Switch from pkg/secrets to pkg/subscriptions

The buildah/pkg/secrts package was move to containers/common/pkg/subscriptions. Switch to using this by default. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2025-12-10 15:47:46 +08:00 · 2020-11-25 05:36:09 -05:00
parent 397e9a9f1b
commit 20160af018
20 changed files with 168 additions and 149 deletions
--- a/vendor/github.com/containers/buildah/buildah.go
+++ b/vendor/github.com/containers/buildah/buildah.go
@@ -28,7 +28,7 @@ const (
 	Package = "buildah"
 	// Version for the Package.  Bump version in contrib/rpm/buildah.spec
 	// too.
-	Version = "1.18.0"
+	Version = "1.19.0-dev"
 	// The value we use to identify what type of information, currently a
 	// serialized Builder structure, we are using as per-container state.
 	// This should only be changed when we make incompatible changes to
--- a/vendor/github.com/containers/buildah/go.mod
+++ b/vendor/github.com/containers/buildah/go.mod
@@ -5,12 +5,11 @@ go 1.12
 require (
 	github.com/containerd/containerd v1.4.1 // indirect
 	github.com/containernetworking/cni v0.7.2-0.20190904153231-83439463f784
-	github.com/containers/common v0.26.3
-	github.com/containers/image/v5 v5.8.0
+	github.com/containers/common v0.29.0
+	github.com/containers/image/v5 v5.8.1
 	github.com/containers/ocicrypt v1.0.3
-	github.com/containers/storage v1.24.0
+	github.com/containers/storage v1.24.1
 	github.com/docker/distribution v2.7.1+incompatible
-	github.com/docker/docker v17.12.0-ce-rc1.0.20201020191947-73dc6a680cdd+incompatible // indirect
 	github.com/docker/go-units v0.4.0
 	github.com/docker/libnetwork v0.8.0-dev.2.0.20190625141545-5a177b73e316
 	github.com/fsouza/go-dockerclient v1.6.6
--- a/vendor/github.com/containers/buildah/go.sum
+++ b/vendor/github.com/containers/buildah/go.sum
@@ -73,20 +73,17 @@ github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDG
 github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=
 github.com/containernetworking/cni v0.7.2-0.20190904153231-83439463f784 h1:rqUVLD8I859xRgUx/WMC3v7QAFqbLKZbs+0kqYboRJc=
 github.com/containernetworking/cni v0.7.2-0.20190904153231-83439463f784/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containers/common v0.26.3 h1:5Kb5fMmJ7/xMiJ+iEbPA+5pQpl/FGxCgJex4nml4Slo=
-github.com/containers/common v0.26.3/go.mod h1:hJWZIlrl5MsE2ELNRa+MPp6I1kPbXHauuj0Ym4BsLG4=
-github.com/containers/image/v5 v5.7.0 h1:fiTC8/Xbr+zEP6njGTZtPW/3UD7MC93nC9DbUoWdxkA=
-github.com/containers/image/v5 v5.7.0/go.mod h1:8aOy+YaItukxghRORkvhq5ibWttHErzDLy6egrKfKos=
-github.com/containers/image/v5 v5.8.0 h1:B3FGHi0bdGXgg698kBIGOlHCXN5n+scJr6/5354GOPU=
-github.com/containers/image/v5 v5.8.0/go.mod h1:jKxdRtyIDumVa56hdsZvV+gwx4zB50hRou6pIuCWLkg=
+github.com/containers/common v0.29.0 h1:hTMC+urdkk5bKfhL/OgCixIX5xjJgQ2l2jPG745ECFQ=
+github.com/containers/common v0.29.0/go.mod h1:yT4GTUHsKRmpaDb+mecXRnIMre7W3ZgwXqaYMywXlaA=
+github.com/containers/image/v5 v5.8.1 h1:aHW8a/Kd0dTJ7PTL/fc6y12sJqHxWgqilu+XyHfjD8Q=
+github.com/containers/image/v5 v5.8.1/go.mod h1:blOEFd/iFdeyh891ByhCVUc+xAcaI3gBegXECwz9UbQ=
