Merge pull request #1813 from jedevc/oci-export-on-containerd

vendor: github.com/compose-spec/compose-go v1.14.0

.github/CONTRIBUTING.md

@@ -116,6 +116,60 @@ commit automatically with `git commit -s`.
 
 ### Run the unit- and integration-tests
 
+Running tests:
+
+```bash
+make test
+```
+
+This runs all unit and integration tests, in a containerized environment.
+Locally, every package can be tested separately with standard Go tools, but
+integration tests are skipped if local user doesn't have enough permissions or
+worker binaries are not installed.
+
+```bash
+# run unit tests only
+make test-unit
+
+# run integration tests only
+make test-integration
+
+# test a specific package
+TESTPKGS=./bake make test
+
+# run all integration tests with a specific worker
+TESTFLAGS="--run=//worker=remote -v" make test-integration
+
+# run a specific integration test
+TESTFLAGS="--run /TestBuild/worker=remote/ -v" make test-integration
+
+# run a selection of integration tests using a regexp
+TESTFLAGS="--run /TestBuild.*/worker=remote/ -v" make test-integration
+```
+
+> **Note**
+>
+> Set `TEST_KEEP_CACHE=1` for the test framework to keep external dependant
+> images in a docker volume if you are repeatedly calling `make test`. This
+> helps to avoid rate limiting on the remote registry side.
+
+> **Note**
+>
+> Set `TEST_DOCKERD=1` for the test framework to enable the docker workers,
+> specifically the `docker` and `docker-container` drivers.
+>
+> The docker tests cannot be run in parallel, so require passing `--parallel=1`
+> in `TESTFLAGS`.
+
+> **Note**
+>
+> If you are working behind a proxy, you can set some of or all
+> `HTTP_PROXY=http://ip:port`, `HTTPS_PROXY=http://ip:port`, `NO_PROXY=http://ip:port`
+> for the test framework to specify the proxy build args.
+
+
+### Run the helper commands
+
 To enter a demo container environment and experiment, you may run:
 
 ```

.github/workflows/build.yml

@@ -23,14 +23,18 @@ env:
   BUILDKIT_IMAGE: "moby/buildkit:latest"
   REPO_SLUG: "docker/buildx-bin"
   DESTDIR: "./bin"
+  TEST_CACHE_SCOPE: "test"
 
 jobs:
-  test:
+  prepare-test:
     runs-on: ubuntu-22.04
     steps:
       -
         name: Checkout
         uses: actions/checkout@v3
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
@@ -39,20 +43,89 @@ jobs:
           driver-opts: image=${{ env.BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
-        name: Test
+        name: Build
         uses: docker/bake-action@v3
         with:
-          targets: test
+          targets: integration-test-base
           set: |
-            *.cache-from=type=gha,scope=test
-            *.cache-to=type=gha,scope=test
+            *.cache-from=type=gha,scope=${{ env.TEST_CACHE_SCOPE }}
+            *.cache-to=type=gha,scope=${{ env.TEST_CACHE_SCOPE }}
+
+  test:
+    runs-on: ubuntu-22.04
+    needs:
+      - prepare-test
+    env:
+      TESTFLAGS: "-v --parallel=6 --timeout=30m"
+      TESTFLAGS_DOCKER: "-v --parallel=1 --timeout=30m"
+      GOTESTSUM_FORMAT: "standard-verbose"
+      TEST_IMAGE_BUILD: "0"
+      TEST_IMAGE_ID: "buildx-tests"
+    strategy:
+      fail-fast: false
+      matrix:
+        worker:
+          - docker
+          - docker-container
+          - remote
+        pkg:
+          - ./tests
+        include:
+          - pkg: ./...
+            skip-integration-tests: 1
+    steps:
       -
-        name: Upload coverage
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          buildkitd-flags: --debug
+      -
+        name: Build test image
+        uses: docker/bake-action@v3
+        with:
+          targets: integration-test
+          set: |
+            *.cache-from=type=gha,scope=${{ env.TEST_CACHE_SCOPE }}
+            *.output=type=docker,name=${{ env.TEST_IMAGE_ID }}
+      -
+        name: Test
+        run: |
+          export TEST_REPORT_SUFFIX=-${{ github.job }}-$(echo "${{ matrix.pkg }}-${{ matrix.skip-integration-tests }}-${{ matrix.worker }}" | tr -dc '[:alnum:]-\n\r' | tr '[:upper:]' '[:lower:]')
+          ./hack/test
+        env:
+          TEST_DOCKERD: "${{ (matrix.worker == 'docker' || matrix.worker == 'docker-container') && '1' || '0' }}"
+          TESTFLAGS: "${{ (matrix.worker == 'docker' || matrix.worker == 'docker-container') && env.TESTFLAGS_DOCKER || env.TESTFLAGS }} --run=//worker=${{ matrix.worker }}$"
+          TESTPKGS: "${{ matrix.pkg }}"
+          SKIP_INTEGRATION_TESTS: "${{ matrix.skip-integration-tests }}"
+      -
+        name: Send to Codecov
+        if: always()
         uses: codecov/codecov-action@v3
         with:
-          directory: ${{ env.DESTDIR }}/coverage
+          directory: ./bin/testreports
+      -
+        name: Generate annotations
+        if: always()
+        uses: crazy-max/.github/.github/actions/gotest-annotations@1a64ea6d01db9a48aa61954cb20e265782c167d9
+        with:
+          directory: ./bin/testreports
+      -
+        name: Upload test reports
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: test-reports
+          path: ./bin/testreports
 
-  prepare:
+  prepare-binaries:
     runs-on: ubuntu-22.04
     outputs:
       matrix: ${{ steps.platforms.outputs.matrix }}
@@ -73,11 +146,11 @@ jobs:
   binaries:
     runs-on: ubuntu-22.04
     needs:
-      - prepare
+      - prepare-binaries
     strategy:
       fail-fast: false
       matrix:
-        platform: ${{ fromJson(needs.prepare.outputs.matrix) }}
+        platform: ${{ fromJson(needs.prepare-binaries.outputs.matrix) }}
     steps:
       -
         name: Prepare
@@ -115,6 +188,8 @@ jobs:
 
   bin-image:
     runs-on: ubuntu-22.04
+    needs:
+      - test
     if: ${{ github.event_name != 'pull_request' && github.repository == 'docker/buildx' }}
     steps:
       -
@@ -166,6 +241,7 @@ jobs:
   release:
     runs-on: ubuntu-22.04
     needs:
+      - test
       - binaries
     steps:
       -

Dockerfile

@@ -1,8 +1,11 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.20
-ARG XX_VERSION=1.1.2
+ARG XX_VERSION=1.2.1
 ARG DOCKERD_VERSION=20.10.14
+ARG GOTESTSUM_VERSION=v1.9.0
+ARG REGISTRY_VERSION=2.8.0
+ARG BUILDKIT_VERSION=v0.11.6
 
 FROM docker:$DOCKERD_VERSION AS dockerd-release
 
@@ -18,6 +21,17 @@ ENV GOFLAGS=-mod=vendor
 ENV CGO_ENABLED=0
 WORKDIR /src
 
+FROM registry:$REGISTRY_VERSION AS registry
+
+FROM moby/buildkit:$BUILDKIT_VERSION AS buildkit
+
+FROM gobase AS gotestsum
+ARG GOTESTSUM_VERSION
+ENV GOFLAGS=
+RUN --mount=target=/root/.cache,type=cache \
+  GOBIN=/out/ go install "gotest.tools/gotestsum@${GOTESTSUM_VERSION}" && \
+  /out/gotestsum --version
+
 FROM gobase AS buildx-version
 RUN --mount=type=bind,target=. <<EOT
   set -e
@@ -39,6 +53,7 @@ RUN --mount=type=bind,target=. \
 EOT
 
 FROM gobase AS test
+ENV SKIP_INTEGRATION_TESTS=1
 RUN --mount=type=bind,target=. \
   --mount=type=cache,target=/root/.cache \
   --mount=type=cache,target=/go/pkg/mod \
@@ -61,6 +76,17 @@ FROM binaries-$TARGETOS AS binaries
 # enable scanning for this stage
 ARG BUILDKIT_SBOM_SCAN_STAGE=true
 
+FROM gobase AS integration-test-base
+RUN apk add --no-cache docker runc containerd
+COPY --link --from=gotestsum /out/gotestsum /usr/bin/
+COPY --link --from=registry /bin/registry /usr/bin/
+COPY --link --from=buildkit /usr/bin/buildkitd /usr/bin/
+COPY --link --from=buildkit /usr/bin/buildctl /usr/bin/
+COPY --link --from=binaries /buildx /usr/bin/
+
+FROM integration-test-base AS integration-test
+COPY . .
+
 # Release
 FROM --platform=$BUILDPLATFORM alpine AS releaser
 WORKDIR /work

Makefile

@@ -45,7 +45,15 @@ lint:
 
 .PHONY: test
 test:
-	$(BUILDX_CMD) bake test
+	./hack/test
+
+.PHONY: test-unit
+test-unit:
+	TESTPKGS=./... SKIP_INTEGRATION_TESTS=1 ./hack/test
+
+.PHONY: test
+test-integration:
+	TESTPKGS=./tests ./hack/test
 
 .PHONY: validate-vendor
 validate-vendor:

bake/bake.go

@@ -620,7 +620,7 @@ var _ hclparser.WithEvalContexts = &Group{}
 var _ hclparser.WithGetName = &Group{}
 
 func (t *Target) normalize() {
-	t.Attest = removeDupes(t.Attest)
+	t.Attest = removeAttestDupes(t.Attest)
 	t.Tags = removeDupes(t.Tags)
 	t.Secrets = removeDupes(t.Secrets)
 	t.SSH = removeDupes(t.SSH)
@@ -682,6 +682,7 @@ func (t *Target) Merge(t2 *Target) {
 	}
 	if t2.Attest != nil { // merge
 		t.Attest = append(t.Attest, t2.Attest...)
+		t.Attest = removeAttestDupes(t.Attest)
 	}
 	if t2.Secrets != nil { // merge
 		t.Secrets = append(t.Secrets, t2.Secrets...)
@@ -999,6 +1000,10 @@ func checkPath(p string) error {
 		}
 		return err
 	}
+	p, err = filepath.Abs(p)
+	if err != nil {
+		return err
+	}
 	wd, err := os.Getwd()
 	if err != nil {
 		return err
@@ -1007,7 +1012,8 @@ func checkPath(p string) error {
 	if err != nil {
 		return err
 	}
-	if strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
+	parts := strings.Split(rel, string(os.PathSeparator))
+	if parts[0] == ".." {
 		return errors.Errorf("path %s is outside of the working directory, please set BAKE_ALLOW_REMOTE_FS_ACCESS=1", p)
 	}
 	return nil
@@ -1193,6 +1199,26 @@ func removeDupes(s []string) []string {
 	return s[:i]
 }
 
+func removeAttestDupes(s []string) []string {
+	res := []string{}
+	m := map[string]int{}
+	for _, v := range s {
+		att, err := buildflags.ParseAttest(v)
+		if err != nil {
+			res = append(res, v)
+			continue
+		}
+
+		if i, ok := m[att.Type]; ok {
+			res[i] = v
+		} else {
+			m[att.Type] = len(res)
+			res = append(res, v)
+		}
+	}
+	return res
+}
+
 func parseOutputType(str string) string {
 	csvReader := csv.NewReader(strings.NewReader(str))
 	fields, err := csvReader.Read()

bake/bake_test.go

@@ -1417,3 +1417,36 @@ func TestReadLocalFilesDefault(t *testing.T) {
 		})
 	}
 }
+
+func TestAttestDuplicates(t *testing.T) {
+	fp := File{
+		Name: "docker-bake.hcl",
+		Data: []byte(
+			`target "default" {
+                attest = ["type=sbom", "type=sbom,generator=custom", "type=sbom,foo=bar", "type=provenance,mode=max"]
+            }`),
+	}
+	ctx := context.TODO()
+
+	m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil)
+	require.Equal(t, []string{"type=sbom,foo=bar", "type=provenance,mode=max"}, m["default"].Attest)
+	require.NoError(t, err)
+
+	opts, err := TargetsToBuildOpt(m, &Input{})
+	require.NoError(t, err)
+	require.Equal(t, map[string]*string{
+		"sbom":       ptrstr("type=sbom,foo=bar"),
+		"provenance": ptrstr("type=provenance,mode=max"),
+	}, opts["default"].Attests)
+
+	m, _, err = ReadTargets(ctx, []File{fp}, []string{"default"}, []string{"*.attest=type=sbom,disabled=true"}, nil)
+	require.Equal(t, []string{"type=sbom,disabled=true", "type=provenance,mode=max"}, m["default"].Attest)
+	require.NoError(t, err)
+
+	opts, err = TargetsToBuildOpt(m, &Input{})
+	require.NoError(t, err)
+	require.Equal(t, map[string]*string{
+		"sbom":       nil,
+		"provenance": ptrstr("type=provenance,mode=max"),
+	}, opts["default"].Attests)
+}

build/build.go

@@ -26,6 +26,7 @@ import (
 	"github.com/docker/buildx/builder"
 	"github.com/docker/buildx/driver"
 	"github.com/docker/buildx/localstate"
+	"github.com/docker/buildx/util/desktop"
 	"github.com/docker/buildx/util/dockerutil"
 	"github.com/docker/buildx/util/imagetools"
 	"github.com/docker/buildx/util/progress"
@@ -65,7 +66,7 @@ var (
 )
 
 const (
-	printFallbackImage = "docker/dockerfile-upstream:1.4-outline@sha256:627443ff4e2d0f635d429cfc1da5388bcd5a70949c38adcd3cd7c4e5df67c73c"
+	printFallbackImage = "docker/dockerfile:1.5.2-labs@sha256:f2e91734a84c0922ff47aa4098ab775f1dfa932430d2888dd5cad5251fafdac4"
 )
 
 type Options struct {
@@ -363,7 +364,7 @@ func toRepoOnly(in string) (string, error) {
 	return strings.Join(out, ","), nil
 }
 
-func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt Options, bopts gateway.BuildOpts, configDir string, pw progress.Writer, dl dockerLoadCallback) (solveOpt *client.SolveOpt, release func(), err error) {
+func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt Options, bopts gateway.BuildOpts, configDir string, pw progress.Writer, docker *dockerutil.Client) (solveOpt *client.SolveOpt, release func(), err error) {
 	nodeDriver := node.Driver
 	defers := make([]func(), 0, 2)
 	releaseF := func() {
@@ -389,7 +390,7 @@ func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt Op
 	}
 
 	for _, e := range opt.CacheTo {
-		if e.Type != "inline" && !nodeDriver.Features()[driver.CacheExport] {
+		if e.Type != "inline" && !nodeDriver.Features(ctx)[driver.CacheExport] {
 			return nil, nil, notSupported(nodeDriver, driver.CacheExport)
 		}
 	}
@@ -527,25 +528,33 @@ func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt Op
 
 	// set up exporters
 	for i, e := range opt.Exports {
-		if e.Type == "oci" && !nodeDriver.Features()[driver.OCIExporter] {
+		if e.Type == "oci" && !nodeDriver.Features(ctx)[driver.OCIExporter] {
 			return nil, nil, notSupported(nodeDriver, driver.OCIExporter)
 		}
 		if e.Type == "docker" {
-			if len(opt.Platforms) > 1 || len(attests) > 0 {
+			features := docker.Features(ctx, e.Attrs["context"])
+			if features[dockerutil.OCIImporter] && e.Output == nil {
+				// rely on oci importer if available (which supports
+				// multi-platform images), otherwise fall back to docker
+				opt.Exports[i].Type = "oci"
+			} else if len(opt.Platforms) > 1 || len(attests) > 0 {
+				if e.Output != nil {
+					return nil, nil, errors.Errorf("docker exporter does not support exporting manifest lists, use the oci exporter instead")
+				}
 				return nil, nil, errors.Errorf("docker exporter does not currently support exporting manifest lists")
 			}
 			if e.Output == nil {
 				if nodeDriver.IsMobyDriver() {
 					e.Type = "image"
 				} else {
-					w, cancel, err := dl(e.Attrs["context"])
+					w, cancel, err := docker.LoadImage(ctx, e.Attrs["context"], pw)
 					if err != nil {
 						return nil, nil, err
 					}
 					defers = append(defers, cancel)
 					opt.Exports[i].Output = wrapWriteCloser(w)
 				}
-			} else if !nodeDriver.Features()[driver.DockerExporter] {
+			} else if !nodeDriver.Features(ctx)[driver.DockerExporter] {
 				return nil, nil, notSupported(nodeDriver, driver.DockerExporter)
 			}
 		}
@@ -614,7 +623,7 @@ func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt Op
 		for i, p := range opt.Platforms {
 			pp[i] = platforms.Format(p)
 		}
-		if len(pp) > 1 && !nodeDriver.Features()[driver.MultiPlatform] {
+		if len(pp) > 1 && !nodeDriver.Features(ctx)[driver.MultiPlatform] {
 			return nil, nil, notSupported(nodeDriver, driver.MultiPlatform)
 		}
 		so.FrontendAttrs["platform"] = strings.Join(pp, ",")
@@ -667,7 +676,7 @@ func Build(ctx context.Context, nodes []builder.Node, opt map[string]Options, do
 	return BuildWithResultHandler(ctx, nodes, opt, docker, configDir, w, nil)
 }
 
-func BuildWithResultHandler(ctx context.Context, nodes []builder.Node, opt map[string]Options, docker *dockerutil.Client, configDir string, w progress.Writer, resultHandleFunc func(driverIndex int, rCtx *ResultContext)) (resp map[string]*client.SolveResponse, err error) {
+func BuildWithResultHandler(ctx context.Context, nodes []builder.Node, opt map[string]Options, docker *dockerutil.Client, configDir string, w progress.Writer, resultHandleFunc func(driverIndex int, rCtx *ResultHandle)) (resp map[string]*client.SolveResponse, err error) {
 	if len(nodes) == 0 {
 		return nil, errors.Errorf("driver required for build")
 	}
@@ -733,9 +742,7 @@ func BuildWithResultHandler(ctx context.Context, nodes []builder.Node, opt map[s
 				hasMobyDriver = true
 			}
 			opt.Platforms = np.platforms
-			so, release, err := toSolveOpt(ctx, node, multiDriver, opt, np.bopts, configDir, w, func(name string) (io.WriteCloser, func(), error) {
-				return docker.LoadImage(ctx, name, w)
-			})
+			so, release, err := toSolveOpt(ctx, node, multiDriver, opt, np.bopts, configDir, w, docker)
 			if err != nil {
 				return nil, err
 			}
@@ -822,6 +829,7 @@ func BuildWithResultHandler(ctx context.Context, nodes []builder.Node, opt map[s
 
 			for i, dp := range dps {
 				i, dp, so := i, dp, *dp.so
+				node := nodes[dp.driverIndex]
 				if multiDriver {
 					for i, e := range so.Exports {
 						switch e.Type {
@@ -885,61 +893,71 @@ func BuildWithResultHandler(ctx context.Context, nodes []builder.Node, opt map[s
 
 					cc := c
 					var printRes map[string][]byte
-					rr, err := c.Build(ctx, so, "buildx", func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
-						var isFallback bool
-						var origErr error
-						for {
-							if opt.PrintFunc != nil {
-								if _, ok := req.FrontendOpt["frontend.caps"]; !ok {
-									req.FrontendOpt["frontend.caps"] = "moby.buildkit.frontend.subrequests+forward"
-								} else {
-									req.FrontendOpt["frontend.caps"] += ",moby.buildkit.frontend.subrequests+forward"
-								}
-								req.FrontendOpt["requestid"] = "frontend." + opt.PrintFunc.Name
-								if isFallback {
-									req.FrontendOpt["build-arg:BUILDKIT_SYNTAX"] = printFallbackImage
-								}
+					buildFunc := func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
+						if opt.PrintFunc != nil {
+							if _, ok := req.FrontendOpt["frontend.caps"]; !ok {
+								req.FrontendOpt["frontend.caps"] = "moby.buildkit.frontend.subrequests+forward"
+							} else {
+								req.FrontendOpt["frontend.caps"] += ",moby.buildkit.frontend.subrequests+forward"
 							}
-							res, err := c.Solve(ctx, req)
-							if err != nil {
-								if origErr != nil {
+							req.FrontendOpt["requestid"] = "frontend." + opt.PrintFunc.Name
+						}
+
+						res, err := c.Solve(ctx, req)
+						if err != nil {
+							fallback := false
+							var reqErr *errdefs.UnsupportedSubrequestError
+							if errors.As(err, &reqErr) {
+								switch reqErr.Name {
+								case "frontend.outline", "frontend.targets":
+									fallback = true
+								default:
 									return nil, err
 								}
-								var reqErr *errdefs.UnsupportedSubrequestError
-								if !isFallback {
-									if errors.As(err, &reqErr) {
-										switch reqErr.Name {
-										case "frontend.outline", "frontend.targets":
-											isFallback = true
-											origErr = err
-											continue
-										}
-										return nil, err
-									}
-									// buildkit v0.8 vendored in Docker 20.10 does not support typed errors
-									if strings.Contains(err.Error(), "unsupported request frontend.outline") || strings.Contains(err.Error(), "unsupported request frontend.targets") {
-										isFallback = true
-										origErr = err
-										continue
-									}
-								}
+							} else {
 								return nil, err
 							}
-							if opt.PrintFunc != nil {
-								printRes = res.Metadata
+							// buildkit v0.8 vendored in Docker 20.10 does not support typed errors
+							if strings.Contains(err.Error(), "unsupported request frontend.outline") || strings.Contains(err.Error(), "unsupported request frontend.targets") {
+								fallback = true
 							}
-							results.Set(resultKey(dp.driverIndex, k), res)
-							if resultHandleFunc != nil {
-								resultCtx, err := NewResultContext(ctx, cc, so, res)
-								if err == nil {
-									resultHandleFunc(dp.driverIndex, resultCtx)
-								} else {
-									logrus.Warnf("failed to record result: %s", err)
+
+							if fallback {
+								req.FrontendOpt["build-arg:BUILDKIT_SYNTAX"] = printFallbackImage
+								res2, err2 := c.Solve(ctx, req)
+								if err2 != nil {
+									return nil, err
 								}
+								res = res2
+							} else {
+								return nil, err
 							}
-							return res, nil
 						}
-					}, ch)
+						if opt.PrintFunc != nil {
+							printRes = res.Metadata
+						}
+
+						results.Set(resultKey(dp.driverIndex, k), res)
+						return res, nil
+					}
+					var rr *client.SolveResponse
+					if resultHandleFunc != nil {
+						var resultHandle *ResultHandle
+						resultHandle, rr, err = NewResultHandle(ctx, cc, so, "buildx", buildFunc, ch)
+						resultHandleFunc(dp.driverIndex, resultHandle)
+					} else {
+						rr, err = c.Build(ctx, so, "buildx", buildFunc, ch)
+					}
+					if node.Driver.Features(ctx)[driver.HistoryAPI] && desktop.BuildBackendEnabled() {
+						buildRef := fmt.Sprintf("%s/%s/%s", node.Builder, node.Name, so.Ref)
+						if err != nil {
+							return &desktop.ErrorWithBuildRef{
+								Ref: buildRef,
+								Err: err,
+							}
+						}
+						progress.WriteBuildRef(w, k, buildRef)
+					}
 					if err != nil {
 						return err
 					}
@@ -1543,8 +1561,6 @@ func notSupported(d driver.Driver, f driver.Feature) error {
 	return errors.Errorf("%s feature is currently not supported for %s driver. Please switch to a different driver (eg. \"docker buildx create --use\")", f, d.Factory().Name())
 }
 
-type dockerLoadCallback func(name string) (io.WriteCloser, func(), error)
-
 func noDefaultLoad() bool {
 	v, ok := os.LookupEnv("BUILDX_NO_DEFAULT_LOAD")
 	if !ok {

build/invoke.go

@@ -21,10 +21,10 @@ type Container struct {
 	initStarted     atomic.Bool
 	container       gateway.Container
 	releaseCh       chan struct{}
-	resultCtx       *ResultContext
+	resultCtx       *ResultHandle
 }
 
-func NewContainer(ctx context.Context, resultCtx *ResultContext, cfg *controllerapi.InvokeConfig) (*Container, error) {
+func NewContainer(ctx context.Context, resultCtx *ResultHandle, cfg *controllerapi.InvokeConfig) (*Container, error) {
 	mainCtx := ctx
 
 	ctrCh := make(chan *Container)
@@ -112,7 +112,7 @@ func (c *Container) Exec(ctx context.Context, cfg *controllerapi.InvokeConfig, s
 	return err
 }
 
-func exec(ctx context.Context, resultCtx *ResultContext, cfg *controllerapi.InvokeConfig, ctr gateway.Container, stdin io.ReadCloser, stdout io.WriteCloser, stderr io.WriteCloser) error {
+func exec(ctx context.Context, resultCtx *ResultHandle, cfg *controllerapi.InvokeConfig, ctr gateway.Container, stdin io.ReadCloser, stdout io.WriteCloser, stderr io.WriteCloser) error {
 	processCfg, err := resultCtx.getProcessConfig(cfg, stdin, stdout, stderr)
 	if err != nil {
 		return err

build/result.go

@@ -6,8 +6,6 @@ import (
 	"encoding/json"
 	"io"
 	"sync"
-	"sync/atomic"
-	"time"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/moby/buildkit/client"
@@ -22,14 +20,187 @@ import (
 	"golang.org/x/sync/errgroup"
 )
 
-func NewResultContext(ctx context.Context, c *client.Client, solveOpt client.SolveOpt, res *gateway.Result) (*ResultContext, error) {
-	def, err := getDefinition(ctx, res)
-	if err != nil {
-		return nil, err
+// NewResultHandle makes a call to client.Build, additionally returning a
+// opaque ResultHandle alongside the standard response and error.
+//
+// This ResultHandle can be used to execute additional build steps in the same
+// context as the build occurred, which can allow easy debugging of build
+// failures and successes.
+//
+// If the returned ResultHandle is not nil, the caller must call Done() on it.
+func NewResultHandle(ctx context.Context, cc *client.Client, opt client.SolveOpt, product string, buildFunc gateway.BuildFunc, ch chan *client.SolveStatus) (*ResultHandle, *client.SolveResponse, error) {
+	// Create a new context to wrap the original, and cancel it when the
+	// caller-provided context is cancelled.
+	//
+	// We derive the context from the background context so that we can forbid
+	// cancellation of the build request after <-done is closed (which we do
+	// before returning the ResultHandle).
+	baseCtx := ctx
+	ctx, cancel := context.WithCancelCause(context.Background())
+	done := make(chan struct{})
+	go func() {
+		select {
+		case <-baseCtx.Done():
+			cancel(baseCtx.Err())
+		case <-done:
+			// Once done is closed, we've recorded a ResultHandle, so we
+			// shouldn't allow cancelling the underlying build request anymore.
+		}
+	}()
+
+	// Create a new channel to forward status messages to the original.
+	//
+	// We do this so that we can discard status messages after the main portion
+	// of the build is complete. This is necessary for the solve error case,
+	// where the original gateway is kept open until the ResultHandle is
+	// closed - we don't want progress messages from operations in that
+	// ResultHandle to display after this function exits.
+	//
+	// Additionally, callers should wait for the progress channel to be closed.
+	// If we keep the session open and never close the progress channel, the
+	// caller will likely hang.
+	baseCh := ch
+	ch = make(chan *client.SolveStatus)
+	go func() {
+		for {
+			s, ok := <-ch
+			if !ok {
+				return
+			}
+			select {
+			case <-baseCh:
+				// base channel is closed, discard status messages
+			default:
+				baseCh <- s
+			}
+		}
+	}()
+	defer close(baseCh)
+
+	var resp *client.SolveResponse
+	var respErr error
+	var respHandle *ResultHandle
+
+	go func() {
+		defer cancel(context.Canceled) // ensure no dangling processes
+
+		var res *gateway.Result
+		var err error
+		resp, err = cc.Build(ctx, opt, product, func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
+			var err error
+			res, err = buildFunc(ctx, c)
+
+			if res != nil && err == nil {
+				// Force evaluation of the build result (otherwise, we likely
+				// won't get a solve error)
+				def, err2 := getDefinition(ctx, res)
+				if err2 != nil {
+					return nil, err2
+				}
+				res, err = evalDefinition(ctx, c, def)
+			}
+
+			if err != nil {
+				// Scenario 1: we failed to evaluate a node somewhere in the
+				// build graph.
+				//
+				// In this case, we construct a ResultHandle from this
+				// original Build session, and return it alongside the original
+				// build error. We then need to keep the gateway session open
+				// until the caller explicitly closes the ResultHandle.
+
+				var se *errdefs.SolveError
+				if errors.As(err, &se) {
+					respHandle = &ResultHandle{
+						done:     make(chan struct{}),
+						solveErr: se,
+						gwClient: c,
+						gwCtx:    ctx,
+					}
+					respErr = se
+					close(done)
+
+					// Block until the caller closes the ResultHandle.
+					select {
+					case <-respHandle.done:
+					case <-ctx.Done():
+					}
+				}
+			}
+			return res, err
+		}, ch)
+		if respHandle != nil {
+			return
+		}
+		if err != nil {
+			// Something unexpected failed during the build, we didn't succeed,
+			// but we also didn't make it far enough to create a ResultHandle.
+			respErr = err
+			close(done)
+			return
+		}
+
+		// Scenario 2: we successfully built the image with no errors.
+		//
+		// In this case, the original gateway session has now been closed
+		// since the Build has been completed. So, we need to create a new
+		// gateway session to populate the ResultHandle. To do this, we
+		// need to re-evaluate the target result, in this new session. This
+		// should be instantaneous since the result should be cached.
+
+		def, err := getDefinition(ctx, res)
+		if err != nil {
+			respErr = err
+			close(done)
+			return
+		}
+
+		// NOTE: ideally this second connection should be lazily opened
+		opt := opt
+		opt.Ref = ""
+		opt.Exports = nil
+		opt.CacheExports = nil
+		_, respErr = cc.Build(ctx, opt, "buildx", func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
+			res, err := evalDefinition(ctx, c, def)
+			if err != nil {
+				// This should probably not happen, since we've previously
+				// successfully evaluated the same result with no issues.
+				return nil, errors.Wrap(err, "inconsistent solve result")
+			}
+			respHandle = &ResultHandle{
+				done:     make(chan struct{}),
+				res:      res,
+				gwClient: c,
+				gwCtx:    ctx,
+			}
+			close(done)
+
+			// Block until the caller closes the ResultHandle.
+			select {
+			case <-respHandle.done:
+			case <-ctx.Done():
+			}
+			return nil, ctx.Err()
+		}, nil)
+		if respHandle != nil {
+			return
+		}
+		close(done)
+	}()
+
+	// Block until the other thread signals that it's completed the build.
+	select {
+	case <-done:
+	case <-baseCtx.Done():
+		if respErr == nil {
+			respErr = baseCtx.Err()
+		}
 	}
-	return getResultAt(ctx, c, solveOpt, def, nil)
+	return respHandle, resp, respErr
 }
 
+// getDefinition converts a gateway result into a collection of definitions for
+// each ref in the result.
 func getDefinition(ctx context.Context, res *gateway.Result) (*result.Result[*pb.Definition], error) {
 	return result.ConvertResult(res, func(ref gateway.Reference) (*pb.Definition, error) {
 		st, err := ref.ToState()
@@ -44,136 +215,58 @@ func getDefinition(ctx context.Context, res *gateway.Result) (*result.Result[*pb
 	})
 }
 
-func getResultAt(ctx context.Context, c *client.Client, solveOpt client.SolveOpt, targets *result.Result[*pb.Definition], statusChan chan *client.SolveStatus) (*ResultContext, error) {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	// forward SolveStatus
-	done := new(atomic.Bool)
-	defer done.Store(true)
-	ch := make(chan *client.SolveStatus)
-	go func() {
-		for {
-			s := <-ch
-			if s == nil {
-				return
-			}
-			if done.Load() {
-				// Do not forward if the function returned because statusChan is possibly closed
-				continue
-			}
-			select {
-			case statusChan <- s:
-			case <-ctx.Done():
-			}
-		}
-	}()
-
-	// get result
-	resultCtxCh := make(chan *ResultContext)
-	errCh := make(chan error)
-	go func() {
-		solveOpt := solveOpt
-		solveOpt.Ref = ""
-		buildDoneCh := make(chan struct{})
-		_, err := c.Build(context.Background(), solveOpt, "buildx", func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
-			doneErr := errors.Errorf("done")
-			ctx, cancel := context.WithCancelCause(ctx)
-			defer cancel(doneErr)
-
-			// force evaluation of all targets in parallel
-			results := make(map[*pb.Definition]*gateway.Result)
-			resultsMu := sync.Mutex{}
-			eg, egCtx := errgroup.WithContext(ctx)
-			targets.EachRef(func(def *pb.Definition) error {
-				eg.Go(func() error {
-					res2, err := c.Solve(egCtx, gateway.SolveRequest{
-						Evaluate:   true,
-						Definition: def,
-					})
-					if err != nil {
-						return err
-					}
-					resultsMu.Lock()
-					results[def] = res2
-					resultsMu.Unlock()
-					return nil
-				})
-				return nil
+// evalDefinition performs the reverse of getDefinition, converting a
+// collection of definitions into a gateway result.
+func evalDefinition(ctx context.Context, c gateway.Client, defs *result.Result[*pb.Definition]) (*gateway.Result, error) {
+	// force evaluation of all targets in parallel
+	results := make(map[*pb.Definition]*gateway.Result)
+	resultsMu := sync.Mutex{}
+	eg, egCtx := errgroup.WithContext(ctx)
+	defs.EachRef(func(def *pb.Definition) error {
+		eg.Go(func() error {
+			res, err := c.Solve(egCtx, gateway.SolveRequest{
+				Evaluate:   true,
+				Definition: def,
 			})
-			resultCtx := ResultContext{}
-			if err := eg.Wait(); err != nil {
-				var se *errdefs.SolveError
-				if errors.As(err, &se) {
-					resultCtx.solveErr = se
-				} else {
-					return nil, err
-				}
+			if err != nil {
+				return err
 			}
-			res2, _ := result.ConvertResult(targets, func(def *pb.Definition) (gateway.Reference, error) {
-				if res, ok := results[def]; ok {
-					return res.Ref, nil
-				}
-				return nil, nil
-			})
-
-			// Record the client and ctx as well so that containers can be created from the SolveError.
-			resultCtx.res = res2
-			resultCtx.gwClient = c
-			resultCtx.gwCtx = ctx
-			resultCtx.gwDone = func() {
-				cancel(doneErr)
-				// wait for Build() completion(or timeout) to ensure the Build's finalizing and avoiding an error "context canceled"
-				select {
-				case <-buildDoneCh:
-				case <-time.After(5 * time.Second):
-				}
-			}
-			select {
-			case resultCtxCh <- &resultCtx:
-			case <-ctx.Done():
-				return nil, ctx.Err()
-			}
-
-			// wait for cleanup or cancel
-			<-ctx.Done()
-			if context.Cause(ctx) != doneErr { // doneErr is not an error.
-				return nil, ctx.Err()
-			}
-			return nil, nil
-		}, ch)
-		close(buildDoneCh)
-		if err != nil {
-			errCh <- err
-		}
-	}()
-
-	select {
-	case resultCtx := <-resultCtxCh:
-		return resultCtx, nil
-	case err := <-errCh:
+			resultsMu.Lock()
+			results[def] = res
+			resultsMu.Unlock()
+			return nil
+		})
+		return nil
+	})
+	if err := eg.Wait(); err != nil {
 		return nil, err
-	case <-ctx.Done():
-		return nil, ctx.Err()
 	}
+	res, _ := result.ConvertResult(defs, func(def *pb.Definition) (gateway.Reference, error) {
+		if res, ok := results[def]; ok {
+			return res.Ref, nil
+		}
+		return nil, nil
+	})
+	return res, nil
 }
 
-// ResultContext is a build result with the client that built it.
-type ResultContext struct {
+// ResultHandle is a build result with the client that built it.
+type ResultHandle struct {
 	res      *gateway.Result
 	solveErr *errdefs.SolveError
 
-	gwClient   gateway.Client
-	gwCtx      context.Context
-	gwDone     func()
-	gwDoneOnce sync.Once
+	done     chan struct{}
+	doneOnce sync.Once
+
+	gwClient gateway.Client
+	gwCtx    context.Context
 
 	cleanups   []func()
 	cleanupsMu sync.Mutex
 }
 
-func (r *ResultContext) Done() {
-	r.gwDoneOnce.Do(func() {
+func (r *ResultHandle) Done() {
+	r.doneOnce.Do(func() {
 		r.cleanupsMu.Lock()
 		cleanups := r.cleanups
 		r.cleanups = nil
@@ -181,22 +274,24 @@ func (r *ResultContext) Done() {
 		for _, f := range cleanups {
 			f()
 		}
-		r.gwDone()
+
+		close(r.done)
+		<-r.gwCtx.Done()
 	})
 }
 
-func (r *ResultContext) registerCleanup(f func()) {
+func (r *ResultHandle) registerCleanup(f func()) {
 	r.cleanupsMu.Lock()
 	r.cleanups = append(r.cleanups, f)
 	r.cleanupsMu.Unlock()
 }
 
-func (r *ResultContext) build(buildFunc gateway.BuildFunc) (err error) {
+func (r *ResultHandle) build(buildFunc gateway.BuildFunc) (err error) {
 	_, err = buildFunc(r.gwCtx, r.gwClient)
 	return err
 }
 
-func (r *ResultContext) getContainerConfig(ctx context.Context, c gateway.Client, cfg *controllerapi.InvokeConfig) (containerCfg gateway.NewContainerRequest, _ error) {
+func (r *ResultHandle) getContainerConfig(ctx context.Context, c gateway.Client, cfg *controllerapi.InvokeConfig) (containerCfg gateway.NewContainerRequest, _ error) {
 	if r.res != nil && r.solveErr == nil {
 		logrus.Debugf("creating container from successful build")
 		ccfg, err := containerConfigFromResult(ctx, r.res, c, *cfg)
@@ -215,7 +310,7 @@ func (r *ResultContext) getContainerConfig(ctx context.Context, c gateway.Client
 	return containerCfg, nil
 }
 
-func (r *ResultContext) getProcessConfig(cfg *controllerapi.InvokeConfig, stdin io.ReadCloser, stdout io.WriteCloser, stderr io.WriteCloser) (_ gateway.StartRequest, err error) {
+func (r *ResultHandle) getProcessConfig(cfg *controllerapi.InvokeConfig, stdin io.ReadCloser, stdout io.WriteCloser, stderr io.WriteCloser) (_ gateway.StartRequest, err error) {
 	processCfg := newStartRequest(stdin, stdout, stderr)
 	if r.res != nil && r.solveErr == nil {
 		logrus.Debugf("creating container from successful build")

builder/node.go

@@ -10,6 +10,7 @@ import (
 	"github.com/docker/buildx/util/dockerutil"
 	"github.com/docker/buildx/util/imagetools"
 	"github.com/docker/buildx/util/platformutil"
+	"github.com/moby/buildkit/client"
 	"github.com/moby/buildkit/util/grpcerrors"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
@@ -24,6 +25,8 @@ type Node struct {
 	Driver      driver.Driver
 	DriverInfo  *driver.Info
 	Platforms   []ocispecs.Platform
+	GCPolicy    []client.PruneInfo
+	Labels      map[string]string
 	ImageOpt    imagetools.Opt
 	ProxyConfig map[string]string
 	Version     string
@@ -184,8 +187,12 @@ func (n *Node) loadData(ctx context.Context) error {
 		if err != nil {
 			return errors.Wrap(err, "listing workers")
 		}
-		for _, w := range workers {
+		for idx, w := range workers {
 			n.Platforms = append(n.Platforms, w.Platforms...)
+			if idx == 0 {
+				n.GCPolicy = w.GCPolicy
+				n.Labels = w.Labels
+			}
 		}
 		n.Platforms = platformutil.Dedupe(n.Platforms)
 		inf, err := driverClient.Info(ctx)

cmd/buildx/main.go

@@ -5,6 +5,7 @@ import (
 	"os"
 
 	"github.com/docker/buildx/commands"
+	"github.com/docker/buildx/util/desktop"
 	"github.com/docker/buildx/version"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli-plugins/manager"
@@ -18,10 +19,7 @@ import (
 	//nolint:staticcheck // vendored dependencies may still use this
 	"github.com/containerd/containerd/pkg/seed"
 
-	_ "k8s.io/client-go/plugin/pkg/client/auth/azure"
-	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
 	_ "k8s.io/client-go/plugin/pkg/client/auth/oidc"
-	_ "k8s.io/client-go/plugin/pkg/client/auth/openstack"
 
 	_ "github.com/docker/buildx/driver/docker"
 	_ "github.com/docker/buildx/driver/docker-container"
@@ -89,6 +87,9 @@ func main() {
 	} else {
 		fmt.Fprintf(cmd.Err(), "ERROR: %v\n", err)
 	}
+	if ebr, ok := err.(*desktop.ErrorWithBuildRef); ok {
+		ebr.Print(cmd.Err())
+	}
 
 	os.Exit(1)
 }

commands/bake.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/containerd/console"
 	"github.com/containerd/containerd/platforms"
 	"github.com/docker/buildx/bake"
 	"github.com/docker/buildx/build"
@@ -13,6 +14,7 @@ import (
 	"github.com/docker/buildx/util/buildflags"
 	"github.com/docker/buildx/util/cobrautil/completion"
 	"github.com/docker/buildx/util/confutil"
+	"github.com/docker/buildx/util/desktop"
 	"github.com/docker/buildx/util/dockerutil"
 	"github.com/docker/buildx/util/progress"
 	"github.com/docker/buildx/util/tracing"
@@ -117,6 +119,11 @@ func runBake(dockerCli command.Cli, targets []string, in bakeOptions, cFlags com
 		progressTextDesc = fmt.Sprintf("building with %q instance using %s driver", b.Name, b.Driver)
 	}
 
+	var term bool
+	if _, err := console.ConsoleFromFile(os.Stderr); err == nil {
+		term = true
+	}
+
 	printer, err := progress.NewPrinter(ctx2, os.Stderr, os.Stderr, cFlags.progress,
 		progress.WithDesc(progressTextDesc, progressConsoleDesc),
 	)
@@ -130,6 +137,9 @@ func runBake(dockerCli command.Cli, targets []string, in bakeOptions, cFlags com
 			if err == nil {
 				err = err1
 			}
+			if err == nil && cFlags.progress != progress.PrinterModeQuiet {
+				desktop.PrintBuildDetails(os.Stderr, printer.BuildRefs(), term)
+			}
 		}
 	}()
 

commands/build.go

@@ -26,6 +26,7 @@ import (
 	"github.com/docker/buildx/store"
 	"github.com/docker/buildx/store/storeutil"
 	"github.com/docker/buildx/util/buildflags"
+	"github.com/docker/buildx/util/desktop"
 	"github.com/docker/buildx/util/ioset"
 	"github.com/docker/buildx/util/progress"
 	"github.com/docker/buildx/util/tracing"
@@ -233,6 +234,15 @@ func runBuild(dockerCli command.Cli, options buildOptions) (err error) {
 	if err != nil {
 		return err
 	}
+	_, err = b.LoadNodes(ctx, false)
+	if err != nil {
+		return err
+	}
+
+	var term bool
+	if _, err := console.ConsoleFromFile(os.Stderr); err == nil {
+		term = true
+	}
 
 	ctx2, cancel := context.WithCancel(context.TODO())
 	defer cancel()
@@ -269,15 +279,15 @@ func runBuild(dockerCli command.Cli, options buildOptions) (err error) {
 		return retErr
 	}
 
-	if options.quiet {
-		fmt.Println(resp.ExporterResponse[exptypes.ExporterImageDigestKey])
+	if progressMode != progress.PrinterModeQuiet {
+		desktop.PrintBuildDetails(os.Stderr, printer.BuildRefs(), term)
+	} else {
+		fmt.Println(getImageID(resp.ExporterResponse))
 	}
 	if options.imageIDFile != "" {
-		dgst := resp.ExporterResponse[exptypes.ExporterImageDigestKey]
-		if v, ok := resp.ExporterResponse[exptypes.ExporterImageConfigDigestKey]; ok {
-			dgst = v
+		if err := os.WriteFile(options.imageIDFile, []byte(getImageID(resp.ExporterResponse)), 0644); err != nil {
+			return errors.Wrap(err, "writing image ID file")
 		}
-		return os.WriteFile(options.imageIDFile, []byte(dgst), 0644)
 	}
 	if options.metadataFile != "" {
 		if err := writeMetadataFile(options.metadataFile, decodeExporterResponse(resp.ExporterResponse)); err != nil {
@@ -292,8 +302,20 @@ func runBuild(dockerCli command.Cli, options buildOptions) (err error) {
 	return nil
 }
 
+// getImageID returns the image ID - the digest of the image config
+func getImageID(resp map[string]string) string {
+	dgst := resp[exptypes.ExporterImageDigestKey]
+	if v, ok := resp[exptypes.ExporterImageConfigDigestKey]; ok {
+		dgst = v
+	}
+	return dgst
+}
+
 func runBasicBuild(ctx context.Context, dockerCli command.Cli, opts *controllerapi.BuildOptions, options buildOptions, printer *progress.Printer) (*client.SolveResponse, error) {
-	resp, _, err := cbuild.RunBuild(ctx, dockerCli, *opts, os.Stdin, printer, false)
+	resp, res, err := cbuild.RunBuild(ctx, dockerCli, *opts, os.Stdin, printer, false)
+	if res != nil {
+		res.Done()
+	}
 	return resp, err
 }
 
@@ -489,7 +511,7 @@ func buildCmd(dockerCli command.Cli, rootOpts *rootOptions) *cobra.Command {
 
 	flags.StringArrayVar(&options.attests, "attest", []string{}, `Attestation parameters (format: "type=sbom,generator=image")`)
 	flags.StringVar(&options.sbom, "sbom", "", `Shorthand for "--attest=type=sbom"`)
-	flags.StringVar(&options.provenance, "provenance", "", `Shortand for "--attest=type=provenance"`)
+	flags.StringVar(&options.provenance, "provenance", "", `Shorthand for "--attest=type=provenance"`)
 
 	if isExperimental() {
 		flags.StringVar(&invokeFlag, "invoke", "", "Invoke a command after the build [experimental]")

commands/inspect.go

@@ -4,15 +4,19 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"sort"
 	"strings"
 	"text/tabwriter"
 	"time"
 
 	"github.com/docker/buildx/builder"
+	"github.com/docker/buildx/driver"
 	"github.com/docker/buildx/util/cobrautil/completion"
 	"github.com/docker/buildx/util/platformutil"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
+	"github.com/docker/cli/cli/debug"
+	"github.com/docker/go-units"
 	"github.com/moby/buildkit/util/appcontext"
 	"github.com/spf13/cobra"
 )
@@ -90,6 +94,38 @@ func runInspect(dockerCli command.Cli, in inspectOptions) error {
 					fmt.Fprintf(w, "Buildkit:\t%s\n", nodes[i].Version)
 				}
 				fmt.Fprintf(w, "Platforms:\t%s\n", strings.Join(platformutil.FormatInGroups(n.Node.Platforms, n.Platforms), ", "))
+				if debug.IsEnabled() {
+					fmt.Fprintf(w, "Features:\n")
+					features := nodes[i].Driver.Features(ctx)
+					featKeys := make([]string, 0, len(features))
+					for k := range features {
+						featKeys = append(featKeys, string(k))
+					}
+					sort.Strings(featKeys)
+					for _, k := range featKeys {
+						fmt.Fprintf(w, "\t%s:\t%t\n", k, features[driver.Feature(k)])
+					}
+				}
+				if len(nodes[i].Labels) > 0 {
+					fmt.Fprintf(w, "Labels:\n")
+					for _, k := range sortedKeys(nodes[i].Labels) {
+						v := nodes[i].Labels[k]
+						fmt.Fprintf(w, "\t%s:\t%s\n", k, v)
+					}
+				}
+				for ri, rule := range nodes[i].GCPolicy {
+					fmt.Fprintf(w, "GC Policy rule#%d:\n", ri)
+					fmt.Fprintf(w, "\tAll:\t%v\n", rule.All)
+					if len(rule.Filter) > 0 {
+						fmt.Fprintf(w, "\tFilters:\t%s\n", strings.Join(rule.Filter, " "))
+					}
+					if rule.KeepDuration > 0 {
+						fmt.Fprintf(w, "\tKeep Duration:\t%v\n", rule.KeepDuration.String())
+					}
+					if rule.KeepBytes > 0 {
+						fmt.Fprintf(w, "\tKeep Bytes:\t%s\n", units.BytesSize(float64(rule.KeepBytes)))
+					}
+				}
 			}
 		}
 	}
@@ -121,3 +157,14 @@ func inspectCmd(dockerCli command.Cli, rootOpts *rootOptions) *cobra.Command {
 
 	return cmd
 }
+
+func sortedKeys(m map[string]string) []string {
+	s := make([]string, len(m))
+	i := 0
+	for k := range m {
+		s[i] = k
+		i++
+	}
+	sort.Strings(s)
+	return s
+}

controller/build/build.go

@@ -33,10 +33,10 @@ const defaultTargetName = "default"
 
 // RunBuild runs the specified build and returns the result.
 //
-// NOTE: When an error happens during the build and this function acquires the debuggable *build.ResultContext,
+// NOTE: When an error happens during the build and this function acquires the debuggable *build.ResultHandle,
 // this function returns it in addition to the error (i.e. it does "return nil, res, err"). The caller can
 // inspect the result and debug the cause of that error.
-func RunBuild(ctx context.Context, dockerCli command.Cli, in controllerapi.BuildOptions, inStream io.Reader, progress progress.Writer, generateResult bool) (*client.SolveResponse, *build.ResultContext, error) {
+func RunBuild(ctx context.Context, dockerCli command.Cli, in controllerapi.BuildOptions, inStream io.Reader, progress progress.Writer, generateResult bool) (*client.SolveResponse, *build.ResultHandle, error) {
 	if in.NoCache && len(in.NoCacheFilter) > 0 {
 		return nil, nil, errors.Errorf("--no-cache and --no-cache-filter cannot currently be used together")
 	}
@@ -176,7 +176,7 @@ func RunBuild(ctx context.Context, dockerCli command.Cli, in controllerapi.Build
 	resp, res, err := buildTargets(ctx, dockerCli, b.NodeGroup, nodes, map[string]build.Options{defaultTargetName: opts}, progress, generateResult)
 	err = wrapBuildError(err, false)
 	if err != nil {
-		// NOTE: buildTargets can return *build.ResultContext even on error.
+		// NOTE: buildTargets can return *build.ResultHandle even on error.
 		return nil, res, err
 	}
 	return resp, res, nil
@@ -184,17 +184,17 @@ func RunBuild(ctx context.Context, dockerCli command.Cli, in controllerapi.Build
 
 // buildTargets runs the specified build and returns the result.
 //
-// NOTE: When an error happens during the build and this function acquires the debuggable *build.ResultContext,
+// NOTE: When an error happens during the build and this function acquires the debuggable *build.ResultHandle,
 // this function returns it in addition to the error (i.e. it does "return nil, res, err"). The caller can
 // inspect the result and debug the cause of that error.
-func buildTargets(ctx context.Context, dockerCli command.Cli, ng *store.NodeGroup, nodes []builder.Node, opts map[string]build.Options, progress progress.Writer, generateResult bool) (*client.SolveResponse, *build.ResultContext, error) {
-	var res *build.ResultContext
+func buildTargets(ctx context.Context, dockerCli command.Cli, ng *store.NodeGroup, nodes []builder.Node, opts map[string]build.Options, progress progress.Writer, generateResult bool) (*client.SolveResponse, *build.ResultHandle, error) {
+	var res *build.ResultHandle
 	var resp map[string]*client.SolveResponse
 	var err error
 	if generateResult {
 		var mu sync.Mutex
 		var idx int
-		resp, err = build.BuildWithResultHandler(ctx, nodes, opts, dockerutil.NewClient(dockerCli), confutil.ConfigDir(dockerCli), progress, func(driverIndex int, gotRes *build.ResultContext) {
+		resp, err = build.BuildWithResultHandler(ctx, nodes, opts, dockerutil.NewClient(dockerCli), confutil.ConfigDir(dockerCli), progress, func(driverIndex int, gotRes *build.ResultHandle) {
 			mu.Lock()
 			defer mu.Unlock()
 			if res == nil || driverIndex < idx {

controller/local/controller.go

@@ -29,7 +29,7 @@ func NewLocalBuildxController(ctx context.Context, dockerCli command.Cli, logger
 type buildConfig struct {
 	// TODO: these two structs should be merged
 	// Discussion: https://github.com/docker/buildx/pull/1640#discussion_r1113279719
-	resultCtx    *build.ResultContext
+	resultCtx    *build.ResultHandle
 	buildOptions *controllerapi.BuildOptions
 }
 
@@ -49,7 +49,7 @@ func (b *localController) Build(ctx context.Context, options controllerapi.Build
 	defer b.buildOnGoing.Store(false)
 
 	resp, res, buildErr := cbuild.RunBuild(ctx, b.dockerCli, options, in, progress, true)
-	// NOTE: RunBuild can return *build.ResultContext even on error.
+	// NOTE: RunBuild can return *build.ResultHandle even on error.
 	if res != nil {
 		b.buildConfig = buildConfig{
 			resultCtx:    res,

controller/pb/progress.go

@@ -19,6 +19,10 @@ func (w *writer) Write(status *client.SolveStatus) {
 	w.ch <- ToControlStatus(status)
 }
 
+func (w *writer) WriteBuildRef(target string, ref string) {
+	return
+}
+
 func (w *writer) ValidateLogSource(digest.Digest, interface{}) bool {
 	return true
 }

controller/processes/processes.go

@@ -98,7 +98,7 @@ func (m *Manager) DeleteProcess(id string) error {
 // When a container isn't available (i.e. first time invoking or the container has exited) or cfg.Rollback is set,
 // this method will start a new container and run the process in it. Otherwise, this method starts a new process in the
 // existing container.
-func (m *Manager) StartProcess(pid string, resultCtx *build.ResultContext, cfg *pb.InvokeConfig) (*Process, error) {
+func (m *Manager) StartProcess(pid string, resultCtx *build.ResultHandle, cfg *pb.InvokeConfig) (*Process, error) {
 	// Get the target result to invoke a container from
 	var ctr *build.Container
 	if a := m.container.Load(); a != nil {

controller/remote/controller.go

@@ -148,7 +148,7 @@ func serveCmd(dockerCli command.Cli) *cobra.Command {
 			}()
 
 			// prepare server
-			b := NewServer(func(ctx context.Context, options *controllerapi.BuildOptions, stdin io.Reader, progress progress.Writer) (*client.SolveResponse, *build.ResultContext, error) {
+			b := NewServer(func(ctx context.Context, options *controllerapi.BuildOptions, stdin io.Reader, progress progress.Writer) (*client.SolveResponse, *build.ResultHandle, error) {
 				return cbuild.RunBuild(ctx, dockerCli, *options, stdin, progress, true)
 			})
 			defer b.Close()

controller/remote/server.go

@@ -19,7 +19,7 @@ import (
 	"golang.org/x/sync/errgroup"
 )
 
-type BuildFunc func(ctx context.Context, options *pb.BuildOptions, stdin io.Reader, progress progress.Writer) (resp *client.SolveResponse, res *build.ResultContext, err error)
+type BuildFunc func(ctx context.Context, options *pb.BuildOptions, stdin io.Reader, progress progress.Writer) (resp *client.SolveResponse, res *build.ResultHandle, err error)
 
 func NewServer(buildFunc BuildFunc) *Server {
 	return &Server{
@@ -40,7 +40,7 @@ type session struct {
 	buildOptions *pb.BuildOptions
 	inputPipe    *io.PipeWriter
 
-	result *build.ResultContext
+	result *build.ResultHandle
 
 	processes *processes.Manager
 }
@@ -205,7 +205,7 @@ func (m *Server) Build(ctx context.Context, req *pb.BuildRequest) (*pb.BuildResp
 	resp, res, buildErr := m.buildFunc(ctx, req.Options, inR, pw)
 	m.sessionMu.Lock()
 	if s, ok := m.session[ref]; ok {
-		// NOTE: buildFunc can return *build.ResultContext even on error (e.g. when it's implemented using (github.com/docker/buildx/controller/build).RunBuild).
+		// NOTE: buildFunc can return *build.ResultHandle even on error (e.g. when it's implemented using (github.com/docker/buildx/controller/build).RunBuild).
 		if res != nil {
 			s.result = res
 			s.cancelBuild = cancel

docker-bake.hcl

@@ -156,3 +156,29 @@ target "image-local" {
   inherits = ["image"]
   output = ["type=docker"]
 }
+
+variable "HTTP_PROXY" {
+  default = ""
+}
+variable "HTTPS_PROXY" {
+  default = ""
+}
+variable "NO_PROXY" {
+  default = ""
+}
+
+target "integration-test-base" {
+  inherits = ["_common"]
+  args = {
+    HTTP_PROXY = HTTP_PROXY
+    HTTPS_PROXY = HTTPS_PROXY
+    NO_PROXY = NO_PROXY
+  }
+  target = "integration-test-base"
+  output = ["type=cacheonly"]
+}
+
+target "integration-test" {
+  inherits = ["integration-test-base"]
+  target = "integration-test"
+}

docs/bake-reference.md

@@ -69,16 +69,16 @@ The following example shows the same Bake file in the HCL format:
 
