Bump c/storage v1.58.0, c/image v5.35.0, c/common v0.63.0

Bump:
c/storage v1.58.0
c/image v5.35.0
c/common v0.63.0

In preparation for Podman v5.5.0

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>

vendor/github.com/containers/common/pkg/sysinfo/numcpu_windows.go

@@ -3,6 +3,7 @@
 package sysinfo
 
 import (
+	"math/bits"
 	"unsafe"
 
 	"golang.org/x/sys/windows"
@@ -22,7 +23,5 @@ func numCPU() int {
 	if ret == 0 {
 		return 0
 	}
-	// For every available thread a bit is set in the mask.
-	ncpu := int(popcnt(uint64(mask)))
-	return ncpu
+	return bits.OnesCount64(uint64(mask))
 }

vendor/github.com/containers/common/pkg/sysinfo/nummem_linux.go

@@ -1,32 +0,0 @@
-//go:build linux
-
-package sysinfo
-
-import (
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-// NUMANodeCount queries the system for the count of Memory Nodes available
-// for use to this process.
-func NUMANodeCount() int {
-	// this is the correct flag name (not defined in the unix package)
-	//nolint:revive
-	MPOL_F_MEMS_ALLOWED := (1 << 2)
-	var mask [1024 / 64]uintptr
-	_, _, err := unix.RawSyscall6(unix.SYS_GET_MEMPOLICY, 0, uintptr(unsafe.Pointer(&mask[0])), uintptr(len(mask)*8), 0, uintptr(MPOL_F_MEMS_ALLOWED), 0)
-	if err != 0 {
-		return 0
-	}
-
-	// For every available thread a bit is set in the mask.
-	nmem := 0
-	for _, e := range mask {
-		if e == 0 {
-			continue
-		}
-		nmem += int(popcnt(uint64(e)))
-	}
-	return nmem
-}

vendor/github.com/containers/common/pkg/sysinfo/nummem_unsupported.go

@@ -1,9 +0,0 @@
-//go:build (windows && ignore) || osx
-
-package sysinfo
-
-// NUMANodeCount queries the system for the count of Memory Nodes available
-// for use to this process. Returns 0 on non NUMAs systems.
-func NUMANodeCount() int {
-	return 0
-}

vendor/github.com/containers/common/pkg/sysinfo/sysinfo.go

@@ -133,16 +133,6 @@ func isCpusetListAvailable(provided, available string) (bool, error) {
 	return true, nil
 }
 
-// Returns bit count of 1, used by NumCPU
-func popcnt(x uint64) (n byte) {
-	x -= (x >> 1) & 0x5555555555555555
-	x = (x>>2)&0x3333333333333333 + x&0x3333333333333333
-	x += x >> 4
-	x &= 0x0f0f0f0f0f0f0f0f
-	x *= 0x0101010101010101
-	return byte(x >> 56)
-}
-
 // GetDefaultPidsLimit returns the default pids limit to run containers with
 func GetDefaultPidsLimit() int64 {
 	sysInfo := New(true)

vendor/github.com/containers/common/version/version.go

@@ -1,4 +1,4 @@
 package version
 
 // Version is the version of the build.
-const Version = "0.63.0-dev"
+const Version = "0.63.0"

vendor/github.com/containers/image/v5/image/unparsed.go

@@ -15,6 +15,9 @@ type UnparsedImage = image.UnparsedImage
 // UnparsedInstance returns a types.UnparsedImage implementation for (source, instanceDigest).
 // If instanceDigest is not nil, it contains a digest of the specific manifest instance to retrieve (when the primary manifest is a manifest list).
 //
+// This implementation of [types.UnparsedImage] ensures that [types.UnparsedImage.Manifest] validates the image
+// against instanceDigest if set, or, if not, a digest implied by src.Reference, if any.
+//
 // The UnparsedImage must not be used after the underlying ImageSource is Close()d.
 func UnparsedInstance(src types.ImageSource, instanceDigest *digest.Digest) *UnparsedImage {
 	return image.UnparsedInstance(src, instanceDigest)
@@ -33,6 +36,9 @@ func (uwr *unparsedWithRef) Reference() types.ImageReference {
 // UnparsedInstanceWithReference returns a types.UnparsedImage for wrappedInstance which claims to be a replacementRef.
 // This is useful for combining image data with other reference values, e.g. to check signatures on a locally-pulled image
 // based on a remote-registry policy.
+//
+// For the purposes of digest validation in [types.UnparsedImage.Manifest], what matters is the
+// reference originally used to create wrappedInstance, not replacementRef.
 func UnparsedInstanceWithReference(wrappedInstance types.UnparsedImage, replacementRef types.ImageReference) types.UnparsedImage {
 	return &unparsedWithRef{
 		UnparsedImage: unparsedimage.FromPublic(wrappedInstance),

vendor/github.com/containers/image/v5/internal/image/unparsed.go

@@ -30,6 +30,9 @@ type UnparsedImage struct {
 // UnparsedInstance returns a types.UnparsedImage implementation for (source, instanceDigest).
 // If instanceDigest is not nil, it contains a digest of the specific manifest instance to retrieve (when the primary manifest is a manifest list).
 //
+// This implementation of [types.UnparsedImage] ensures that [types.UnparsedImage.Manifest] validates the image
+// against instanceDigest if set, or, if not, a digest implied by src.Reference, if any.
+//
 // The UnparsedImage must not be used after the underlying ImageSource is Close()d.
 //
 // This is publicly visible as c/image/image.UnparsedInstance.
@@ -48,6 +51,9 @@ func (i *UnparsedImage) Reference() types.ImageReference {
 }
 