 github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b h1:Q8ePgVfHDplZ7U33NwHZkrVELsZP5fYj9pM5WBZB2GE=
 github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
 github.com/containers/ocicrypt v1.0.3 h1:vYgl+RZ9Q3DPMuTfxmN+qp0X2Bj52uuY2vnt6GzVe1c=
 github.com/containers/ocicrypt v1.0.3/go.mod h1:CUBa+8MRNL/VkpxYIpaMtgn1WgXGyvPQj8jcy0EVG6g=
-github.com/containers/storage v1.23.6/go.mod h1:haFs0HRowKwyzvWEx9EgI3WsL8XCSnBDb5f8P5CAxJY=
 github.com/containers/storage v1.23.7/go.mod h1:cUT2zHjtx+WlVri30obWmM2gpqpi8jfPsmIzP1TVpEI=
-github.com/containers/storage v1.24.0 h1:Fo2LkF7tkMLmo38sTZ/G8wHjcn8JfUFPfyTxM4WwMfk=
-github.com/containers/storage v1.24.0/go.mod h1:A4d3BzuZK9b3oLVEsiSRhZLPIx3z7utgiPyXLK/YMhY=
+github.com/containers/storage v1.24.1 h1:1+f8fy6ly35c8SLet5jzZ8t0WJJs5+xSpfMAYw0R3kc=
+github.com/containers/storage v1.24.1/go.mod h1:0xJL06Dmd+ZYXIUdnBUPN0JnhHGgwMkLvnnAonJfWJU=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
@@ -232,8 +229,8 @@ github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvW
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.11.1/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.2 h1:MiK62aErc3gIiVEtyzKfeOHgW7atJb5g/KNX5m3c2nQ=
-github.com/klauspost/compress v1.11.2/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.11.3 h1:dB4Bn0tN3wdCzQxnS8r06kV74qN/TAfaIS0bVE8h3jc=
+github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
@@ -278,7 +275,6 @@ github.com/moby/sys/mount v0.1.1 h1:mdhBytJ1SMmMat0gtzWWjFX/87K5j6E/7Q5z7rR0cZY=
 github.com/moby/sys/mount v0.1.1/go.mod h1:FVQFLDRWwyBjDTBNQXDlWnSFREqOo3OKX9aqhmeoo74=
 github.com/moby/sys/mountinfo v0.1.0/go.mod h1:w2t2Avltqx8vE7gX5l+QiBKxODu2TX0+Syr3h52Tw4o=
 github.com/moby/sys/mountinfo v0.1.3/go.mod h1:w2t2Avltqx8vE7gX5l+QiBKxODu2TX0+Syr3h52Tw4o=
-github.com/moby/sys/mountinfo v0.3.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/sys/mountinfo v0.4.0 h1:1KInV3Huv18akCu58V7lzNlt+jFmqlu1EaErnEHE/VM=
 github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/term v0.0.0-20200429084858-129dac9f73f6/go.mod h1:or9wGItza1sRcM4Wd3dIv8DsFHYQuFsMHEdxUIlUxms=
--- a/vendor/github.com/containers/buildah/image.go
+++ b/vendor/github.com/containers/buildah/image.go
@@ -321,10 +321,7 @@ func (i *containerImageRef) NewImageSource(ctx context.Context, sc *types.System
 		}
 		// If we're not re-exporting the data, and we're reusing layers individually, reuse
 		// the blobsum and diff IDs.
-		if !i.exporting && !i.squash && layerID != i.layerID {
-			if layer.UncompressedDigest == "" {
-				return nil, errors.Errorf("unable to look up size of layer %q", layerID)
-			}
+		if !i.exporting && !i.squash && layerID != i.layerID && layer.UncompressedDigest != "" {
 			layerBlobSum := layer.UncompressedDigest
 			layerBlobSize := layer.UncompressedSize
 			diffID := layer.UncompressedDigest
--- a/vendor/github.com/containers/buildah/imagebuildah/build.go
+++ b/vendor/github.com/containers/buildah/imagebuildah/build.go
@@ -185,6 +185,8 @@ type BuildOptions struct {
 	Jobs *int
 	// LogRusage logs resource usage for each step.
 	LogRusage bool
+	// Excludes is a list of excludes to be used instead of the .dockerignore file.