 ```hcl
 variable "TAG" {
-  "default" = "latest"
+  default = "latest"
 }
 
 group "default" {
-  "targets" = ["latest"]
+  targets = ["webapp"]
 }
 
 target "webapp" {
-  "dockerfile" = "Dockerfile"
-  "tags" = ["docker.io/username/webapp:${TAG}"]
+  dockerfile = "Dockerfile"
+  tags = ["docker.io/username/webapp:${TAG}"]
 }
 ```
 

docs/guides/debugging.md

@@ -24,7 +24,7 @@ build command to specify a command to launch in the resulting image.
 
 ```console
 $ docker buildx build --invoke /bin/sh .
-+] Building 4.2s (19/19) FINISHED
+[+] Building 4.2s (19/19) FINISHED
  => [internal] connecting to local controller                                                                                   0.0s
  => [internal] load build definition from Dockerfile                                                                            0.0s
  => => transferring dockerfile: 32B                                                                                             0.0s
@@ -49,6 +49,47 @@ bin    etc    lib    mnt    proc   run    srv    tmp    var
 dev    home   media  opt    root   sbin   sys    usr    work
 ```
 
+#### `on-error`
+
+If you want to start a debug session when a build fails, you can use
+`--invoke=on-error` to start a debug session when the build fails.
+
+```console
+$ docker buildx build --invoke on-error .
+[+] Building 4.2s (19/19) FINISHED
+ => [internal] connecting to local controller                                                                                   0.0s
+ => [internal] load build definition from Dockerfile                                                                            0.0s
+ => => transferring dockerfile: 32B                                                                                             0.0s
+ => [internal] load .dockerignore                                                                                               0.0s
+ => => transferring context: 34B                                                                                                0.0s
+ ...
+ => ERROR [shell 10/10] RUN bad-command
+------
+ > [shell 10/10] RUN bad-command:
+#0 0.049 /bin/sh: bad-command: not found
+------
+Launching interactive container. Press Ctrl-a-c to switch to monitor console
+Interactive container was restarted with process "edmzor60nrag7rh1mbi4o9lm8". Press Ctrl-a-c to switch to the new container
+/ # 
+```
+
+This allows you to explore the state of the image when the build failed.
+
+#### `debug-shell`
+
+If you want to drop into a debug session without first starting the build, you
+can use `--invoke=debug-shell` to start a debug session.
+
+```
+$ docker buildx build --invoke debug-shell .
+[+] Building 4.2s (19/19) FINISHED
+ => [internal] connecting to local controller                                                                                   0.0s
+(buildx)
+```
+
+You can then use the commands available in [monitor mode](#monitor-mode) to
+start and observe the build.
+
 ## Monitor mode
 
 By default, when debugging, you'll be dropped into a shell in the final stage.
@@ -93,7 +134,7 @@ immediately enter the monitor mode.
 