 // Manifest is like ImageSource.GetManifest, but the result is cached; it is OK to call this however often you need.
+//
+// Users of UnparsedImage are promised that this validates the image
+// against either i.instanceDigest if set, or against a digest included in i.src.Reference.
 func (i *UnparsedImage) Manifest(ctx context.Context) ([]byte, string, error) {
 	if i.cachedManifest == nil {
 		m, mt, err := i.src.GetManifest(ctx, i.instanceDigest)

vendor/github.com/containers/image/v5/types/types.go

@@ -242,6 +242,7 @@ type BlobInfoCache interface {
 //
 // WARNING: Various methods which return an object identified by digest generally do not
 // validate that the returned data actually matches that digest; this is the caller’s responsibility.
+// See the individual methods’ documentation for potentially more details.
 type ImageSource interface {
 	// Reference returns the reference used to set up this source, _as specified by the user_
 	// (not as the image itself, or its underlying storage, claims).  This can be used e.g. to determine which public keys are trusted for this image.
@@ -252,10 +253,17 @@ type ImageSource interface {
 	// It may use a remote (= slow) service.
 	// If instanceDigest is not nil, it contains a digest of the specific manifest instance to retrieve (when the primary manifest is a manifest list);
 	// this never happens if the primary manifest is not a manifest list (e.g. if the source never returns manifest lists).
+	//
+	// WARNING: This is a raw access to the data as provided by the source; if the reference contains a digest, or instanceDigest is set,
+	// callers must enforce the digest match themselves, typically by using image.UnparsedInstance to access the manifest instead
+	// of calling this directly. (Compare the generic warning applicable to all of the [ImageSource] interface.)
 	GetManifest(ctx context.Context, instanceDigest *digest.Digest) ([]byte, string, error)
 	// GetBlob returns a stream for the specified blob, and the blob’s size (or -1 if unknown).
 	// The Digest field in BlobInfo is guaranteed to be provided, Size may be -1 and MediaType may be optionally provided.
 	// May update BlobInfoCache, preferably after it knows for certain that a blob truly exists at a specific location.
+	//
+	// WARNING: This is a raw access to the data as provided by the source; callers must validate the contents
+	// against the blob’s digest themselves. (Compare the generic warning applicable to all of the [ImageSource] interface.)
 	GetBlob(context.Context, BlobInfo, BlobInfoCache) (io.ReadCloser, int64, error)
 	// HasThreadSafeGetBlob indicates whether GetBlob can be executed concurrently.
 	HasThreadSafeGetBlob() bool

vendor/github.com/containers/image/v5/version/version.go

@@ -11,7 +11,7 @@ const (
 	VersionPatch = 0
 
 	// VersionDev indicates development branch. Releases will be empty string.
-	VersionDev = "-dev"
+	VersionDev = ""
 )
 
 // Version is the specification version that the package types support.

vendor/github.com/containers/storage/.golangci.yml

@@ -5,6 +5,9 @@ formatters:
     - gofumpt
 
 linters:
+  enable:
+    - nolintlint
+    - unconvert
   exclusions:
     presets:
       - comments

vendor/github.com/containers/storage/VERSION

@@ -1 +1 @@
-1.58.0-dev
+1.58.0

vendor/github.com/containers/storage/containers.go

@@ -82,7 +82,7 @@ type Container struct {
 	UIDMap []idtools.IDMap `json:"uidmap,omitempty"`
 	GIDMap []idtools.IDMap `json:"gidmap,omitempty"`
 
-	Flags map[string]interface{} `json:"flags,omitempty"`
+	Flags map[string]any `json:"flags,omitempty"`
 
 	// volatileStore is true if the container is from the volatile json file
 	volatileStore bool `json:"-"`
@@ -196,7 +196,7 @@ func (c *Container) MountOpts() []string {
 	switch value := c.Flags[mountOptsFlag].(type) {
 	case []string:
 		return value
-	case []interface{}:
+	case []any:
 		var mountOpts []string
 		for _, v := range value {
 			if flag, ok := v.(string); ok {
@@ -458,7 +458,7 @@ func (r *containerStore) load(lockedForWriting bool) (bool, error) {
 
 	ids := make(map[string]*Container)
 
-	for locationIndex := 0; locationIndex < numContainerLocationIndex; locationIndex++ {
+	for locationIndex := range numContainerLocationIndex {
 		location := containerLocationFromIndex(locationIndex)
 		rpath := r.jsonPath[locationIndex]
 
@@ -531,7 +531,7 @@ func (r *containerStore) save(saveLocations containerLocations) error {
 		return err
 	}
 	r.lastWrite = lw
-	for locationIndex := 0; locationIndex < numContainerLocationIndex; locationIndex++ {
+	for locationIndex := range numContainerLocationIndex {
 		location := containerLocationFromIndex(locationIndex)
 		if location&saveLocations == 0 {
 			continue
@@ -641,13 +641,13 @@ func (r *containerStore) ClearFlag(id string, flag string) error {
 }
 
 // Requires startWriting.
-func (r *containerStore) SetFlag(id string, flag string, value interface{}) error {
+func (r *containerStore) SetFlag(id string, flag string, value any) error {
 	container, ok := r.lookup(id)
 	if !ok {
 		return ErrContainerUnknown
 	}
 	if container.Flags == nil {
-		container.Flags = make(map[string]interface{})
+		container.Flags = make(map[string]any)
 	}
 	container.Flags[flag] = value
 	return r.saveFor(container)

vendor/github.com/containers/storage/deprecated.go

@@ -111,7 +111,7 @@ type LayerBigDataStore interface {
 // Deprecated: There is no way to use this from any external user of c/storage to invoke c/storage functionality.
 type FlaggableStore interface {
 	ClearFlag(id string, flag string) error
-	SetFlag(id string, flag string, value interface{}) error
+	SetFlag(id string, flag string, value any) error
 }
 