+	Excludes []string
 }

 // BuildDockerfiles parses a set of one or more Dockerfiles (which may be
--- a/vendor/github.com/containers/buildah/imagebuildah/executor.go
+++ b/vendor/github.com/containers/buildah/imagebuildah/executor.go
@@ -130,9 +130,12 @@ func NewExecutor(store storage.Store, options BuildOptions, mainNode *parser.Nod
 		return nil, errors.Wrapf(err, "failed to get container config")
 	}

-	excludes, err := imagebuilder.ParseDockerignore(options.ContextDirectory)
-	if err != nil {
-		return nil, err
+	excludes := options.Excludes
+	if len(excludes) == 0 {
+		excludes, err = imagebuilder.ParseDockerignore(options.ContextDirectory)
+		if err != nil {
+			return nil, err
+		}
 	}
 	capabilities, err := defaultContainerConfig.Capabilities("", options.AddCapabilities, options.DropCapabilities)
 	if err != nil {
--- a/vendor/github.com/containers/buildah/imagebuildah/stage_executor.go
+++ b/vendor/github.com/containers/buildah/imagebuildah/stage_executor.go
@@ -368,6 +368,7 @@ func (s *StageExecutor) Run(run imagebuilder.Run, config docker.Config) error {
 		Stderr:           s.executor.err,
 		Quiet:            s.executor.quiet,
 		NamespaceOptions: s.executor.namespaceOptions,
+		Terminal:         buildah.WithoutTerminal,
 	}
 	if config.NetworkDisabled {
 		options.ConfigureNetwork = buildah.NetworkDisabled
@@ -1144,7 +1145,11 @@ func (s *StageExecutor) intermediateImageExists(ctx context.Context, currNode *p
 		// lines in the Dockerfile up till the point we are at in the build.
 		manifestType, history, diffIDs, err := s.executor.getImageTypeAndHistoryAndDiffIDs(ctx, image.ID)
 		if err != nil {
-			return "", errors.Wrapf(err, "error getting history of %q", image.ID)
+			// It's possible that this image is for another architecture, which results
+			// in a custom-crafted error message that we'd have to use substring matching
+			// to recognize.  Instead, ignore the image.
+			logrus.Debugf("error getting history of %q (%v), ignoring it", image.ID, err)
+			continue
 		}
 		// If this candidate isn't of the type that we're building, then it may have lost
 		// some format-specific information that a building-without-cache run wouldn't lose.
--- a/vendor/github.com/containers/buildah/install.md
+++ b/vendor/github.com/containers/buildah/install.md
@@ -59,35 +59,31 @@ sudo dnf -y install buildah

 #### [Debian](https://debian.org)

-The buildah package is [being worked on](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928083)
-for inclusion in the default Debian repos.
-
-Alternatively, the [Kubic project](https://build.opensuse.org/project/show/devel:kubic:libcontainers:stable)
-provides packages for Debian 10, testing and unstable.
+The buildah package is available in
+the [Bullseye (testing) branch](https://packages.debian.org/bullseye/buildah), which
+will be the next stable release (Debian 11) as well as Debian Unstable/Sid.

 ```bash
-# Debian Unstable/Sid
-echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Unstable/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
-wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Unstable/Release.key -O Release.key
-
-# Debian Testing
-echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Testing/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
-wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Testing/Release.key -O Release.key
-
-# Debian 10
-echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_10/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
-wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_10/Release.key -O Release.key
-
-sudo apt-key add - < Release.key
-sudo apt-get update -qq
-sudo apt-get -qq -y install buildah
+# Debian Testing/Bullseye or Unstable/Sid
+sudo apt-get update
+sudo apt-get -y install buildah
 ```

+The [Kubic project](https://build.opensuse.org/project/show/devel:kubic:libcontainers:stable)
+provides packages for Debian 10. The Kubic packages for Debian Testing/Bullseye and Debian Unstable/Sid
+have been discontinued to avoid
+[conflicts](https://github.com/containers/buildah/issues/2797) with the official packages.

-### [Fedora](https://www.fedoraproject.org), [CentOS](https://www.centos.org)
+Caution: If you upgrade from Debian 10 to Testing/Bullseye or
+Unstable/Sid you would likely end up downgrading Buildah because the version in
+OBS is more frequently updated than the one in Debian's official repositories,
+due to how Debian works.
+
+
+### [Fedora](https://www.fedoraproject.org)

 ```bash
-sudo yum -y install buildah
+sudo dnf -y install buildah
 ```

 ### [Fedora SilverBlue](https://silverblue.fedoraproject.org)
@@ -127,19 +123,25 @@ sudo subscription-manager repos --enable=rhel-7-server-extras-rpms
 sudo yum -y install buildah
 ```

-#### [Raspbian](https://raspbian.org)
+#### [Raspberry Pi OS armhf (ex Raspbian)](https://www.raspberrypi.org/downloads/raspberry-pi-os/)

 The Kubic project provides packages for Raspbian 10.