 ```console
 $ docker buildx debug-shell
-+] Building 0.0s (1/1) FINISHED                                                                                                                                                                                
+[+] Building 0.0s (1/1) FINISHED                                                                                                                                                                                
  => [internal] connecting to remote controller
 (buildx) list
 ID                              CURRENT_SESSION

docs/reference/buildx_build.md

@@ -38,7 +38,7 @@ Start a build
 | [`--platform`](#platform)                                                                                                                              | `stringArray` |           | Set target platform for build                                                                       |
 | `--print`                                                                                                                                              | `string`      |           | Print result of information request (e.g., outline, targets) [experimental]                         |
 | [`--progress`](#progress)                                                                                                                              | `string`      | `auto`    | Set type of progress output (`auto`, `plain`, `tty`). Use plain to show container output            |
-| [`--provenance`](#provenance)                                                                                                                          | `string`      |           | Shortand for `--attest=type=provenance`                                                             |
+| [`--provenance`](#provenance)                                                                                                                          | `string`      |           | Shorthand for `--attest=type=provenance`                                                            |
 | `--pull`                                                                                                                                               |               |           | Always attempt to pull all referenced images                                                        |
 | [`--push`](#push)                                                                                                                                      |               |           | Shorthand for `--output=type=registry`                                                              |
 | `-q`, `--quiet`                                                                                                                                        |               |           | Suppress the build output and print image ID on success                                             |

docs/reference/buildx_inspect.md

@@ -49,20 +49,44 @@ The following example shows information about a builder instance named
 
 ```console
 $ docker buildx inspect elated_tesla
-
-Name:   elated_tesla
-Driver: docker-container
+Name:          elated_tesla
+Driver:        docker-container
+Last Activity: 2022-11-30 12:42:47 +0100 CET
 
 Nodes:
-Name:      elated_tesla0
-Endpoint:  unix:///var/run/docker.sock
-Status:    running
-Buildkit:  v0.10.3
-Platforms: linux/amd64
-
-Name:      elated_tesla1
-Endpoint:  ssh://ubuntu@1.2.3.4
-Status:    running
-Buildkit:  v0.10.3
-Platforms: linux/arm64*, linux/arm/v7, linux/arm/v6
+Name:           elated_tesla0
+Endpoint:       unix:///var/run/docker.sock
+Driver Options: env.BUILDKIT_STEP_LOG_MAX_SPEED="10485760" env.JAEGER_TRACE="localhost:6831" image="moby/buildkit:latest" network="host" env.BUILDKIT_STEP_LOG_MAX_SIZE="10485760"
+Status:         running
+Flags:          --debug --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
+BuildKit:       v0.10.6
+Platforms:      linux/arm64*, linux/arm/v7, linux/arm/v6
+Labels:
+ org.mobyproject.buildkit.worker.executor:         oci
+ org.mobyproject.buildkit.worker.hostname:         docker-desktop
+ org.mobyproject.buildkit.worker.network:          host
+ org.mobyproject.buildkit.worker.oci.process-mode: sandbox
+ org.mobyproject.buildkit.worker.selinux.enabled:  false
+ org.mobyproject.buildkit.worker.snapshotter:      overlayfs
+GC Policy rule#0:
+ All:           false
+ Filters:       type==source.local,type==exec.cachemount,type==source.git.checkout
+ Keep Duration: 48h0m0s
+ Keep Bytes:    488.3MiB
+GC Policy rule#1:
+ All:           false
+ Keep Duration: 1440h0m0s
+ Keep Bytes:    24.21GiB
+GC Policy rule#2:
+ All:        false
+ Keep Bytes: 24.21GiB
+GC Policy rule#3:
+ All:        true
+ Keep Bytes: 24.21GiB
+```
+
+`debug` flag can also be used to get more information about the builder:
+
+```console
+$ docker --debug buildx inspect elated_tesla
 ```

driver/docker-container/driver.go

@@ -387,13 +387,19 @@ func (d *Driver) Factory() driver.Factory {
 	return d.factory
 }
 
-func (d *Driver) Features() map[driver.Feature]bool {
+func (d *Driver) Features(ctx context.Context) map[driver.Feature]bool {
+	var historyAPI bool
+	c, err := d.Client(ctx)
+	if err == nil {
+		historyAPI = driver.HistoryAPISupported(ctx, c)
+		c.Close()
+	}
 	return map[driver.Feature]bool{
 		driver.OCIExporter:    true,
 		driver.DockerExporter: true,
-
-		driver.CacheExport:   true,
-		driver.MultiPlatform: true,
+		driver.CacheExport:    true,
+		driver.MultiPlatform:  true,
+		driver.HistoryAPI:     historyAPI,
 	}
 }
 

driver/docker/driver.go

@@ -58,9 +58,9 @@ func (d *Driver) Client(ctx context.Context) (*client.Client, error) {
 	}))
 }
 
-func (d *Driver) Features() map[driver.Feature]bool {
+func (d *Driver) Features(ctx context.Context) map[driver.Feature]bool {
 	var useContainerdSnapshotter bool
-	ctx := context.Background()
+	var historyAPI bool
 	c, err := d.Client(ctx)
 	if err == nil {
 		workers, _ := c.ListWorkers(ctx)
@@ -69,6 +69,7 @@ func (d *Driver) Features() map[driver.Feature]bool {
 				useContainerdSnapshotter = true
 			}
 		}
+		historyAPI = driver.HistoryAPISupported(ctx, c)
 		c.Close()
 	}
 	return map[driver.Feature]bool{
@@ -76,6 +77,7 @@ func (d *Driver) Features() map[driver.Feature]bool {
 		driver.DockerExporter: useContainerdSnapshotter,
 		driver.CacheExport:    useContainerdSnapshotter,
 		driver.MultiPlatform:  useContainerdSnapshotter,
+		driver.HistoryAPI:     historyAPI,
 	}
 }
 

driver/driver.go

@@ -2,10 +2,12 @@ package driver
 
 import (
 	"context"
+	"io"
 
 	"github.com/docker/buildx/store"
 	"github.com/docker/buildx/util/progress"
 	clitypes "github.com/docker/cli/cli/config/types"
+	controlapi "github.com/moby/buildkit/api/services/control"
 	"github.com/moby/buildkit/client"
 	"github.com/pkg/errors"
 )
@@ -57,7 +59,7 @@ type Driver interface {
 	Stop(ctx context.Context, force bool) error
 	Rm(ctx context.Context, force, rmVolume, rmDaemon bool) error
 	Client(ctx context.Context) (*client.Client, error)
-	Features() map[Feature]bool
+	Features(ctx context.Context) map[Feature]bool
 	IsMobyDriver() bool
 	Config() InitConfig
 }
@@ -89,3 +91,22 @@ func Boot(ctx, clientContext context.Context, d Driver, pw progress.Writer) (*cl
 		return c, nil
 	}
 }
+
+func HistoryAPISupported(ctx context.Context, c *client.Client) bool {
+	cl, err := c.ControlClient().ListenBuildHistory(ctx, &controlapi.BuildHistoryRequest{
+		ActiveOnly: true,
+		Ref:        "buildx-test-history-api-feature", // dummy ref to check if the server supports the API
+		EarlyExit:  true,
+	})
+	if err != nil {
+		return false
+	}
+	for {
+		_, err := cl.Recv()
+		if errors.Is(err, io.EOF) {
+			return true
+		} else if err != nil {
+			return false
+		}
+	}
+}

driver/features.go

@@ -5,5 +5,7 @@ type Feature string
 const OCIExporter Feature = "OCI exporter"
 const DockerExporter Feature = "Docker exporter"
 
-const CacheExport Feature = "cache export"
-const MultiPlatform Feature = "multiple platforms"
+const CacheExport Feature = "Cache export"
+const MultiPlatform Feature = "Multiple platforms"
+
+const HistoryAPI Feature = "History API"

driver/kubernetes/driver.go

@@ -204,8 +204,7 @@ func (d *Driver) Client(ctx context.Context) (*client.Client, error) {
 	}
 	containerName := pod.Spec.Containers[0].Name
 	cmd := []string{"buildctl", "dial-stdio"}
-	conn, err := execconn.ExecConn(restClient, restClientConfig,
-		pod.Namespace, pod.Name, containerName, cmd)
+	conn, err := execconn.ExecConn(ctx, restClient, restClientConfig, pod.Namespace, pod.Name, containerName, cmd)
 	if err != nil {
 		return nil, err
 	}
@@ -229,12 +228,18 @@ func (d *Driver) Factory() driver.Factory {
 	return d.factory
 }
 
-func (d *Driver) Features() map[driver.Feature]bool {
+func (d *Driver) Features(ctx context.Context) map[driver.Feature]bool {
+	var historyAPI bool
+	c, err := d.Client(ctx)
+	if err == nil {
+		historyAPI = driver.HistoryAPISupported(ctx, c)
+		c.Close()
+	}
 	return map[driver.Feature]bool{
 		driver.OCIExporter:    true,
 		driver.DockerExporter: d.DockerAPI != nil,
-
-		driver.CacheExport:   true,
-		driver.MultiPlatform: true, // Untested (needs multiple Driver instances)
+		driver.CacheExport:    true,
+		driver.MultiPlatform:  true, // Untested (needs multiple Driver instances)
+		driver.HistoryAPI:     historyAPI,
 	}
 }

driver/kubernetes/execconn/execconn.go

@@ -1,6 +1,7 @@
 package execconn
 
 import (
+	"context"
 	"io"
 	"net"
 	"os"
@@ -14,7 +15,7 @@ import (
 	"k8s.io/client-go/tools/remotecommand"
 )
 
-func ExecConn(restClient rest.Interface, restConfig *rest.Config, namespace, pod, container string, cmd []string) (net.Conn, error) {
+func ExecConn(ctx context.Context, restClient rest.Interface, restConfig *rest.Config, namespace, pod, container string, cmd []string) (net.Conn, error) {
 	req := restClient.
 		Post().
 		Namespace(namespace).
@@ -42,13 +43,13 @@ func ExecConn(restClient rest.Interface, restConfig *rest.Config, namespace, pod
 		remoteAddr: dummyAddr{network: "dummy", s: "dummy-1"},
 	}
 	go func() {
-		serr := exec.Stream(remotecommand.StreamOptions{
+		serr := exec.StreamWithContext(ctx, remotecommand.StreamOptions{
 			Stdin:  stdinR,
 			Stdout: stdoutW,
 			Stderr: os.Stderr,
 			Tty:    false,
 		})
-		if serr != nil {
+		if serr != nil && serr != context.Canceled {
 			logrus.Error(serr)
 		}
 	}()

driver/manager.go

@@ -147,9 +147,11 @@ func GetFactories(instanceRequired bool) []Factory {
 
 type cachedDriver struct {
 	Driver
-	client *client.Client
-	err    error
-	once   sync.Once
+	client       *client.Client
+	err          error
+	once         sync.Once
+	featuresOnce sync.Once
+	features     map[Feature]bool
 }
 
 func (d *cachedDriver) Client(ctx context.Context) (*client.Client, error) {
@@ -158,3 +160,10 @@ func (d *cachedDriver) Client(ctx context.Context) (*client.Client, error) {
 	})
 	return d.client, d.err
 }
+
+func (d *cachedDriver) Features(ctx context.Context) map[Feature]bool {
+	d.featuresOnce.Do(func() {
+		d.features = d.Driver.Features(ctx)
+	})
+	return d.features
+}

driver/remote/driver.go

@@ -87,12 +87,19 @@ func (d *Driver) Client(ctx context.Context) (*client.Client, error) {
 	return client.New(ctx, d.InitConfig.EndpointAddr, opts...)
 }
 
-func (d *Driver) Features() map[driver.Feature]bool {
+func (d *Driver) Features(ctx context.Context) map[driver.Feature]bool {
+	var historyAPI bool
+	c, err := d.Client(ctx)
+	if err == nil {
+		historyAPI = driver.HistoryAPISupported(ctx, c)
+		c.Close()
+	}
 	return map[driver.Feature]bool{
 		driver.OCIExporter:    true,
-		driver.DockerExporter: false,
+		driver.DockerExporter: true,
 		driver.CacheExport:    true,
 		driver.MultiPlatform:  true,
+		driver.HistoryAPI:     historyAPI,
 	}
 }
 

go.mod

@@ -3,42 +3,43 @@ module github.com/docker/buildx
 go 1.20
 
 require (
-	github.com/Masterminds/semver/v3 v3.2.0
-	github.com/aws/aws-sdk-go-v2/config v1.15.5
-	github.com/compose-spec/compose-go v1.13.4
+	github.com/Masterminds/semver/v3 v3.2.1
+	github.com/aws/aws-sdk-go-v2/config v1.18.16
+	github.com/compose-spec/compose-go v1.14.0
 	github.com/containerd/console v1.0.3
-	github.com/containerd/containerd v1.7.0
-	github.com/containerd/typeurl/v2 v2.1.0
-	github.com/docker/cli v23.0.6+incompatible
+	github.com/containerd/containerd v1.7.1
+	github.com/containerd/continuity v0.4.1
+	github.com/containerd/typeurl/v2 v2.1.1
+	github.com/docker/cli v24.0.1+incompatible
 	github.com/docker/cli-docs-tool v0.5.1
 	github.com/docker/distribution v2.8.2+incompatible
-	github.com/docker/docker v23.0.6+incompatible
+	github.com/docker/docker v24.0.1+incompatible
 	github.com/docker/go-units v0.5.0
 	github.com/gofrs/flock v0.8.1
 	github.com/gogo/protobuf v1.3.2
-	github.com/golang/protobuf v1.5.2
+	github.com/golang/protobuf v1.5.3
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/google/uuid v1.3.0
 	github.com/hashicorp/go-cty-funcs v0.0.0-20200930094925-2721b1e36840
 	github.com/hashicorp/hcl/v2 v2.8.2
-	github.com/moby/buildkit v0.11.0-rc3.0.20230411142536-333ee9158128
+	github.com/moby/buildkit v0.11.0-rc3.0.20230530080511-c36941f4a10e
 	github.com/moby/sys/mountinfo v0.6.2
 	github.com/moby/sys/signal v0.7.0
 	github.com/morikuni/aec v1.0.0
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b
+	github.com/opencontainers/image-spec v1.1.0-rc3
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pkg/errors v0.9.1
 	github.com/serialx/hashring v0.0.0-20190422032157-8b2912629002
 	github.com/sirupsen/logrus v1.9.0
-	github.com/spf13/cobra v1.6.1
+	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.8.2
+	github.com/stretchr/testify v1.8.4
 	github.com/zclconf/go-cty v1.10.0
 	go.opentelemetry.io/otel v1.14.0
 	go.opentelemetry.io/otel/trace v1.14.0
-	golang.org/x/sync v0.1.0
-	golang.org/x/term v0.5.0
+	golang.org/x/sync v0.2.0
+	golang.org/x/term v0.6.0
 	google.golang.org/grpc v1.53.0
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.26.2
@@ -48,32 +49,25 @@ require (
 )
 
 require (
-	cloud.google.com/go/compute v1.18.0 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
-	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
-	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
-	github.com/Azure/go-autorest/logger v0.2.1 // indirect
-	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
-	github.com/Microsoft/go-winio v0.6.0 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/agl/ed25519 v0.0.0-20170116200512-5312a6153412 // indirect
 	github.com/apparentlymart/go-cidr v1.0.1 // indirect
 	github.com/apparentlymart/go-textseg/v12 v12.0.0 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.16.3 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.16.4 // indirect
-	github.com/aws/smithy-go v1.11.2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.17.6 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.24 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.24 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.31 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.18.6 // indirect
+	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bugsnag/bugsnag-go v1.4.1 // indirect
 	github.com/bugsnag/panicwrap v1.2.0 // indirect
@@ -81,8 +75,7 @@ require (
 	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cloudflare/cfssl v0.0.0-20181213083726-b94e044bb51e // indirect
-	github.com/containerd/continuity v0.3.0 // indirect
-	github.com/containerd/ttrpc v1.2.1 // indirect
+	github.com/containerd/ttrpc v1.2.2 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/distribution/v3 v3.0.0-20230214150026-36d8c594d7aa // indirect
@@ -102,7 +95,6 @@ require (
 	github.com/go-openapi/swag v0.19.14 // indirect
 	github.com/go-sql-driver/mysql v1.6.0 // indirect
 	github.com/gogo/googleapis v1.4.1 // indirect
-	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
 	github.com/google/certificate-transparency-go v1.1.4 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
@@ -112,13 +104,15 @@ require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/imdario/mergo v0.3.15 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/in-toto/in-toto-golang v0.5.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jinzhu/gorm v1.9.2 // indirect
 	github.com/jinzhu/inflection v0.0.0-20180308033659-04140366298a // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect
-	github.com/klauspost/compress v1.16.0 // indirect
+	github.com/klauspost/compress v1.16.3 // indirect
+	github.com/kr/pretty v0.2.1 // indirect
 	github.com/mailru/easyjson v0.7.6 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
@@ -129,21 +123,22 @@ require (
 	github.com/moby/patternmatcher v0.5.0 // indirect
 	github.com/moby/spdystream v0.2.0 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
-	github.com/moby/term v0.0.0-20221120202655-abb19827d345 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/opencontainers/runc v1.1.5 // indirect
+	github.com/opencontainers/runc v1.1.7 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.14.0 // indirect
 	github.com/prometheus/client_model v0.3.0 // indirect
-	github.com/prometheus/common v0.37.0 // indirect
-	github.com/prometheus/procfs v0.8.0 // indirect
-	github.com/rogpeppe/go-internal v1.8.1 // indirect
+	github.com/prometheus/common v0.42.0 // indirect
+	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
 	github.com/sergi/go-diff v1.2.0 // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/spf13/viper v1.14.0 // indirect
 	github.com/theupdateframework/notary v0.6.1 // indirect
-	github.com/tonistiigi/fsutil v0.0.0-20230105215944-fb433841cbfa // indirect
+	github.com/tonistiigi/fsutil v0.0.0-20230407161946-9e7a6df48576 // indirect
 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/tonistiigi/vt100 v0.0.0-20210615222946-8066bb97264f // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
@@ -160,17 +155,16 @@ require (
 	go.opentelemetry.io/otel/sdk v1.14.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
 	golang.org/x/crypto v0.2.0 // indirect
-	golang.org/x/mod v0.7.0 // indirect
-	golang.org/x/net v0.7.0 // indirect
-	golang.org/x/oauth2 v0.4.0 // indirect
-	golang.org/x/sys v0.6.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
-	golang.org/x/time v0.1.0 // indirect
-	golang.org/x/tools v0.5.0 // indirect
+	golang.org/x/mod v0.9.0 // indirect
+	golang.org/x/net v0.8.0 // indirect
+	golang.org/x/oauth2 v0.5.0 // indirect
+	golang.org/x/sys v0.7.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.7.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/dancannon/gorethink.v3 v3.0.5 // indirect
 	gopkg.in/fatih/pool.v2 v2.0.0 // indirect
 	gopkg.in/gorethink/gorethink.v3 v3.0.5 // indirect
@@ -183,10 +177,3 @@ require (
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
-
-replace (
-	k8s.io/api => k8s.io/api v0.25.4
-	k8s.io/apimachinery => k8s.io/apimachinery v0.25.4
-	k8s.io/apiserver => k8s.io/apiserver v0.25.4
-	k8s.io/client-go => k8s.io/client-go v0.25.4
-)

go.sum

@@ -13,6 +13,7 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
+cloud.google.com/go v0.110.0 h1:Zc8gqp3+a9/Eyph2KDmcGaPtbKRIoqq4YTlL4NMD0Ys=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -20,9 +21,7 @@ cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUM
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
 cloud.google.com/go/compute v1.18.0 h1:FEigFqoDbys2cvFkZ9Fjq4gnHBP55anJ0yQyau2f9oY=
-cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
@@ -40,29 +39,13 @@ github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1/go.mod h
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20221215162035-5330a85ea652 h1:+vTEFqeoeur6XSq06bs+roX3YiT49gUniJK7Zky7Xjg=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
-github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest/autorest v0.11.27 h1:F3R3q42aWytozkV8ihzcgMO4OA4cuqr3bNlsEuF6//A=
-github.com/Azure/go-autorest/autorest v0.11.27/go.mod h1:7l8ybrIdUmGqZMTD0sRtAr8NvbHjfofbf8RSP2q7w7U=
-github.com/Azure/go-autorest/autorest/adal v0.9.18/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
-github.com/Azure/go-autorest/autorest/adal v0.9.20 h1:gJ3E98kMpFB1MFqQCvA1yFab8vthOeD4VlFRQULxahg=
-github.com/Azure/go-autorest/autorest/adal v0.9.20/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
-github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
-github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
-github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
-github.com/Azure/go-autorest/autorest/mocks v0.4.2 h1:PGN4EDXnuQbojHbU0UWoNvmu9AGVwYHG9/fkDYhtAfw=
-github.com/Azure/go-autorest/autorest/mocks v0.4.2/go.mod h1:Vy7OitM9Kei0i1Oj+LvyAWMXJHeKH1MVlzFugfVrmyU=
-github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg=
-github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
-github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
-github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
-github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
-github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
-github.com/Microsoft/hcsshim v0.10.0-rc.7 h1:HBytQPxcv8Oy4244zbQbe6hnOnx544eL5QPUqhJldz8=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/hcsshim v0.10.0-rc.8 h1:YSZVvlIIDD1UxQpJp0h+dnpLUw+TrY0cx8obKsp3bek=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
 github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
@@ -71,10 +54,8 @@ github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki
 github.com/agl/ed25519 v0.0.0-20170116200512-5312a6153412 h1:w1UutsfOrms1J05zt7ISrnJIXKzwaspym5BTKGx93EI=
 github.com/agl/ed25519 v0.0.0-20170116200512-5312a6153412/go.mod h1:WPjqKcmVOxf0XSf3YxCJs6N6AOSrOx3obionmG7T0y0=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 h1:aM1rlcoLz8y5B2r4tTLMiVTrMtpfY0O8EScKJxaSaEc=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apparentlymart/go-cidr v1.0.1 h1:NmIwLZ/KdsjIUlhf+/Np40atNXm/+lZ5txfTJ/SpF+U=
 github.com/apparentlymart/go-cidr v1.0.1/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
@@ -85,28 +66,30 @@ github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJE
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
-github.com/aws/aws-sdk-go-v2 v1.16.3 h1:0W1TSJ7O6OzwuEvIXAtJGvOeQ0SGAhcpxPN2/NK5EhM=
-github.com/aws/aws-sdk-go-v2 v1.16.3/go.mod h1:ytwTPBG6fXTZLxxeeCCWj2/EMYp/xDUgX+OET6TLNNU=
-github.com/aws/aws-sdk-go-v2/config v1.15.5 h1:P+xwhr6kabhxDTXTVH9YoHkqjLJ0wVVpIUHtFNr2hjU=
-github.com/aws/aws-sdk-go-v2/config v1.15.5/go.mod h1:ZijHHh0xd/A+ZY53az0qzC5tT46kt4JVCePf2NX9Lk4=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.0 h1:4R/NqlcRFSkR0wxOhgHi+agGpbEr5qMCjn7VqUIJY+E=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.0/go.mod h1:9YWk7VW+eyKsoIL6/CljkTrNVWBSK9pkqOPUuijid4A=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.4 h1:FP8gquGeGHHdfY6G5llaMQDF+HAf20VKc8opRwmjf04=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.4/go.mod h1:u/s5/Z+ohUQOPXl00m2yJVyioWDECsbpXTQlaqSlufc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.10 h1:uFWgo6mGJI1n17nbcvSc6fxVuR3xLNqvXt12JCnEcT8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.10/go.mod h1:F+EZtuIwjlv35kRJPyBGcsA4f7bnSoz15zOQ2lJq1Z4=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.4 h1:cnsvEKSoHN4oAN7spMMr0zhEW2MHnhAVpmqQg8E6UcM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.4/go.mod h1:8glyUqVIM4AmeenIsPo0oVh3+NUwnsQml2OFupfQW+0=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.11 h1:6cZRymlLEIlDTEB0+5+An6Zj1CKt6rSE69tOmFeu1nk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.11/go.mod h1:0MR+sS1b/yxsfAPvAESrw8NfwUoxMinDyw6EYR9BS2U=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.4 h1:b16QW0XWl0jWjLABFc1A+uh145Oqv+xDcObNk0iQgUk=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.4/go.mod h1:uKkN7qmSIsNJVyMtxNQoCEYMvFEXbOg9fwCJPdfp2u8=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.4 h1:Uw5wBybFQ1UeA9ts0Y07gbv0ncZnIAyw858tDW0NP2o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.4/go.mod h1:cPDwJwsP4Kff9mldCXAmddjJL6JGQqtA3Mzer2zyr88=
-github.com/aws/aws-sdk-go-v2/service/sts v1.16.4 h1:+xtV90n3abQmgzk1pS++FdxZTrPEDgQng6e4/56WR2A=
-github.com/aws/aws-sdk-go-v2/service/sts v1.16.4/go.mod h1:lfSYenAXtavyX2A1LsViglqlG9eEFYxNryTZS5rn3QE=
-github.com/aws/smithy-go v1.11.2 h1:eG/N+CcUMAvsdffgMvjMKwfyDzIkjM6pfxMJ8Mzc6mE=
-github.com/aws/smithy-go v1.11.2/go.mod h1:3xHYmszWVx2c0kIwQeEVf9uSm4fYZt67FBJnwub1bgM=
+github.com/aws/aws-sdk-go-v2 v1.17.6 h1:Y773UK7OBqhzi5VDXMi1zVGsoj+CVHs2eaC2bDsLwi0=
+github.com/aws/aws-sdk-go-v2 v1.17.6/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
+github.com/aws/aws-sdk-go-v2/config v1.18.16 h1:4r7gsCu8Ekwl5iJGE/GmspA2UifqySCCkyyyPFeWs3w=
+github.com/aws/aws-sdk-go-v2/config v1.18.16/go.mod h1:XjM6lVbq7UgELp9NjXBrb1DQY/ownlWsvDhEQksemJc=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.16 h1:GgToSxaENX/1zXIGNFfiVk4hxryYJ5Vt4Mh8XLAL7Lc=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.16/go.mod h1:KP7aFJhfwPFgx9aoVYL2nYHjya5WBD98CWaadpgmnpY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.24 h1:5qyqXASrX2zy5cTnoHHa4N2c3Lc94GH7gjnBP3GwKdU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.24/go.mod h1:neYVaeKr5eT7BzwULuG2YbLhzWZ22lpjKdCybR7AXrQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.30 h1:y+8n9AGDjikyXoMBTRaHHHSaFEB8267ykmvyPodJfys=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.30/go.mod h1:LUBAO3zNXQjoONBKn/kR1y0Q4cj/D02Ts0uHYjcCQLM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.24 h1:r+Kv+SEJquhAZXaJ7G4u44cIwXV3f8K+N482NNAzJZA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.24/go.mod h1:gAuCezX/gob6BSMbItsSlMb6WZGV7K2+fWOvk8xBSto=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.31 h1:hf+Vhp5WtTdcSdE+yEcUz8L73sAzN0R+0jQv+Z51/mI=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.31/go.mod h1:5zUjguZfG5qjhG9/wqmuyHRyUftl2B5Cp6NNxNC6kRA=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.24 h1:c5qGfdbCHav6viBwiyDns3OXqhqAbGjfIB4uVu2ayhk=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.24/go.mod h1:HMA4FZG6fyib+NDo5bpIxX1EhYjrAOveZJY2YR0xrNE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.5 h1:bdKIX6SVF3nc3xJFw6Nf0igzS6Ff/louGq8Z6VP/3Hs=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.5/go.mod h1:vuWiaDB30M/QTC+lI3Wj6S/zb7tpUK2MSYgy3Guh2L0=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.5 h1:xLPZMyuZ4GuqRCIec/zWuIhRFPXh2UOJdLXBSi64ZWQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.5/go.mod h1:QjxpHmCwAg0ESGtPQnLIVp7SedTOBMYy+Slr3IfMKeI=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.6 h1:rIFn5J3yDoeuKCE9sESXqM5POTAhOP1du3bv/qTL+tE=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.6/go.mod h1:48WJ9l3dwP0GSHWGc5sFGGlCkuA82Mc2xnw+T6Q8aDw=
+github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
+github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -123,14 +106,11 @@ github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/cfssl v0.0.0-20181213083726-b94e044bb51e h1:Qux+lbuMaRzkQyTdzgtz8MgzPtzmaPQy6DXmxpdxT3U=
 github.com/cloudflare/cfssl v0.0.0-20181213083726-b94e044bb51e/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
@@ -141,28 +121,27 @@ github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/compose-spec/compose-go v1.13.4 h1:O6xAsPqaY1s9KXteiO7wRCDTJLahv1XP/z/eUO9EfbI=
-github.com/compose-spec/compose-go v1.13.4/go.mod h1:rsiZ8uaOHJYJemDBzTe9UBpaq5ZFVEOO4TxM2G3SJxk=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
+github.com/compose-spec/compose-go v1.14.0 h1:/+tQxBEPIrfsi87Qh7/VjMzcJN3BRNER/RO71ku+u6E=
+github.com/compose-spec/compose-go v1.14.0/go.mod h1:m0o4G6MQDHjjz9rY7No9FpnNi+9sKic262rzrwuCqic=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw=
 github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
-github.com/containerd/containerd v1.7.0 h1:G/ZQr3gMZs6ZT0qPUZ15znx5QSdQdASW11nXTLTM2Pg=
-github.com/containerd/containerd v1.7.0/go.mod h1:QfR7Efgb/6X2BDpTPJRvPTYDE9rsF0FsXX9J8sIs/sc=
-github.com/containerd/continuity v0.3.0 h1:nisirsYROK15TAMVukJOUyGJjz4BNQJBVsNvAXZJ/eg=
-github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1Ag8espWhkykbPM=
+github.com/containerd/containerd v1.7.1 h1:k8DbDkSOwt5rgxQ3uCI4WMKIJxIndSCBUaGm5oRn+Go=
+github.com/containerd/containerd v1.7.1/go.mod h1:gA+nJUADRBm98QS5j5RPROnt0POQSMK+r7P7EGMC/Qc=
+github.com/containerd/continuity v0.4.1 h1:wQnVrjIyQ8vhU2sgOiL5T07jo+ouqc2bnKsv5/EqGhU=
+github.com/containerd/continuity v0.4.1/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
-github.com/containerd/nydus-snapshotter v0.3.1 h1:b8WahTrPkt3XsabjG2o/leN4fw3HWZYr+qxo/Z8Mfzk=
-github.com/containerd/stargz-snapshotter v0.14.1 h1:M58AiJ+Kj50cabqYP1TpBPgUczKgn8zipmteC5FyjVs=
-github.com/containerd/stargz-snapshotter/estargz v0.14.1 h1:n9M2GDSWM96pyipFTA0DaU+zdtzi3Iwsnj/rIHr1yFM=
-github.com/containerd/ttrpc v1.2.1 h1:VWv/Rzx023TBLv4WQ+9WPXlBG/s3rsRjY3i9AJ2BJdE=
-github.com/containerd/ttrpc v1.2.1/go.mod h1:sIT6l32Ph/H9cvnJsfXM5drIVzTr5A2flTf1G5tYZak=
-github.com/containerd/typeurl/v2 v2.1.0 h1:yNAhJvbNEANt7ck48IlEGOxP7YAp6LLpGn5jZACDNIE=
-github.com/containerd/typeurl/v2 v2.1.0/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/containerd/nydus-snapshotter v0.8.2 h1:7SOrMU2YmLzfbsr5J7liMZJlNi5WT6vtIOxLGv+iz7E=
+github.com/containerd/stargz-snapshotter v0.14.3 h1:OTUVZoPSPs8mGgmQUE1dqw3WX/3nrsmsurW7UPLWl1U=
+github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSkDwbkEETK84kQgEeFwDC+62k=
+github.com/containerd/ttrpc v1.2.2 h1:9vqZr0pxwOF5koz6N0N3kJ0zDHokrcPxIR/ZR2YFtOs=
+github.com/containerd/ttrpc v1.2.2/go.mod h1:sIT6l32Ph/H9cvnJsfXM5drIVzTr5A2flTf1G5tYZak=
+github.com/containerd/typeurl/v2 v2.1.1 h1:3Q4Pt7i8nYwy2KmQWIw2+1hTvwTE/6w9FqcttATPO/4=
+github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -170,14 +149,14 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/distribution/v3 v3.0.0-20230214150026-36d8c594d7aa h1:L9Ay/slwQ4ERSPaurC+TVkZrM0K98GNrEEo1En3e8as=
 github.com/distribution/distribution/v3 v3.0.0-20230214150026-36d8c594d7aa/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
-github.com/docker/cli v23.0.6+incompatible h1:CScadyCJ2ZKUDpAMZta6vK8I+6/m60VIjGIV7Wg/Eu4=
-github.com/docker/cli v23.0.6+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v24.0.1+incompatible h1:uVl5Xv/39kZJpDo9VaktTOYBc702sdYYF33FqwUG/dM=
+github.com/docker/cli v24.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli-docs-tool v0.5.1 h1:jIk/cCZurZERhALPVKhqlNxTQGxn2kcI+56gE57PQXg=
 github.com/docker/cli-docs-tool v0.5.1/go.mod h1:zMjqTFCU361PRh8apiXzeAZ1Q/xupbIwTusYpzCXS/o=
 github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
 github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v23.0.6+incompatible h1:aBD4np894vatVX99UTx/GyOUOK4uEcROwA3+bQhEcoU=
-github.com/docker/docker v23.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v24.0.1+incompatible h1:NxN81beIxDlUaVt46iUQrYHD9/W3u9EGl52r86O/IGw=
+github.com/docker/docker v24.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
@@ -187,7 +166,6 @@ github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5Xh
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
-github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/libtrust v0.0.0-20150526203908-9cbd2a1374f4 h1:k8TfKGeAcDQFFQOGCQMRN04N4a9YrPlRMMKnzAuvM9Q=
@@ -207,7 +185,6 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fvbommel/sortorder v1.0.1 h1:dSnXLt4mJYH25uDDGa3biZNQsozaUWDSWeKJ0qqFfzE=
 github.com/fvbommel/sortorder v1.0.1/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
@@ -217,12 +194,8 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
@@ -242,8 +215,6 @@ github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LB
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
@@ -252,10 +223,6 @@ github.com/gogo/googleapis v1.4.1/go.mod h1:2lpHqI5OcWCtVElxXnPt+s8oJvMpySlOyM6x
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
-github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ=
 github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
@@ -286,8 +253,9 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/certificate-transparency-go v1.1.4 h1:hCyXHDbtqlr/lMXU0D4WgbalXL0Zk4dSWWMbPV8VrqY=
@@ -304,7 +272,7 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -350,8 +318,9 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
 github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
 github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/in-toto/in-toto-golang v0.5.0 h1:hb8bgwr0M2hGdDsLjkJ3ZqJ8JFLL/tgYdAxF/XEFBbY=
-github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
-github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/in-toto/in-toto-golang v0.5.0/go.mod h1:/Rq0IZHLV7Ku5gielPT4wPHJfH1GdHMCq8+WPxw8/BE=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jinzhu/gorm v1.9.2 h1:lCvgEaqe/HVE+tjAR2mt4HbbHAZsQOv3XAZiEZV37iw=
 github.com/jinzhu/gorm v1.9.2/go.mod h1:Vla75njaFJ8clLU1W44h34PjIkijhjHIYnZxMqCdxqo=
 github.com/jinzhu/inflection v0.0.0-20180308033659-04140366298a h1:eeaG9XMUvRBYXJi4pg1ZKM7nxc5AfXfojeLLW7O5J3k=
@@ -360,30 +329,25 @@ github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHW
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 h1:iQTw/8FWTuc7uiaSepXwyf3o52HaUYcV+Tu66S3F5GA=
 github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.16.0 h1:iULayQNOReoYUe+1qtKOqw9CwJv3aNQu8ivo7lw1HU4=
-github.com/klauspost/compress v1.16.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.16.3 h1:XuJt9zzcnaz6a16/OU53ZjWp/v7/42WcR5t2a0PcNQY=
+github.com/klauspost/compress v1.16.3/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -407,23 +371,22 @@ github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7 h1:DpOJ2HYzC
 github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.11.0-rc3.0.20230411142536-333ee9158128 h1:MpK1e4TlETVYELLbzaxmbvQrftq1TWYoOftFiSNk/iE=
-github.com/moby/buildkit v0.11.0-rc3.0.20230411142536-333ee9158128/go.mod h1:GwK84qTEVfkyvAhd6aET84FRzND+lrQZC0pTesljST0=
+github.com/moby/buildkit v0.11.0-rc3.0.20230530080511-c36941f4a10e h1:d5nOEUewXcVebVTyUVeQHXX8+Ofb/+TSlqZSn9xIg3k=
+github.com/moby/buildkit v0.11.0-rc3.0.20230530080511-c36941f4a10e/go.mod h1:nWISTd0U2LNfp6z0W5T0NO73xO5rrdRiTTQkSF6uIjc=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.5.0 h1:YCZgJOeULcxLw1Q+sVR636pmS7sPEn1Qo2iAN6M7DBo=
 github.com/moby/patternmatcher v0.5.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
-github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
 github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
 github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
 github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
 github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
 github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
-github.com/moby/term v0.0.0-20221120202655-abb19827d345 h1:J9c53/kxIH+2nTKBEfZYFMlhghtHpIHSXpm5VRGHSnU=
-github.com/moby/term v0.0.0-20221120202655-abb19827d345/go.mod h1:15ce4BGCFxt7I5NQKT+HV0yEDxmf6fSysfEDiVo3zFM=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -433,30 +396,25 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
-github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/onsi/ginkgo/v2 v2.1.6 h1:Fx2POJZfKRQcM1pH49qSZiYeu319wji004qX+GDovrU=
-github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
+github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs=
+github.com/onsi/gomega v1.23.0 h1:/oxKu9c2HVap+F3PfKort2Hw5DEU+HGlW8n+tguWsys=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b h1:YWuSjZCQAPM8UUBLkYUk1e+rZcvWHJmFb6i6rM44Xs8=
-github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
-github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/GDEs=
-github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
-github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.1.0-rc.1 h1:wHa9jroFfKGQqFHj0I1fMRKLl0pfj+ynAqBxo3v6u9w=
-github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
+github.com/opencontainers/image-spec v1.1.0-rc3 h1:fzg1mXZFj8YdPeNkRXMg+zb88BFV0Ys52cJydRwBkb8=
+github.com/opencontainers/image-spec v1.1.0-rc3/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/opencontainers/runc v1.1.7 h1:y2EZDS8sNng4Ksf0GUYNhKbTShZJPJg1FiXJNH/uoCk=
+github.com/opencontainers/runc v1.1.7/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50=
+github.com/opencontainers/runtime-spec v1.1.0-rc.2 h1:ucBtEms2tamYYW/SvGpvq9yUN0NEVL6oyLEwDcTSrk8=
 github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/package-url/packageurl-go v0.1.1-0.20220428063043-89078438f170 h1:DiLBVp4DAcZlBVBEtJpNWZpZVq0AEeCY7Hqk8URVs4o=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.0.5 h1:ipoSadvV8oGUjnUbMub59IDPPwfxF694nG/jwbMiyQg=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -466,60 +424,47 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
-github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_golang v1.14.0 h1:nJdhIvne2eSX/XRAFV9PcvFFRbrjbcTUj0VP62TMhnw=
 github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
 github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
-github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/common v0.37.0 h1:ccBbHCgIiT9uSoFY0vX8H3zsNR5eLt17/RQLUvn8pXE=
-github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
+github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
+github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
-github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
-github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
+github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
+github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-charset v0.0.0-20180617210344-2471d30d28b4/go.mod h1:qgYeAmZ5ZIpBWTGllZSQnw97Dj+woV0toclVaRGI8pc=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.8.1 h1:geMPLpDpQOgVyCg5z5GoRwLHepNdb71NXb67XFkP+Eg=
-github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/secure-systems-lab/go-securesystemslib v0.4.0 h1:b23VGrQhTA8cN2CbBw7/FulN9fTtqYUdS5+Oxzt+DUE=
+github.com/secure-systems-lab/go-securesystemslib v0.4.0/go.mod h1:FGBZgq2tXWICsxWQW1msNf49F0Pf2Op5Htayx335Qbs=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/serialx/hashring v0.0.0-20190422032157-8b2912629002 h1:ka9QPuQg2u4LGipiZGsgkg3rJCo4iIUCy75FddM0GRQ=
 github.com/serialx/hashring v0.0.0-20190422032157-8b2912629002/go.mod h1:/yeG0My1xr/u+HZrFQ1tOQQQQrOawfyMUH13ai5brBc=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spdx/tools-golang v0.3.1-0.20230104082527-d6f58551be3f h1:9B623Cfs+mclYK6dsae7gLSwuIBHvlgmEup87qpqsAQ=
+github.com/spdx/tools-golang v0.5.0 h1:/fqihV2Jna7fmow65dHpgKNsilgLK7ICpd2tkCnPEyY=
 github.com/spf13/afero v1.9.2 h1:j49Hj62F0n+DaZ1dDCvhABaPNSGNkt32oRFxI33IEMw=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
-github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
-github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
+github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
+github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
@@ -529,32 +474,24 @@ github.com/spf13/viper v1.14.0/go.mod h1:WT//axPky3FdvXHzGw33dNdXXXfFQqmEalje+eg
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
-github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/theupdateframework/notary v0.6.1 h1:7wshjstgS9x9F5LuB1L5mBI2xNMObWqjz+cjWoom6l0=
 github.com/theupdateframework/notary v0.6.1/go.mod h1:MOfgIfmox8s7/7fduvB2xyPPMJCrjRLRizA8OFwpnKY=
-github.com/tonistiigi/fsutil v0.0.0-20230105215944-fb433841cbfa h1:XOFp/3aBXlqmOFAg3r6e0qQjPnK5I970LilqX+Is1W8=
-github.com/tonistiigi/fsutil v0.0.0-20230105215944-fb433841cbfa/go.mod h1:AvLEd1LEIl64G2Jpgwo7aVV5lGH0ePcKl0ygGIHNYl8=
+github.com/tonistiigi/fsutil v0.0.0-20230407161946-9e7a6df48576 h1:fZXPQDVh5fm2x7pA0CH1TtH80tiZ0L7i834kZqZN8Pw=
+github.com/tonistiigi/fsutil v0.0.0-20230407161946-9e7a6df48576/go.mod h1:q1CxMSzcAbjUkVGHoZeQUcCaALnaE4XdWk+zJcgMYFw=
 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/v/cCndK0AMpt1wiVFb/YYmqB3/QG0=
 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea/go.mod h1:WPnis/6cRcDZSUvVmezrxJPkiO87ThFYsoUiMwWNDJk=
 github.com/tonistiigi/vt100 v0.0.0-20210615222946-8066bb97264f h1:DLpt6B5oaaS8jyXHa9VA4rrZloBVPVXeCtrOsrFauxc=
 github.com/tonistiigi/vt100 v0.0.0-20210615222946-8066bb97264f/go.mod h1:ulncasL3N9uLrVann0m+CDlJKWsIAP34MPcOJF6VRvc=
-github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/vbatts/tar-split v0.11.2 h1:Via6XqJr0hceW4wff3QRzD5gAk/tatMw/4ZA7cTlIME=
-github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
-github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
@@ -615,8 +552,6 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200422194213-44a606286825/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.2.0 h1:BRXPfhNivWL5Yq0BGQ39a2sW6t44aODpfxkWjYdzewE=
 golang.org/x/crypto v0.2.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -649,8 +584,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.9.0 h1:KENHtAZL2y3NLMYZeHY9DW8HW8V+kQyJsY/V9JlKvCs=
+golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -681,25 +616,17 @@ golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M=
-golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
+golang.org/x/oauth2 v0.5.0 h1:HuArIo48skDwlrvM3sEdHXElYslAMsf3KwRkkW4MC4s=
+golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -710,8 +637,8 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
+golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -723,16 +650,13 @@ golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190502175342-a43fa875dd82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -745,47 +669,35 @@ golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.1.0 h1:xYY+Bajn2a7VBmTM5GikTmnK8ZuX8YgnQCqZpbBNtmA=
-golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -828,8 +740,8 @@ golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.5.0 h1:+bSpV5HIeWkuvgaMfI3UmKRThoTA5ODJTUd8T17NO+4=
-golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k=
+golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4=
+golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -924,15 +836,14 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/dancannon/gorethink.v3 v3.0.5 h1:/g7PWP7zUS6vSNmHSDbjCHQh1Rqn8Jy6zSMQxAsBSMQ=
 gopkg.in/dancannon/gorethink.v3 v3.0.5/go.mod h1:GXsi1e3N2OcKhcP6nsYABTiUejbWMFO4GY5a4pEaeEc=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
@@ -947,9 +858,7 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -964,14 +873,14 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.25.4 h1:3YO8J4RtmG7elEgaWMb4HgmpS2CfY1QlaOz9nwB+ZSs=
-k8s.io/api v0.25.4/go.mod h1:IG2+RzyPQLllQxnhzD8KQNEu4c4YvyDTpSMztf4A0OQ=
-k8s.io/apimachinery v0.25.4 h1:CtXsuaitMESSu339tfhVXhQrPET+EiWnIY1rcurKnAc=
-k8s.io/apimachinery v0.25.4/go.mod h1:jaF9C/iPNM1FuLl7Zuy5b9v+n35HGSh6AQ4HYRkCqwo=
-k8s.io/apiserver v0.25.4 h1:/3TwZcgLqX7wUxq7TtXOUqXeBTwXIblVMQdhR5XZ7yo=
-k8s.io/apiserver v0.25.4/go.mod h1:rPcm567XxjOnnd7jedDUnGJGmDGAo+cT6H7QHAN+xV0=
-k8s.io/client-go v0.25.4 h1:3RNRDffAkNU56M/a7gUfXaEzdhZlYhoW8dgViGy5fn8=
-k8s.io/client-go v0.25.4/go.mod h1:8trHCAC83XKY0wsBIpbirZU4NTUpbuhc2JnI7OruGZw=
+k8s.io/api v0.26.2 h1:dM3cinp3PGB6asOySalOZxEG4CZ0IAdJsrYZXE/ovGQ=
+k8s.io/api v0.26.2/go.mod h1:1kjMQsFE+QHPfskEcVNgL3+Hp88B80uj0QtSOlj8itU=
+k8s.io/apimachinery v0.26.2 h1:da1u3D5wfR5u2RpLhE/ZtZS2P7QvDgLZTi9wrNZl/tQ=
+k8s.io/apimachinery v0.26.2/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I=
+k8s.io/apiserver v0.26.2 h1:Pk8lmX4G14hYqJd1poHGC08G03nIHVqdJMR0SD3IH3o=
+k8s.io/apiserver v0.26.2/go.mod h1:GHcozwXgXsPuOJ28EnQ/jXEM9QeG6HT22YxSNmpYNh8=
+k8s.io/client-go v0.26.2 h1:s1WkVujHX3kTp4Zn4yGNFK+dlDXy1bAAkIl+cFAiuYI=
+k8s.io/client-go v0.26.2/go.mod h1:u5EjOuSyBa09yqqyY7m3abZeovO/7D/WehVVlZ2qcqU=
 k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
 k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E=

