vendor of containers/(common, storage, image)

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

vendor/github.com/containers/common/libimage/filters.go

@@ -110,7 +110,6 @@ func (r *Runtime) compileImageFilters(ctx context.Context, options *ListImagesOp
 		key = split[0]
 		value = split[1]
 		switch key {
-
 		case "after", "since":
 			img, err := r.time(key, value)
 			if err != nil {
@@ -244,7 +243,7 @@ func (r *Runtime) until(value string) (time.Time, error) {
 func (r *Runtime) time(key, value string) (*Image, error) {
 	img, _, err := r.LookupImage(value, nil)
 	if err != nil {
-		return nil, fmt.Errorf("could not find local image for filter filter %q=%q: %w", key, value, err)
+		return nil, fmt.Errorf("could not find local image for filter %q=%q: %w", key, value, err)
 	}
 	return img, nil
 }

vendor/github.com/containers/common/libimage/image_config.go

@@ -88,7 +88,7 @@ func ImageConfigFromChanges(changes []string) (*ImageConfig, error) { // nolint:
 		case "ENV":
 			// Format is either:
 			// ENV key=value
-			// ENV key=value key=value ...
+			// ENV key-1=value key-2=value ...
 			// ENV key value
 			// Both keys and values can be surrounded by quotes to group them.
 			// For now: we only support key=value

vendor/github.com/containers/common/libimage/import.go

@@ -66,7 +66,7 @@ func (r *Runtime) Import(ctx context.Context, path string, options *ImportOption
 	u, err := url.ParseRequestURI(path)
 	if err == nil && u.Scheme != "" {
 		// If source is a URL, download the file.
-		fmt.Printf("Downloading from %q\n", path)
+		fmt.Printf("Downloading from %q\n", path) //nolint:forbidigo
 		file, err := download.FromURL(r.systemContext.BigFilesTemporaryDir, path)
 		if err != nil {
 			return "", err

vendor/github.com/containers/common/libimage/pull.go

@@ -138,7 +138,6 @@ func (r *Runtime) Pull(ctx context.Context, name string, pullPolicy config.PullP
 
 	// Dispatch the copy operation.
 	switch ref.Transport().Name() {
-
 	// DOCKER REGISTRY
 	case registryTransport.Transport.Name():
 		pulledImages, pullError = r.copyFromRegistry(ctx, ref, possiblyUnqualifiedName, pullPolicy, options)
@@ -218,7 +217,6 @@ func (r *Runtime) copyFromDefault(ctx context.Context, ref types.ImageReference,
 	// Figure out a name for the storage destination.
 	var storageName, imageName string
 	switch ref.Transport().Name() {
-
 	case dockerDaemonTransport.Transport.Name():
 		// Normalize to docker.io if needed (see containers/podman/issues/10998).
 		named, err := reference.ParseNormalizedNamed(ref.StringWithinTransport())

vendor/github.com/containers/common/libnetwork/netavark/exec.go

@@ -23,7 +23,7 @@ type netavarkError struct {
 
 func (e *netavarkError) Error() string {
 	ec := ""
-	// only add the exit code the the error message if we have at least info log level
+	// only add the exit code the error message if we have at least info log level
 	// the normal user does not need to care about the number
 	if e.exitCode > 0 && logrus.IsLevelEnabled(logrus.InfoLevel) {
 		ec = " (exit code " + strconv.Itoa(e.exitCode) + ")"

vendor/github.com/containers/common/libnetwork/netavark/ipam.go

@@ -65,7 +65,7 @@ func (n *netavarkNetwork) openDB() (*bbolt.DB, error) {
 	return db, nil
 }
 
-// allocIPs will allocate ips for the the container. It will change the
+// allocIPs will allocate ips for the container. It will change the
 // NetworkOptions in place. When static ips are given it will validate
 // that these are free to use and will allocate them to the container.
 func (n *netavarkNetwork) allocIPs(opts *types.NetworkOptions) error {

vendor/github.com/containers/common/libnetwork/netavark/network.go

@@ -44,7 +44,7 @@ type netavarkNetwork struct {
 	// defaultsubnetPools contains the subnets which must be used to allocate a free subnet by network create
 	defaultsubnetPools []config.SubnetPool
 