 ```bash
 # Raspbian 10
-echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Raspbian_10/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
-wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Raspbian_10/Release.key -O Release.key
-sudo apt-key add - < Release.key
+echo 'deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Raspbian_10/ /' | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
+curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Raspbian_10/Release.key | sudo apt-key add -
 sudo apt-get update -qq
 sudo apt-get -qq -y install buildah
 ```

+#### [Raspberry Pi OS arm64 (beta)](https://downloads.raspberrypi.org/raspios_arm64/images/)
+
+Raspberry Pi OS use the standard Debian's repositories,
+so it is fully compatible with Debian's arm64 repository.
+You can simply follow the [steps for Debian](#debian) to install podman.
+
+
 ### [RHEL8 Beta](https://www.redhat.com/en/blog/powering-its-future-while-preserving-present-introducing-red-hat-enterprise-linux-8-beta?intcmp=701f2000001Cz6OAAS)

 ```bash
@@ -149,7 +151,16 @@ sudo yum module install -y buildah

 ### [Ubuntu](https://www.ubuntu.com)

-The Kubic project provides packages for Ubuntu 18.04, 19.04 and 19.10 (it should also work with direct derivatives like Pop!\_OS).
+The buildah package is available in the official repositories for Ubuntu 20.10
+and newer.
+
+```bash
+# Ubuntu 20.10 and newer
+sudo apt-get -y update
+sudo apt-get -y install buildah
+```
+
+The [Kubic project](https://build.opensuse.org/package/show/devel:kubic:libcontainers:stable/buildah) provides packages for some older but supported Ubuntu versions (it should also work with direct derivatives like Pop!\_OS).

 ```bash
 . /etc/os-release
--- a/vendor/github.com/containers/buildah/pkg/cli/common.go
+++ b/vendor/github.com/containers/buildah/pkg/cli/common.go
@@ -59,6 +59,7 @@ type BudResults struct {
 	Creds               string
 	DisableCompression  bool
 	DisableContentTrust bool
+	IgnoreFile          string
 	File                []string
 	Format              string
 	Iidfile             string
@@ -185,6 +186,7 @@ func GetBudFlags(flags *BudResults) pflag.FlagSet {
 	fs.StringVar(&flags.Creds, "creds", "", "use `[username[:password]]` for accessing the registry")
 	fs.BoolVarP(&flags.DisableCompression, "disable-compression", "D", true, "don't compress layers by default")
 	fs.BoolVar(&flags.DisableContentTrust, "disable-content-trust", false, "This is a Docker specific option and is a NOOP")
+	fs.StringVar(&flags.IgnoreFile, "ignorefile", "", "path to an alternate .dockerignore file")
 	fs.StringSliceVarP(&flags.File, "file", "f", []string{}, "`pathname or URL` of a Dockerfile")
 	fs.StringVar(&flags.Format, "format", DefaultFormat(), "`format` of the built image's manifest and metadata. Use BUILDAH_FORMAT environment variable to override.")
 	fs.StringVar(&flags.Iidfile, "iidfile", "", "`file` to write the image ID to")
@@ -231,6 +233,7 @@ func GetBudFlagsCompletions() commonComp.FlagCompletions {
 	flagCompletion["creds"] = commonComp.AutocompleteNone
 	flagCompletion["file"] = commonComp.AutocompleteDefault
 	flagCompletion["format"] = commonComp.AutocompleteNone
+	flagCompletion["ignorefile"] = commonComp.AutocompleteDefault
 	flagCompletion["iidfile"] = commonComp.AutocompleteDefault
 	flagCompletion["jobs"] = commonComp.AutocompleteNone
 	flagCompletion["label"] = commonComp.AutocompleteNone
--- a/vendor/github.com/containers/buildah/pkg/secrets/secrets.go
+++ b/vendor/github.com/containers/buildah/pkg/secrets/secrets.go
@@ -1,386 +0,0 @@
-package secrets
-
-import (
-	"bufio"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/containers/buildah/pkg/umask"
-	"github.com/containers/storage/pkg/idtools"
-	rspec "github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/opencontainers/selinux/go-selinux/label"
-	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
-)
-
-var (
-	// DefaultMountsFile holds the default mount paths in the form
-	// "host_path:container_path"
-	DefaultMountsFile = "/usr/share/containers/mounts.conf"
-	// OverrideMountsFile holds the default mount paths in the form
-	// "host_path:container_path" overridden by the user
-	OverrideMountsFile = "/etc/containers/mounts.conf"
-	// UserOverrideMountsFile holds the default mount paths in the form
-	// "host_path:container_path" overridden by the rootless user
-	UserOverrideMountsFile = filepath.Join(os.Getenv("HOME"), ".config/containers/mounts.conf")
-)
-
-// secretData stores the name of the file and the content read from it
-type secretData struct {
-	name    string
-	data    []byte
-	mode    os.FileMode
-	dirMode os.FileMode
-}
-
-// saveTo saves secret data to given directory
-func (s secretData) saveTo(dir string) error {
-	path := filepath.Join(dir, s.name)
-	if err := os.MkdirAll(filepath.Dir(path), s.dirMode); err != nil {
-		return err
-	}
-	return ioutil.WriteFile(path, s.data, s.mode)
-}
-
-func readAll(root, prefix string, parentMode os.FileMode) ([]secretData, error) {
-	path := filepath.Join(root, prefix)
-
-	data := []secretData{}
-
-	files, err := ioutil.ReadDir(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return data, nil
-		}
-
-		return nil, err
-	}
-
-	for _, f := range files {
-		fileData, err := readFileOrDir(root, filepath.Join(prefix, f.Name()), parentMode)
-		if err != nil {
-			// If the file did not exist, might be a dangling symlink
-			// Ignore the error
-			if os.IsNotExist(err) {
-				continue
-			}
-			return nil, err
-		}
-		data = append(data, fileData...)