hack/test

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -eu -o pipefail
+
+: "${BUILDX_CMD=docker buildx}"
+
+: "${TEST_IMAGE_BUILD=1}"
+: "${TEST_IMAGE_ID=buildx-tests}"
+
+: "${TEST_REPORT_SUFFIX=}"
+: "${TEST_KEEP_CACHE=}"
+: "${TEST_DOCKERD=}"
+: "${TEST_BUILDKIT_IMAGE=}"
+
+if [ "$TEST_IMAGE_BUILD" = "1" ]; then
+  ${BUILDX_CMD} bake integration-test --set "*.output=type=docker,name=$TEST_IMAGE_ID"
+fi
+
+testReportsDir="$(pwd)/bin/testreports"
+mkdir -p "$testReportsDir"
+testReportsVol="-v $testReportsDir:/testreports"
+gotestsumArgs="--format=standard-verbose --jsonfile=/testreports/go-test-report$TEST_REPORT_SUFFIX.json --junitfile=/testreports/junit-report$TEST_REPORT_SUFFIX.xml"
+gotestArgs="-mod=vendor -coverprofile=/testreports/coverage-report$TEST_REPORT_SUFFIX.txt -covermode=atomic"
+
+cacheVolume="buildx-test-cache"
+if ! docker container inspect "$cacheVolume" >/dev/null 2>/dev/null; then
+  docker create -v /root/.cache -v /root/.cache/registry -v /go/pkg/mod --name "$cacheVolume" alpine
+fi
+if [ "$TEST_KEEP_CACHE" != "1" ]; then
+  trap 'docker rm -v $cacheVolume' EXIT
+fi
+
+cid=$(docker create --rm -v /tmp $testReportsVol --volumes-from=$cacheVolume -e GITHUB_REF -e TEST_DOCKERD -e TEST_BUILDKIT_IMAGE -e SKIP_INTEGRATION_TESTS -e GOTESTSUM_FORMAT ${BUILDKIT_INTEGRATION_SNAPSHOTTER:+"-eBUILDKIT_INTEGRATION_SNAPSHOTTER"} -e BUILDKIT_REGISTRY_MIRROR_DIR=/root/.cache/registry --privileged $TEST_IMAGE_ID gotestsum $gotestsumArgs --packages="${TESTPKGS:-./...}" -- $gotestArgs ${TESTFLAGS:--v})
+docker start -a -i $cid

monitor/commands/attach.go

@@ -20,7 +20,17 @@ func NewAttachCmd(m types.Monitor, stdout io.WriteCloser) types.Command {
 }
 
 func (cm *AttachCmd) Info() types.CommandInfo {
-	return types.CommandInfo{HelpMessage: "attach to a buildx server or a process in the container"}
+	return types.CommandInfo{
+		Name:        "attach",
+		HelpMessage: "attach to a buildx server or a process in the container",
+		HelpMessageLong: `
+Usage:
+  attach ID
+
+ID is for a session (visible via list command) or a process (visible via ps command).
+If you attached to a process, use Ctrl-c-a for switching the monitor to that process's STDIO.
+`,
+	}
 }
 
 func (cm *AttachCmd) Exec(ctx context.Context, args []string) error {

monitor/commands/disconnect.go

@@ -2,6 +2,7 @@ package commands
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/docker/buildx/monitor/types"
 	"github.com/pkg/errors"
@@ -16,7 +17,16 @@ func NewDisconnectCmd(m types.Monitor) types.Command {
 }
 
 func (cm *DisconnectCmd) Info() types.CommandInfo {
-	return types.CommandInfo{HelpMessage: "disconnect a client from a buildx server. Specific session ID can be specified an arg"}
+	return types.CommandInfo{
+		Name:        "disconnect",
+		HelpMessage: "disconnect a client from a buildx server. Specific session ID can be specified an arg",
+		HelpMessageLong: fmt.Sprintf(`
+Usage:
+  disconnect [ID]
+
+ID is for a session (visible via list command). Default is %q.
+`, cm.m.AttachedSessionID()),
+	}
 }
 
 func (cm *DisconnectCmd) Exec(ctx context.Context, args []string) error {

monitor/commands/exec.go

@@ -22,7 +22,16 @@ func NewExecCmd(m types.Monitor, invokeConfig controllerapi.InvokeConfig, stdout
 }
 
 func (cm *ExecCmd) Info() types.CommandInfo {
-	return types.CommandInfo{HelpMessage: "execute a process in the interactive container"}
+	return types.CommandInfo{
+		Name:        "exec",
+		HelpMessage: "execute a process in the interactive container",
+		HelpMessageLong: `
+Usage:
+  exec COMMAND [ARG...]
+
+COMMAND and ARG... will be executed in the container.
+`,
+	}
 }
 
 func (cm *ExecCmd) Exec(ctx context.Context, args []string) error {

monitor/commands/kill.go

@@ -16,7 +16,16 @@ func NewKillCmd(m types.Monitor) types.Command {
 }
 
 func (cm *KillCmd) Info() types.CommandInfo {
-	return types.CommandInfo{HelpMessage: "kill buildx server"}
+	return types.CommandInfo{
+		Name:        "kill",
+		HelpMessage: "kill buildx server",
+		HelpMessageLong: `
+Usage:
+  kill
+
+Kills the currently connecting buildx server process.
+`,
+	}
 }
 
 func (cm *KillCmd) Exec(ctx context.Context, args []string) error {

monitor/commands/list.go

@@ -21,7 +21,14 @@ func NewListCmd(m types.Monitor, stdout io.WriteCloser) types.Command {
 }
 
 func (cm *ListCmd) Info() types.CommandInfo {
-	return types.CommandInfo{HelpMessage: "list buildx sessions"}
+	return types.CommandInfo{
+		Name:        "list",
+		HelpMessage: "list buildx sessions",
+		HelpMessageLong: `
+Usage:
+  list
+`,
+	}
 }
 
 func (cm *ListCmd) Exec(ctx context.Context, args []string) error {

monitor/commands/ps.go

@@ -20,7 +20,14 @@ func NewPsCmd(m types.Monitor, stdout io.WriteCloser) types.Command {
 }
 
 func (cm *PsCmd) Info() types.CommandInfo {
-	return types.CommandInfo{HelpMessage: `list processes invoked by "exec". Use "attach" to attach IO to that process`}
+	return types.CommandInfo{
+		Name:        "ps",
+		HelpMessage: `list processes invoked by "exec". Use "attach" to attach IO to that process`,
+		HelpMessageLong: `
+Usage:
+  ps
+`,
+	}
 }
 
 func (cm *PsCmd) Exec(ctx context.Context, args []string) error {

monitor/commands/reload.go

@@ -27,7 +27,14 @@ func NewReloadCmd(m types.Monitor, stdout io.WriteCloser, progress *progress.Pri
 }
 
 func (cm *ReloadCmd) Info() types.CommandInfo {
-	return types.CommandInfo{HelpMessage: "reloads the context and build it"}
+	return types.CommandInfo{
+		Name:        "reload",
+		HelpMessage: "reloads the context and build it",
+		HelpMessageLong: `
+Usage:
+  reload
+`,
+	}
 }
 
 func (cm *ReloadCmd) Exec(ctx context.Context, args []string) error {

monitor/commands/rollback.go

@@ -21,7 +21,19 @@ func NewRollbackCmd(m types.Monitor, invokeConfig controllerapi.InvokeConfig, st
 }
 
 func (cm *RollbackCmd) Info() types.CommandInfo {
-	return types.CommandInfo{HelpMessage: "re-runs the interactive container with initial rootfs contents"}
+	return types.CommandInfo{
+		Name:        "rollback",
+		HelpMessage: "re-runs the interactive container with the step's rootfs contents",
+		HelpMessageLong: `
+Usage:
+  rollback [FLAGS] [COMMAND] [ARG...]
+
+Flags:
+  --init Run the container with the initial rootfs of that step.
+
+COMMAND and ARG... will be executed in the container.
+`,
+	}
 }
 
 func (cm *RollbackCmd) Exec(ctx context.Context, args []string) error {

monitor/monitor.go

@@ -85,18 +85,22 @@ func RunMonitor(ctx context.Context, curRef string, options *controllerapi.Build
 	id := m.Rollback(ctx, invokeConfig)
 	fmt.Fprintf(stdout, "Interactive container was restarted with process %q. Press Ctrl-a-c to switch to the new container\n", id)
 
-	registeredCommands := map[string]types.Command{
-		"reload":     commands.NewReloadCmd(m, stdout, progress, options, invokeConfig),
-		"rollback":   commands.NewRollbackCmd(m, invokeConfig, stdout),
-		"list":       commands.NewListCmd(m, stdout),
-		"disconnect": commands.NewDisconnectCmd(m),
-		"kill":       commands.NewKillCmd(m),
-		"attach":     commands.NewAttachCmd(m, stdout),
-		"exec":       commands.NewExecCmd(m, invokeConfig, stdout),
-		"ps":         commands.NewPsCmd(m, stdout),
+	availableCommands := []types.Command{
+		commands.NewReloadCmd(m, stdout, progress, options, invokeConfig),
+		commands.NewRollbackCmd(m, invokeConfig, stdout),
+		commands.NewListCmd(m, stdout),
+		commands.NewDisconnectCmd(m),
+		commands.NewKillCmd(m),
+		commands.NewAttachCmd(m, stdout),
+		commands.NewExecCmd(m, invokeConfig, stdout),
+		commands.NewPsCmd(m, stdout),
+	}
+	registeredCommands := make(map[string]types.Command)
+	for _, c := range availableCommands {
+		registeredCommands[c.Info().Name] = c
 	}
 	additionalHelpMessages := map[string]string{
-		"help": "shows this message",
+		"help": "shows this message. Optionally pass a command name as an argument to print the detailed usage.",
 		"exit": "exits monitor",
 	}
 
@@ -141,6 +145,10 @@ func RunMonitor(ctx context.Context, curRef string, options *controllerapi.Build
 				case "exit":
 					return
 				case "help":
+					if len(args) >= 2 {
+						printHelpMessageOfCommand(stdout, args[1], registeredCommands, additionalHelpMessages)
+						continue
+					}
 					printHelpMessage(stdout, registeredCommands, additionalHelpMessages)
 					continue
 				default:
@@ -171,6 +179,21 @@ func RunMonitor(ctx context.Context, curRef string, options *controllerapi.Build
 	}
 }
 
+func printHelpMessageOfCommand(out io.Writer, name string, registeredCommands map[string]types.Command, additional map[string]string) {
+	var target types.Command
+	if c, ok := registeredCommands[name]; ok {
+		target = c
+	} else {
+		fmt.Fprintf(out, "monitor: no help message for %q\n", name)
+		printHelpMessage(out, registeredCommands, additional)
+		return
+	}
+	fmt.Fprintln(out, target.Info().HelpMessage)
+	if h := target.Info().HelpMessageLong; h != "" {
+		fmt.Fprintln(out, h)
+	}
+}
+
 func printHelpMessage(out io.Writer, registeredCommands map[string]types.Command, additional map[string]string) {
 	var names []string
 	for name := range registeredCommands {

monitor/types/types.go

@@ -38,9 +38,14 @@ type Monitor interface {
 
 // CommandInfo is information about a command.
 type CommandInfo struct {
+	// Name is the name of the command.
+	Name string
 
-	// HelpMessage is the message printed to the console when "help" command is invoked.
+	// HelpMessage is one-line message printed to the console when "help" command is invoked.
 	HelpMessage string
+
+	// HelpMessageLong is a detailed message printed to the console when "help" command prints this command's information.
+	HelpMessageLong string
 }
 
 // Command represents a command for debugging.

tests/bake.go

@@ -0,0 +1,265 @@
+package tests
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/containerd/continuity/fs/fstest"
+	"github.com/docker/buildx/util/gitutil"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/stretchr/testify/require"
+)
+
+func bakeCmd(sb integration.Sandbox, opts ...cmdOpt) (string, error) {
+	opts = append([]cmdOpt{withArgs("bake", "--progress=quiet")}, opts...)
+	cmd := buildxCmd(sb, opts...)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+var bakeTests = []func(t *testing.T, sb integration.Sandbox){
+	testBakeRemote,
+	testBakeRemoteCmdContext,
+	testBakeRemoteCmdContextOverride,
+	testBakeRemoteContextSubdir,
+	testBakeRemoteCmdContextEscapeRoot,
+	testBakeRemoteCmdContextEscapeRelative,
+}
+
+func testBakeRemote(t *testing.T, sb integration.Sandbox) {
+	bakefile := []byte(`
+target "default" {
+	dockerfile-inline = <<EOT
+FROM scratch
+COPY foo /foo
+EOT
+}
+`)
+	dir := tmpdir(
+		t,
+		fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
+		fstest.CreateFile("foo", []byte("foo"), 0600),
+	)
+	dirDest := t.TempDir()
+
+	git, err := gitutil.New(gitutil.WithWorkingDir(dir))
+	require.NoError(t, err)
+
+	gitutil.GitInit(git, t)
+	gitutil.GitAdd(git, t, "docker-bake.hcl", "foo")
+	gitutil.GitCommit(git, t, "initial commit")
+	addr := gitutil.GitServeHTTP(git, t)
+
+	out, err := bakeCmd(sb, withDir(dir), withArgs(addr, "--set", "*.output=type=local,dest="+dirDest))
+	require.NoError(t, err, out)
+
+	require.FileExists(t, filepath.Join(dirDest, "foo"))
+}
+
+func testBakeRemoteCmdContext(t *testing.T, sb integration.Sandbox) {
+	bakefile := []byte(`
+target "default" {
+	context = BAKE_CMD_CONTEXT
+	dockerfile-inline = <<EOT
+FROM scratch
+COPY foo /foo
+EOT
+}
+`)
+	dirSpec := tmpdir(
+		t,
+		fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
+	)
+	dirSrc := tmpdir(
+		t,
+		fstest.CreateFile("foo", []byte("foo"), 0600),
+	)
+	dirDest := t.TempDir()
+
+	git, err := gitutil.New(gitutil.WithWorkingDir(dirSpec))
+	require.NoError(t, err)
+
+	gitutil.GitInit(git, t)
+	gitutil.GitAdd(git, t, "docker-bake.hcl")
+	gitutil.GitCommit(git, t, "initial commit")
+	addr := gitutil.GitServeHTTP(git, t)
+
+	out, err := bakeCmd(sb, withDir(dirSrc), withArgs(addr, "--set", "*.output=type=local,dest="+dirDest))
+	require.NoError(t, err, out)
+
+	require.FileExists(t, filepath.Join(dirDest, "foo"))
+}
+
+func testBakeRemoteCmdContextOverride(t *testing.T, sb integration.Sandbox) {
+	bakefile := []byte(`
+target "default" {
+	context = BAKE_CMD_CONTEXT
+	dockerfile-inline = <<EOT
+FROM scratch
+COPY foo /foo
+EOT
+}
+`)
+	dirSpec := tmpdir(
+		t,
+		fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
+	)
+	dirSrc := tmpdir(
+		t,
+		fstest.CreateFile("foo", []byte("foo"), 0600),
+	)
+	dirDest := t.TempDir()
+
+	gitSpec, err := gitutil.New(gitutil.WithWorkingDir(dirSpec))
+	require.NoError(t, err)
+	gitutil.GitInit(gitSpec, t)
+	gitutil.GitAdd(gitSpec, t, "docker-bake.hcl")
+	gitutil.GitCommit(gitSpec, t, "initial commit")
+	addrSpec := gitutil.GitServeHTTP(gitSpec, t)
+
+	gitSrc, err := gitutil.New(gitutil.WithWorkingDir(dirSrc))
+	require.NoError(t, err)
+	gitutil.GitInit(gitSrc, t)
+	gitutil.GitAdd(gitSrc, t, "foo")
+	gitutil.GitCommit(gitSrc, t, "initial commit")
+	addrSrc := gitutil.GitServeHTTP(gitSrc, t)
+
+	out, err := bakeCmd(sb, withDir("/tmp"), withArgs(addrSpec, addrSrc, "--set", "*.output=type=local,dest="+dirDest))
+	require.NoError(t, err, out)
+
+	require.FileExists(t, filepath.Join(dirDest, "foo"))
+}
+
+// https://github.com/docker/buildx/issues/1738
+func testBakeRemoteContextSubdir(t *testing.T, sb integration.Sandbox) {
+	bakefile := []byte(`
+target default {
+	context = "./bar"
+}
+`)
+	dockerfile := []byte(`
+FROM scratch
+COPY super-cool.txt /
+`)
+
+	dir := tmpdir(
+		t,
+		fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
+		fstest.CreateDir("bar", 0700),
+		fstest.CreateFile("bar/Dockerfile", dockerfile, 0600),
+		fstest.CreateFile("bar/super-cool.txt", []byte("super cool"), 0600),
+	)
+	dirDest := t.TempDir()
+
+	git, err := gitutil.New(gitutil.WithWorkingDir(dir))
+	require.NoError(t, err)
+	gitutil.GitInit(git, t)
+	gitutil.GitAdd(git, t, "docker-bake.hcl", "bar")
+	gitutil.GitCommit(git, t, "initial commit")
+	addr := gitutil.GitServeHTTP(git, t)
+
+	out, err := bakeCmd(sb, withDir("/tmp"), withArgs(addr, "--set", "*.output=type=local,dest="+dirDest))
+	require.NoError(t, err, out)
+
+	require.FileExists(t, filepath.Join(dirDest, "super-cool.txt"))
+}
+
+func testBakeRemoteCmdContextEscapeRoot(t *testing.T, sb integration.Sandbox) {
+	dirSrc := tmpdir(
+		t,
+		fstest.CreateFile("foo", []byte("foo"), 0600),
+	)
+	dirSrc, err := filepath.Abs(dirSrc)
+	require.NoError(t, err)
+
+	dirCurrent := tmpdir(t)
+	dirCurrent, err = filepath.Abs(dirCurrent)
+	require.NoError(t, err)
+
+	bakefile := []byte(`
+target "default" {
+	context = "cwd://` + dirSrc + `"
+	dockerfile-inline = <<EOT
+FROM scratch
+COPY foo /foo
+EOT
+}
+`)
+	dirSpec := tmpdir(
+		t,
+		fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
+	)
+	dirDest := t.TempDir()
+
+	git, err := gitutil.New(gitutil.WithWorkingDir(dirSpec))
+	require.NoError(t, err)
+
+	gitutil.GitInit(git, t)
+	gitutil.GitAdd(git, t, "docker-bake.hcl")
+	gitutil.GitCommit(git, t, "initial commit")
+	addr := gitutil.GitServeHTTP(git, t)
+
+	out, err := bakeCmd(
+		sb,
+		withDir(dirCurrent),
+		withArgs(addr, "--set", "*.output=type=local,dest="+dirDest),
+	)
+	require.Error(t, err, out)
+	require.Contains(t, out, "outside of the working directory, please set BAKE_ALLOW_REMOTE_FS_ACCESS")
+
+	out, err = bakeCmd(
+		sb,
+		withDir(dirCurrent),
+		withArgs(addr, "--set", "*.output=type=local,dest="+dirDest),
+		withEnv("BAKE_ALLOW_REMOTE_FS_ACCESS=1"),
+	)
+	require.NoError(t, err, out)
+	require.FileExists(t, filepath.Join(dirDest, "foo"))
+}
+
+func testBakeRemoteCmdContextEscapeRelative(t *testing.T, sb integration.Sandbox) {
+	bakefile := []byte(`
+target "default" {
+	context = "cwd://../"
+	dockerfile-inline = <<EOT
+FROM scratch
+COPY foo /foo
+EOT
+}
+`)
+	dirSpec := tmpdir(
+		t,
+		fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
+	)
+	dirSrc := tmpdir(
+		t,
+		fstest.CreateFile("foo", []byte("foo"), 0600),
+		fstest.CreateDir("subdir", 0700),
+	)
+	dirDest := t.TempDir()
+
+	git, err := gitutil.New(gitutil.WithWorkingDir(dirSpec))
+	require.NoError(t, err)
+
+	gitutil.GitInit(git, t)
+	gitutil.GitAdd(git, t, "docker-bake.hcl")
+	gitutil.GitCommit(git, t, "initial commit")
+	addr := gitutil.GitServeHTTP(git, t)
+
+	out, err := bakeCmd(
+		sb,
+		withDir(filepath.Join(dirSrc, "subdir")),
+		withArgs(addr, "--set", "*.output=type=local,dest="+dirDest),
+	)
+	require.Error(t, err, out)
+	require.Contains(t, out, "outside of the working directory, please set BAKE_ALLOW_REMOTE_FS_ACCESS")
+
+	out, err = bakeCmd(
+		sb,
+		withDir(filepath.Join(dirSrc, "subdir")),
+		withArgs(addr, "--set", "*.output=type=local,dest="+dirDest),
+		withEnv("BAKE_ALLOW_REMOTE_FS_ACCESS=1"),
+	)
+	require.NoError(t, err, out)
+	require.FileExists(t, filepath.Join(dirDest, "foo"))
+}