-	// dnsBindPort is set the the port to pass to netavark for aardvark
+	// dnsBindPort is set the port to pass to netavark for aardvark
 	dnsBindPort uint16
 
 	// pluginDirs list of directories were netavark plugins are located
@@ -87,7 +87,7 @@ type InitConfig struct {
 	// DefaultsubnetPools contains the subnets which must be used to allocate a free subnet by network create
 	DefaultsubnetPools []config.SubnetPool
 
-	// DNSBindPort is set the the port to pass to netavark for aardvark
+	// DNSBindPort is set the port to pass to netavark for aardvark
 	DNSBindPort uint16
 
 	// PluginDirs list of directories were netavark plugins are located

vendor/github.com/containers/common/libnetwork/network/interface.go

@@ -35,7 +35,7 @@ const (
 
 // NetworkBackend returns the network backend name and interface
 // It returns either the CNI or netavark backend depending on what is set in the config.
-// If the the backend is set to "" we will automatically assign the backend on the following conditions:
+// If the backend is set to "" we will automatically assign the backend on the following conditions:
 //  1. read ${graphroot}/defaultNetworkBackend
 //  2. find netavark binary (if not installed use CNI)
 //  3. check containers, images and CNI networks and if there are some we have an existing install and should continue to use CNI

vendor/github.com/containers/common/pkg/apparmor/apparmor_linux_template.go

@@ -43,7 +43,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   deny /sys/kernel/security/** rwklx,
 
 {{if ge .Version 208095}}
-  # suppress ptrace denials when using using 'ps' inside a container
+  # suppress ptrace denials when using 'ps' inside a container
   ptrace (trace,read) peer={{.Name}},
 {{end}}
 }

vendor/github.com/containers/common/pkg/auth/auth.go

@@ -10,13 +10,13 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/containers/common/pkg/util"
 	"github.com/containers/image/v5/docker"
 	"github.com/containers/image/v5/docker/reference"
 	"github.com/containers/image/v5/pkg/docker/config"
 	"github.com/containers/image/v5/pkg/sysregistriesv2"
 	"github.com/containers/image/v5/types"
 	"github.com/sirupsen/logrus"
-	terminal "golang.org/x/term"
 )
 
 // ErrNewCredentialsInvalid means that the new user-provided credentials are
@@ -259,7 +259,7 @@ func getUserAndPass(opts *LoginOptions, password, userFromAuthFile string) (user
 		if err != nil {
 			return "", "", fmt.Errorf("reading username: %w", err)
 		}
-		// If the user just hit enter, use the displayed user from the
+		// If the user just hit enter, use the displayed user from
 		// the authentication file.  This allows to do a lazy
 		// `$ buildah login -p $NEW_PASSWORD` without specifying the
 		// user.
@@ -269,7 +269,7 @@ func getUserAndPass(opts *LoginOptions, password, userFromAuthFile string) (user
 	}
 	if password == "" {
 		fmt.Fprint(opts.Stdout, "Password: ")
-		pass, err := terminal.ReadPassword(int(os.Stdin.Fd()))
+		pass, err := util.ReadPassword(int(os.Stdin.Fd()))
 		if err != nil {
 			return "", "", fmt.Errorf("reading password: %w", err)
 		}
@@ -336,7 +336,7 @@ func Logout(systemContext *types.SystemContext, opts *LogoutOptions, args []stri
 
 		authInvalid := docker.CheckAuth(context.Background(), systemContext, authConfig.Username, authConfig.Password, registry)
 		if authConfig.Username != "" && authConfig.Password != "" && authInvalid == nil {
-			fmt.Printf("Not logged into %s with current tool. Existing credentials were established via docker login. Please use docker logout instead.\n", key)
+			fmt.Printf("Not logged into %s with current tool. Existing credentials were established via docker login. Please use docker logout instead.\n", key) //nolint:forbidigo
 			return nil
 		}
 		return fmt.Errorf("not logged into %s", key)