-	}
-
-	return data, nil
-}
-
-func readFileOrDir(root, name string, parentMode os.FileMode) ([]secretData, error) {
-	path := filepath.Join(root, name)
-
-	s, err := os.Stat(path)
-	if err != nil {
-		return nil, err
-	}
-
-	if s.IsDir() {
-		dirData, err := readAll(root, name, s.Mode())
-		if err != nil {
-			return nil, err
-		}
-		return dirData, nil
-	}
-	bytes, err := ioutil.ReadFile(path)
-	if err != nil {
-		return nil, err
-	}
-	return []secretData{{
-		name:    name,
-		data:    bytes,
-		mode:    s.Mode(),
-		dirMode: parentMode,
-	}}, nil
-}
-
-func getHostSecretData(hostDir string, mode os.FileMode) ([]secretData, error) {
-	var allSecrets []secretData
-	hostSecrets, err := readAll(hostDir, "", mode)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to read secrets from %q", hostDir)
-	}
-	return append(allSecrets, hostSecrets...), nil
-}
-
-func getMounts(filePath string) []string {
-	file, err := os.Open(filePath)
-	if err != nil {
-		// This is expected on most systems
-		logrus.Debugf("file %q not found, skipping...", filePath)
-		return nil
-	}
-	defer file.Close()
-	scanner := bufio.NewScanner(file)
-	if err = scanner.Err(); err != nil {
-		logrus.Errorf("error reading file %q, %v skipping...", filePath, err)
-		return nil
-	}
-	var mounts []string
-	for scanner.Scan() {
-		if strings.HasPrefix(strings.TrimSpace(scanner.Text()), "/") {
-			mounts = append(mounts, scanner.Text())
-		} else {
-			logrus.Debugf("skipping unrecognized mount in %v: %q",
-				filePath, scanner.Text())
-		}
-	}
-	return mounts
-}
-
-// getHostAndCtrDir separates the host:container paths
-func getMountsMap(path string) (string, string, error) {
-	arr := strings.SplitN(path, ":", 2)
-	switch len(arr) {
-	case 1:
-		return arr[0], arr[0], nil
-	case 2:
-		return arr[0], arr[1], nil
-	}
-	return "", "", errors.Errorf("unable to get host and container dir from path: %s", path)
-}
-
-// SecretMounts copies, adds, and mounts the secrets to the container root filesystem
-// Deprecated, Please use SecretMountWithUIDGID
-func SecretMounts(mountLabel, containerWorkingDir, mountFile string, rootless, disableFips bool) []rspec.Mount {
-	return SecretMountsWithUIDGID(mountLabel, containerWorkingDir, mountFile, containerWorkingDir, 0, 0, rootless, disableFips)
-}
-
-// SecretMountsWithUIDGID copies, adds, and mounts the secrets to the container root filesystem
-// mountLabel: MAC/SELinux label for container content
-// containerWorkingDir: Private data for storing secrets on the host mounted in container.
-// mountFile: Additional mount points required for the container.