tests/build.go

@@ -0,0 +1,157 @@
+package tests
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/containerd/containerd/platforms"
+	"github.com/containerd/continuity/fs/fstest"
+	"github.com/moby/buildkit/util/contentutil"
+	"github.com/moby/buildkit/util/testutil"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/opencontainers/go-digest"
+	"github.com/stretchr/testify/require"
+)
+
+func buildCmd(sb integration.Sandbox, opts ...cmdOpt) (string, error) {
+	opts = append([]cmdOpt{withArgs("build", "--progress=quiet")}, opts...)
+	cmd := buildxCmd(sb, opts...)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+var buildTests = []func(t *testing.T, sb integration.Sandbox){
+	testBuild,
+	testImageIDOutput,
+	testBuildLocalExport,
+	testBuildRegistryExport,
+	testBuildTarExport,
+}
+
+func testBuild(t *testing.T, sb integration.Sandbox) {
+	dir := createTestProject(t)
+	out, err := buildCmd(sb, withArgs(dir))
+	require.NoError(t, err, string(out))
+}
+
+func testBuildLocalExport(t *testing.T, sb integration.Sandbox) {
+	dir := createTestProject(t)
+	out, err := buildCmd(sb, withArgs(fmt.Sprintf("--output=type=local,dest=%s/result", dir), dir))
+	require.NoError(t, err, string(out))
+
+	dt, err := os.ReadFile(dir + "/result/bar")
+	require.NoError(t, err)
+	require.Equal(t, "foo", string(dt))
+}
+
+func testBuildTarExport(t *testing.T, sb integration.Sandbox) {
+	dir := createTestProject(t)
+	out, err := buildCmd(sb, withArgs(fmt.Sprintf("--output=type=tar,dest=%s/result.tar", dir), dir))
+	require.NoError(t, err, string(out))
+
+	dt, err := os.ReadFile(fmt.Sprintf("%s/result.tar", dir))
+	require.NoError(t, err)
+	m, err := testutil.ReadTarToMap(dt, false)
+	require.NoError(t, err)
+
+	require.Contains(t, m, "bar")
+	require.Equal(t, "foo", string(m["bar"].Data))
+}
+
+func testBuildRegistryExport(t *testing.T, sb integration.Sandbox) {
+	dir := createTestProject(t)
+
+	registry, err := sb.NewRegistry()
+	if errors.Is(err, integration.ErrRequirements) {
+		t.Skip(err.Error())
+	}
+	require.NoError(t, err)
+	target := registry + "/buildx/registry:latest"
+
+	out, err := buildCmd(sb, withArgs(fmt.Sprintf("--output=type=image,name=%s,push=true", target), dir))
+	require.NoError(t, err, string(out))
+
+	desc, provider, err := contentutil.ProviderFromRef(target)
+	require.NoError(t, err)
+	imgs, err := testutil.ReadImages(sb.Context(), provider, desc)
+	require.NoError(t, err)
+
+	pk := platforms.Format(platforms.Normalize(platforms.DefaultSpec()))
+	img := imgs.Find(pk)
+	require.NotNil(t, img)
+	require.Len(t, img.Layers, 1)
+	require.Equal(t, img.Layers[0]["bar"].Data, []byte("foo"))
+}
+
+func testImageIDOutput(t *testing.T, sb integration.Sandbox) {
+	dockerfile := []byte(`FROM busybox:latest`)
+
+	dir := tmpdir(t,
+		fstest.CreateFile("Dockerfile", dockerfile, 0600),
+	)
+	targetDir := t.TempDir()
+
+	outFlag := "--output=type=docker"
+
+	if sb.Name() == "remote" {
+		// there is no Docker atm to load the image
+		outFlag += ",dest=" + targetDir + "/image.tar"
+	}
+
+	cmd := buildxCmd(
+		sb,
+		withArgs("build", "-q", outFlag, "--iidfile", filepath.Join(targetDir, "iid.txt"), "--metadata-file", filepath.Join(targetDir, "md.json"), dir),
+	)
+	stdout := bytes.NewBuffer(nil)
+	cmd.Stdout = stdout
+	cmd.Stderr = os.Stderr
+	err := cmd.Run()
+	require.NoError(t, err)
+
+	dt, err := os.ReadFile(filepath.Join(targetDir, "iid.txt"))
+	require.NoError(t, err)
+
+	imageID := string(dt)
+	require.NotEmpty(t, imageID)
+
+	dgst, err := digest.Parse(string(dt))
+	require.NoError(t, err)
+
+	require.Equal(t, dgst.String(), strings.TrimSpace(stdout.String()))
+
+	dt, err = os.ReadFile(filepath.Join(targetDir, "md.json"))
+	require.NoError(t, err)
+
+	type mdT struct {
+		ConfigDigest string `json:"containerimage.config.digest"`
+	}
+	var md mdT
+	err = json.Unmarshal(dt, &md)
+	require.NoError(t, err)
+
+	require.NotEmpty(t, md.ConfigDigest)
+	require.Equal(t, dgst, digest.Digest(md.ConfigDigest))
+}
+
+func createTestProject(t *testing.T) string {
+	dockerfile := []byte(`
+FROM busybox:latest AS base
+COPY foo /etc/foo
+RUN cp /etc/foo /etc/bar
+
+FROM scratch
+COPY --from=base /etc/bar /bar
+`)
+	dir := tmpdir(
+		t,
+		fstest.CreateFile("Dockerfile", dockerfile, 0600),
+		fstest.CreateFile("foo", []byte("foo"), 0600),
+	)
+	return dir
+}

tests/inspect.go

@@ -0,0 +1,38 @@
+package tests
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/stretchr/testify/require"
+)
+
+func inspectCmd(sb integration.Sandbox, opts ...cmdOpt) (string, error) {
+	opts = append([]cmdOpt{withArgs("inspect")}, opts...)
+	cmd := buildxCmd(sb, opts...)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+var inspectTests = []func(t *testing.T, sb integration.Sandbox){
+	testInspect,
+}
+
+func testInspect(t *testing.T, sb integration.Sandbox) {
+	out, err := inspectCmd(sb)
+	require.NoError(t, err, string(out))
+
+	var name string
+	var driver string
+	for _, line := range strings.Split(out, "\n") {
+		if v, ok := strings.CutPrefix(line, "Name:"); ok && name == "" {
+			name = strings.TrimSpace(v)
+		}
+		if v, ok := strings.CutPrefix(line, "Driver:"); ok && driver == "" {
+			driver = strings.TrimSpace(v)
+		}
+	}
+	require.Equal(t, sb.Address(), name)
+	require.Equal(t, sb.Name(), driver)
+}

tests/integration.go

@@ -0,0 +1,56 @@
+package tests
+
+import (
+	"os"
+	"os/exec"
+	"testing"
+
+	"github.com/containerd/continuity/fs/fstest"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/stretchr/testify/require"
+)
+
+func tmpdir(t *testing.T, appliers ...fstest.Applier) string {
+	t.Helper()
+	tmpdir := t.TempDir()
+	err := fstest.Apply(appliers...).Apply(tmpdir)
+	require.NoError(t, err)
+	return tmpdir
+}
+
+type cmdOpt func(*exec.Cmd)
+
+func withEnv(env ...string) cmdOpt {
+	return func(cmd *exec.Cmd) {
+		cmd.Env = append(cmd.Env, env...)
+	}
+}
+
+func withArgs(args ...string) cmdOpt {
+	return func(cmd *exec.Cmd) {
+		cmd.Args = append(cmd.Args, args...)
+	}
+}
+
+func withDir(dir string) cmdOpt {
+	return func(cmd *exec.Cmd) {
+		cmd.Dir = dir
+	}
+}
+
+func buildxCmd(sb integration.Sandbox, opts ...cmdOpt) *exec.Cmd {
+	cmd := exec.Command("buildx")
+	cmd.Env = append([]string{}, os.Environ()...)
+	for _, opt := range opts {
+		opt(cmd)
+	}
+
+	if builder := sb.Address(); builder != "" {
+		cmd.Args = append(cmd.Args, "--builder="+builder)
+	}
+	if context := sb.DockerAddress(); context != "" {
+		cmd.Env = append(cmd.Env, "DOCKER_CONTEXT="+context)
+	}
+
+	return cmd
+}

tests/integration_test.go

@@ -0,0 +1,46 @@
+package tests
+
+import (
+	"os"
+	"testing"
+
+	"github.com/docker/buildx/tests/workers"
+	"github.com/docker/distribution/reference"
+	"github.com/moby/buildkit/util/testutil/integration"
+)
+
+func init() {
+	if integration.IsTestDockerd() {
+		workers.InitDockerWorker()
+		workers.InitDockerContainerWorker()
+	} else {
+		workers.InitRemoteWorker()
+	}
+}
+
+func TestIntegration(t *testing.T) {
+	var tests []func(t *testing.T, sb integration.Sandbox)
+	tests = append(tests, buildTests...)
+	tests = append(tests, bakeTests...)
+	tests = append(tests, inspectTests...)
+	tests = append(tests, lsTests...)
+	testIntegration(t, tests...)
+}
+
+func testIntegration(t *testing.T, funcs ...func(t *testing.T, sb integration.Sandbox)) {
+	mirroredImages := integration.OfficialImages("busybox:latest", "alpine:latest")
+	buildkitImage := "docker.io/moby/buildkit:buildx-stable-1"
+	if integration.IsTestDockerd() {
+		if img, ok := os.LookupEnv("TEST_BUILDKIT_IMAGE"); ok {
+			ref, err := reference.ParseNormalizedNamed(img)
+			if err == nil {
+				buildkitImage = ref.String()
+			}
+		}
+	}
+	mirroredImages["moby/buildkit:buildx-stable-1"] = buildkitImage
+	mirrors := integration.WithMirroredImages(mirroredImages)
+
+	tests := integration.TestFuncs(funcs...)
+	integration.Run(t, tests, mirrors)
+}

tests/ls.go

@@ -0,0 +1,33 @@
+package tests
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/stretchr/testify/require"
+)
+
+func lsCmd(sb integration.Sandbox, opts ...cmdOpt) (string, error) {
+	opts = append([]cmdOpt{withArgs("ls")}, opts...)
+	cmd := buildxCmd(sb, opts...)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+var lsTests = []func(t *testing.T, sb integration.Sandbox){
+	testLs,
+}
+
+func testLs(t *testing.T, sb integration.Sandbox) {
+	out, err := lsCmd(sb)
+	require.NoError(t, err, string(out))
+
+	for _, line := range strings.Split(out, "\n") {
+		if strings.Contains(line, sb.Address()) {
+			require.Contains(t, line, sb.Name())
+			return
+		}
+	}
+	require.Fail(t, out)
+}

tests/workers/backend.go

@@ -0,0 +1,26 @@
+package workers
+
+type backend struct {
+	builder string
+	context string
+}
+
+func (s *backend) Address() string {
+	return s.builder
+}
+
+func (s *backend) DockerAddress() string {
+	return s.context
+}
+
+func (s *backend) ContainerdAddress() string {
+	return ""
+}
+
+func (s *backend) Snapshotter() string {
+	return ""
+}
+
+func (s *backend) Rootless() bool {
+	return false
+}

tests/workers/docker-container.go

@@ -0,0 +1,66 @@
+package workers
+
+import (
+	"context"
+	"os"
+	"os/exec"
+
+	"github.com/moby/buildkit/identity"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+)
+
+func InitDockerContainerWorker() {
+	integration.Register(&containerWorker{
+		id: "docker-container",
+	})
+}
+
+type containerWorker struct {
+	id string
+}
+
+func (w *containerWorker) Name() string {
+	return w.id
+}
+
+func (w *containerWorker) Rootless() bool {
+	return false
+}
+
+func (w *containerWorker) New(ctx context.Context, cfg *integration.BackendConfig) (integration.Backend, func() error, error) {
+	bk, bkclose, err := dockerWorker{id: w.id}.New(ctx, cfg)
+	if err != nil {
+		return bk, bkclose, err
+	}
+
+	name := "integration-container-" + identity.NewID()
+	cmd := exec.Command("buildx", "create",
+		"--bootstrap",
+		"--name="+name,
+		"--config="+cfg.ConfigFile,
+		"--driver=docker-container",
+		"--driver-opt=network=host",
+	)
+	cmd.Env = append(os.Environ(), "DOCKER_CONTEXT="+bk.DockerAddress())
+	if err := cmd.Run(); err != nil {
+		return nil, nil, errors.Wrapf(err, "failed to create buildx instance %s", name)
+	}
+
+	cl := func() error {
+		var err error
+		if err1 := bkclose(); err == nil {
+			err = err1
+		}
+		cmd := exec.Command("buildx", "rm", "-f", name)
+		if err1 := cmd.Run(); err == nil {
+			err = err1
+		}
+		return err
+	}
+
+	return &backend{
+		context: bk.DockerAddress(),
+		builder: name,
+	}, cl, nil
+}

tests/workers/docker.go

@@ -0,0 +1,64 @@
+package workers
+
+import (
+	"context"
+	"os/exec"
+
+	"github.com/moby/buildkit/identity"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+)
+
+func InitDockerWorker() {
+	integration.Register(&dockerWorker{
+		id: "docker",
+	})
+}
+
+type dockerWorker struct {
+	id string
+}
+
+func (c dockerWorker) Name() string {
+	return c.id
+}
+
+func (c dockerWorker) Rootless() bool {
+	return false
+}
+
+func (c dockerWorker) New(ctx context.Context, cfg *integration.BackendConfig) (b integration.Backend, cl func() error, err error) {
+	moby := integration.Moby{
+		ID: c.id,
+	}
+	bk, bkclose, err := moby.New(ctx, cfg)
+	if err != nil {
+		return bk, cl, err
+	}
+
+	name := "integration-" + identity.NewID()
+	cmd := exec.Command("docker", "context", "create",
+		name,
+		"--docker", "host="+bk.DockerAddress(),
+	)
+	if err := cmd.Run(); err != nil {
+		return nil, cl, errors.Wrapf(err, "failed to create buildx instance %s", name)
+	}
+
+	cl = func() error {
+		var err error
+		if err1 := bkclose(); err == nil {
+			err = err1
+		}
+		cmd := exec.Command("docker", "context", "rm", "-f", name)
+		if err1 := cmd.Run(); err1 != nil {
+			err = errors.Wrapf(err1, "failed to remove buildx instance %s", name)
+		}
+		return err
+	}
+
+	return &backend{
+		builder: name,
+		context: name,
+	}, cl, nil
+}

tests/workers/remote.go

@@ -0,0 +1,63 @@
+package workers
+
+import (
+	"context"
+	"os/exec"
+
+	"github.com/moby/buildkit/identity"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+)
+
+func InitRemoteWorker() {
+	integration.Register(&remoteWorker{
+		id: "remote",
+	})
+}
+
+type remoteWorker struct {
+	id string
+}
+
+func (w remoteWorker) Name() string {
+	return w.id
+}
+
+func (w remoteWorker) Rootless() bool {
+	return false
+}
+
+func (w remoteWorker) New(ctx context.Context, cfg *integration.BackendConfig) (b integration.Backend, cl func() error, err error) {
+	oci := integration.OCI{ID: w.id}
+	bk, bkclose, err := oci.New(ctx, cfg)
+	if err != nil {
+		return bk, cl, err
+	}
+
+	name := "integration-remote-" + identity.NewID()
+	cmd := exec.Command("buildx", "create",
+		"--bootstrap",
+		"--name="+name,
+		"--driver=remote",
+		bk.Address(),
+	)
+	if err := cmd.Run(); err != nil {
+		return nil, nil, errors.Wrapf(err, "failed to create buildx instance %s", name)
+	}
+
+	cl = func() error {
+		var err error
+		if err1 := bkclose(); err == nil {
+			err = err1
+		}
+		cmd := exec.Command("buildx", "rm", "-f", name)
+		if err1 := cmd.Run(); err == nil {
+			err = err1
+		}
+		return err
+	}
+
+	return &backend{
+		builder: name,
+	}, cl, nil
+}

util/buildflags/attests.go

@@ -25,7 +25,7 @@ func ParseAttests(in []string) ([]*controllerapi.Attest, error) {
 	found := map[string]struct{}{}
 	for _, in := range in {
 		in := in
-		attest, err := parseAttest(in)
+		attest, err := ParseAttest(in)
 		if err != nil {
 			return nil, err
 		}
@@ -40,7 +40,7 @@ func ParseAttests(in []string) ([]*controllerapi.Attest, error) {
 	return out, nil
 }
 
-func parseAttest(in string) (*controllerapi.Attest, error) {
+func ParseAttest(in string) (*controllerapi.Attest, error) {
 	if in == "" {
 		return nil, nil
 	}

util/buildflags/cache.go

@@ -88,6 +88,12 @@ func addAwsCredentials(ci *controllerapi.CacheOptionsEntry) {
 	if ci.Type != "s3" {
 		return
 	}
+	_, okAccessKeyID := ci.Attrs["access_key_id"]
+	_, okSecretAccessKey := ci.Attrs["secret_access_key"]
+	// If the user provides access_key_id, secret_access_key, do not override the session token.
+	if okAccessKeyID && okSecretAccessKey {
+		return
+	}
 	ctx := context.TODO()
 	awsConfig, err := awsconfig.LoadDefaultConfig(ctx)
 	if err != nil {
@@ -97,10 +103,10 @@ func addAwsCredentials(ci *controllerapi.CacheOptionsEntry) {
 	if err != nil {
 		return
 	}
-	if _, ok := ci.Attrs["access_key_id"]; !ok && credentials.AccessKeyID != "" {
+	if !okAccessKeyID && credentials.AccessKeyID != "" {
 		ci.Attrs["access_key_id"] = credentials.AccessKeyID
 	}
-	if _, ok := ci.Attrs["secret_access_key"]; !ok && credentials.SecretAccessKey != "" {
+	if !okSecretAccessKey && credentials.SecretAccessKey != "" {
 		ci.Attrs["secret_access_key"] = credentials.SecretAccessKey
 	}
 	if _, ok := ci.Attrs["session_token"]; !ok && credentials.SessionToken != "" {

util/confutil/container.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path"
+	"regexp"
 
 	"github.com/pelletier/go-toml"
 	"github.com/pkg/errors"
@@ -19,6 +20,8 @@ const (
 	DefaultBuildKitConfigDir = "/etc/buildkit"
 )
 
+var reInvalidCertsDir = regexp.MustCompile(`[^a-zA-Z0-9.-]+`)
+
 // LoadConfigFiles creates a temp directory with BuildKit config and
 // registry certificates ready to be copied to a container.
 func LoadConfigFiles(bkconfig string) (map[string][]byte, error) {
@@ -60,7 +63,7 @@ func LoadConfigFiles(bkconfig string) (map[string][]byte, error) {
 			if regConf == nil {
 				continue
 			}
-			pfx := path.Join("certs", regName)
+			pfx := path.Join("certs", reInvalidCertsDir.ReplaceAllString(regName, "_"))
 			if regConf.Has("ca") {
 				regCAs := regConf.GetArray("ca").([]string)
 				if len(regCAs) > 0 {

util/desktop/desktop.go

@@ -0,0 +1,86 @@
+package desktop
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/containerd/console"
+)
+
+var (
+	bbEnabledOnce sync.Once
+	bbEnabled     bool
+)
+
+func BuildBackendEnabled() bool {
+	bbEnabledOnce.Do(func() {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return
+		}
+		_, err = os.Stat(filepath.Join(home, ".docker", "desktop-build", ".lastaccess"))
+		bbEnabled = err == nil
+	})
+	return bbEnabled
+}
+
+func BuildDetailsOutput(refs map[string]string, term bool) string {
+	if len(refs) == 0 {
+		return ""
+	}
+	refURL := func(ref string) string {
+		return fmt.Sprintf("docker-desktop://dashboard/build/%s", ref)
+	}
+	var out bytes.Buffer
+	out.WriteString("View build details: ")
+	multiTargets := len(refs) > 1
+	for target, ref := range refs {
+		if multiTargets {
+			out.WriteString(fmt.Sprintf("\n  %s: ", target))
+		}
+		if term {
+			out.WriteString(hyperlink(refURL(ref)))
+		} else {
+			out.WriteString(refURL(ref))
+		}
+	}
+	return out.String()
+}
+
+func PrintBuildDetails(w io.Writer, refs map[string]string, term bool) {
+	if out := BuildDetailsOutput(refs, term); out != "" {
+		fmt.Fprintf(w, "\n%s\n", out)
+	}
+}
+
+func hyperlink(url string) string {
+	// create an escape sequence using the OSC 8 format: https://gist.github.com/egmontkob/eb114294efbcd5adb1944c9f3cb5feda
+	return fmt.Sprintf("\033]8;;%s\033\\%s\033]8;;\033\\", url, url)
+}
+
+type ErrorWithBuildRef struct {
+	Ref string
+	Err error
+	Msg string
+}
+
+func (e *ErrorWithBuildRef) Error() string {
+	return e.Err.Error()
+}
+
+func (e *ErrorWithBuildRef) Unwrap() error {
+	return e.Err
+}
+
+func (e *ErrorWithBuildRef) Print(w io.Writer) error {
+	var term bool
+	if _, err := console.ConsoleFromFile(os.Stderr); err == nil {
+		term = true
+	}
+	fmt.Fprintf(w, "\n%s", BuildDetailsOutput(map[string]string{"default": e.Ref}, term))
+	return nil
+}

util/dockerutil/client.go

@@ -63,6 +63,23 @@ func (c *Client) LoadImage(ctx context.Context, name string, status progress.Wri
 	}, nil
 }
 
+func (c *Client) Features(ctx context.Context, name string) map[Feature]bool {
+	features := make(map[Feature]bool)
+	if dapi, err := c.API(name); err == nil {
+		if info, err := dapi.Info(ctx); err == nil {
+			for _, v := range info.DriverStatus {
+				switch v[0] {
+				case "driver-type":
+					if v[1] == "io.containerd.snapshotter.v1" {
+						features[OCIImporter] = true
+					}
+				}
+			}
+		}
+	}
+	return features
+}
+
 type waitingWriter struct {
 	*io.PipeWriter
 	f      func()

util/dockerutil/features.go

@@ -0,0 +1,5 @@
+package dockerutil
+
+type Feature string
+
+const OCIImporter Feature = "OCI importer"

util/gitutil/gitutil.go

@@ -6,6 +6,7 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 
 	"github.com/pkg/errors"
@@ -68,6 +69,14 @@ func (c *Git) RootDir() (string, error) {
 	return c.clean(c.run("rev-parse", "--show-toplevel"))
 }
 
+func (c *Git) GitDir() (string, error) {
+	dir, err := c.RootDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, ".git"), nil
+}
+
 func (c *Git) RemoteURL() (string, error) {
 	// Try to get the remote URL from the origin remote first
 	if ru, err := c.clean(c.run("remote", "get-url", "origin")); err == nil && ru != "" {

util/gitutil/testutil.go

@@ -39,9 +39,10 @@ func GitCheckoutBranch(c *Git, tb testing.TB, name string) {
 	require.Empty(tb, out)
 }
 
-func GitAdd(c *Git, tb testing.TB, file string) {
+func GitAdd(c *Git, tb testing.TB, files ...string) {
 	tb.Helper()
-	_, err := fakeGit(c, "add", file)
+	args := append([]string{"add"}, files...)
+	_, err := fakeGit(c, args...)
 	require.NoError(tb, err)
 }
 

util/gitutil/testutilserve.go

@@ -0,0 +1,62 @@
+package gitutil
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func GitServeHTTP(c *Git, t testing.TB) (url string) {
+	t.Helper()
+	gitUpdateServerInfo(c, t)
+	ctx, cancel := context.WithCancel(context.TODO())
+
+	ready := make(chan struct{})
+	done := make(chan struct{})
+
+	name := "test.git"
+	dir, err := c.GitDir()
+	if err != nil {
+		cancel()
+	}
+
+	var addr string
+	go func() {
+		mux := http.NewServeMux()
+		prefix := fmt.Sprintf("/%s/", name)
+		mux.Handle(prefix, http.StripPrefix(prefix, http.FileServer(http.Dir(dir))))
+		l, err := net.Listen("tcp", "localhost:0")
+		if err != nil {
+			panic(err)
+		}
+
+		addr = l.Addr().String()
+
+		close(ready)
+
+		s := http.Server{Handler: mux} //nolint:gosec // potential attacks are not relevant for tests
+		go s.Serve(l)
+		<-ctx.Done()
+		s.Shutdown(context.TODO())
+		l.Close()
+
+		close(done)
+	}()
+	<-ready
+
+	t.Cleanup(func() {
+		cancel()
+		<-done
+	})
+	return fmt.Sprintf("http://%s/%s", addr, name)
+}
+
+func gitUpdateServerInfo(c *Git, tb testing.TB) {
+	tb.Helper()
+	_, err := fakeGit(c, "update-server-info")
+	require.NoError(tb, err)
+}

util/imagetools/create.go

@@ -122,24 +122,29 @@ func (r *Resolver) Combine(ctx context.Context, srcs []*Source) ([]byte, ocispec
 		}
 	}
 
-	mt := images.MediaTypeDockerSchema2ManifestList //ocispec.MediaTypeImageIndex
-	idx := struct {
-		// MediaType is reserved in the OCI spec but
-		// excluded from go types.
-		MediaType string `json:"mediaType,omitempty"`
-
-		ocispec.Index
-	}{
-		MediaType: mt,
-		Index: ocispec.Index{
-			Versioned: specs.Versioned{
-				SchemaVersion: 2,
-			},
-			Manifests: newDescs,
-		},
+	dockerMfsts := 0
+	for _, desc := range newDescs {
+		if strings.HasPrefix(desc.MediaType, "application/vnd.docker.") {
+			dockerMfsts++
+		}
 	}
 
-	idxBytes, err := json.MarshalIndent(idx, "", "  ")
+	var mt string
+	if dockerMfsts == len(newDescs) {
+		// all manifests are Docker types, use Docker manifest list
+		mt = images.MediaTypeDockerSchema2ManifestList
+	} else {
+		// otherwise, use OCI index
+		mt = ocispec.MediaTypeImageIndex
+	}
+
+	idxBytes, err := json.MarshalIndent(ocispec.Index{
+		MediaType: mt,
+		Versioned: specs.Versioned{
+			SchemaVersion: 2,
+		},
+		Manifests: newDescs,
+	}, "", "  ")
 	if err != nil {
 		return nil, ocispec.Descriptor{}, errors.Wrap(err, "failed to marshal index")
 	}

util/logutil/format.go

@@ -1,6 +1,7 @@
 package logutil
 
 import (
+	"bytes"
 	"fmt"
 	"strings"
 
@@ -12,5 +13,11 @@ type Formatter struct {
 }
 
 func (f *Formatter) Format(entry *logrus.Entry) ([]byte, error) {
-	return []byte(fmt.Sprintf("%s: %s\n", strings.ToUpper(entry.Level.String()), entry.Message)), nil
+	msg := bytes.NewBuffer(nil)
+	fmt.Fprintf(msg, "%s: %s", strings.ToUpper(entry.Level.String()), entry.Message)
+	if v, ok := entry.Data[logrus.ErrorKey]; ok {
+		fmt.Fprintf(msg, ": %v", v)
+	}
+	fmt.Fprintf(msg, "\n")
+	return msg.Bytes(), nil
 }

util/progress/printer.go

@@ -33,6 +33,11 @@ type Printer struct {
 	warnings     []client.VertexWarning
 	logMu        sync.Mutex
 	logSourceMap map[digest.Digest]interface{}
+
+	// TODO: remove once we can use result context to pass build ref
+	//  see https://github.com/docker/buildx/pull/1861
+	buildRefsMu sync.Mutex
+	buildRefs   map[string]string
 }
 
 func (p *Printer) Wait() error {
@@ -143,6 +148,19 @@ func NewPrinter(ctx context.Context, w io.Writer, out console.File, mode string,
 	return pw, nil
 }
 
+func (p *Printer) WriteBuildRef(target string, ref string) {
+	p.buildRefsMu.Lock()
+	defer p.buildRefsMu.Unlock()
+	if p.buildRefs == nil {
+		p.buildRefs = map[string]string{}
+	}
+	p.buildRefs[target] = ref
+}
+
+func (p *Printer) BuildRefs() map[string]string {
+	return p.buildRefs
+}
+
 type printerOpts struct {
 	displayOpts []progressui.DisplaySolveStatusOpt
 

util/progress/writer.go

@@ -10,6 +10,7 @@ import (
 
 type Writer interface {
 	Write(*client.SolveStatus)
+	WriteBuildRef(string, string)
 	ValidateLogSource(digest.Digest, interface{}) bool
 	ClearLogSource(interface{})
 }
@@ -41,6 +42,10 @@ func Write(w Writer, name string, f func() error) {
 	})
 }
 
+func WriteBuildRef(w Writer, target string, ref string) {
+	w.WriteBuildRef(target, ref)
+}
+
 func NewChannel(w Writer) (chan *client.SolveStatus, chan struct{}) {
 	ch := make(chan *client.SolveStatus)
 	done := make(chan struct{})

vendor/cloud.google.com/go/compute/metadata/CHANGES.md

@@ -1,19 +0,0 @@
-# Changes
-
-## [0.2.3](https://github.com/googleapis/google-cloud-go/compare/compute/metadata/v0.2.2...compute/metadata/v0.2.3) (2022-12-15)
-
-
-### Bug Fixes
-
-* **compute/metadata:** Switch DNS lookup to an absolute lookup ([119b410](https://github.com/googleapis/google-cloud-go/commit/119b41060c7895e45e48aee5621ad35607c4d021)), refs [#7165](https://github.com/googleapis/google-cloud-go/issues/7165)
-
-## [0.2.2](https://github.com/googleapis/google-cloud-go/compare/compute/metadata/v0.2.1...compute/metadata/v0.2.2) (2022-12-01)
-
-
-### Bug Fixes
-
-* **compute/metadata:** Set IdleConnTimeout for http.Client ([#7084](https://github.com/googleapis/google-cloud-go/issues/7084)) ([766516a](https://github.com/googleapis/google-cloud-go/commit/766516aaf3816bfb3159efeea65aa3d1d205a3e2)), refs [#5430](https://github.com/googleapis/google-cloud-go/issues/5430)
-
-## [0.1.0] (2022-10-26)
-
-Initial release of metadata being it's own module.

vendor/cloud.google.com/go/compute/metadata/README.md

@@ -1,27 +0,0 @@
-# Compute API
-
-[![Go Reference](https://pkg.go.dev/badge/cloud.google.com/go/compute.svg)](https://pkg.go.dev/cloud.google.com/go/compute/metadata)
-
-This is a utility library for communicating with Google Cloud metadata service
-on Google Cloud.
-
-## Install
-
-```bash
-go get cloud.google.com/go/compute/metadata
-```
-
-## Go Version Support
-
-See the [Go Versions Supported](https://github.com/googleapis/google-cloud-go#go-versions-supported)
-section in the root directory's README.
-
-## Contributing
-
-Contributions are welcome. Please, see the [CONTRIBUTING](https://github.com/GoogleCloudPlatform/google-cloud-go/blob/main/CONTRIBUTING.md)
-document for details.
-
-Please note that this project is released with a Contributor Code of Conduct.
-By participating in this project you agree to abide by its terms. See
-[Contributor Code of Conduct](https://github.com/GoogleCloudPlatform/google-cloud-go/blob/main/CONTRIBUTING.md#contributor-code-of-conduct)
-for more information.