 // ContainerStore is a deprecated interface with no documented way to use it from callers outside of c/storage.
@@ -195,8 +195,8 @@ type LayerStore interface {
 	FlaggableStore
 	RWLayerBigDataStore
 	Create(id string, parent *Layer, names []string, mountLabel string, options map[string]string, moreOptions *LayerOptions, writeable bool) (*Layer, error)
-	CreateWithFlags(id string, parent *Layer, names []string, mountLabel string, options map[string]string, moreOptions *LayerOptions, writeable bool, flags map[string]interface{}) (layer *Layer, err error)
-	Put(id string, parent *Layer, names []string, mountLabel string, options map[string]string, moreOptions *LayerOptions, writeable bool, flags map[string]interface{}, diff io.Reader) (*Layer, int64, error)
+	CreateWithFlags(id string, parent *Layer, names []string, mountLabel string, options map[string]string, moreOptions *LayerOptions, writeable bool, flags map[string]any) (layer *Layer, err error)
+	Put(id string, parent *Layer, names []string, mountLabel string, options map[string]string, moreOptions *LayerOptions, writeable bool, flags map[string]any, diff io.Reader) (*Layer, int64, error)
 	SetNames(id string, names []string) error
 	AddNames(id string, names []string) error
 	RemoveNames(id string, names []string) error

vendor/github.com/containers/storage/drivers/btrfs/version.go

@@ -1,4 +1,4 @@
-//go:build linux && !btrfs_noversion && cgo
+//go:build linux && cgo
 
 package btrfs
 

vendor/github.com/containers/storage/drivers/btrfs/version_none.go

@@ -1,14 +0,0 @@
-//go:build linux && btrfs_noversion && cgo
-
-package btrfs
-
-// TODO(vbatts) remove this work-around once supported linux distros are on
-// btrfs utilities of >= 3.16.1
-
-func btrfsBuildVersion() string {
-	return "-"
-}
-
-func btrfsLibVersion() int {
-	return -1
-}

vendor/github.com/containers/storage/drivers/chown_unix.go

@@ -36,8 +36,8 @@ func (c *platformChowner) LChown(path string, info os.FileInfo, toHost, toContai
 	}
 
 	i := inode{
-		Dev: uint64(st.Dev),
-		Ino: uint64(st.Ino),
+		Dev: uint64(st.Dev), //nolint:unconvert
+		Ino: st.Ino,
 	}
 
 	c.mutex.Lock()

vendor/github.com/containers/storage/drivers/copy/copy_linux.go

@@ -160,7 +160,10 @@ func DirCopy(srcDir, dstDir string, copyMode Mode, copyXattrs bool) error {
 
 		switch mode := f.Mode(); {
 		case mode.IsRegular():
-			id := fileID{dev: uint64(stat.Dev), ino: stat.Ino}
+			id := fileID{
+				dev: uint64(stat.Dev), //nolint:unconvert
+				ino: stat.Ino,
+			}
 			if copyMode == Hardlink {
 				isHardlink = true
 				if err2 := os.Link(srcPath, dstPath); err2 != nil {
@@ -242,12 +245,11 @@ func DirCopy(srcDir, dstDir string, copyMode Mode, copyXattrs bool) error {
 		}
 
 		// system.Chtimes doesn't support a NOFOLLOW flag atm
-		// nolint: unconvert
 		if f.IsDir() {
 			dirsToSetMtimes.PushFront(&dirMtimeInfo{dstPath: &dstPath, stat: stat})
 		} else if !isSymlink {
-			aTime := time.Unix(int64(stat.Atim.Sec), int64(stat.Atim.Nsec))
-			mTime := time.Unix(int64(stat.Mtim.Sec), int64(stat.Mtim.Nsec))
+			aTime := time.Unix(stat.Atim.Unix())
+			mTime := time.Unix(stat.Mtim.Unix())
 			if err := system.Chtimes(dstPath, aTime, mTime); err != nil {
 				return err
 			}

vendor/github.com/containers/storage/drivers/driver.go

@@ -79,7 +79,7 @@ type ApplyDiffOpts struct {
 type ApplyDiffWithDifferOpts struct {
 	ApplyDiffOpts
 
-	Flags map[string]interface{}
+	Flags map[string]any
 }
 
 // DedupArgs contains the information to perform storage deduplication.
@@ -222,7 +222,7 @@ type DriverWithDifferOutput struct {
 	RootDirMode *os.FileMode
 	// Artifacts is a collection of additional artifacts
 	// generated by the differ that the storage driver can use.
-	Artifacts map[string]interface{}
+	Artifacts map[string]any
 }
 
 type DifferOutputFormat int

vendor/github.com/containers/storage/drivers/overlay/check.go

@@ -259,7 +259,7 @@ func supportsIdmappedLowerLayers(home string) (bool, error) {
 	}
 	defer cleanupFunc()
 
-	if err := idmap.CreateIDMappedMount(lowerDir, lowerMappedDir, int(pid)); err != nil {
+	if err := idmap.CreateIDMappedMount(lowerDir, lowerMappedDir, pid); err != nil {
 		return false, fmt.Errorf("create mapped mount: %w", err)
 	}
 	defer func() {

vendor/github.com/containers/storage/drivers/overlay/composefs.go

@@ -42,7 +42,7 @@ func getComposefsBlob(dataDir string) string {
 	return filepath.Join(dataDir, "composefs.blob")
 }
 