-// mountPoint: Container image mountpoint
-// uid: to assign to content created for secrets
-// gid: to assign to content created for secrets
-// rootless: indicates whether container is running in rootless mode
-// disableFips: indicates whether system should ignore fips mode
-func SecretMountsWithUIDGID(mountLabel, containerWorkingDir, mountFile, mountPoint string, uid, gid int, rootless, disableFips bool) []rspec.Mount {
-	var (
-		secretMounts []rspec.Mount
-		mountFiles   []string
-	)
-	// Add secrets from paths given in the mounts.conf files
-	// mountFile will have a value if the hidden --default-mounts-file flag is set
-	// Note for testing purposes only
-	if mountFile == "" {
-		mountFiles = append(mountFiles, []string{OverrideMountsFile, DefaultMountsFile}...)
-		if rootless {
-			mountFiles = append([]string{UserOverrideMountsFile}, mountFiles...)
-		}
-	} else {
-		mountFiles = append(mountFiles, mountFile)
-	}
-	for _, file := range mountFiles {
-		if _, err := os.Stat(file); err == nil {
-			mounts, err := addSecretsFromMountsFile(file, mountLabel, containerWorkingDir, uid, gid)
-			if err != nil {
-				logrus.Warnf("error mounting secrets, skipping entry in %s: %v", file, err)
-			}
-			secretMounts = mounts
-			break
-		}
-	}
-
-	// Only add FIPS secret mount if disableFips=false
-	if disableFips {
-		return secretMounts
-	}
-	// Add FIPS mode secret if /etc/system-fips exists on the host
-	_, err := os.Stat("/etc/system-fips")
-	if err == nil {
-		if err := addFIPSModeSecret(&secretMounts, containerWorkingDir, mountPoint, mountLabel, uid, gid); err != nil {
-			logrus.Errorf("error adding FIPS mode secret to container: %v", err)
-		}
-	} else if os.IsNotExist(err) {
-		logrus.Debug("/etc/system-fips does not exist on host, not mounting FIPS mode secret")
-	} else {
-		logrus.Errorf("stat /etc/system-fips failed for FIPS mode secret: %v", err)
-	}
-	return secretMounts
-}
-
-func rchown(chowndir string, uid, gid int) error {
-	return filepath.Walk(chowndir, func(filePath string, f os.FileInfo, err error) error {
-		return os.Lchown(filePath, uid, gid)
-	})
-}
-
-// addSecretsFromMountsFile copies the contents of host directory to container directory
-// and returns a list of mounts
-func addSecretsFromMountsFile(filePath, mountLabel, containerWorkingDir string, uid, gid int) ([]rspec.Mount, error) {
-	var mounts []rspec.Mount
-	defaultMountsPaths := getMounts(filePath)
-	for _, path := range defaultMountsPaths {
-		hostDirOrFile, ctrDirOrFile, err := getMountsMap(path)
-		if err != nil {
-			return nil, err
-		}
-		// skip if the hostDirOrFile path doesn't exist
-		fileInfo, err := os.Stat(hostDirOrFile)
-		if err != nil {
-			if os.IsNotExist(err) {
-				logrus.Warnf("Path %q from %q doesn't exist, skipping", hostDirOrFile, filePath)
-				continue
-			}
-			return nil, errors.Wrapf(err, "failed to stat %q", hostDirOrFile)
-		}
-
-		ctrDirOrFileOnHost := filepath.Join(containerWorkingDir, ctrDirOrFile)
-
-		// In the event of a restart, don't want to copy secrets over again as they already would exist in ctrDirOrFileOnHost
-		_, err = os.Stat(ctrDirOrFileOnHost)
-		if os.IsNotExist(err) {
-
-			hostDirOrFile, err = resolveSymbolicLink(hostDirOrFile)
-			if err != nil {
-				return nil, err
-			}
-
-			// Don't let the umask have any influence on the file and directory creation
-			oldUmask := umask.SetUmask(0)
-			defer umask.SetUmask(oldUmask)
-
-			switch mode := fileInfo.Mode(); {
-			case mode.IsDir():
-				if err = os.MkdirAll(ctrDirOrFileOnHost, mode.Perm()); err != nil {
-					return nil, errors.Wrapf(err, "making container directory %q failed", ctrDirOrFileOnHost)
-				}
-				data, err := getHostSecretData(hostDirOrFile, mode.Perm())
-				if err != nil {
-					return nil, errors.Wrapf(err, "getting host secret data failed")
-				}
-				for _, s := range data {