vendor/cloud.google.com/go/compute/metadata/metadata.go

@@ -1,543 +0,0 @@
-// Copyright 2014 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package metadata provides access to Google Compute Engine (GCE)
-// metadata and API service accounts.
-//
-// This package is a wrapper around the GCE metadata service,
-// as documented at https://cloud.google.com/compute/docs/metadata/overview.
-package metadata // import "cloud.google.com/go/compute/metadata"
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"net"
-	"net/http"
-	"net/url"
-	"os"
-	"runtime"
-	"strings"
-	"sync"
-	"time"
-)
-
-const (
-	// metadataIP is the documented metadata server IP address.
-	metadataIP = "169.254.169.254"
-
-	// metadataHostEnv is the environment variable specifying the
-	// GCE metadata hostname.  If empty, the default value of
-	// metadataIP ("169.254.169.254") is used instead.
-	// This is variable name is not defined by any spec, as far as
-	// I know; it was made up for the Go package.
-	metadataHostEnv = "GCE_METADATA_HOST"
-
-	userAgent = "gcloud-golang/0.1"
-)
-
-type cachedValue struct {
-	k    string
-	trim bool
-	mu   sync.Mutex
-	v    string
-}
-
-var (
-	projID  = &cachedValue{k: "project/project-id", trim: true}
-	projNum = &cachedValue{k: "project/numeric-project-id", trim: true}
-	instID  = &cachedValue{k: "instance/id", trim: true}
-)
-
-var defaultClient = &Client{hc: newDefaultHTTPClient()}
-
-func newDefaultHTTPClient() *http.Client {
-	return &http.Client{
-		Transport: &http.Transport{
-			Dial: (&net.Dialer{
-				Timeout:   2 * time.Second,
-				KeepAlive: 30 * time.Second,
-			}).Dial,
-			IdleConnTimeout: 60 * time.Second,
-		},
-		Timeout: 5 * time.Second,
-	}
-}
-
-// NotDefinedError is returned when requested metadata is not defined.
-//
-// The underlying string is the suffix after "/computeMetadata/v1/".
-//
-// This error is not returned if the value is defined to be the empty
-// string.
-type NotDefinedError string
-
-func (suffix NotDefinedError) Error() string {
-	return fmt.Sprintf("metadata: GCE metadata %q not defined", string(suffix))
-}
-
-func (c *cachedValue) get(cl *Client) (v string, err error) {
-	defer c.mu.Unlock()
-	c.mu.Lock()
-	if c.v != "" {
-		return c.v, nil
-	}
-	if c.trim {
-		v, err = cl.getTrimmed(c.k)
-	} else {
-		v, err = cl.Get(c.k)
-	}
-	if err == nil {
-		c.v = v
-	}
-	return
-}
-
-var (
-	onGCEOnce sync.Once
-	onGCE     bool
-)
-
-// OnGCE reports whether this process is running on Google Compute Engine.
-func OnGCE() bool {
-	onGCEOnce.Do(initOnGCE)
-	return onGCE
-}
-
-func initOnGCE() {
-	onGCE = testOnGCE()
-}
-
-func testOnGCE() bool {
-	// The user explicitly said they're on GCE, so trust them.
-	if os.Getenv(metadataHostEnv) != "" {
-		return true
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	resc := make(chan bool, 2)
-
-	// Try two strategies in parallel.
-	// See https://github.com/googleapis/google-cloud-go/issues/194
-	go func() {
-		req, _ := http.NewRequest("GET", "http://"+metadataIP, nil)
-		req.Header.Set("User-Agent", userAgent)
-		res, err := newDefaultHTTPClient().Do(req.WithContext(ctx))
-		if err != nil {
-			resc <- false
-			return
-		}
-		defer res.Body.Close()
-		resc <- res.Header.Get("Metadata-Flavor") == "Google"
-	}()
-
-	go func() {
-		resolver := &net.Resolver{}
-		addrs, err := resolver.LookupHost(ctx, "metadata.google.internal.")
-		if err != nil || len(addrs) == 0 {
-			resc <- false
-			return
-		}
-		resc <- strsContains(addrs, metadataIP)
-	}()
-
-	tryHarder := systemInfoSuggestsGCE()
-	if tryHarder {
-		res := <-resc
-		if res {
-			// The first strategy succeeded, so let's use it.
-			return true
-		}
-		// Wait for either the DNS or metadata server probe to
-		// contradict the other one and say we are running on
-		// GCE. Give it a lot of time to do so, since the system
-		// info already suggests we're running on a GCE BIOS.
-		timer := time.NewTimer(5 * time.Second)
-		defer timer.Stop()
-		select {
-		case res = <-resc:
-			return res
-		case <-timer.C:
-			// Too slow. Who knows what this system is.
-			return false
-		}
-	}
-
-	// There's no hint from the system info that we're running on
-	// GCE, so use the first probe's result as truth, whether it's
-	// true or false. The goal here is to optimize for speed for
-	// users who are NOT running on GCE. We can't assume that
-	// either a DNS lookup or an HTTP request to a blackholed IP
-	// address is fast. Worst case this should return when the
-	// metaClient's Transport.ResponseHeaderTimeout or
-	// Transport.Dial.Timeout fires (in two seconds).
-	return <-resc
-}
-
-// systemInfoSuggestsGCE reports whether the local system (without
-// doing network requests) suggests that we're running on GCE. If this
-// returns true, testOnGCE tries a bit harder to reach its metadata
-// server.
-func systemInfoSuggestsGCE() bool {
-	if runtime.GOOS != "linux" {
-		// We don't have any non-Linux clues available, at least yet.
-		return false
-	}
-	slurp, _ := ioutil.ReadFile("/sys/class/dmi/id/product_name")
-	name := strings.TrimSpace(string(slurp))
-	return name == "Google" || name == "Google Compute Engine"
-}
-
-// Subscribe calls Client.Subscribe on the default client.
-func Subscribe(suffix string, fn func(v string, ok bool) error) error {
-	return defaultClient.Subscribe(suffix, fn)
-}
-
-// Get calls Client.Get on the default client.
-func Get(suffix string) (string, error) { return defaultClient.Get(suffix) }
-
-// ProjectID returns the current instance's project ID string.
-func ProjectID() (string, error) { return defaultClient.ProjectID() }
-
-// NumericProjectID returns the current instance's numeric project ID.
-func NumericProjectID() (string, error) { return defaultClient.NumericProjectID() }
-
-// InternalIP returns the instance's primary internal IP address.
-func InternalIP() (string, error) { return defaultClient.InternalIP() }
-
-// ExternalIP returns the instance's primary external (public) IP address.
-func ExternalIP() (string, error) { return defaultClient.ExternalIP() }
-
-// Email calls Client.Email on the default client.
-func Email(serviceAccount string) (string, error) { return defaultClient.Email(serviceAccount) }
-
-// Hostname returns the instance's hostname. This will be of the form
-// "<instanceID>.c.<projID>.internal".
-func Hostname() (string, error) { return defaultClient.Hostname() }
-
-// InstanceTags returns the list of user-defined instance tags,
-// assigned when initially creating a GCE instance.
-func InstanceTags() ([]string, error) { return defaultClient.InstanceTags() }
-
-// InstanceID returns the current VM's numeric instance ID.
-func InstanceID() (string, error) { return defaultClient.InstanceID() }
-
-// InstanceName returns the current VM's instance ID string.
-func InstanceName() (string, error) { return defaultClient.InstanceName() }
-
-// Zone returns the current VM's zone, such as "us-central1-b".
-func Zone() (string, error) { return defaultClient.Zone() }
-
-// InstanceAttributes calls Client.InstanceAttributes on the default client.
-func InstanceAttributes() ([]string, error) { return defaultClient.InstanceAttributes() }
-
-// ProjectAttributes calls Client.ProjectAttributes on the default client.
-func ProjectAttributes() ([]string, error) { return defaultClient.ProjectAttributes() }
-
-// InstanceAttributeValue calls Client.InstanceAttributeValue on the default client.
-func InstanceAttributeValue(attr string) (string, error) {
-	return defaultClient.InstanceAttributeValue(attr)
-}
-
-// ProjectAttributeValue calls Client.ProjectAttributeValue on the default client.
-func ProjectAttributeValue(attr string) (string, error) {
-	return defaultClient.ProjectAttributeValue(attr)
-}
-
-// Scopes calls Client.Scopes on the default client.
-func Scopes(serviceAccount string) ([]string, error) { return defaultClient.Scopes(serviceAccount) }
-
-func strsContains(ss []string, s string) bool {
-	for _, v := range ss {
-		if v == s {
-			return true
-		}
-	}
-	return false
-}
-
-// A Client provides metadata.
-type Client struct {
-	hc *http.Client
-}
-
-// NewClient returns a Client that can be used to fetch metadata.
-// Returns the client that uses the specified http.Client for HTTP requests.
-// If nil is specified, returns the default client.
-func NewClient(c *http.Client) *Client {
-	if c == nil {
-		return defaultClient
-	}
-
-	return &Client{hc: c}
-}
-
-// getETag returns a value from the metadata service as well as the associated ETag.
-// This func is otherwise equivalent to Get.
-func (c *Client) getETag(suffix string) (value, etag string, err error) {
-	ctx := context.TODO()
-	// Using a fixed IP makes it very difficult to spoof the metadata service in
-	// a container, which is an important use-case for local testing of cloud
-	// deployments. To enable spoofing of the metadata service, the environment
-	// variable GCE_METADATA_HOST is first inspected to decide where metadata
-	// requests shall go.
-	host := os.Getenv(metadataHostEnv)
-	if host == "" {
-		// Using 169.254.169.254 instead of "metadata" here because Go
-		// binaries built with the "netgo" tag and without cgo won't
-		// know the search suffix for "metadata" is
-		// ".google.internal", and this IP address is documented as
-		// being stable anyway.
-		host = metadataIP
-	}
-	suffix = strings.TrimLeft(suffix, "/")
-	u := "http://" + host + "/computeMetadata/v1/" + suffix
-	req, err := http.NewRequest("GET", u, nil)
-	if err != nil {
-		return "", "", err
-	}
-	req.Header.Set("Metadata-Flavor", "Google")
-	req.Header.Set("User-Agent", userAgent)
-	var res *http.Response
-	var reqErr error
-	retryer := newRetryer()
-	for {
-		res, reqErr = c.hc.Do(req)
-		var code int
-		if res != nil {
-			code = res.StatusCode
-		}
-		if delay, shouldRetry := retryer.Retry(code, reqErr); shouldRetry {
-			if err := sleep(ctx, delay); err != nil {
-				return "", "", err
-			}
-			continue
-		}
-		break
-	}
-	if reqErr != nil {
-		return "", "", reqErr
-	}
-	defer res.Body.Close()
-	if res.StatusCode == http.StatusNotFound {
-		return "", "", NotDefinedError(suffix)
-	}
-	all, err := ioutil.ReadAll(res.Body)
-	if err != nil {
-		return "", "", err
-	}
-	if res.StatusCode != 200 {
-		return "", "", &Error{Code: res.StatusCode, Message: string(all)}
-	}
-	return string(all), res.Header.Get("Etag"), nil
-}
-
-// Get returns a value from the metadata service.
-// The suffix is appended to "http://${GCE_METADATA_HOST}/computeMetadata/v1/".
-//
-// If the GCE_METADATA_HOST environment variable is not defined, a default of
-// 169.254.169.254 will be used instead.
-//
-// If the requested metadata is not defined, the returned error will
-// be of type NotDefinedError.
-func (c *Client) Get(suffix string) (string, error) {
-	val, _, err := c.getETag(suffix)
-	return val, err
-}
-
-func (c *Client) getTrimmed(suffix string) (s string, err error) {
-	s, err = c.Get(suffix)
-	s = strings.TrimSpace(s)
-	return
-}
-
-func (c *Client) lines(suffix string) ([]string, error) {
-	j, err := c.Get(suffix)
-	if err != nil {
-		return nil, err
-	}
-	s := strings.Split(strings.TrimSpace(j), "\n")
-	for i := range s {
-		s[i] = strings.TrimSpace(s[i])
-	}
-	return s, nil
-}
-
-// ProjectID returns the current instance's project ID string.
-func (c *Client) ProjectID() (string, error) { return projID.get(c) }
-
-// NumericProjectID returns the current instance's numeric project ID.
-func (c *Client) NumericProjectID() (string, error) { return projNum.get(c) }
-
-// InstanceID returns the current VM's numeric instance ID.
-func (c *Client) InstanceID() (string, error) { return instID.get(c) }
-
-// InternalIP returns the instance's primary internal IP address.
-func (c *Client) InternalIP() (string, error) {
-	return c.getTrimmed("instance/network-interfaces/0/ip")
-}
-
-// Email returns the email address associated with the service account.
-// The account may be empty or the string "default" to use the instance's
-// main account.
-func (c *Client) Email(serviceAccount string) (string, error) {
-	if serviceAccount == "" {
-		serviceAccount = "default"
-	}
-	return c.getTrimmed("instance/service-accounts/" + serviceAccount + "/email")
-}
-
-// ExternalIP returns the instance's primary external (public) IP address.
-func (c *Client) ExternalIP() (string, error) {
-	return c.getTrimmed("instance/network-interfaces/0/access-configs/0/external-ip")
-}
-
-// Hostname returns the instance's hostname. This will be of the form
-// "<instanceID>.c.<projID>.internal".
-func (c *Client) Hostname() (string, error) {
-	return c.getTrimmed("instance/hostname")
-}
-
-// InstanceTags returns the list of user-defined instance tags,
-// assigned when initially creating a GCE instance.
-func (c *Client) InstanceTags() ([]string, error) {
-	var s []string
-	j, err := c.Get("instance/tags")
-	if err != nil {
-		return nil, err
-	}
-	if err := json.NewDecoder(strings.NewReader(j)).Decode(&s); err != nil {
-		return nil, err
-	}
-	return s, nil
-}
-
-// InstanceName returns the current VM's instance ID string.
-func (c *Client) InstanceName() (string, error) {
-	return c.getTrimmed("instance/name")
-}
-
-// Zone returns the current VM's zone, such as "us-central1-b".
-func (c *Client) Zone() (string, error) {
-	zone, err := c.getTrimmed("instance/zone")
-	// zone is of the form "projects/<projNum>/zones/<zoneName>".
-	if err != nil {
-		return "", err
-	}
-	return zone[strings.LastIndex(zone, "/")+1:], nil
-}
-
-// InstanceAttributes returns the list of user-defined attributes,
-// assigned when initially creating a GCE VM instance. The value of an
-// attribute can be obtained with InstanceAttributeValue.
-func (c *Client) InstanceAttributes() ([]string, error) { return c.lines("instance/attributes/") }
-
-// ProjectAttributes returns the list of user-defined attributes
-// applying to the project as a whole, not just this VM.  The value of
-// an attribute can be obtained with ProjectAttributeValue.
-func (c *Client) ProjectAttributes() ([]string, error) { return c.lines("project/attributes/") }
-
-// InstanceAttributeValue returns the value of the provided VM
-// instance attribute.
-//
-// If the requested attribute is not defined, the returned error will
-// be of type NotDefinedError.
-//
-// InstanceAttributeValue may return ("", nil) if the attribute was
-// defined to be the empty string.
-func (c *Client) InstanceAttributeValue(attr string) (string, error) {
-	return c.Get("instance/attributes/" + attr)
-}
-
-// ProjectAttributeValue returns the value of the provided
-// project attribute.
-//
-// If the requested attribute is not defined, the returned error will
-// be of type NotDefinedError.
-//
-// ProjectAttributeValue may return ("", nil) if the attribute was
-// defined to be the empty string.
-func (c *Client) ProjectAttributeValue(attr string) (string, error) {
-	return c.Get("project/attributes/" + attr)
-}
-
-// Scopes returns the service account scopes for the given account.
-// The account may be empty or the string "default" to use the instance's
-// main account.
-func (c *Client) Scopes(serviceAccount string) ([]string, error) {
-	if serviceAccount == "" {
-		serviceAccount = "default"
-	}
-	return c.lines("instance/service-accounts/" + serviceAccount + "/scopes")
-}
-
-// Subscribe subscribes to a value from the metadata service.
-// The suffix is appended to "http://${GCE_METADATA_HOST}/computeMetadata/v1/".
-// The suffix may contain query parameters.
-//
-// Subscribe calls fn with the latest metadata value indicated by the provided
-// suffix. If the metadata value is deleted, fn is called with the empty string
-// and ok false. Subscribe blocks until fn returns a non-nil error or the value
-// is deleted. Subscribe returns the error value returned from the last call to
-// fn, which may be nil when ok == false.
-func (c *Client) Subscribe(suffix string, fn func(v string, ok bool) error) error {
-	const failedSubscribeSleep = time.Second * 5
-
-	// First check to see if the metadata value exists at all.
-	val, lastETag, err := c.getETag(suffix)
-	if err != nil {
-		return err
-	}
-
-	if err := fn(val, true); err != nil {
-		return err
-	}
-
-	ok := true
-	if strings.ContainsRune(suffix, '?') {
-		suffix += "&wait_for_change=true&last_etag="
-	} else {
-		suffix += "?wait_for_change=true&last_etag="
-	}
-	for {
-		val, etag, err := c.getETag(suffix + url.QueryEscape(lastETag))
-		if err != nil {
-			if _, deleted := err.(NotDefinedError); !deleted {
-				time.Sleep(failedSubscribeSleep)
-				continue // Retry on other errors.
-			}
-			ok = false
-		}
-		lastETag = etag
-
-		if err := fn(val, ok); err != nil || !ok {
-			return err
-		}
-	}
-}
-
-// Error contains an error response from the server.
-type Error struct {
-	// Code is the HTTP response status code.
-	Code int
-	// Message is the server response message.
-	Message string
-}
-
-func (e *Error) Error() string {
-	return fmt.Sprintf("compute: Received %d `%s`", e.Code, e.Message)
-}

vendor/cloud.google.com/go/compute/metadata/retry.go

@@ -1,114 +0,0 @@
-// Copyright 2021 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package metadata
-
-import (
-	"context"
-	"io"
-	"math/rand"
-	"net/http"
-	"time"
-)
-
-const (
-	maxRetryAttempts = 5
-)
-
-var (
-	syscallRetryable = func(err error) bool { return false }
-)
-
-// defaultBackoff is basically equivalent to gax.Backoff without the need for
-// the dependency.
-type defaultBackoff struct {
-	max time.Duration
-	mul float64
-	cur time.Duration
-}
-
-func (b *defaultBackoff) Pause() time.Duration {
-	d := time.Duration(1 + rand.Int63n(int64(b.cur)))
-	b.cur = time.Duration(float64(b.cur) * b.mul)
-	if b.cur > b.max {
-		b.cur = b.max
-	}
-	return d
-}
-
-// sleep is the equivalent of gax.Sleep without the need for the dependency.
-func sleep(ctx context.Context, d time.Duration) error {
-	t := time.NewTimer(d)
-	select {
-	case <-ctx.Done():
-		t.Stop()
-		return ctx.Err()
-	case <-t.C:
-		return nil
-	}
-}
-
-func newRetryer() *metadataRetryer {
-	return &metadataRetryer{bo: &defaultBackoff{
-		cur: 100 * time.Millisecond,
-		max: 30 * time.Second,
-		mul: 2,
-	}}
-}
-
-type backoff interface {
-	Pause() time.Duration
-}
-
-type metadataRetryer struct {
-	bo       backoff
-	attempts int
-}
-
-func (r *metadataRetryer) Retry(status int, err error) (time.Duration, bool) {
-	if status == http.StatusOK {
-		return 0, false
-	}
-	retryOk := shouldRetry(status, err)
-	if !retryOk {
-		return 0, false
-	}
-	if r.attempts == maxRetryAttempts {
-		return 0, false
-	}
-	r.attempts++
-	return r.bo.Pause(), true
-}
-
-func shouldRetry(status int, err error) bool {
-	if 500 <= status && status <= 599 {
-		return true
-	}
-	if err == io.ErrUnexpectedEOF {
-		return true
-	}
-	// Transient network errors should be retried.
-	if syscallRetryable(err) {
-		return true
-	}
-	if err, ok := err.(interface{ Temporary() bool }); ok {
-		if err.Temporary() {
-			return true
-		}
-	}
-	if err, ok := err.(interface{ Unwrap() error }); ok {
-		return shouldRetry(status, err.Unwrap())
-	}
-	return false
-}

vendor/cloud.google.com/go/compute/metadata/retry_linux.go

@@ -1,26 +0,0 @@
-// Copyright 2021 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build linux
-// +build linux
-
-package metadata
-
-import "syscall"
-
-func init() {
-	// Initialize syscallRetryable to return true on transient socket-level
-	// errors. These errors are specific to Linux.
-	syscallRetryable = func(err error) bool { return err == syscall.ECONNRESET || err == syscall.ECONNREFUSED }
-}

vendor/cloud.google.com/go/compute/metadata/tidyfix.go

@@ -1,23 +0,0 @@
-// Copyright 2022 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// This file, and the {{.RootMod}} import, won't actually become part of
-// the resultant binary.
-//go:build modhack
-// +build modhack
-
-package metadata
-
-// Necessary for safely adding multi-module repo. See: https://github.com/golang/go/wiki/Modules#is-it-possible-to-add-a-module-to-a-multi-module-repository
-import _ "cloud.google.com/go/compute/internal"

vendor/github.com/Azure/go-autorest/GNUmakefile

@@ -1,23 +0,0 @@
-DIR?=./autorest/
-
-default: build
-
-build: fmt
-	go install $(DIR)
-
-test:
-	go test $(DIR) || exit 1
-
-vet:
-	@echo "go vet ."
-	@go vet $(DIR)... ; if [ $$? -eq 1 ]; then \
-		echo ""; \
-		echo "Vet found suspicious constructs. Please check the reported constructs"; \
-		echo "and fix them if necessary before submitting the code for review."; \
-		exit 1; \
-	fi
-
-fmt:
-	gofmt -w $(DIR)
-
-.PHONY: build test vet fmt

vendor/github.com/Azure/go-autorest/Gopkg.lock

@@ -1,324 +0,0 @@
-# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
-
-
-[[projects]]
-  digest = "1:892e39e5c083d0943f1e80ab8351690f183c6a5ab24e1d280adcad424c26255e"
-  name = "contrib.go.opencensus.io/exporter/ocagent"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "a8a6f458bbc1d5042322ad1f9b65eeb0b69be9ea"
-  version = "v0.6.0"
-
-[[projects]]
-  digest = "1:8f5acd4d4462b5136af644d25101f0968a7a94ee90fcb2059cec5b7cc42e0b20"
-  name = "github.com/census-instrumentation/opencensus-proto"
-  packages = [
-    "gen-go/agent/common/v1",
-    "gen-go/agent/metrics/v1",
-    "gen-go/agent/trace/v1",
-    "gen-go/metrics/v1",
-    "gen-go/resource/v1",
-    "gen-go/trace/v1",
-  ]
-  pruneopts = "UT"
-  revision = "d89fa54de508111353cb0b06403c00569be780d8"
-  version = "v0.2.1"
-
-[[projects]]
-  digest = "1:ffe9824d294da03b391f44e1ae8281281b4afc1bdaa9588c9097785e3af10cec"
-  name = "github.com/davecgh/go-spew"
-  packages = ["spew"]
-  pruneopts = "UT"
-  revision = "8991bc29aa16c548c550c7ff78260e27b9ab7c73"
-  version = "v1.1.1"
-
-[[projects]]
-  digest = "1:76dc72490af7174349349838f2fe118996381b31ea83243812a97e5a0fd5ed55"
-  name = "github.com/dgrijalva/jwt-go"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "06ea1031745cb8b3dab3f6a236daf2b0aa468b7e"
-  version = "v3.2.0"
-
-[[projects]]
-  digest = "1:cf0d2e435fd4ce45b789e93ef24b5f08e86be0e9807a16beb3694e2d8c9af965"
-  name = "github.com/dimchansky/utfbom"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "d2133a1ce379ef6fa992b0514a77146c60db9d1c"
-  version = "v1.1.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:b7cb6054d3dff43b38ad2e92492f220f57ae6087ee797dca298139776749ace8"
-  name = "github.com/golang/groupcache"
-  packages = ["lru"]
-  pruneopts = "UT"
-  revision = "611e8accdfc92c4187d399e95ce826046d4c8d73"
-
-[[projects]]
-  digest = "1:e3839df32927e8d3403cd5aa7253d966e8ff80fc8f10e2e35d146461cd83fcfa"
-  name = "github.com/golang/protobuf"
-  packages = [
-    "descriptor",
-    "jsonpb",
-    "proto",
-    "protoc-gen-go/descriptor",
-    "ptypes",
-    "ptypes/any",
-    "ptypes/duration",
-    "ptypes/struct",
-    "ptypes/timestamp",
-    "ptypes/wrappers",
-  ]
-  pruneopts = "UT"
-  revision = "6c65a5562fc06764971b7c5d05c76c75e84bdbf7"
-  version = "v1.3.2"
-
-[[projects]]
-  digest = "1:c560cd79300fac84f124b96225181a637a70b60155919a3c36db50b7cca6b806"
-  name = "github.com/grpc-ecosystem/grpc-gateway"
-  packages = [
-    "internal",
-    "runtime",
-    "utilities",
-  ]
-  pruneopts = "UT"
-  revision = "f7120437bb4f6c71f7f5076ad65a45310de2c009"
-  version = "v1.12.1"
-
-[[projects]]
-  digest = "1:5d231480e1c64a726869bc4142d270184c419749d34f167646baa21008eb0a79"
-  name = "github.com/mitchellh/go-homedir"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "af06845cf3004701891bf4fdb884bfe4920b3727"
-  version = "v1.1.0"
-
-[[projects]]
-  digest = "1:0028cb19b2e4c3112225cd871870f2d9cf49b9b4276531f03438a88e94be86fe"
-  name = "github.com/pmezard/go-difflib"
-  packages = ["difflib"]
-  pruneopts = "UT"
-  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
-  version = "v1.0.0"
-
-[[projects]]
-  digest = "1:99d32780e5238c2621fff621123997c3e3cca96db8be13179013aea77dfab551"
-  name = "github.com/stretchr/testify"
-  packages = [
-    "assert",
-    "require",
-  ]
-  pruneopts = "UT"
-  revision = "221dbe5ed46703ee255b1da0dec05086f5035f62"
-  version = "v1.4.0"
-
-[[projects]]
-  digest = "1:7c5e00383399fe13de0b4b65c9fdde16275407ce8ac02d867eafeaa916edcc71"
-  name = "go.opencensus.io"
-  packages = [
-    ".",
-    "internal",
-    "internal/tagencoding",
-    "metric/metricdata",
-    "metric/metricproducer",
-    "plugin/ocgrpc",
-    "plugin/ochttp",
-    "plugin/ochttp/propagation/b3",
-    "plugin/ochttp/propagation/tracecontext",
-    "resource",
-    "stats",
-    "stats/internal",
-    "stats/view",
-    "tag",
-    "trace",
-    "trace/internal",
-    "trace/propagation",
-    "trace/tracestate",
-  ]
-  pruneopts = "UT"
-  revision = "aad2c527c5defcf89b5afab7f37274304195a6b2"
-  version = "v0.22.2"
-
-[[projects]]
-  branch = "master"
-  digest = "1:f604f5e2ee721b6757d962dfe7bab4f28aae50c456e39cfb2f3819762a44a6ae"
-  name = "golang.org/x/crypto"
-  packages = [
-    "pkcs12",
-    "pkcs12/internal/rc2",
-  ]
-  pruneopts = "UT"
-  revision = "e9b2fee46413994441b28dfca259d911d963dfed"
-
-[[projects]]
-  branch = "master"
-  digest = "1:334b27eac455cb6567ea28cd424230b07b1a64334a2f861a8075ac26ce10af43"
-  name = "golang.org/x/lint"
-  packages = [
-    ".",
-    "golint",
-  ]
-  pruneopts = "UT"
-  revision = "fdd1cda4f05fd1fd86124f0ef9ce31a0b72c8448"
-
-[[projects]]
-  branch = "master"
-  digest = "1:257a75d024975428ab9192bfc334c3490882f8cb21322ea5784ca8eca000a910"
-  name = "golang.org/x/net"
-  packages = [
-    "http/httpguts",
-    "http2",
-    "http2/hpack",
-    "idna",
-    "internal/timeseries",
-    "trace",
-  ]
-  pruneopts = "UT"
-  revision = "1ddd1de85cb0337b623b740a609d35817d516a8d"
-
-[[projects]]
-  branch = "master"
-  digest = "1:382bb5a7fb4034db3b6a2d19e5a4a6bcf52f4750530603c01ca18a172fa3089b"
-  name = "golang.org/x/sync"
-  packages = ["semaphore"]
-  pruneopts = "UT"
-  revision = "cd5d95a43a6e21273425c7ae415d3df9ea832eeb"
-
-[[projects]]
-  branch = "master"
-  digest = "1:4da420ceda5f68e8d748aa2169d0ed44ffadb1bbd6537cf778a49563104189b8"
-  name = "golang.org/x/sys"
-  packages = ["unix"]
-  pruneopts = "UT"
-  revision = "ce4227a45e2eb77e5c847278dcc6a626742e2945"
-
-[[projects]]
-  digest = "1:8d8faad6b12a3a4c819a3f9618cb6ee1fa1cfc33253abeeea8b55336721e3405"
-  name = "golang.org/x/text"
-  packages = [
-    "collate",
-    "collate/build",
-    "internal/colltab",
-    "internal/gen",
-    "internal/language",
-    "internal/language/compact",
-    "internal/tag",
-    "internal/triegen",
-    "internal/ucd",
-    "language",
-    "secure/bidirule",
-    "transform",
-    "unicode/bidi",
-    "unicode/cldr",
-    "unicode/norm",
-    "unicode/rangetable",
-  ]
-  pruneopts = "UT"
-  revision = "342b2e1fbaa52c93f31447ad2c6abc048c63e475"
-  version = "v0.3.2"
-
-[[projects]]
-  branch = "master"
-  digest = "1:4eb5ea8395fb60212dd58b92c9db80bab59d5e99c7435f9a6a0a528c373b60e7"
-  name = "golang.org/x/tools"
-  packages = [
-    "go/ast/astutil",
-    "go/gcexportdata",
-    "go/internal/gcimporter",
-    "go/types/typeutil",
-  ]
-  pruneopts = "UT"
-  revision = "259af5ff87bdcd4abf2ecda8edc3f13f04f26a42"
-
-[[projects]]
-  digest = "1:964bb30febc27fabfbec4759fa530c6ec35e77a7c85fed90b9317ea39a054877"
-  name = "google.golang.org/api"
-  packages = ["support/bundler"]
-  pruneopts = "UT"
-  revision = "8a410c21381766a810817fd6200fce8838ecb277"
-  version = "v0.14.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:a8d5c2c6e746b3485e36908ab2a9e3d77b86b81f8156d88403c7d2b462431dfd"
-  name = "google.golang.org/genproto"
-  packages = [
-    "googleapis/api/httpbody",
-    "googleapis/rpc/status",
-    "protobuf/field_mask",
-  ]
-  pruneopts = "UT"
-  revision = "51378566eb590fa106d1025ea12835a4416dda84"
-
-[[projects]]
-  digest = "1:b59ce3ddb11daeeccccc9cb3183b58ebf8e9a779f1c853308cd91612e817a301"
-  name = "google.golang.org/grpc"
-  packages = [
-    ".",
-    "backoff",
-    "balancer",
-    "balancer/base",
-    "balancer/roundrobin",
-    "binarylog/grpc_binarylog_v1",
-    "codes",
-    "connectivity",
-    "credentials",
-    "credentials/internal",
-    "encoding",
-    "encoding/proto",
-    "grpclog",
-    "internal",
-    "internal/backoff",
-    "internal/balancerload",
-    "internal/binarylog",
-    "internal/buffer",
-    "internal/channelz",
-    "internal/envconfig",
-    "internal/grpcrand",
-    "internal/grpcsync",
-    "internal/resolver/dns",
-    "internal/resolver/passthrough",
-    "internal/syscall",
-    "internal/transport",
-    "keepalive",
-    "metadata",
-    "naming",
-    "peer",
-    "resolver",
-    "serviceconfig",
-    "stats",
-    "status",
-    "tap",
-  ]
-  pruneopts = "UT"
-  revision = "1a3960e4bd028ac0cec0a2afd27d7d8e67c11514"
-  version = "v1.25.1"
-
-[[projects]]
-  digest = "1:b75b3deb2bce8bc079e16bb2aecfe01eb80098f5650f9e93e5643ca8b7b73737"
-  name = "gopkg.in/yaml.v2"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "1f64d6156d11335c3f22d9330b0ad14fc1e789ce"
-  version = "v2.2.7"
-
-[solve-meta]
-  analyzer-name = "dep"
-  analyzer-version = 1
-  input-imports = [
-    "contrib.go.opencensus.io/exporter/ocagent",
-    "github.com/dgrijalva/jwt-go",
-    "github.com/dimchansky/utfbom",
-    "github.com/mitchellh/go-homedir",
-    "github.com/stretchr/testify/require",
-    "go.opencensus.io/plugin/ochttp",
-    "go.opencensus.io/plugin/ochttp/propagation/tracecontext",
-    "go.opencensus.io/stats/view",
-    "go.opencensus.io/trace",
-    "golang.org/x/crypto/pkcs12",
-    "golang.org/x/lint/golint",
-  ]
-  solver-name = "gps-cdcl"
-  solver-version = 1

vendor/github.com/Azure/go-autorest/Gopkg.toml

@@ -1,59 +0,0 @@
-# Gopkg.toml example
-#
-# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html
-# for detailed Gopkg.toml documentation.
-#
-# required = ["github.com/user/thing/cmd/thing"]
-# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
-#
-# [[constraint]]
-#   name = "github.com/user/project"
-#   version = "1.0.0"
-#
-# [[constraint]]
-#   name = "github.com/user/project2"
-#   branch = "dev"
-#   source = "github.com/myfork/project2"
-#
-# [[override]]
-#   name = "github.com/x/y"
-#   version = "2.4.0"
-#
-# [prune]
-#   non-go = false
-#   go-tests = true
-#   unused-packages = true
-
-required = ["golang.org/x/lint/golint"]
-
-[prune]
-  go-tests = true
-  unused-packages = true
-
-[[constraint]]
-  name = "contrib.go.opencensus.io/exporter/ocagent"
-  version = "0.6.0"
-
-[[constraint]]
-  name = "github.com/dgrijalva/jwt-go"
-  version = "3.2.0"
-
-[[constraint]]
-  name = "github.com/dimchansky/utfbom"
-  version = "1.1.0"
-
-[[constraint]]
-  name = "github.com/mitchellh/go-homedir"
-  version = "1.1.0"
-
-[[constraint]]
-  name = "github.com/stretchr/testify"
-  version = "1.3.0"
-
-[[constraint]]
-  name = "go.opencensus.io"
-  version = "0.22.0"
-
-[[constraint]]
-  branch = "master"
-  name = "golang.org/x/crypto"

vendor/github.com/Azure/go-autorest/LICENSE

@@ -1,191 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright 2015 Microsoft Corporation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

