, openVirtualDiskFlags uint32, parameters *OpenVirtualDiskParameters, handle *syscall.Handle) (err error) {
+	r1, _, e1 := syscall.Syscall6(procOpenVirtualDisk.Addr(), 6, uintptr(unsafe.Pointer(virtualStorageType)), uintptr(unsafe.Pointer(path)), uintptr(virtualDiskAccessMask), uintptr(openVirtualDiskFlags), uintptr(unsafe.Pointer(parameters)), uintptr(unsafe.Pointer(handle)))
+	if r1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }

vendor/github.com/Microsoft/hcsshim/.gitignore

@@ -1,38 +1,3 @@
-# Binaries for programs and plugins
 *.exe
-*.dll
-*.so
-*.dylib
-
-# Ignore vscode setting files
-.vscode/
-
-# Test binary, build with `go test -c`
-*.test
-
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
-
-# Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736
-.glide/
-
-# Ignore gcs bin directory
-service/bin/
-service/pkg/
-
-*.img
-*.vhd
-*.tar.gz
-
-# Make stuff
-.rootfs-done
-bin/*
-rootfs/*
-*.o
-/build/
-
-deps/*
-out/*
-
-.idea/
-.vscode/
+.idea
+.vscode