-func generateComposeFsBlob(verityDigests map[string]string, toc interface{}, composefsDir string) error {
+func generateComposeFsBlob(verityDigests map[string]string, toc any, composefsDir string) error {
 	if err := os.MkdirAll(composefsDir, 0o700); err != nil {
 		return err
 	}

vendor/github.com/containers/storage/drivers/overlay/overlay.go

@@ -492,7 +492,7 @@ func parseOptions(options []string) (*overlayOptions, error) {
 			if err != nil {
 				return nil, err
 			}
-			o.quota.Inodes = uint64(inodes)
+			o.quota.Inodes = inodes
 		case "imagestore", "additionalimagestore":
 			logrus.Debugf("overlay: imagestore=%s", val)
 			// Additional read only image stores to use for lower paths
@@ -1163,7 +1163,7 @@ func (d *Driver) parseStorageOpt(storageOpt map[string]string, driver *Driver) e
 			if err != nil {
 				return err
 			}
-			driver.options.quota.Inodes = uint64(inodes)
+			driver.options.quota.Inodes = inodes
 		default:
 			return fmt.Errorf("unknown option %s", key)
 		}
@@ -1551,7 +1551,7 @@ func (d *Driver) get(id string, disableShifting bool, options graphdriver.MountO
 	permsKnown := false
 	st, err := os.Stat(filepath.Join(dir, nameWithSuffix("diff", diffN)))
 	if err == nil {
-		perms = os.FileMode(st.Mode())
+		perms = st.Mode()
 		permsKnown = true
 	}
 	for err == nil {
@@ -1566,7 +1566,7 @@ func (d *Driver) get(id string, disableShifting bool, options graphdriver.MountO
 		if err != nil {
 			return "", err
 		}
-		idmappedMountProcessPid = int(pid)
+		idmappedMountProcessPid = pid
 		defer cleanupFunc()
 	}
 
@@ -1638,7 +1638,7 @@ func (d *Driver) get(id string, disableShifting bool, options graphdriver.MountO
 				lower = path.Join(p, d.name, l)
 				if st2, err2 := os.Stat(lower); err2 == nil {
 					if !permsKnown {
-						perms = os.FileMode(st2.Mode())
+						perms = st2.Mode()
 						permsKnown = true
 					}
 					break
@@ -1659,7 +1659,7 @@ func (d *Driver) get(id string, disableShifting bool, options graphdriver.MountO
 			}
 		} else {
 			if !permsKnown {
-				perms = os.FileMode(st.Mode())
+				perms = st.Mode()
 				permsKnown = true
 			}
 			lower = newpath
@@ -2505,7 +2505,7 @@ func (d *Driver) UpdateLayerIDMap(id string, toContainer, toHost *idtools.IDMapp
 		perms = *d.options.forceMask
 	} else {
 		if err == nil {
-			perms = os.FileMode(st.Mode())
+			perms = st.Mode()
 		}
 	}
 	for err == nil {

vendor/github.com/containers/storage/images.go

@@ -93,7 +93,7 @@ type Image struct {
 	// ReadOnly is true if this image resides in a read-only layer store.
 	ReadOnly bool `json:"-"`
 
-	Flags map[string]interface{} `json:"flags,omitempty"`
+	Flags map[string]any `json:"flags,omitempty"`
 }
 
 // roImageStore provides bookkeeping for information about Images.
@@ -675,7 +675,7 @@ func (r *imageStore) ClearFlag(id string, flag string) error {
 }
 
 // Requires startWriting.
-func (r *imageStore) SetFlag(id string, flag string, value interface{}) error {
+func (r *imageStore) SetFlag(id string, flag string, value any) error {
 	if !r.lockfile.IsReadWrite() {
 		return fmt.Errorf("not allowed to set flags on images at %q: %w", r.imagespath(), ErrStoreIsReadOnly)
 	}
@@ -684,7 +684,7 @@ func (r *imageStore) SetFlag(id string, flag string, value interface{}) error {
 		return fmt.Errorf("locating image with ID %q: %w", id, ErrImageUnknown)
 	}
 	if image.Flags == nil {
-		image.Flags = make(map[string]interface{})
+		image.Flags = make(map[string]any)
 	}
 	image.Flags[flag] = value
 	return r.Save()

vendor/github.com/containers/storage/internal/dedup/dedup_linux.go

@@ -48,7 +48,7 @@ func (d *dedupFiles) isFirstVisitOf(fi fs.FileInfo) (bool, error) {
 	if !ok {
 		return false, fmt.Errorf("unable to get raw syscall.Stat_t data")
 	}
-	return d.recordInode(uint64(st.Dev), st.Ino)
+	return d.recordInode(uint64(st.Dev), st.Ino) //nolint:unconvert
 }
 
 // dedup deduplicates the file at src path to dst path
@@ -94,7 +94,7 @@ func (d *dedupFiles) dedup(src, dst string, fiDst fs.FileInfo) (uint64, error) {
 	}
 	err = unix.IoctlFileDedupeRange(int(srcFile.Fd()), &value)
 	if err == nil {
-		return uint64(value.Info[0].Bytes_deduped), nil
+		return value.Info[0].Bytes_deduped, nil
 	}
 
 	if errors.Is(err, unix.ENOTSUP) {

vendor/github.com/containers/storage/layers.go

@@ -161,7 +161,7 @@ type Layer struct {
 	GIDs []uint32 `json:"gidset,omitempty"`
 
 	// Flags is arbitrary data about the layer.
-	Flags map[string]interface{} `json:"flags,omitempty"`
+	Flags map[string]any `json:"flags,omitempty"`
 
 	// UIDMap and GIDMap are used for setting up a layer's contents
 	// for use inside of a user namespace where UID mapping is being used.
@@ -656,7 +656,7 @@ func (r *layerStore) layersModified() (lockfile.LastWrite, bool, error) {
 	// If the layers.json file or container-layers.json has been
 	// modified manually, then we have to reload the storage in
 	// any case.
-	for locationIndex := 0; locationIndex < numLayerLocationIndex; locationIndex++ {
+	for locationIndex := range numLayerLocationIndex {
 		rpath := r.jsonPath[locationIndex]
 		if rpath == "" {
 			continue
@@ -794,7 +794,7 @@ func (r *layerStore) load(lockedForWriting bool) (bool, error) {
 	layers := []*Layer{}
 	ids := make(map[string]*Layer)
 