vendor/github.com/Azure/go-autorest/README.md

@@ -1,165 +0,0 @@
-# go-autorest
-
-[![GoDoc](https://godoc.org/github.com/Azure/go-autorest/autorest?status.png)](https://godoc.org/github.com/Azure/go-autorest/autorest)
-[![Build Status](https://dev.azure.com/azure-sdk/public/_apis/build/status/go/Azure.go-autorest?branchName=master)](https://dev.azure.com/azure-sdk/public/_build/latest?definitionId=625&branchName=master)
-[![Go Report Card](https://goreportcard.com/badge/Azure/go-autorest)](https://goreportcard.com/report/Azure/go-autorest)
-
-Package go-autorest provides an HTTP request client for use with [Autorest](https://github.com/Azure/autorest.go)-generated API client packages.
-
-An authentication client tested with Azure Active Directory (AAD) is also
-provided in this repo in the package
-`github.com/Azure/go-autorest/autorest/adal`.  Despite its name, this package
-is maintained only as part of the Azure Go SDK and is not related to other
-"ADAL" libraries in [github.com/AzureAD](https://github.com/AzureAD).
-
-## Overview
-
-Package go-autorest implements an HTTP request pipeline suitable for use across
-multiple goroutines and provides the shared routines used by packages generated
-by [Autorest](https://github.com/Azure/autorest.go).
-
-The package breaks sending and responding to HTTP requests into three phases: Preparing, Sending,
-and Responding. A typical pattern is:
-
-```go
-  req, err := Prepare(&http.Request{},
-    token.WithAuthorization())
-
-  resp, err := Send(req,
-    WithLogging(logger),
-    DoErrorIfStatusCode(http.StatusInternalServerError),
-    DoCloseIfError(),
-    DoRetryForAttempts(5, time.Second))
-
-  err = Respond(resp,
-		ByDiscardingBody(),
-    ByClosing())
-```
-
-Each phase relies on decorators to modify and / or manage processing. Decorators may first modify
-and then pass the data along, pass the data first and then modify the result, or wrap themselves
-around passing the data (such as a logger might do). Decorators run in the order provided. For
-example, the following:
-
-```go
-  req, err := Prepare(&http.Request{},
-    WithBaseURL("https://microsoft.com/"),
-    WithPath("a"),
-    WithPath("b"),
-    WithPath("c"))
-```
-
-will set the URL to:
-
-```
-  https://microsoft.com/a/b/c
-```
-
-Preparers and Responders may be shared and re-used (assuming the underlying decorators support
-sharing and re-use). Performant use is obtained by creating one or more Preparers and Responders
-shared among multiple go-routines, and a single Sender shared among multiple sending go-routines,
-all bound together by means of input / output channels.
-
-Decorators hold their passed state within a closure (such as the path components in the example
-above). Be careful to share Preparers and Responders only in a context where such held state
-applies. For example, it may not make sense to share a Preparer that applies a query string from a
-fixed set of values. Similarly, sharing a Responder that reads the response body into a passed
-struct (e.g., `ByUnmarshallingJson`) is likely incorrect.
-
-Errors raised by autorest objects and methods will conform to the `autorest.Error` interface.
-
-See the included examples for more detail. For details on the suggested use of this package by
-generated clients, see the Client described below.
-
-## Helpers
-
-### Handling Swagger Dates
-
-The Swagger specification (https://swagger.io) that drives AutoRest
-(https://github.com/Azure/autorest/) precisely defines two date forms: date and date-time. The
-github.com/Azure/go-autorest/autorest/date package provides time.Time derivations to ensure correct
-parsing and formatting.
-
-### Handling Empty Values
-
-In JSON, missing values have different semantics than empty values. This is especially true for
-services using the HTTP PATCH verb. The JSON submitted with a PATCH request generally contains
-only those values to modify. Missing values are to be left unchanged. Developers, then, require a
-means to both specify an empty value and to leave the value out of the submitted JSON.
-
-The Go JSON package (`encoding/json`) supports the `omitempty` tag. When specified, it omits
-empty values from the rendered JSON. Since Go defines default values for all base types (such as ""
-for string and 0 for int) and provides no means to mark a value as actually empty, the JSON package
-treats default values as meaning empty, omitting them from the rendered JSON. This means that, using
-the Go base types encoded through the default JSON package, it is not possible to create JSON to
-clear a value at the server.
-
-The workaround within the Go community is to use pointers to base types in lieu of base types within
-structures that map to JSON. For example, instead of a value of type `string`, the workaround uses
-`*string`. While this enables distinguishing empty values from those to be unchanged, creating
-pointers to a base type (notably constant, in-line values) requires additional variables. This, for
-example,
-
-```go
-  s := struct {
-    S *string
-  }{ S: &"foo" }
-```
-fails, while, this
-
-```go
-  v := "foo"
-  s := struct {
-    S *string
-  }{ S: &v }
-```
-succeeds.
-
-To ease using pointers, the subpackage `to` contains helpers that convert to and from pointers for
-Go base types which have Swagger analogs. It also provides a helper that converts between
-`map[string]string` and `map[string]*string`, enabling the JSON to specify that the value
-associated with a key should be cleared. With the helpers, the previous example becomes
-
-```go
-  s := struct {
-    S *string
-  }{ S: to.StringPtr("foo") }
-```
-
-## Install
-
-```bash
-go get github.com/Azure/go-autorest/autorest
-go get github.com/Azure/go-autorest/autorest/azure
-go get github.com/Azure/go-autorest/autorest/date
-go get github.com/Azure/go-autorest/autorest/to
-```
-
-### Using with Go Modules
-In [v12.0.1](https://github.com/Azure/go-autorest/pull/386), this repository introduced the following modules.
-
-- autorest/adal
-- autorest/azure/auth
-- autorest/azure/cli
-- autorest/date
-- autorest/mocks
-- autorest/to
-- autorest/validation
-- autorest
-- logger
-- tracing
-
-Tagging cumulative SDK releases as a whole (e.g. `v12.3.0`) is still enabled to support consumers of this repo that have not yet migrated to modules.
-
-## License
-
-See LICENSE file.
-
------
-
-This project has adopted the [Microsoft Open Source Code of
-Conduct](https://opensource.microsoft.com/codeofconduct/). For more information
-see the [Code of Conduct
-FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact
-[opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional
-questions or comments.

vendor/github.com/Azure/go-autorest/autorest/LICENSE

@@ -1,191 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright 2015 Microsoft Corporation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

vendor/github.com/Azure/go-autorest/autorest/adal/LICENSE

@@ -1,191 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright 2015 Microsoft Corporation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

vendor/github.com/Azure/go-autorest/autorest/adal/README.md

@@ -1,294 +0,0 @@
-# NOTE: This module will go out of support by March 31, 2023.  For authenticating with Azure AD, use module [azidentity](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity) instead.  For help migrating from `adal` to `azidentiy` please consult the [migration guide](https://aka.ms/azsdk/go/identity/migration).  General information about the retirement of this and other legacy modules can be found [here](https://azure.microsoft.com/updates/support-for-azure-sdk-libraries-that-do-not-conform-to-our-current-azure-sdk-guidelines-will-be-retired-as-of-31-march-2023/).
-
-# Azure Active Directory authentication for Go
-
-This is a standalone package for authenticating with Azure Active
-Directory from other Go libraries and applications, in particular the [Azure SDK
-for Go](https://github.com/Azure/azure-sdk-for-go).
-
-Note: Despite the package's name it is not related to other "ADAL" libraries
-maintained in the [github.com/AzureAD](https://github.com/AzureAD) org. Issues
-should be opened in [this repo's](https://github.com/Azure/go-autorest/issues)
-or [the SDK's](https://github.com/Azure/azure-sdk-for-go/issues) issue
-trackers.
-
-## Install
-
-```bash
-go get -u github.com/Azure/go-autorest/autorest/adal
-```
-
-## Usage
-
-An Active Directory application is required in order to use this library. An application can be registered in the [Azure Portal](https://portal.azure.com/) by following these [guidelines](https://docs.microsoft.com/azure/active-directory/develop/active-directory-integrating-applications) or using the [Azure CLI](https://github.com/Azure/azure-cli).
-
-### Register an Azure AD Application with secret
-
-
-1. Register a new application with a `secret` credential
-
-   ```
-   az ad app create \
-      --display-name example-app \
-      --homepage https://example-app/home \
-      --identifier-uris https://example-app/app \
-      --password secret
-   ```
-
-2. Create a service principal using the `Application ID` from previous step
-
-   ```
-   az ad sp create --id "Application ID"
-   ```
-
-   * Replace `Application ID` with `appId` from step 1.
-
-### Register an Azure AD Application with certificate
-
-1. Create a private key
-
-   ```
-   openssl genrsa -out "example-app.key" 2048
-   ```
-
-2. Create the certificate
-
-   ```
-   openssl req -new -key "example-app.key" -subj "/CN=example-app" -out "example-app.csr"
-   openssl x509 -req -in "example-app.csr" -signkey "example-app.key" -out "example-app.crt" -days 10000
-   ```
-
-3. Create the PKCS12 version of the certificate containing also the private key
-
-   ```
-   openssl pkcs12 -export -out "example-app.pfx" -inkey "example-app.key" -in "example-app.crt" -passout pass:
-
-   ```
-
-4. Register a new application with the certificate content form `example-app.crt`
-
-   ```
-   certificateContents="$(tail -n+2 "example-app.crt" | head -n-1)"
-
-   az ad app create \
-      --display-name example-app \
-      --homepage https://example-app/home \
-      --identifier-uris https://example-app/app \
-      --key-usage Verify --end-date 2018-01-01 \
-      --key-value "${certificateContents}"
-   ```
-
-5. Create a service principal using the `Application ID` from previous step
-
-   ```
-   az ad sp create --id "APPLICATION_ID"
-   ```
-
-   * Replace `APPLICATION_ID` with `appId` from step 4.
-
-
-### Grant the necessary permissions
-
-Azure relies on a Role-Based Access Control (RBAC) model to manage the access to resources at a fine-grained
-level. There is a set of [pre-defined roles](https://docs.microsoft.com/azure/active-directory/role-based-access-built-in-roles)
-which can be assigned to a service principal of an Azure AD application depending of your needs.
-
-```
-az role assignment create --assigner "SERVICE_PRINCIPAL_ID" --role "ROLE_NAME"
-```
-
-* Replace the `SERVICE_PRINCIPAL_ID` with the `appId` from previous step.
-* Replace the `ROLE_NAME` with a role name of your choice.
-
-It is also possible to define custom role definitions.
-
-```
-az role definition create --role-definition role-definition.json
-```
-
-* Check [custom roles](https://docs.microsoft.com/azure/active-directory/role-based-access-control-custom-roles) for more details regarding the content of `role-definition.json` file.
-
-
-### Acquire Access Token
-
-The common configuration used by all flows:
-
-```Go
-const activeDirectoryEndpoint = "https://login.microsoftonline.com/"
-tenantID := "TENANT_ID"
-oauthConfig, err := adal.NewOAuthConfig(activeDirectoryEndpoint, tenantID)
-
-applicationID := "APPLICATION_ID"
-
-callback := func(token adal.Token) error {
-    // This is called after the token is acquired
-}
-
-// The resource for which the token is acquired
-resource := "https://management.core.windows.net/"
-```
-
-* Replace the `TENANT_ID` with your tenant ID.
-* Replace the `APPLICATION_ID` with the value from previous section.
-
-#### Client Credentials
-
-```Go
-applicationSecret := "APPLICATION_SECRET"
-
-spt, err := adal.NewServicePrincipalToken(
-	*oauthConfig,
-	appliationID,
-	applicationSecret,
-	resource,
-	callbacks...)
-if err != nil {
-	return nil, err
-}
-
-// Acquire a new access token
-err  = spt.Refresh()
-if (err == nil) {
-    token := spt.Token
-}
-```
-
-* Replace the `APPLICATION_SECRET` with the `password` value from previous section.
-
-#### Client Certificate
-
-```Go
-certificatePath := "./example-app.pfx"
-
-certData, err := ioutil.ReadFile(certificatePath)
-if err != nil {
-	return nil, fmt.Errorf("failed to read the certificate file (%s): %v", certificatePath, err)
-}
-
-// Get the certificate and private key from pfx file
-certificate, rsaPrivateKey, err := decodePkcs12(certData, "")
-if err != nil {
-	return nil, fmt.Errorf("failed to decode pkcs12 certificate while creating spt: %v", err)
-}
-
-spt, err := adal.NewServicePrincipalTokenFromCertificate(
-	*oauthConfig,
-	applicationID,
-	certificate,
-	rsaPrivateKey,
-	resource,
-	callbacks...)
-
-// Acquire a new access token
-err  = spt.Refresh()
-if (err == nil) {
-    token := spt.Token
-}
-```
-
-* Update the certificate path to point to the example-app.pfx file which was created in previous section.
-
-
-#### Device Code
-
-```Go
-oauthClient := &http.Client{}
-
-// Acquire the device code
-deviceCode, err := adal.InitiateDeviceAuth(
-	oauthClient,
-	*oauthConfig,
-	applicationID,
-	resource)
-if err != nil {
-	return nil, fmt.Errorf("Failed to start device auth flow: %s", err)
-}
-
-// Display the authentication message
-fmt.Println(*deviceCode.Message)
-
-// Wait here until the user is authenticated
-token, err := adal.WaitForUserCompletion(oauthClient, deviceCode)
-if err != nil {
-	return nil, fmt.Errorf("Failed to finish device auth flow: %s", err)
-}
-
-spt, err := adal.NewServicePrincipalTokenFromManualToken(
-	*oauthConfig,
-	applicationID,
-	resource,
-	*token,
-	callbacks...)
-
-if (err == nil) {
-    token := spt.Token
-}
-```
-
-#### Username password authenticate
-
-```Go
-spt, err := adal.NewServicePrincipalTokenFromUsernamePassword(
-	*oauthConfig,
-	applicationID,
-	username,
-	password,
-	resource,
-	callbacks...)
-
-if (err == nil) {
-    token := spt.Token
-}
-```
-
-#### Authorization code authenticate
-
-``` Go
-spt, err := adal.NewServicePrincipalTokenFromAuthorizationCode(
-	*oauthConfig,
-	applicationID,
-	clientSecret,
-        authorizationCode,
-        redirectURI,
-	resource,
-	callbacks...)
-
-err  = spt.Refresh()
-if (err == nil) {
-    token := spt.Token
-}
-```
-
-### Command Line Tool
-
-A command line tool is available in `cmd/adal.go` that can acquire a token for a given resource. It supports all flows mentioned above.
-
-```
-adal -h
-
-Usage of ./adal:
-  -applicationId string
-        application id
-  -certificatePath string
-        path to pk12/PFC application certificate
-  -mode string
-        authentication mode (device, secret, cert, refresh) (default "device")
-  -resource string
-        resource for which the token is requested
-  -secret string
-        application secret
-  -tenantId string
-        tenant id
-  -tokenCachePath string
-        location of oath token cache (default "/home/cgc/.adal/accessToken.json")
-```
-
-Example acquire a token for `https://management.core.windows.net/` using device code flow:
-
-```
-adal -mode device \
-    -applicationId "APPLICATION_ID" \
-    -tenantId "TENANT_ID" \
-    -resource https://management.core.windows.net/
-
-```

vendor/github.com/Azure/go-autorest/autorest/adal/config.go

@@ -1,151 +0,0 @@
-package adal
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"errors"
-	"fmt"
-	"net/url"
-)
-
-const (
-	activeDirectoryEndpointTemplate = "%s/oauth2/%s%s"
-)
-
-// OAuthConfig represents the endpoints needed
-// in OAuth operations
-type OAuthConfig struct {
-	AuthorityEndpoint  url.URL `json:"authorityEndpoint"`
-	AuthorizeEndpoint  url.URL `json:"authorizeEndpoint"`
-	TokenEndpoint      url.URL `json:"tokenEndpoint"`
-	DeviceCodeEndpoint url.URL `json:"deviceCodeEndpoint"`
-}
-
-// IsZero returns true if the OAuthConfig object is zero-initialized.
-func (oac OAuthConfig) IsZero() bool {
-	return oac == OAuthConfig{}
-}
-
-func validateStringParam(param, name string) error {
-	if len(param) == 0 {
-		return fmt.Errorf("parameter '" + name + "' cannot be empty")
-	}
-	return nil
-}
-
-// NewOAuthConfig returns an OAuthConfig with tenant specific urls
-func NewOAuthConfig(activeDirectoryEndpoint, tenantID string) (*OAuthConfig, error) {
-	apiVer := "1.0"
-	return NewOAuthConfigWithAPIVersion(activeDirectoryEndpoint, tenantID, &apiVer)
-}
-
-// NewOAuthConfigWithAPIVersion returns an OAuthConfig with tenant specific urls.
-// If apiVersion is not nil the "api-version" query parameter will be appended to the endpoint URLs with the specified value.
-func NewOAuthConfigWithAPIVersion(activeDirectoryEndpoint, tenantID string, apiVersion *string) (*OAuthConfig, error) {
-	if err := validateStringParam(activeDirectoryEndpoint, "activeDirectoryEndpoint"); err != nil {
-		return nil, err
-	}
-	api := ""
-	// it's legal for tenantID to be empty so don't validate it
-	if apiVersion != nil {
-		if err := validateStringParam(*apiVersion, "apiVersion"); err != nil {
-			return nil, err
-		}
-		api = fmt.Sprintf("?api-version=%s", *apiVersion)
-	}
-	u, err := url.Parse(activeDirectoryEndpoint)
-	if err != nil {
-		return nil, err
-	}
-	authorityURL, err := u.Parse(tenantID)
-	if err != nil {
-		return nil, err
-	}
-	authorizeURL, err := u.Parse(fmt.Sprintf(activeDirectoryEndpointTemplate, tenantID, "authorize", api))
-	if err != nil {
-		return nil, err
-	}
-	tokenURL, err := u.Parse(fmt.Sprintf(activeDirectoryEndpointTemplate, tenantID, "token", api))
-	if err != nil {
-		return nil, err
-	}
-	deviceCodeURL, err := u.Parse(fmt.Sprintf(activeDirectoryEndpointTemplate, tenantID, "devicecode", api))
-	if err != nil {
-		return nil, err
-	}
-
-	return &OAuthConfig{
-		AuthorityEndpoint:  *authorityURL,
-		AuthorizeEndpoint:  *authorizeURL,
-		TokenEndpoint:      *tokenURL,
-		DeviceCodeEndpoint: *deviceCodeURL,
-	}, nil
-}
-
-// MultiTenantOAuthConfig provides endpoints for primary and aulixiary tenant IDs.
-type MultiTenantOAuthConfig interface {
-	PrimaryTenant() *OAuthConfig
-	AuxiliaryTenants() []*OAuthConfig
-}
-
-// OAuthOptions contains optional OAuthConfig creation arguments.
-type OAuthOptions struct {
-	APIVersion string
-}
-
-func (c OAuthOptions) apiVersion() string {
-	if c.APIVersion != "" {
-		return fmt.Sprintf("?api-version=%s", c.APIVersion)
-	}
-	return "1.0"
-}
-
-// NewMultiTenantOAuthConfig creates an object that support multitenant OAuth configuration.
-// See https://docs.microsoft.com/en-us/azure/azure-resource-manager/authenticate-multi-tenant for more information.
-func NewMultiTenantOAuthConfig(activeDirectoryEndpoint, primaryTenantID string, auxiliaryTenantIDs []string, options OAuthOptions) (MultiTenantOAuthConfig, error) {
-	if len(auxiliaryTenantIDs) == 0 || len(auxiliaryTenantIDs) > 3 {
-		return nil, errors.New("must specify one to three auxiliary tenants")
-	}
-	mtCfg := multiTenantOAuthConfig{
-		cfgs: make([]*OAuthConfig, len(auxiliaryTenantIDs)+1),
-	}
-	apiVer := options.apiVersion()
-	pri, err := NewOAuthConfigWithAPIVersion(activeDirectoryEndpoint, primaryTenantID, &apiVer)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create OAuthConfig for primary tenant: %v", err)
-	}
-	mtCfg.cfgs[0] = pri
-	for i := range auxiliaryTenantIDs {
-		aux, err := NewOAuthConfig(activeDirectoryEndpoint, auxiliaryTenantIDs[i])
-		if err != nil {
-			return nil, fmt.Errorf("failed to create OAuthConfig for tenant '%s': %v", auxiliaryTenantIDs[i], err)
-		}
-		mtCfg.cfgs[i+1] = aux
-	}
-	return mtCfg, nil
-}
-
-type multiTenantOAuthConfig struct {
-	// first config in the slice is the primary tenant
-	cfgs []*OAuthConfig
-}
-
-func (m multiTenantOAuthConfig) PrimaryTenant() *OAuthConfig {
-	return m.cfgs[0]
-}
-
-func (m multiTenantOAuthConfig) AuxiliaryTenants() []*OAuthConfig {
-	return m.cfgs[1:]
-}

vendor/github.com/Azure/go-autorest/autorest/adal/devicetoken.go

@@ -1,273 +0,0 @@
-package adal
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-/*
-  This file is largely based on rjw57/oauth2device's code, with the follow differences:
-   * scope -> resource, and only allow a single one
-   * receive "Message" in the DeviceCode struct and show it to users as the prompt
-   * azure-xplat-cli has the following behavior that this emulates:
-     - does not send client_secret during the token exchange
-     - sends resource again in the token exchange request
-*/
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-)
-
-const (
-	logPrefix = "autorest/adal/devicetoken:"
-)
-
-var (
-	// ErrDeviceGeneric represents an unknown error from the token endpoint when using device flow
-	ErrDeviceGeneric = fmt.Errorf("%s Error while retrieving OAuth token: Unknown Error", logPrefix)
-
-	// ErrDeviceAccessDenied represents an access denied error from the token endpoint when using device flow
-	ErrDeviceAccessDenied = fmt.Errorf("%s Error while retrieving OAuth token: Access Denied", logPrefix)
-
-	// ErrDeviceAuthorizationPending represents the server waiting on the user to complete the device flow
-	ErrDeviceAuthorizationPending = fmt.Errorf("%s Error while retrieving OAuth token: Authorization Pending", logPrefix)
-
-	// ErrDeviceCodeExpired represents the server timing out and expiring the code during device flow
-	ErrDeviceCodeExpired = fmt.Errorf("%s Error while retrieving OAuth token: Code Expired", logPrefix)
-
-	// ErrDeviceSlowDown represents the service telling us we're polling too often during device flow
-	ErrDeviceSlowDown = fmt.Errorf("%s Error while retrieving OAuth token: Slow Down", logPrefix)
-
-	// ErrDeviceCodeEmpty represents an empty device code from the device endpoint while using device flow
-	ErrDeviceCodeEmpty = fmt.Errorf("%s Error while retrieving device code: Device Code Empty", logPrefix)
-
-	// ErrOAuthTokenEmpty represents an empty OAuth token from the token endpoint when using device flow
-	ErrOAuthTokenEmpty = fmt.Errorf("%s Error while retrieving OAuth token: Token Empty", logPrefix)
-
-	errCodeSendingFails   = "Error occurred while sending request for Device Authorization Code"
-	errCodeHandlingFails  = "Error occurred while handling response from the Device Endpoint"
-	errTokenSendingFails  = "Error occurred while sending request with device code for a token"
-	errTokenHandlingFails = "Error occurred while handling response from the Token Endpoint (during device flow)"
-	errStatusNotOK        = "Error HTTP status != 200"
-)
-
-// DeviceCode is the object returned by the device auth endpoint
-// It contains information to instruct the user to complete the auth flow
-type DeviceCode struct {
-	DeviceCode      *string `json:"device_code,omitempty"`
-	UserCode        *string `json:"user_code,omitempty"`
-	VerificationURL *string `json:"verification_url,omitempty"`
-	ExpiresIn       *int64  `json:"expires_in,string,omitempty"`
-	Interval        *int64  `json:"interval,string,omitempty"`
-
-	Message     *string `json:"message"` // Azure specific
-	Resource    string  // store the following, stored when initiating, used when exchanging
-	OAuthConfig OAuthConfig
-	ClientID    string
-}
-
-// TokenError is the object returned by the token exchange endpoint
-// when something is amiss
-type TokenError struct {
-	Error            *string `json:"error,omitempty"`
-	ErrorCodes       []int   `json:"error_codes,omitempty"`
-	ErrorDescription *string `json:"error_description,omitempty"`
-	Timestamp        *string `json:"timestamp,omitempty"`
-	TraceID          *string `json:"trace_id,omitempty"`
-}
-
-// DeviceToken is the object return by the token exchange endpoint
-// It can either look like a Token or an ErrorToken, so put both here
-// and check for presence of "Error" to know if we are in error state
-type deviceToken struct {
-	Token
-	TokenError
-}
-
-// InitiateDeviceAuth initiates a device auth flow. It returns a DeviceCode
-// that can be used with CheckForUserCompletion or WaitForUserCompletion.
-// Deprecated: use InitiateDeviceAuthWithContext() instead.
-func InitiateDeviceAuth(sender Sender, oauthConfig OAuthConfig, clientID, resource string) (*DeviceCode, error) {
-	return InitiateDeviceAuthWithContext(context.Background(), sender, oauthConfig, clientID, resource)
-}
-
-// InitiateDeviceAuthWithContext initiates a device auth flow. It returns a DeviceCode
-// that can be used with CheckForUserCompletion or WaitForUserCompletion.
-func InitiateDeviceAuthWithContext(ctx context.Context, sender Sender, oauthConfig OAuthConfig, clientID, resource string) (*DeviceCode, error) {
-	v := url.Values{
-		"client_id": []string{clientID},
-		"resource":  []string{resource},
-	}
-
-	s := v.Encode()
-	body := ioutil.NopCloser(strings.NewReader(s))
-
-	req, err := http.NewRequest(http.MethodPost, oauthConfig.DeviceCodeEndpoint.String(), body)
-	if err != nil {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errCodeSendingFails, err.Error())
-	}
-
-	req.ContentLength = int64(len(s))
-	req.Header.Set(contentType, mimeTypeFormPost)
-	resp, err := sender.Do(req.WithContext(ctx))
-	if err != nil {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errCodeSendingFails, err.Error())
-	}
-	defer resp.Body.Close()
-
-	rb, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errCodeHandlingFails, err.Error())
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errCodeHandlingFails, errStatusNotOK)
-	}
-
-	if len(strings.Trim(string(rb), " ")) == 0 {
-		return nil, ErrDeviceCodeEmpty
-	}
-
-	var code DeviceCode
-	err = json.Unmarshal(rb, &code)
-	if err != nil {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errCodeHandlingFails, err.Error())
-	}
-
-	code.ClientID = clientID
-	code.Resource = resource
-	code.OAuthConfig = oauthConfig
-
-	return &code, nil
-}
-
-// CheckForUserCompletion takes a DeviceCode and checks with the Azure AD OAuth endpoint
-// to see if the device flow has: been completed, timed out, or otherwise failed
-// Deprecated: use CheckForUserCompletionWithContext() instead.
-func CheckForUserCompletion(sender Sender, code *DeviceCode) (*Token, error) {
-	return CheckForUserCompletionWithContext(context.Background(), sender, code)
-}
-
-// CheckForUserCompletionWithContext takes a DeviceCode and checks with the Azure AD OAuth endpoint
-// to see if the device flow has: been completed, timed out, or otherwise failed
-func CheckForUserCompletionWithContext(ctx context.Context, sender Sender, code *DeviceCode) (*Token, error) {
-	v := url.Values{
-		"client_id":  []string{code.ClientID},
-		"code":       []string{*code.DeviceCode},
-		"grant_type": []string{OAuthGrantTypeDeviceCode},
-		"resource":   []string{code.Resource},
-	}
-
-	s := v.Encode()
-	body := ioutil.NopCloser(strings.NewReader(s))
-
-	req, err := http.NewRequest(http.MethodPost, code.OAuthConfig.TokenEndpoint.String(), body)
-	if err != nil {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errTokenSendingFails, err.Error())
-	}
-
-	req.ContentLength = int64(len(s))
-	req.Header.Set(contentType, mimeTypeFormPost)
-	resp, err := sender.Do(req.WithContext(ctx))
-	if err != nil {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errTokenSendingFails, err.Error())
-	}
-	defer resp.Body.Close()
-
-	rb, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errTokenHandlingFails, err.Error())
-	}
-
-	if resp.StatusCode != http.StatusOK && len(strings.Trim(string(rb), " ")) == 0 {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errTokenHandlingFails, errStatusNotOK)
-	}
-	if len(strings.Trim(string(rb), " ")) == 0 {
-		return nil, ErrOAuthTokenEmpty
-	}
-
-	var token deviceToken
-	err = json.Unmarshal(rb, &token)
-	if err != nil {
-		return nil, fmt.Errorf("%s %s: %s", logPrefix, errTokenHandlingFails, err.Error())
-	}
-
-	if token.Error == nil {
-		return &token.Token, nil
-	}
-
-	switch *token.Error {
-	case "authorization_pending":
-		return nil, ErrDeviceAuthorizationPending
-	case "slow_down":
-		return nil, ErrDeviceSlowDown
-	case "access_denied":
-		return nil, ErrDeviceAccessDenied
-	case "code_expired":
-		return nil, ErrDeviceCodeExpired
-	default:
-		// return a more meaningful error message if available
-		if token.ErrorDescription != nil {
-			return nil, fmt.Errorf("%s %s: %s", logPrefix, *token.Error, *token.ErrorDescription)
-		}
-		return nil, ErrDeviceGeneric
-	}
-}
-
-// WaitForUserCompletion calls CheckForUserCompletion repeatedly until a token is granted or an error state occurs.
-// This prevents the user from looping and checking against 'ErrDeviceAuthorizationPending'.
-// Deprecated: use WaitForUserCompletionWithContext() instead.
-func WaitForUserCompletion(sender Sender, code *DeviceCode) (*Token, error) {
-	return WaitForUserCompletionWithContext(context.Background(), sender, code)
-}
-
-// WaitForUserCompletionWithContext calls CheckForUserCompletion repeatedly until a token is granted or an error
-// state occurs.  This prevents the user from looping and checking against 'ErrDeviceAuthorizationPending'.
-func WaitForUserCompletionWithContext(ctx context.Context, sender Sender, code *DeviceCode) (*Token, error) {
-	intervalDuration := time.Duration(*code.Interval) * time.Second
-	waitDuration := intervalDuration
-
-	for {
-		token, err := CheckForUserCompletionWithContext(ctx, sender, code)
-
-		if err == nil {
-			return token, nil
-		}
-
-		switch err {
-		case ErrDeviceSlowDown:
-			waitDuration += waitDuration
-		case ErrDeviceAuthorizationPending:
-			// noop
-		default: // everything else is "fatal" to us
-			return nil, err
-		}
-
-		if waitDuration > (intervalDuration * 3) {
-			return nil, fmt.Errorf("%s Error waiting for user to complete device flow. Server told us to slow_down too much", logPrefix)
-		}
-
-		select {
-		case <-time.After(waitDuration):
-			// noop
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		}
-	}
-}

vendor/github.com/Azure/go-autorest/autorest/adal/go_mod_tidy_hack.go

@@ -1,25 +0,0 @@
-//go:build modhack
-// +build modhack
-
-package adal
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-// This file, and the github.com/Azure/go-autorest import, won't actually become part of
-// the resultant binary.
-
-// Necessary for safely adding multi-module repo.
-// See: https://github.com/golang/go/wiki/Modules#is-it-possible-to-add-a-module-to-a-multi-module-repository
-import _ "github.com/Azure/go-autorest"