-					if err := s.saveTo(ctrDirOrFileOnHost); err != nil {
-						return nil, errors.Wrapf(err, "error saving data to container filesystem on host %q", ctrDirOrFileOnHost)
-					}
-				}
-			case mode.IsRegular():
-				data, err := readFileOrDir("", hostDirOrFile, mode.Perm())
-				if err != nil {
-					return nil, errors.Wrapf(err, "error reading file %q", hostDirOrFile)
-
-				}
-				for _, s := range data {
-					if err := os.MkdirAll(filepath.Dir(ctrDirOrFileOnHost), s.dirMode); err != nil {
-						return nil, err
-					}
-					if err := ioutil.WriteFile(ctrDirOrFileOnHost, s.data, s.mode); err != nil {
-						return nil, errors.Wrapf(err, "error saving data to container filesystem on host %q", ctrDirOrFileOnHost)
-					}
-				}
-			default:
-				return nil, errors.Errorf("unsupported file type for: %q", hostDirOrFile)
-			}
-
-			err = label.Relabel(ctrDirOrFileOnHost, mountLabel, false)
-			if err != nil {
-				return nil, errors.Wrap(err, "error applying correct labels")
-			}
-			if uid != 0 || gid != 0 {
-				if err := rchown(ctrDirOrFileOnHost, uid, gid); err != nil {
-					return nil, err
-				}
-			}
-		} else if err != nil {
-			return nil, errors.Wrapf(err, "error getting status of %q", ctrDirOrFileOnHost)
-		}
-
-		m := rspec.Mount{
-			Source:      ctrDirOrFileOnHost,
-			Destination: ctrDirOrFile,
-			Type:        "bind",
-			Options:     []string{"bind", "rprivate"},
-		}
-
-		mounts = append(mounts, m)
-	}
-	return mounts, nil
-}
-
-// addFIPSModeSecret creates /run/secrets/system-fips in the container
-// root filesystem if /etc/system-fips exists on hosts.
-// This enables the container to be FIPS compliant and run openssl in
-// FIPS mode as the host is also in FIPS mode.
-func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir, mountPoint, mountLabel string, uid, gid int) error {
-	secretsDir := "/run/secrets"
-	ctrDirOnHost := filepath.Join(containerWorkingDir, secretsDir)
-	if _, err := os.Stat(ctrDirOnHost); os.IsNotExist(err) {
-		if err = idtools.MkdirAllAs(ctrDirOnHost, 0755, uid, gid); err != nil {
-			return errors.Wrapf(err, "making container directory %q on host failed", ctrDirOnHost)
-		}
-		if err = label.Relabel(ctrDirOnHost, mountLabel, false); err != nil {
-			return errors.Wrapf(err, "error applying correct labels on %q", ctrDirOnHost)
-		}
-	}
-	fipsFile := filepath.Join(ctrDirOnHost, "system-fips")
-	// In the event of restart, it is possible for the FIPS mode file to already exist
-	if _, err := os.Stat(fipsFile); os.IsNotExist(err) {
-		file, err := os.Create(fipsFile)
-		if err != nil {
-			return errors.Wrapf(err, "error creating system-fips file in container for FIPS mode")
-		}
-		defer file.Close()
-	}
-
-	if !mountExists(*mounts, secretsDir) {
-		m := rspec.Mount{
-			Source:      ctrDirOnHost,
-			Destination: secretsDir,
-			Type:        "bind",
-			Options:     []string{"bind", "rprivate"},
-		}
-		*mounts = append(*mounts, m)
-	}
-
-	srcBackendDir := "/usr/share/crypto-policies/back-ends/FIPS"
-	destDir := "/etc/crypto-policies/back-ends"
-	srcOnHost := filepath.Join(mountPoint, srcBackendDir)
-	if _, err := os.Stat(srcOnHost); err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return errors.Wrapf(err, "failed to stat FIPS Backend directory %q", ctrDirOnHost)
-	}
-
-	if !mountExists(*mounts, destDir) {
-		m := rspec.Mount{
-			Source:      srcOnHost,
-			Destination: destDir,
-			Type:        "bind",
-			Options:     []string{"bind", "rprivate"},
-		}
-		*mounts = append(*mounts, m)
-	}
-	return nil
-}
-
-// mountExists checks if a mount already exists in the spec
-func mountExists(mounts []rspec.Mount, dest string) bool {
-	for _, mount := range mounts {
-		if mount.Destination == dest {
-			return true
-		}
-	}
-	return false
-}
-
-// resolveSymbolicLink resolves a possbile symlink path. If the path is a symlink, returns resolved
-// path; if not, returns the original path.