-	for locationIndex := 0; locationIndex < numLayerLocationIndex; locationIndex++ {
+	for locationIndex := range numLayerLocationIndex {
 		location := layerLocationFromIndex(locationIndex)
 		rpath := r.jsonPath[locationIndex]
 		if rpath == "" {
@@ -922,7 +922,7 @@ func (r *layerStore) load(lockedForWriting bool) (bool, error) {
 		var layersToDelete []*Layer
 		for _, layer := range r.layers {
 			if layer.Flags == nil {
-				layer.Flags = make(map[string]interface{})
+				layer.Flags = make(map[string]any)
 			}
 			if layerHasIncompleteFlag(layer) {
 				// Important: Do not call r.deleteInternal() here. It modifies r.layers
@@ -1031,7 +1031,7 @@ func (r *layerStore) saveLayers(saveLocations layerLocations) error {
 	}
 	r.lastWrite = lw
 
-	for locationIndex := 0; locationIndex < numLayerLocationIndex; locationIndex++ {
+	for locationIndex := range numLayerLocationIndex {
 		location := layerLocationFromIndex(locationIndex)
 		if location&saveLocations == 0 {
 			continue
@@ -1261,7 +1261,7 @@ func (r *layerStore) ClearFlag(id string, flag string) error {
 }
 
 // Requires startWriting.
-func (r *layerStore) SetFlag(id string, flag string, value interface{}) error {
+func (r *layerStore) SetFlag(id string, flag string, value any) error {
 	if !r.lockfile.IsReadWrite() {
 		return fmt.Errorf("not allowed to set flags on layers at %q: %w", r.layerdir, ErrStoreIsReadOnly)
 	}
@@ -1270,7 +1270,7 @@ func (r *layerStore) SetFlag(id string, flag string, value interface{}) error {
 		return ErrLayerUnknown
 	}
 	if layer.Flags == nil {
-		layer.Flags = make(map[string]interface{})
+		layer.Flags = make(map[string]any)
 	}
 	layer.Flags[flag] = value
 	return r.saveFor(layer)
@@ -1931,7 +1931,7 @@ func (r *layerStore) deleteInternal(id string) error {
 	// Ensure that if we are interrupted, the layer will be cleaned up.
 	if !layerHasIncompleteFlag(layer) {
 		if layer.Flags == nil {
-			layer.Flags = make(map[string]interface{})
+			layer.Flags = make(map[string]any)
 		}
 		layer.Flags[incompleteFlag] = true
 		if err := r.saveFor(layer); err != nil {
@@ -2475,16 +2475,12 @@ func (r *layerStore) applyDiffWithOptions(to string, layerOptions *LayerOptions,
 	for uid := range uidLog {
 		layer.UIDs = append(layer.UIDs, uid)
 	}
-	sort.Slice(layer.UIDs, func(i, j int) bool {
-		return layer.UIDs[i] < layer.UIDs[j]
-	})
+	slices.Sort(layer.UIDs)
 	layer.GIDs = make([]uint32, 0, len(gidLog))
 	for gid := range gidLog {
 		layer.GIDs = append(layer.GIDs, gid)
 	}
-	sort.Slice(layer.GIDs, func(i, j int) bool {
-		return layer.GIDs[i] < layer.GIDs[j]
-	})
+	slices.Sort(layer.GIDs)
 
 	err = r.saveFor(layer)
 
@@ -2540,7 +2536,7 @@ func (r *layerStore) applyDiffFromStagingDirectory(id string, diffOutput *driver
 	layer.Metadata = diffOutput.Metadata
 	if options != nil && options.Flags != nil {
 		if layer.Flags == nil {
-			layer.Flags = make(map[string]interface{})
+			layer.Flags = make(map[string]any)
 		}
 		maps.Copy(layer.Flags, options.Flags)
 	}

vendor/github.com/containers/storage/pkg/archive/archive.go

@@ -53,7 +53,7 @@ type (
 		// This is additional data to be used by the converter.  It will
 		// not survive a round trip through JSON, so it's primarily
 		// intended for generating archives (i.e., converting writes).
-		WhiteoutData interface{}
+		WhiteoutData any
 		// When unpacking, specifies whether overwriting a directory with a
 		// non-directory is allowed and vice versa.
 		NoOverwriteDirNonDir bool
@@ -83,7 +83,7 @@ const (
 	freebsd = "freebsd"
 )
 
-var xattrsToIgnore = map[string]interface{}{
+var xattrsToIgnore = map[string]any{
 	"security.selinux": true,
 }
 
@@ -378,7 +378,7 @@ type nosysFileInfo struct {
 	os.FileInfo
 }
 
-func (fi nosysFileInfo) Sys() interface{} {
+func (fi nosysFileInfo) Sys() any {
 	// A Sys value of type *tar.Header is safe as it is system-independent.
 	// The tar.FileInfoHeader function copies the fields into the returned
 	// header without performing any OS lookups.
@@ -705,7 +705,9 @@ func extractTarFileEntry(path, extractDir string, hdr *tar.Header, reader io.Rea
 			file.Close()
 			return err
 		}
-		file.Close()
+		if err := file.Close(); err != nil {
+			return err
+		}
 
 	case tar.TypeBlock, tar.TypeChar:
 		if inUserns { // cannot create devices in a userns
@@ -1406,7 +1408,7 @@ func remapIDs(readIDMappings, writeIDMappings *idtools.IDMappings, chownOpts *id
 		} else if runtime.GOOS == darwin {
 			uid, gid = hdr.Uid, hdr.Gid
 			if xstat, ok := hdr.PAXRecords[PaxSchilyXattr+idtools.ContainersOverrideXattr]; ok {
-				attrs := strings.Split(string(xstat), ":")
+				attrs := strings.Split(xstat, ":")
 				if len(attrs) >= 3 {
 					val, err := strconv.ParseUint(attrs[0], 10, 32)
 					if err != nil {

vendor/github.com/containers/storage/pkg/archive/archive_linux.go

@@ -16,7 +16,7 @@ func getOverlayOpaqueXattrName() string {
 	return GetOverlayXattrName("opaque")
 }
 