vendor/github.com/containers/common/pkg/cgroups/blkio_linux.go

@@ -34,7 +34,6 @@ func (c *linuxBlkioHandler) Apply(ctr *CgroupControl, res *configs.Resources) er
 			return err
 		}
 		return man.Set(res)
-
 	}
 	path := filepath.Join(cgroupRoot, Blkio, ctr.config.Path)
 	return c.Blkio.Set(path, res)

vendor/github.com/containers/common/pkg/cgroups/cgroups_linux.go

@@ -269,7 +269,7 @@ func readFileByKeyAsUint64(path, key string) (uint64, error) {
 	for _, line := range strings.Split(string(content), "\n") {
 		fields := strings.SplitN(line, " ", 2)
 		if fields[0] == key {
-			v := cleanString(string(fields[1]))
+			v := cleanString(fields[1])
 			if v == "max" {
 				return math.MaxUint64, nil
 			}

vendor/github.com/containers/common/pkg/cgroups/systemd_linux.go

@@ -29,7 +29,7 @@ func systemdCreate(resources *configs.Resources, path string, c *systemdDbus.Con
 			systemdDbus.PropDescription(fmt.Sprintf("cgroup %s", name)),
 			systemdDbus.PropWants(slice),
 		}
-		ioString := ""
+		var ioString string
 		v2, _ := IsCgroup2UnifiedMode()
 		if v2 {
 			ioString = "IOAccounting"
@@ -250,7 +250,6 @@ func resourcesToProps(res *configs.Resources, v2 bool) (map[string]uint64, map[s
 			} else {
 				structMap["BlockIODeviceWeight"] = append(structMap["BlockIODeviceWeight"], newWeight)
 			}
-
 		}
 	}
 

vendor/github.com/containers/common/pkg/cgroups/utils_linux.go

@@ -26,7 +26,7 @@ func WriteFile(dir, file, data string) error {
 	}
 	defer fd.Close()
 	for {
-		_, err := fd.Write([]byte(data))
+		_, err := fd.WriteString(data)
 		if errors.Is(err, unix.EINTR) {
 			logrus.Infof("interrupted while writing %s to %s", data, fd.Name())
 			continue
@@ -85,7 +85,6 @@ func OpenFile(dir, file string, flags int) (*os.File, error) {
 			Mode:    uint64(mode),
 		})
 	if err != nil {
-		fmt.Println("Error in openat")
 		return nil, err
 	}
 

vendor/github.com/containers/common/pkg/config/config.go

@@ -169,7 +169,7 @@ type ContainersConfig struct {
 	// InitPath is the path for init to run if the Init bool is enabled
 	InitPath string `toml:"init_path,omitempty"`
 
-	// IPCNS way to to create a ipc namespace for the container
+	// IPCNS way to create a ipc namespace for the container
 	IPCNS string `toml:"ipcns,omitempty"`
 
 	// LogDriver  for the container.  For example: k8s-file and journald
@@ -321,7 +321,7 @@ type EngineConfig struct {
 	// helper binaries.
 	HelperBinariesDir []string `toml:"helper_binaries_dir"`
 
-	// configuration files. When the same filename is present in in
+	// configuration files. When the same filename is present in
 	// multiple directories, the file in the directory listed last in
 	// this slice takes precedence.
 	HooksDir []string `toml:"hooks_dir,omitempty"`
@@ -740,14 +740,11 @@ func (c *Config) CheckCgroupsAndAdjustConfig() {
 }
 
 func (c *Config) addCAPPrefix() {
-	toCAPPrefixed := func(cap string) string {
-		if !strings.HasPrefix(strings.ToLower(cap), "cap_") {
-			return "CAP_" + strings.ToUpper(cap)
+	for i, val := range c.Containers.DefaultCapabilities {
+		if !strings.HasPrefix(strings.ToLower(val), "cap_") {
+			val = "CAP_" + strings.ToUpper(val)
 		}
-		return cap
-	}
-	for i, cap := range c.Containers.DefaultCapabilities {
-		c.Containers.DefaultCapabilities[i] = toCAPPrefixed(cap)
+		c.Containers.DefaultCapabilities[i] = val
 	}
 }
 