-func resolveSymbolicLink(path string) (string, error) {
-	info, err := os.Lstat(path)
-	if err != nil {
-		return "", err
-	}
-	if info.Mode()&os.ModeSymlink != os.ModeSymlink {
-		return path, nil
-	}
-	return filepath.EvalSymlinks(path)
-}
--- a/vendor/github.com/containers/buildah/pkg/umask/umask_unix.go
+++ b/vendor/github.com/containers/buildah/pkg/umask/umask_unix.go
@@ -1,20 +0,0 @@
-// +build linux darwin
-
-package umask
-
-import (
-	"syscall"
-
-	"github.com/sirupsen/logrus"
-)
-
-func CheckUmask() {
-	oldUmask := syscall.Umask(0022)
-	if (oldUmask & ^0022) != 0 {
-		logrus.Debugf("umask value too restrictive.  Forcing it to 022")
-	}
-}
-
-func SetUmask(value int) int {
-	return syscall.Umask(value)
-}
--- a/vendor/github.com/containers/buildah/pkg/umask/umask_unsupported.go
+++ b/vendor/github.com/containers/buildah/pkg/umask/umask_unsupported.go
@@ -1,7 +0,0 @@
-// +build !linux,!darwin
-
-package umask
-
-func CheckUmask() {}
-
-func SetUmask(int) int { return 0 }
--- a/vendor/github.com/containers/buildah/run_linux.go
+++ b/vendor/github.com/containers/buildah/run_linux.go
@@ -25,10 +25,10 @@ import (
 	"github.com/containers/buildah/chroot"
 	"github.com/containers/buildah/copier"
 	"github.com/containers/buildah/pkg/overlay"
-	"github.com/containers/buildah/pkg/secrets"
 	"github.com/containers/buildah/util"
 	"github.com/containers/common/pkg/capabilities"
 	"github.com/containers/common/pkg/config"
+	"github.com/containers/common/pkg/subscriptions"
 	"github.com/containers/storage/pkg/idtools"
 	"github.com/containers/storage/pkg/ioutils"
 	"github.com/containers/storage/pkg/reexec"
@@ -216,16 +216,28 @@ func (b *Builder) Run(command []string, options RunOptions) error {
 	}
 	// Empty file, so no need to recreate if it exists
 	if _, ok := bindFiles["/run/.containerenv"]; !ok {
-		// Empty string for now, but we may consider populating this later
 		containerenvPath := filepath.Join(path, "/run/.containerenv")
 		if err = os.MkdirAll(filepath.Dir(containerenvPath), 0755); err != nil {
 			return err
 		}
-		emptyFile, err := os.Create(containerenvPath)
-		if err != nil {
+
+		rootless := 0
+		if unshare.IsRootless() {
+			rootless = 1
+		}
+		// Populate the .containerenv with container information
+		containerenv := fmt.Sprintf(`\
+engine="buildah-%s"
+name=%q
+id=%q
+image=%q
+imageid=%q
+rootless=%d
+`, Version, b.Container, b.ContainerID, b.FromImage, b.FromImageID, rootless)
+
+		if err = ioutils.AtomicWriteFile(containerenvPath, []byte(containerenv), 0755); err != nil {
 			return err
 		}
-		emptyFile.Close()
 		if err := label.Relabel(containerenvPath, b.MountLabel, false); err != nil {
 			return err
 		}
@@ -477,15 +489,15 @@ func (b *Builder) setupMounts(mountPoint string, spec *specs.Spec, bundlePath st
 		return errors.Wrapf(err, "error determining work directory for container %q", b.ContainerID)
 	}

-	// Figure out which UID and GID to tell the secrets package to use
+	// Figure out which UID and GID to tell the subscritions package to use
 	// for files that it creates.
 	rootUID, rootGID, err := util.GetHostRootIDs(spec)
 	if err != nil {
 		return err
 	}

-	// Get the list of secrets mounts.
-	secretMounts := secrets.SecretMountsWithUIDGID(b.MountLabel, cdir, b.DefaultMountsFilePath, mountPoint, int(rootUID), int(rootGID), unshare.IsRootless(), false)
+	// Get the list of subscriptionss mounts.
+	secretMounts := subscriptions.MountsWithUIDGID(b.MountLabel, cdir, b.DefaultMountsFilePath, mountPoint, int(rootUID), int(rootGID), unshare.IsRootless(), false)

 	// Add temporary copies of the contents of volume locations at the
 	// volume locations, unless we already have something there.