-func GetWhiteoutConverter(format WhiteoutFormat, data interface{}) TarWhiteoutConverter {
+func GetWhiteoutConverter(format WhiteoutFormat, data any) TarWhiteoutConverter {
 	if format == OverlayWhiteoutFormat {
 		if rolayers, ok := data.([]string); ok && len(rolayers) > 0 {
 			return overlayWhiteoutConverter{rolayers: rolayers}
@@ -173,7 +173,7 @@ func (o overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, path string) (boo
 
 func isWhiteOut(stat os.FileInfo) bool {
 	s := stat.Sys().(*syscall.Stat_t)
-	return major(uint64(s.Rdev)) == 0 && minor(uint64(s.Rdev)) == 0
+	return major(uint64(s.Rdev)) == 0 && minor(uint64(s.Rdev)) == 0 //nolint:unconvert
 }
 
 func GetFileOwner(path string) (uint32, uint32, uint32, error) {

vendor/github.com/containers/storage/pkg/archive/archive_unix.go

@@ -67,7 +67,7 @@ func chmodTarEntry(perm os.FileMode) os.FileMode {
 	return perm // noop for unix as golang APIs provide perm bits correctly
 }
 
-func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat interface{}) (err error) {
+func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat any) (err error) {
 	s, ok := stat.(*syscall.Stat_t)
 
 	if ok {
@@ -82,7 +82,7 @@ func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat interface{}) (
 	return
 }
 
-func getInodeFromStat(stat interface{}) (inode uint64, err error) {
+func getInodeFromStat(stat any) (inode uint64, err error) {
 	s, ok := stat.(*syscall.Stat_t)
 
 	if ok {
@@ -92,7 +92,7 @@ func getInodeFromStat(stat interface{}) (inode uint64, err error) {
 	return
 }
 
-func getFileUIDGID(stat interface{}) (idtools.IDPair, error) {
+func getFileUIDGID(stat any) (idtools.IDPair, error) {
 	s, ok := stat.(*syscall.Stat_t)
 
 	if !ok {

vendor/github.com/containers/storage/pkg/archive/changes_linux.go

@@ -297,7 +297,7 @@ func parseDirent(buf []byte, names []nameIno) (consumed int, newnames []nameIno)
 			continue
 		}
 		builder := make([]byte, 0, dirent.Reclen)
-		for i := 0; i < len(dirent.Name); i++ {
+		for i := range len(dirent.Name) {
 			if dirent.Name[i] == 0 {
 				break
 			}

vendor/github.com/containers/storage/pkg/chunked/bloom_filter_linux.go

@@ -65,7 +65,7 @@ func (bf *bloomFilter) writeTo(writer io.Writer) error {
 	if err := binary.Write(writer, binary.LittleEndian, uint64(len(bf.bitArray))); err != nil {
 		return err
 	}
-	if err := binary.Write(writer, binary.LittleEndian, uint32(bf.k)); err != nil {
+	if err := binary.Write(writer, binary.LittleEndian, bf.k); err != nil {
 		return err
 	}
 	if err := binary.Write(writer, binary.LittleEndian, bf.bitArray); err != nil {

vendor/github.com/containers/storage/pkg/chunked/compression_linux.go

@@ -87,7 +87,7 @@ func readEstargzChunkedManifest(blobStream ImageSourceSeekable, blobSize int64,
 		return nil, 0, fmt.Errorf("parse ToC offset: %w", err)
 	}
 
-	size := int64(blobSize - footerSize - tocOffset)
+	size := blobSize - footerSize - tocOffset
 	// set a reasonable limit
 	if size > maxTocSize {
 		// Not errFallbackCanConvert: we would still use too much memory.

vendor/github.com/containers/storage/pkg/chunked/compressor/compressor.go

@@ -160,7 +160,7 @@ func (rc *rollingChecksumReader) Read(b []byte) (bool, int, error) {
 		return false, 0, io.EOF
 	}
 
-	for i := 0; i < len(b); i++ {
+	for i := range b {
 		holeLen, n, err := rc.reader.readByte()
 		if err != nil {
 			if err == io.EOF {

vendor/github.com/containers/storage/pkg/chunked/dump/dump.go

@@ -43,7 +43,7 @@ func escaped(val []byte, escape int) string {
 	}
 
 	var result string
-	for _, c := range []byte(val) {
+	for _, c := range val {
 		hexEscape := false
 		var special string
 
@@ -214,7 +214,7 @@ func dumpNode(out io.Writer, added map[string]*minimal.FileMetadata, links map[s
 }
 
 // GenerateDump generates a dump of the TOC in the same format as `composefs-info dump`
-func GenerateDump(tocI interface{}, verityDigests map[string]string) (io.Reader, error) {
+func GenerateDump(tocI any, verityDigests map[string]string) (io.Reader, error) {
 	toc, ok := tocI.(*minimal.TOC)
 	if !ok {
 		return nil, fmt.Errorf("invalid TOC type")

vendor/github.com/containers/storage/pkg/chunked/internal/minimal/compression.go

@@ -234,7 +234,7 @@ func WriteZstdChunkedManifest(dest io.Writer, outMetadata map[string]string, off
 		Offset:                     manifestOffset,
 		LengthCompressed:           uint64(len(compressedManifest)),
 		LengthUncompressed:         uint64(len(manifest)),
-		OffsetTarSplit:             uint64(tarSplitOffset),
+		OffsetTarSplit:             tarSplitOffset,
 		LengthCompressedTarSplit:   uint64(len(tarSplitData.Data)),
 		LengthUncompressedTarSplit: uint64(tarSplitData.UncompressedSize),
 	}

vendor/github.com/containers/storage/pkg/chunked/storage_linux.go

@@ -111,7 +111,7 @@ type chunkedDiffer struct {
 	useFsVerity graphdriver.DifferFsVerity
 }
 