vendor/github.com/containers/common/pkg/config/default_linux.go

@@ -30,7 +30,7 @@ func getDefaultProcessLimits() []string {
 		val := strings.TrimSuffix(string(dat), "\n")
 		max, err := strconv.ParseUint(val, 10, 64)
 		if err == nil {
-			rlim = unix.Rlimit{Cur: uint64(max), Max: uint64(max)}
+			rlim = unix.Rlimit{Cur: max, Max: max}
 		}
 	}
 	defaultLimits := []string{}

vendor/github.com/containers/common/pkg/flag/flag.go

@@ -165,7 +165,7 @@ func (ob *optionalIntValue) String() string {
 	if !ob.present {
 		return "" // If the value is not present, just return an empty string, any other value wouldn't make sense.
 	}
-	return strconv.Itoa(int(ob.value))
+	return strconv.Itoa(ob.value)
 }
 
 // Type returns the int's type.

vendor/github.com/containers/common/pkg/report/camelcase/camelcase.go

@@ -51,8 +51,7 @@ func Split(src string) (entries []string) {
 	}
 	entries = []string{}
 	var runes [][]rune
-	lastClass := 0
-	class := 0
+	var class, lastClass int
 	// split into fields based on class of unicode character
 	for _, r := range src {
 		switch {

vendor/github.com/containers/common/pkg/retry/retry.go

@@ -74,7 +74,6 @@ func IsErrorRetryable(err error) bool {
 	}
 
 	switch e := err.(type) {
-
 	case errcode.Error:
 		switch e.Code {
 		case errcode.ErrorCodeUnauthorized, errcode.ErrorCodeDenied,

vendor/github.com/containers/common/pkg/secrets/filedriver/filedriver.go

@@ -150,7 +150,7 @@ func (d *Driver) getAllData() (map[string][]byte, error) {
 		return nil, err
 	}
 	secretData := new(map[string][]byte)
-	err = json.Unmarshal([]byte(byteValue), secretData)
+	err = json.Unmarshal(byteValue, secretData)
 	if err != nil {
 		return nil, err
 	}

vendor/github.com/containers/common/pkg/secrets/shelldriver/shelldriver.go

@@ -58,7 +58,6 @@ func (cfg *driverConfig) ParseOpts(opts map[string]string) error {
 		cfg.ListCommand == "" ||
 		cfg.LookupCommand == "" ||
 		cfg.StoreCommand == "" {
-
 		return errMissingConfig
 	}
 	return nil

vendor/github.com/containers/common/pkg/ssh/connection_golang.go

@@ -28,7 +28,7 @@ import (
 func golangConnectionCreate(options ConnectionCreateOptions) error {
 	var match bool
 	var err error
-	if match, err = regexp.Match("^[A-Za-z][A-Za-z0-9+.-]*://", []byte(options.Path)); err != nil {
+	if match, err = regexp.MatchString("^[A-Za-z][A-Za-z0-9+.-]*://", options.Path); err != nil {
 		return fmt.Errorf("invalid destination: %w", err)
 	}
 
@@ -229,7 +229,7 @@ func GetUserInfo(uri *url.URL) (*url.Userinfo, error) {
 }
 
 // ValidateAndConfigure will take a ssh url and an identity key (rsa and the like) and ensure the information given is valid
-// iden iden can be blank to mean no identity key
+// iden can be blank to mean no identity key
 // once the function validates the information it creates and returns an ssh.ClientConfig.
 func ValidateAndConfigure(uri *url.URL, iden string, insecureIsMachineConnection bool) (*ssh.ClientConfig, error) {
 	var signers []ssh.Signer

vendor/github.com/containers/common/pkg/ssh/connection_native.go

@@ -14,7 +14,7 @@ import (
 func nativeConnectionCreate(options ConnectionCreateOptions) error {
 	var match bool
 	var err error
-	if match, err = regexp.Match("^[A-Za-z][A-Za-z0-9+.-]*://", []byte(options.Path)); err != nil {
+	if match, err = regexp.MatchString("^[A-Za-z][A-Za-z0-9+.-]*://", options.Path); err != nil {
 		return fmt.Errorf("invalid destination: %w", err)
 	}
 