-var xattrsToIgnore = map[string]interface{}{
+var xattrsToIgnore = map[string]any{
 	"security.selinux": true,
 }
 
@@ -1011,7 +1011,7 @@ func mergeMissingChunks(missingParts []missingPart, target int) []missingPart {
 			!missingParts[prevIndex].Hole && !missingParts[i].Hole &&
 			len(missingParts[prevIndex].Chunks) == 1 && len(missingParts[i].Chunks) == 1 &&
 			missingParts[prevIndex].Chunks[0].File.Name == missingParts[i].Chunks[0].File.Name {
-			missingParts[prevIndex].SourceChunk.Length += uint64(gap) + missingParts[i].SourceChunk.Length
+			missingParts[prevIndex].SourceChunk.Length += gap + missingParts[i].SourceChunk.Length
 			missingParts[prevIndex].Chunks[0].CompressedSize += missingParts[i].Chunks[0].CompressedSize
 			missingParts[prevIndex].Chunks[0].UncompressedSize += missingParts[i].Chunks[0].UncompressedSize
 		} else {
@@ -1069,7 +1069,7 @@ func mergeMissingChunks(missingParts []missingPart, target int) []missingPart {
 		} else {
 			gap := getGap(missingParts, i)
 			prev := &newMissingParts[len(newMissingParts)-1]
-			prev.SourceChunk.Length += uint64(gap) + missingParts[i].SourceChunk.Length
+			prev.SourceChunk.Length += gap + missingParts[i].SourceChunk.Length
 			prev.Hole = false
 			prev.OriginFile = nil
 			if gap > 0 {
@@ -1483,7 +1483,7 @@ func (c *chunkedDiffer) ApplyDiff(dest string, options *archive.TarOptions, diff
 			bigDataKey:          c.manifest,
 			chunkedLayerDataKey: lcdBigData,
 		},
-		Artifacts: map[string]interface{}{
+		Artifacts: map[string]any{
 			tocKey: toc,
 		},
 		TOCDigest:          c.tocDigest,
@@ -1761,7 +1761,7 @@ func (c *chunkedDiffer) ApplyDiff(dest string, options *archive.TarOptions, diff
 
 		// the file is missing, attempt to find individual chunks.
 		for _, chunk := range r.chunks {
-			compressedSize := int64(chunk.EndOffset - chunk.Offset)
+			compressedSize := chunk.EndOffset - chunk.Offset
 			size := remainingSize
 			if chunk.ChunkSize > 0 {
 				size = chunk.ChunkSize

vendor/github.com/containers/storage/pkg/directory/directory_unix.go

@@ -42,13 +42,11 @@ func Usage(dir string) (usage *DiskUsage, err error) {
 
 		// Check inode to only count the sizes of files with multiple hard links once.
 		inode := fileInfo.Sys().(*syscall.Stat_t).Ino
-		// inode is not a uint64 on all platforms. Cast it to avoid issues.
-		if _, exists := data[uint64(inode)]; exists {
+		if _, exists := data[inode]; exists {
 			return nil
 		}
 
-		// inode is not a uint64 on all platforms. Cast it to avoid issues.
-		data[uint64(inode)] = struct{}{}
+		data[inode] = struct{}{}
 		// Ignore directory sizes
 		if entry.IsDir() {
 			return nil

vendor/github.com/containers/storage/pkg/ioutils/bytespipe.go

@@ -175,7 +175,7 @@ func getBuffer(size int) *fixedBuffer {
 	bufPoolsLock.Lock()
 	pool, ok := bufPools[size]
 	if !ok {
-		pool = &sync.Pool{New: func() interface{} { return &fixedBuffer{buf: make([]byte, 0, size)} }}
+		pool = &sync.Pool{New: func() any { return &fixedBuffer{buf: make([]byte, 0, size)} }}
 		bufPools[size] = pool
 	}
 	bufPoolsLock.Unlock()

vendor/github.com/containers/storage/pkg/loopback/attach_loopback.go

@@ -113,7 +113,7 @@ func openNextAvailableLoopback(sparseName string, sparseFile *os.File) (*os.File
 			logrus.Errorf("Getting loopback backing file: %s", err)
 			return nil, ErrGetLoopbackBackingFile
 		}
-		if dev != uint64(st.Dev) || ino != st.Ino {
+		if dev != uint64(st.Dev) || ino != st.Ino { //nolint:unconvert
 			logrus.Errorf("Loopback device and filesystem disagree on device/inode for %q: %#x(%d):%#x(%d) vs %#x(%d):%#x(%d)", sparseName, dev, dev, ino, ino, st.Dev, st.Dev, st.Ino, st.Ino)
 		}
 		return loopFile, nil

vendor/github.com/containers/storage/pkg/loopback/loopback.go

@@ -36,7 +36,7 @@ func FindLoopDeviceFor(file *os.File) *os.File {
 		return nil
 	}
 	targetInode := stat.Sys().(*syscall.Stat_t).Ino
-	targetDevice := stat.Sys().(*syscall.Stat_t).Dev
+	targetDevice := uint64(stat.Sys().(*syscall.Stat_t).Dev) //nolint:unconvert
 
 	for i := 0; true; i++ {
 		path := fmt.Sprintf("/dev/loop%d", i)
@@ -53,7 +53,7 @@ func FindLoopDeviceFor(file *os.File) *os.File {
 		}
 
 		dev, inode, err := getLoopbackBackingFile(file)
-		if err == nil && dev == uint64(targetDevice) && inode == targetInode {
+		if err == nil && dev == targetDevice && inode == targetInode {
 			return file
 		}
 		file.Close()

vendor/github.com/containers/storage/pkg/pools/pools.go

@@ -40,7 +40,7 @@ func init() {
 // added here to be shared where required.
 func newBufioReaderPoolWithSize(size int) *BufioReaderPool {
 	pool := &sync.Pool{
-		New: func() interface{} { return bufio.NewReaderSize(nil, size) },
+		New: func() any { return bufio.NewReaderSize(nil, size) },
 	}
 	return &BufioReaderPool{pool: pool}
 }
@@ -87,7 +87,7 @@ type BufioWriterPool struct {
 // added here to be shared where required.
 func newBufioWriterPoolWithSize(size int) *BufioWriterPool {
 	pool := &sync.Pool{
-		New: func() interface{} { return bufio.NewWriterSize(nil, size) },
+		New: func() any { return bufio.NewWriterSize(nil, size) },
 	}
 	return &BufioWriterPool{pool: pool}
 }

vendor/github.com/containers/storage/pkg/reexec/reexec.go

@@ -49,7 +49,7 @@ func panicIfNotInitialized() {
 	}
 }
 
-func naiveSelf() string { //nolint: unused
+func naiveSelf() string {
 	name := os.Args[0]
 	if filepath.Base(name) == name {
 		if lp, err := exec.LookPath(name); err == nil {

vendor/github.com/containers/storage/pkg/stringutils/stringutils.go

@@ -24,7 +24,7 @@ func GenerateRandomASCIIString(n int) string {
 		"ABCDEFGHIJKLMNOPQRSTUVWXYZ" +
 		"~!@#$%^&*()-_+={}[]\\|<,>.?/\"';:` "
 	res := make([]byte, n)
-	for i := 0; i < n; i++ {
+	for i := range n {
 		res[i] = chars[rand.IntN(len(chars))]
 	}
 	return string(res)
@@ -83,7 +83,7 @@ func quote(word string, buf *bytes.Buffer) {
 
 	buf.WriteString("'")
 
-	for i := 0; i < len(word); i++ {
+	for i := range len(word) {
 		b := word[i]
 		if b == '\'' {
 			// Replace literal ' with a close ', a \', and an open '

vendor/github.com/containers/storage/pkg/system/stat_linux.go

@@ -9,9 +9,9 @@ func fromStatT(s *syscall.Stat_t) (*StatT, error) {
 		mode: s.Mode,
 		uid:  s.Uid,
 		gid:  s.Gid,
-		rdev: uint64(s.Rdev),
+		rdev: uint64(s.Rdev), //nolint:unconvert
 		mtim: s.Mtim,
-		dev:  uint64(s.Dev),
+		dev:  uint64(s.Dev), //nolint:unconvert
 	}, nil
 }
 

vendor/github.com/containers/storage/pkg/unshare/unshare_linux.go

@@ -468,7 +468,7 @@ type Runnable interface {
 	Run() error
 }
 
-func bailOnError(err error, format string, a ...interface{}) { // nolint: revive,goprintffuncname
+func bailOnError(err error, format string, a ...any) { //nolint:revive,goprintffuncname
 	if err != nil {
 		if format != "" {
 			logrus.Errorf("%s: %v", fmt.Sprintf(format, a...), err)

vendor/github.com/containers/storage/store.go

@@ -162,7 +162,7 @@ type flaggableStore interface {
 	ClearFlag(id string, flag string) error
 
 	// SetFlag sets a named flag and its value on an item in the store.
-	SetFlag(id string, flag string, value interface{}) error
+	SetFlag(id string, flag string, value any) error
 }
 
 type StoreOptions = types.StoreOptions
@@ -672,7 +672,7 @@ type LayerOptions struct {
 	// Flags is a set of named flags and their values to store with the layer.
 	// Currently these can only be set when the layer record is created, but that
 	// could change in the future.
-	Flags map[string]interface{}
+	Flags map[string]any
 }
 
 type LayerBigDataOption struct {
@@ -700,7 +700,7 @@ type ImageOptions struct {
 	NamesHistory []string
 	// Flags is a set of named flags and their values to store with the image.  Currently these can only
 	// be set when the image record is created, but that could change in the future.
-	Flags map[string]interface{}
+	Flags map[string]any
 }
 
 type ImageBigDataOption struct {
@@ -720,7 +720,7 @@ type ContainerOptions struct {
 	// Flags is a set of named flags and their values to store with the container.
 	// Currently these can only be set when the container record is created, but that
 	// could change in the future.
-	Flags      map[string]interface{}
+	Flags      map[string]any
 	MountOpts  []string
 	Volatile   bool
 	StorageOpt map[string]string
@@ -1649,7 +1649,7 @@ func (s *store) CreateImage(id string, names []string, layer, metadata string, i
 			options.BigData = append(options.BigData, copyImageBigDataOptionSlice(iOptions.BigData)...)
 			options.NamesHistory = append(options.NamesHistory, iOptions.NamesHistory...)
 			if options.Flags == nil {
-				options.Flags = make(map[string]interface{})
+				options.Flags = make(map[string]any)
 			}
 			maps.Copy(options.Flags, iOptions.Flags)
 		}
@@ -1918,7 +1918,7 @@ func (s *store) CreateContainer(id string, names []string, image, layer, metadat
 		}
 	}
 	if options.Flags == nil {
-		options.Flags = make(map[string]interface{})
+		options.Flags = make(map[string]any)
 	}
 	plabel, _ := options.Flags[processLabelFlag].(string)
 	mlabel, _ := options.Flags[mountLabelFlag].(string)
@@ -3763,11 +3763,10 @@ func copyMapPreferringNil[K comparable, V any](m map[K]V) map[K]V {
 // newMapFrom returns a shallow clone of map m.
 // If m is empty, an empty map is allocated and returned.
 func newMapFrom[K comparable, V any](m map[K]V) map[K]V {
-	ret := make(map[K]V, len(m))
-	for k, v := range m {
-		ret[k] = v
+	if len(m) == 0 {
+		return make(map[K]V, 0)
 	}
-	return ret
+	return maps.Clone(m)
 }
 
 func copyImageBigDataOptionSlice(slice []ImageBigDataOption) []ImageBigDataOption {