vendor/github.com/containers/common/pkg/ssh/utils.go

@@ -145,7 +145,7 @@ func ParseScpArgs(options ConnectionScpOptions) (string, string, string, bool, e
 	if strings.Contains(localPath, "ssh://") {
 		localPath = strings.Split(localPath, "ssh://")[1]
 	}
-	remotePath := ""
+	var remotePath string
 	swap := false
 	if split := strings.Split(localPath, ":"); len(split) == 2 {
 		// save to remote, load to local

vendor/github.com/containers/common/pkg/subscriptions/subscriptions.go

@@ -242,7 +242,6 @@ func addSubscriptionsFromMountsFile(filePath, mountLabel, containerRunDir string
 		// In the event of a restart, don't want to copy subscriptions over again as they already would exist in ctrDirOrFileOnHost
 		_, err = os.Stat(ctrDirOrFileOnHost)
 		if errors.Is(err, os.ErrNotExist) {
-
 			hostDirOrFile, err = resolveSymbolicLink(hostDirOrFile)
 			if err != nil {
 				return nil, err

vendor/github.com/containers/common/pkg/util/util.go

@@ -2,6 +2,7 @@ package util
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -19,6 +20,8 @@ const (
 	UnknownPackage = "Unknown"
 )
 
+var ErrInterrupt = errors.New("interrupted")
+
 // Note: This function is copied from containers/podman libpod/util.go
 // Please see https://github.com/containers/common/pull/1460
 func queryPackageVersion(cmdArg ...string) string {

vendor/github.com/containers/common/pkg/util/util_supported.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"os/signal"
 	"path/filepath"
 	"sync"
 	"syscall"
@@ -14,6 +15,7 @@ import (
 	"github.com/containers/storage/pkg/homedir"
 	"github.com/containers/storage/pkg/unshare"
 	"github.com/sirupsen/logrus"
+	terminal "golang.org/x/term"
 )
 
 var (
@@ -89,3 +91,45 @@ func GetRuntimeDir() (string, error) {
 	}
 	return rootlessRuntimeDir, nil
 }
+
+// ReadPassword reads a password from the terminal without echo.
+func ReadPassword(fd int) ([]byte, error) {
+	// Store and restore the terminal status on interruptions to
+	// avoid that the terminal remains in the password state
+	// This is necessary as for https://github.com/golang/go/issues/31180
+
+	oldState, err := terminal.GetState(fd)
+	if err != nil {
+		return make([]byte, 0), err
+	}
+
+	type Buffer struct {
+		Buffer []byte
+		Error  error
+	}
+	errorChannel := make(chan Buffer, 1)
+
+	// SIGINT and SIGTERM restore the terminal, otherwise the no-echo mode would remain intact
+	interruptChannel := make(chan os.Signal, 1)
+	signal.Notify(interruptChannel, syscall.SIGINT, syscall.SIGTERM)
+	defer func() {
+		signal.Stop(interruptChannel)
+		close(interruptChannel)
+	}()
+	go func() {
+		for range interruptChannel {
+			if oldState != nil {
+				_ = terminal.Restore(fd, oldState)
+			}
+			errorChannel <- Buffer{Buffer: make([]byte, 0), Error: ErrInterrupt}
+		}
+	}()
+
+	go func() {
+		buf, err := terminal.ReadPassword(fd)
+		errorChannel <- Buffer{Buffer: buf, Error: err}
+	}()
+
+	buf := <-errorChannel
+	return buf.Buffer, buf.Error
+}

vendor/github.com/containers/common/pkg/util/util_windows.go

@@ -5,9 +5,24 @@ package util
 
 import (
 	"errors"
+
+	terminal "golang.org/x/term"
 )
 
 // getRuntimeDir returns the runtime directory
 func GetRuntimeDir() (string, error) {
 	return "", errors.New("this function is not implemented for windows")
 }
+
+// ReadPassword reads a password from the terminal.
+func ReadPassword(fd int) ([]byte, error) {
+	oldState, err := terminal.GetState(fd)
+	if err != nil {
+		return make([]byte, 0), err
+	}
+	buf, err := terminal.ReadPassword(fd)
+	if oldState != nil {
+		_ = terminal.Restore(fd, oldState)
+	}
+	return buf, err
+}