vendor/github.com/Azure/go-autorest/autorest/adal/persist.go

@@ -1,135 +0,0 @@
-package adal
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"golang.org/x/crypto/pkcs12"
-)
-
-var (
-	// ErrMissingCertificate is returned when no local certificate is found in the provided PFX data.
-	ErrMissingCertificate = errors.New("adal: certificate missing")
-
-	// ErrMissingPrivateKey is returned when no private key is found in the provided PFX data.
-	ErrMissingPrivateKey = errors.New("adal: private key missing")
-)
-
-// LoadToken restores a Token object from a file located at 'path'.
-func LoadToken(path string) (*Token, error) {
-	file, err := os.Open(path)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open file (%s) while loading token: %v", path, err)
-	}
-	defer file.Close()
-
-	var token Token
-
-	dec := json.NewDecoder(file)
-	if err = dec.Decode(&token); err != nil {
-		return nil, fmt.Errorf("failed to decode contents of file (%s) into Token representation: %v", path, err)
-	}
-	return &token, nil
-}
-
-// SaveToken persists an oauth token at the given location on disk.
-// It moves the new file into place so it can safely be used to replace an existing file
-// that maybe accessed by multiple processes.
-func SaveToken(path string, mode os.FileMode, token Token) error {
-	dir := filepath.Dir(path)
-	err := os.MkdirAll(dir, os.ModePerm)
-	if err != nil {
-		return fmt.Errorf("failed to create directory (%s) to store token in: %v", dir, err)
-	}
-
-	newFile, err := ioutil.TempFile(dir, "token")
-	if err != nil {
-		return fmt.Errorf("failed to create the temp file to write the token: %v", err)
-	}
-	tempPath := newFile.Name()
-
-	if err := json.NewEncoder(newFile).Encode(token); err != nil {
-		return fmt.Errorf("failed to encode token to file (%s) while saving token: %v", tempPath, err)
-	}
-	if err := newFile.Close(); err != nil {
-		return fmt.Errorf("failed to close temp file %s: %v", tempPath, err)
-	}
-
-	// Atomic replace to avoid multi-writer file corruptions
-	if err := os.Rename(tempPath, path); err != nil {
-		return fmt.Errorf("failed to move temporary token to desired output location. src=%s dst=%s: %v", tempPath, path, err)
-	}
-	if err := os.Chmod(path, mode); err != nil {
-		return fmt.Errorf("failed to chmod the token file %s: %v", path, err)
-	}
-	return nil
-}
-
-// DecodePfxCertificateData extracts the x509 certificate and RSA private key from the provided PFX data.
-// The PFX data must contain a private key along with a certificate whose public key matches that of the
-// private key or an error is returned.
-// If the private key is not password protected pass the empty string for password.
-func DecodePfxCertificateData(pfxData []byte, password string) (*x509.Certificate, *rsa.PrivateKey, error) {
-	blocks, err := pkcs12.ToPEM(pfxData, password)
-	if err != nil {
-		return nil, nil, err
-	}
-	// first extract the private key
-	var priv *rsa.PrivateKey
-	for _, block := range blocks {
-		if block.Type == "PRIVATE KEY" {
-			priv, err = x509.ParsePKCS1PrivateKey(block.Bytes)
-			if err != nil {
-				return nil, nil, err
-			}
-			break
-		}
-	}
-	if priv == nil {
-		return nil, nil, ErrMissingPrivateKey
-	}
-	// now find the certificate with the matching public key of our private key
-	var cert *x509.Certificate
-	for _, block := range blocks {
-		if block.Type == "CERTIFICATE" {
-			pcert, err := x509.ParseCertificate(block.Bytes)
-			if err != nil {
-				return nil, nil, err
-			}
-			certKey, ok := pcert.PublicKey.(*rsa.PublicKey)
-			if !ok {
-				// keep looking
-				continue
-			}
-			if priv.E == certKey.E && priv.N.Cmp(certKey.N) == 0 {
-				// found a match
-				cert = pcert
-				break
-			}
-		}
-	}
-	if cert == nil {
-		return nil, nil, ErrMissingCertificate
-	}
-	return cert, priv, nil
-}

vendor/github.com/Azure/go-autorest/autorest/adal/sender.go

@@ -1,101 +0,0 @@
-package adal
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"crypto/tls"
-	"net"
-	"net/http"
-	"net/http/cookiejar"
-	"sync"
-	"time"
-
-	"github.com/Azure/go-autorest/tracing"
-)
-
-const (
-	contentType      = "Content-Type"
-	mimeTypeFormPost = "application/x-www-form-urlencoded"
-)
-
-// DO NOT ACCESS THIS DIRECTLY.  go through sender()
-var defaultSender Sender
-var defaultSenderInit = &sync.Once{}
-
-// Sender is the interface that wraps the Do method to send HTTP requests.
-//
-// The standard http.Client conforms to this interface.
-type Sender interface {
-	Do(*http.Request) (*http.Response, error)
-}
-
-// SenderFunc is a method that implements the Sender interface.
-type SenderFunc func(*http.Request) (*http.Response, error)
-
-// Do implements the Sender interface on SenderFunc.
-func (sf SenderFunc) Do(r *http.Request) (*http.Response, error) {
-	return sf(r)
-}
-
-// SendDecorator takes and possibly decorates, by wrapping, a Sender. Decorators may affect the
-// http.Request and pass it along or, first, pass the http.Request along then react to the
-// http.Response result.
-type SendDecorator func(Sender) Sender
-
-// CreateSender creates, decorates, and returns, as a Sender, the default http.Client.
-func CreateSender(decorators ...SendDecorator) Sender {
-	return DecorateSender(sender(), decorators...)
-}
-
-// DecorateSender accepts a Sender and a, possibly empty, set of SendDecorators, which is applies to
-// the Sender. Decorators are applied in the order received, but their affect upon the request
-// depends on whether they are a pre-decorator (change the http.Request and then pass it along) or a
-// post-decorator (pass the http.Request along and react to the results in http.Response).
-func DecorateSender(s Sender, decorators ...SendDecorator) Sender {
-	for _, decorate := range decorators {
-		s = decorate(s)
-	}
-	return s
-}
-
-func sender() Sender {
-	// note that we can't init defaultSender in init() since it will
-	// execute before calling code has had a chance to enable tracing
-	defaultSenderInit.Do(func() {
-		// copied from http.DefaultTransport with a TLS minimum version.
-		transport := &http.Transport{
-			Proxy: http.ProxyFromEnvironment,
-			DialContext: (&net.Dialer{
-				Timeout:   30 * time.Second,
-				KeepAlive: 30 * time.Second,
-			}).DialContext,
-			ForceAttemptHTTP2:     true,
-			MaxIdleConns:          100,
-			IdleConnTimeout:       90 * time.Second,
-			TLSHandshakeTimeout:   10 * time.Second,
-			ExpectContinueTimeout: 1 * time.Second,
-			TLSClientConfig: &tls.Config{
-				MinVersion: tls.VersionTLS12,
-			},
-		}
-		var roundTripper http.RoundTripper = transport
-		if tracing.IsEnabled() {
-			roundTripper = tracing.NewTransport(transport)
-		}
-		j, _ := cookiejar.New(nil)
-		defaultSender = &http.Client{Jar: j, Transport: roundTripper}
-	})
-	return defaultSender
-}

vendor/github.com/Azure/go-autorest/autorest/adal/token_1.13.go

@@ -1,76 +0,0 @@
-//go:build go1.13
-// +build go1.13
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-package adal
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"time"
-)
-
-func getMSIEndpoint(ctx context.Context, sender Sender) (*http.Response, error) {
-	tempCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
-	defer cancel()
-	// http.NewRequestWithContext() was added in Go 1.13
-	req, _ := http.NewRequestWithContext(tempCtx, http.MethodGet, msiEndpoint, nil)
-	q := req.URL.Query()
-	q.Add("api-version", msiAPIVersion)
-	req.URL.RawQuery = q.Encode()
-	return sender.Do(req)
-}
-
-// EnsureFreshWithContext will refresh the token if it will expire within the refresh window (as set by
-// RefreshWithin) and autoRefresh flag is on.  This method is safe for concurrent use.
-func (mt *MultiTenantServicePrincipalToken) EnsureFreshWithContext(ctx context.Context) error {
-	if err := mt.PrimaryToken.EnsureFreshWithContext(ctx); err != nil {
-		return fmt.Errorf("failed to refresh primary token: %w", err)
-	}
-	for _, aux := range mt.AuxiliaryTokens {
-		if err := aux.EnsureFreshWithContext(ctx); err != nil {
-			return fmt.Errorf("failed to refresh auxiliary token: %w", err)
-		}
-	}
-	return nil
-}
-
-// RefreshWithContext obtains a fresh token for the Service Principal.
-func (mt *MultiTenantServicePrincipalToken) RefreshWithContext(ctx context.Context) error {
-	if err := mt.PrimaryToken.RefreshWithContext(ctx); err != nil {
-		return fmt.Errorf("failed to refresh primary token: %w", err)
-	}
-	for _, aux := range mt.AuxiliaryTokens {
-		if err := aux.RefreshWithContext(ctx); err != nil {
-			return fmt.Errorf("failed to refresh auxiliary token: %w", err)
-		}
-	}
-	return nil
-}
-
-// RefreshExchangeWithContext refreshes the token, but for a different resource.
-func (mt *MultiTenantServicePrincipalToken) RefreshExchangeWithContext(ctx context.Context, resource string) error {
-	if err := mt.PrimaryToken.RefreshExchangeWithContext(ctx, resource); err != nil {
-		return fmt.Errorf("failed to refresh primary token: %w", err)
-	}
-	for _, aux := range mt.AuxiliaryTokens {
-		if err := aux.RefreshExchangeWithContext(ctx, resource); err != nil {
-			return fmt.Errorf("failed to refresh auxiliary token: %w", err)
-		}
-	}
-	return nil
-}

vendor/github.com/Azure/go-autorest/autorest/adal/token_legacy.go

@@ -1,75 +0,0 @@
-//go:build !go1.13
-// +build !go1.13
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-package adal
-
-import (
-	"context"
-	"net/http"
-	"time"
-)
-
-func getMSIEndpoint(ctx context.Context, sender Sender) (*http.Response, error) {
-	tempCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
-	defer cancel()
-	req, _ := http.NewRequest(http.MethodGet, msiEndpoint, nil)
-	req = req.WithContext(tempCtx)
-	q := req.URL.Query()
-	q.Add("api-version", msiAPIVersion)
-	req.URL.RawQuery = q.Encode()
-	return sender.Do(req)
-}
-
-// EnsureFreshWithContext will refresh the token if it will expire within the refresh window (as set by
-// RefreshWithin) and autoRefresh flag is on.  This method is safe for concurrent use.
-func (mt *MultiTenantServicePrincipalToken) EnsureFreshWithContext(ctx context.Context) error {
-	if err := mt.PrimaryToken.EnsureFreshWithContext(ctx); err != nil {
-		return err
-	}
-	for _, aux := range mt.AuxiliaryTokens {
-		if err := aux.EnsureFreshWithContext(ctx); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// RefreshWithContext obtains a fresh token for the Service Principal.
-func (mt *MultiTenantServicePrincipalToken) RefreshWithContext(ctx context.Context) error {
-	if err := mt.PrimaryToken.RefreshWithContext(ctx); err != nil {
-		return err
-	}
-	for _, aux := range mt.AuxiliaryTokens {
-		if err := aux.RefreshWithContext(ctx); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// RefreshExchangeWithContext refreshes the token, but for a different resource.
-func (mt *MultiTenantServicePrincipalToken) RefreshExchangeWithContext(ctx context.Context, resource string) error {
-	if err := mt.PrimaryToken.RefreshExchangeWithContext(ctx, resource); err != nil {
-		return err
-	}
-	for _, aux := range mt.AuxiliaryTokens {
-		if err := aux.RefreshExchangeWithContext(ctx, resource); err != nil {
-			return err
-		}
-	}
-	return nil
-}

vendor/github.com/Azure/go-autorest/autorest/adal/version.go

@@ -1,45 +0,0 @@
-package adal
-
-import (
-	"fmt"
-	"runtime"
-)
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-const number = "v1.0.0"
-
-var (
-	ua = fmt.Sprintf("Go/%s (%s-%s) go-autorest/adal/%s",
-		runtime.Version(),
-		runtime.GOARCH,
-		runtime.GOOS,
-		number,
-	)
-)
-
-// UserAgent returns a string containing the Go version, system architecture and OS, and the adal version.
-func UserAgent() string {
-	return ua
-}
-
-// AddToUserAgent adds an extension to the current user agent
-func AddToUserAgent(extension string) error {
-	if extension != "" {
-		ua = fmt.Sprintf("%s %s", ua, extension)
-		return nil
-	}
-	return fmt.Errorf("Extension was empty, User Agent remained as '%s'", ua)
-}

vendor/github.com/Azure/go-autorest/autorest/authorization.go

@@ -1,353 +0,0 @@
-package autorest
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"crypto/tls"
-	"encoding/base64"
-	"fmt"
-	"net/http"
-	"net/url"
-	"strings"
-
-	"github.com/Azure/go-autorest/autorest/adal"
-)
-
-const (
-	bearerChallengeHeader       = "Www-Authenticate"
-	bearer                      = "Bearer"
-	tenantID                    = "tenantID"
-	apiKeyAuthorizerHeader      = "Ocp-Apim-Subscription-Key"
-	bingAPISdkHeader            = "X-BingApis-SDK-Client"
-	golangBingAPISdkHeaderValue = "Go-SDK"
-	authorization               = "Authorization"
-	basic                       = "Basic"
-)
-
-// Authorizer is the interface that provides a PrepareDecorator used to supply request
-// authorization. Most often, the Authorizer decorator runs last so it has access to the full
-// state of the formed HTTP request.
-type Authorizer interface {
-	WithAuthorization() PrepareDecorator
-}
-
-// NullAuthorizer implements a default, "do nothing" Authorizer.
-type NullAuthorizer struct{}
-
-// WithAuthorization returns a PrepareDecorator that does nothing.
-func (na NullAuthorizer) WithAuthorization() PrepareDecorator {
-	return WithNothing()
-}
-
-// APIKeyAuthorizer implements API Key authorization.
-type APIKeyAuthorizer struct {
-	headers         map[string]interface{}
-	queryParameters map[string]interface{}
-}
-
-// NewAPIKeyAuthorizerWithHeaders creates an ApiKeyAuthorizer with headers.
-func NewAPIKeyAuthorizerWithHeaders(headers map[string]interface{}) *APIKeyAuthorizer {
-	return NewAPIKeyAuthorizer(headers, nil)
-}
-
-// NewAPIKeyAuthorizerWithQueryParameters creates an ApiKeyAuthorizer with query parameters.
-func NewAPIKeyAuthorizerWithQueryParameters(queryParameters map[string]interface{}) *APIKeyAuthorizer {
-	return NewAPIKeyAuthorizer(nil, queryParameters)
-}
-
-// NewAPIKeyAuthorizer creates an ApiKeyAuthorizer with headers.
-func NewAPIKeyAuthorizer(headers map[string]interface{}, queryParameters map[string]interface{}) *APIKeyAuthorizer {
-	return &APIKeyAuthorizer{headers: headers, queryParameters: queryParameters}
-}
-
-// WithAuthorization returns a PrepareDecorator that adds an HTTP headers and Query Parameters.
-func (aka *APIKeyAuthorizer) WithAuthorization() PrepareDecorator {
-	return func(p Preparer) Preparer {
-		return DecoratePreparer(p, WithHeaders(aka.headers), WithQueryParameters(aka.queryParameters))
-	}
-}
-
-// CognitiveServicesAuthorizer implements authorization for Cognitive Services.
-type CognitiveServicesAuthorizer struct {
-	subscriptionKey string
-}
-
-// NewCognitiveServicesAuthorizer is
-func NewCognitiveServicesAuthorizer(subscriptionKey string) *CognitiveServicesAuthorizer {
-	return &CognitiveServicesAuthorizer{subscriptionKey: subscriptionKey}
-}
-
-// WithAuthorization is
-func (csa *CognitiveServicesAuthorizer) WithAuthorization() PrepareDecorator {
-	headers := make(map[string]interface{})
-	headers[apiKeyAuthorizerHeader] = csa.subscriptionKey
-	headers[bingAPISdkHeader] = golangBingAPISdkHeaderValue
-
-	return NewAPIKeyAuthorizerWithHeaders(headers).WithAuthorization()
-}
-
-// BearerAuthorizer implements the bearer authorization
-type BearerAuthorizer struct {
-	tokenProvider adal.OAuthTokenProvider
-}
-
-// NewBearerAuthorizer crates a BearerAuthorizer using the given token provider
-func NewBearerAuthorizer(tp adal.OAuthTokenProvider) *BearerAuthorizer {
-	return &BearerAuthorizer{tokenProvider: tp}
-}
-
-// WithAuthorization returns a PrepareDecorator that adds an HTTP Authorization header whose
-// value is "Bearer " followed by the token.
-//
-// By default, the token will be automatically refreshed through the Refresher interface.
-func (ba *BearerAuthorizer) WithAuthorization() PrepareDecorator {
-	return func(p Preparer) Preparer {
-		return PreparerFunc(func(r *http.Request) (*http.Request, error) {
-			r, err := p.Prepare(r)
-			if err == nil {
-				// the ordering is important here, prefer RefresherWithContext if available
-				if refresher, ok := ba.tokenProvider.(adal.RefresherWithContext); ok {
-					err = refresher.EnsureFreshWithContext(r.Context())
-				} else if refresher, ok := ba.tokenProvider.(adal.Refresher); ok {
-					err = refresher.EnsureFresh()
-				}
-				if err != nil {
-					var resp *http.Response
-					if tokError, ok := err.(adal.TokenRefreshError); ok {
-						resp = tokError.Response()
-					}
-					return r, NewErrorWithError(err, "azure.BearerAuthorizer", "WithAuthorization", resp,
-						"Failed to refresh the Token for request to %s", r.URL)
-				}
-				return Prepare(r, WithHeader(headerAuthorization, fmt.Sprintf("Bearer %s", ba.tokenProvider.OAuthToken())))
-			}
-			return r, err
-		})
-	}
-}
-
-// TokenProvider returns OAuthTokenProvider so that it can be used for authorization outside the REST.
-func (ba *BearerAuthorizer) TokenProvider() adal.OAuthTokenProvider {
-	return ba.tokenProvider
-}
-
-// BearerAuthorizerCallbackFunc is the authentication callback signature.
-type BearerAuthorizerCallbackFunc func(tenantID, resource string) (*BearerAuthorizer, error)
-
-// BearerAuthorizerCallback implements bearer authorization via a callback.
-type BearerAuthorizerCallback struct {
-	sender   Sender
-	callback BearerAuthorizerCallbackFunc
-}
-
-// NewBearerAuthorizerCallback creates a bearer authorization callback.  The callback
-// is invoked when the HTTP request is submitted.
-func NewBearerAuthorizerCallback(s Sender, callback BearerAuthorizerCallbackFunc) *BearerAuthorizerCallback {
-	if s == nil {
-		s = sender(tls.RenegotiateNever)
-	}
-	return &BearerAuthorizerCallback{sender: s, callback: callback}
-}
-
-// WithAuthorization returns a PrepareDecorator that adds an HTTP Authorization header whose value
-// is "Bearer " followed by the token.  The BearerAuthorizer is obtained via a user-supplied callback.
-//
-// By default, the token will be automatically refreshed through the Refresher interface.
-func (bacb *BearerAuthorizerCallback) WithAuthorization() PrepareDecorator {
-	return func(p Preparer) Preparer {
-		return PreparerFunc(func(r *http.Request) (*http.Request, error) {
-			r, err := p.Prepare(r)
-			if err == nil {
-				// make a copy of the request and remove the body as it's not
-				// required and avoids us having to create a copy of it.
-				rCopy := *r
-				removeRequestBody(&rCopy)
-
-				resp, err := bacb.sender.Do(&rCopy)
-				if err != nil {
-					return r, err
-				}
-				DrainResponseBody(resp)
-				if resp.StatusCode == 401 && hasBearerChallenge(resp.Header) {
-					bc, err := newBearerChallenge(resp.Header)
-					if err != nil {
-						return r, err
-					}
-					if bacb.callback != nil {
-						ba, err := bacb.callback(bc.values[tenantID], bc.values["resource"])
-						if err != nil {
-							return r, err
-						}
-						return Prepare(r, ba.WithAuthorization())
-					}
-				}
-			}
-			return r, err
-		})
-	}
-}
-
-// returns true if the HTTP response contains a bearer challenge
-func hasBearerChallenge(header http.Header) bool {
-	authHeader := header.Get(bearerChallengeHeader)
-	if len(authHeader) == 0 || strings.Index(authHeader, bearer) < 0 {
-		return false
-	}
-	return true
-}
-
-type bearerChallenge struct {
-	values map[string]string
-}
-
-func newBearerChallenge(header http.Header) (bc bearerChallenge, err error) {
-	challenge := strings.TrimSpace(header.Get(bearerChallengeHeader))
-	trimmedChallenge := challenge[len(bearer)+1:]
-
-	// challenge is a set of key=value pairs that are comma delimited
-	pairs := strings.Split(trimmedChallenge, ",")
-	if len(pairs) < 1 {
-		err = fmt.Errorf("challenge '%s' contains no pairs", challenge)
-		return bc, err
-	}
-
-	bc.values = make(map[string]string)
-	for i := range pairs {
-		trimmedPair := strings.TrimSpace(pairs[i])
-		pair := strings.Split(trimmedPair, "=")
-		if len(pair) == 2 {
-			// remove the enclosing quotes
-			key := strings.Trim(pair[0], "\"")
-			value := strings.Trim(pair[1], "\"")
-
-			switch key {
-			case "authorization", "authorization_uri":
-				// strip the tenant ID from the authorization URL
-				asURL, err := url.Parse(value)
-				if err != nil {
-					return bc, err
-				}
-				bc.values[tenantID] = asURL.Path[1:]
-			default:
-				bc.values[key] = value
-			}
-		}
-	}
-
-	return bc, err
-}
-
-// EventGridKeyAuthorizer implements authorization for event grid using key authentication.
-type EventGridKeyAuthorizer struct {
-	topicKey string
-}
-
-// NewEventGridKeyAuthorizer creates a new EventGridKeyAuthorizer
-// with the specified topic key.
-func NewEventGridKeyAuthorizer(topicKey string) EventGridKeyAuthorizer {
-	return EventGridKeyAuthorizer{topicKey: topicKey}
-}
-
-// WithAuthorization returns a PrepareDecorator that adds the aeg-sas-key authentication header.
-func (egta EventGridKeyAuthorizer) WithAuthorization() PrepareDecorator {
-	headers := map[string]interface{}{
-		"aeg-sas-key": egta.topicKey,
-	}
-	return NewAPIKeyAuthorizerWithHeaders(headers).WithAuthorization()
-}
-
-// BasicAuthorizer implements basic HTTP authorization by adding the Authorization HTTP header
-// with the value "Basic <TOKEN>" where <TOKEN> is a base64-encoded username:password tuple.
-type BasicAuthorizer struct {
-	userName string
-	password string
-}
-
-// NewBasicAuthorizer creates a new BasicAuthorizer with the specified username and password.
-func NewBasicAuthorizer(userName, password string) *BasicAuthorizer {
-	return &BasicAuthorizer{
-		userName: userName,
-		password: password,
-	}
-}
-
-// WithAuthorization returns a PrepareDecorator that adds an HTTP Authorization header whose
-// value is "Basic " followed by the base64-encoded username:password tuple.
-func (ba *BasicAuthorizer) WithAuthorization() PrepareDecorator {
-	headers := make(map[string]interface{})
-	headers[authorization] = basic + " " + base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", ba.userName, ba.password)))
-
-	return NewAPIKeyAuthorizerWithHeaders(headers).WithAuthorization()
-}
-
-// MultiTenantServicePrincipalTokenAuthorizer provides authentication across tenants.
-type MultiTenantServicePrincipalTokenAuthorizer interface {
-	WithAuthorization() PrepareDecorator
-}
-
-// NewMultiTenantServicePrincipalTokenAuthorizer crates a BearerAuthorizer using the given token provider
-func NewMultiTenantServicePrincipalTokenAuthorizer(tp adal.MultitenantOAuthTokenProvider) MultiTenantServicePrincipalTokenAuthorizer {
-	return NewMultiTenantBearerAuthorizer(tp)
-}
-
-// MultiTenantBearerAuthorizer implements bearer authorization across multiple tenants.
-type MultiTenantBearerAuthorizer struct {
-	tp adal.MultitenantOAuthTokenProvider
-}
-
-// NewMultiTenantBearerAuthorizer creates a MultiTenantBearerAuthorizer using the given token provider.
-func NewMultiTenantBearerAuthorizer(tp adal.MultitenantOAuthTokenProvider) *MultiTenantBearerAuthorizer {
-	return &MultiTenantBearerAuthorizer{tp: tp}
-}
-
-// WithAuthorization returns a PrepareDecorator that adds an HTTP Authorization header using the
-// primary token along with the auxiliary authorization header using the auxiliary tokens.
-//
-// By default, the token will be automatically refreshed through the Refresher interface.
-func (mt *MultiTenantBearerAuthorizer) WithAuthorization() PrepareDecorator {
-	return func(p Preparer) Preparer {
-		return PreparerFunc(func(r *http.Request) (*http.Request, error) {
-			r, err := p.Prepare(r)
-			if err != nil {
-				return r, err
-			}
-			if refresher, ok := mt.tp.(adal.RefresherWithContext); ok {
-				err = refresher.EnsureFreshWithContext(r.Context())
-				if err != nil {
-					var resp *http.Response
-					if tokError, ok := err.(adal.TokenRefreshError); ok {
-						resp = tokError.Response()
-					}
-					return r, NewErrorWithError(err, "azure.multiTenantSPTAuthorizer", "WithAuthorization", resp,
-						"Failed to refresh one or more Tokens for request to %s", r.URL)
-				}
-			}
-			r, err = Prepare(r, WithHeader(headerAuthorization, fmt.Sprintf("Bearer %s", mt.tp.PrimaryOAuthToken())))
-			if err != nil {
-				return r, err
-			}
-			auxTokens := mt.tp.AuxiliaryOAuthTokens()
-			for i := range auxTokens {
-				auxTokens[i] = fmt.Sprintf("Bearer %s", auxTokens[i])
-			}
-			return Prepare(r, WithHeader(headerAuxAuthorization, strings.Join(auxTokens, ", ")))
-		})
-	}
-}
-
-// TokenProvider returns the underlying MultitenantOAuthTokenProvider for this authorizer.
-func (mt *MultiTenantBearerAuthorizer) TokenProvider() adal.MultitenantOAuthTokenProvider {
-	return mt.tp
-}

vendor/github.com/Azure/go-autorest/autorest/authorization_sas.go

@@ -1,66 +0,0 @@
-package autorest
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"fmt"
-	"net/http"
-	"strings"
-)
-
-// SASTokenAuthorizer implements an authorization for SAS Token Authentication
-// this can be used for interaction with Blob Storage Endpoints
-type SASTokenAuthorizer struct {
-	sasToken string
-}
-
-// NewSASTokenAuthorizer creates a SASTokenAuthorizer using the given credentials
-func NewSASTokenAuthorizer(sasToken string) (*SASTokenAuthorizer, error) {
-	if strings.TrimSpace(sasToken) == "" {
-		return nil, fmt.Errorf("sasToken cannot be empty")
-	}
-
-	token := sasToken
-	if strings.HasPrefix(sasToken, "?") {
-		token = strings.TrimPrefix(sasToken, "?")
-	}
-
-	return &SASTokenAuthorizer{
-		sasToken: token,
-	}, nil
-}
-
-// WithAuthorization returns a PrepareDecorator that adds a shared access signature token to the
-// URI's query parameters.  This can be used for the Blob, Queue, and File Services.
-//
-// See https://docs.microsoft.com/en-us/rest/api/storageservices/delegate-access-with-shared-access-signature
-func (sas *SASTokenAuthorizer) WithAuthorization() PrepareDecorator {
-	return func(p Preparer) Preparer {
-		return PreparerFunc(func(r *http.Request) (*http.Request, error) {
-			r, err := p.Prepare(r)
-			if err != nil {
-				return r, err
-			}
-
-			if r.URL.RawQuery == "" {
-				r.URL.RawQuery = sas.sasToken
-			} else if !strings.Contains(r.URL.RawQuery, sas.sasToken) {
-				r.URL.RawQuery = fmt.Sprintf("%s&%s", r.URL.RawQuery, sas.sasToken)
-			}
-
-			return Prepare(r)
-		})
-	}
-}

vendor/github.com/Azure/go-autorest/autorest/authorization_storage.go

@@ -1,307 +0,0 @@
-package autorest
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"bytes"
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"fmt"
-	"net/http"
-	"net/url"
-	"sort"
-	"strings"
-	"time"
-)
-
-// SharedKeyType defines the enumeration for the various shared key types.
-// See https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key for details on the shared key types.
-type SharedKeyType string
-
-const (
-	// SharedKey is used to authorize against blobs, files and queues services.
-	SharedKey SharedKeyType = "sharedKey"
-
-	// SharedKeyForTable is used to authorize against the table service.
-	SharedKeyForTable SharedKeyType = "sharedKeyTable"
-
-	// SharedKeyLite is used to authorize against blobs, files and queues services.  It's provided for
-	// backwards compatibility with API versions before 2009-09-19.  Prefer SharedKey instead.
-	SharedKeyLite SharedKeyType = "sharedKeyLite"
-
-	// SharedKeyLiteForTable is used to authorize against the table service.  It's provided for
-	// backwards compatibility with older table API versions.  Prefer SharedKeyForTable instead.
-	SharedKeyLiteForTable SharedKeyType = "sharedKeyLiteTable"
-)
-
-const (
-	headerAccept            = "Accept"
-	headerAcceptCharset     = "Accept-Charset"
-	headerContentEncoding   = "Content-Encoding"
-	headerContentLength     = "Content-Length"
-	headerContentMD5        = "Content-MD5"
-	headerContentLanguage   = "Content-Language"
-	headerIfModifiedSince   = "If-Modified-Since"
-	headerIfMatch           = "If-Match"
-	headerIfNoneMatch       = "If-None-Match"
-	headerIfUnmodifiedSince = "If-Unmodified-Since"
-	headerDate              = "Date"
-	headerXMSDate           = "X-Ms-Date"
-	headerXMSVersion        = "x-ms-version"
-	headerRange             = "Range"
-)
-
-const storageEmulatorAccountName = "devstoreaccount1"
-
-// SharedKeyAuthorizer implements an authorization for Shared Key
-// this can be used for interaction with Blob, File and Queue Storage Endpoints
-type SharedKeyAuthorizer struct {
-	accountName string
-	accountKey  []byte
-	keyType     SharedKeyType
-}
-
-// NewSharedKeyAuthorizer creates a SharedKeyAuthorizer using the provided credentials and shared key type.
-func NewSharedKeyAuthorizer(accountName, accountKey string, keyType SharedKeyType) (*SharedKeyAuthorizer, error) {
-	key, err := base64.StdEncoding.DecodeString(accountKey)
-	if err != nil {
-		return nil, fmt.Errorf("malformed storage account key: %v", err)
-	}
-	return &SharedKeyAuthorizer{
-		accountName: accountName,
-		accountKey:  key,
-		keyType:     keyType,
-	}, nil
-}
-
-// WithAuthorization returns a PrepareDecorator that adds an HTTP Authorization header whose
-// value is "<SharedKeyType> " followed by the computed key.
-// This can be used for the Blob, Queue, and File Services
-//
-// from: https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key
-// You may use Shared Key authorization to authorize a request made against the
-// 2009-09-19 version and later of the Blob and Queue services,
-// and version 2014-02-14 and later of the File services.
-func (sk *SharedKeyAuthorizer) WithAuthorization() PrepareDecorator {
-	return func(p Preparer) Preparer {
-		return PreparerFunc(func(r *http.Request) (*http.Request, error) {
-			r, err := p.Prepare(r)
-			if err != nil {
-				return r, err
-			}
-
-			sk, err := buildSharedKey(sk.accountName, sk.accountKey, r, sk.keyType)
-			if err != nil {
-				return r, err
-			}
-			return Prepare(r, WithHeader(headerAuthorization, sk))
-		})
-	}
-}
-
-func buildSharedKey(accName string, accKey []byte, req *http.Request, keyType SharedKeyType) (string, error) {
-	canRes, err := buildCanonicalizedResource(accName, req.URL.String(), keyType)
-	if err != nil {
-		return "", err
-	}
-
-	if req.Header == nil {
-		req.Header = http.Header{}
-	}
-
-	// ensure date is set
-	if req.Header.Get(headerDate) == "" && req.Header.Get(headerXMSDate) == "" {
-		date := time.Now().UTC().Format(http.TimeFormat)
-		req.Header.Set(headerXMSDate, date)
-	}
-	canString, err := buildCanonicalizedString(req.Method, req.Header, canRes, keyType)
-	if err != nil {
-		return "", err
-	}
-	return createAuthorizationHeader(accName, accKey, canString, keyType), nil
-}
-
-func buildCanonicalizedResource(accountName, uri string, keyType SharedKeyType) (string, error) {
-	errMsg := "buildCanonicalizedResource error: %s"
-	u, err := url.Parse(uri)
-	if err != nil {
-		return "", fmt.Errorf(errMsg, err.Error())
-	}
-
-	cr := bytes.NewBufferString("")
-	if accountName != storageEmulatorAccountName {
-		cr.WriteString("/")
-		cr.WriteString(getCanonicalizedAccountName(accountName))
-	}
-
-	if len(u.Path) > 0 {
-		// Any portion of the CanonicalizedResource string that is derived from
-		// the resource's URI should be encoded exactly as it is in the URI.
-		// -- https://msdn.microsoft.com/en-gb/library/azure/dd179428.aspx
-		cr.WriteString(u.EscapedPath())
-	} else {
-		// a slash is required to indicate the root path
-		cr.WriteString("/")
-	}
-
-	params, err := url.ParseQuery(u.RawQuery)
-	if err != nil {
-		return "", fmt.Errorf(errMsg, err.Error())
-	}
-
-	// See https://github.com/Azure/azure-storage-net/blob/master/Lib/Common/Core/Util/AuthenticationUtility.cs#L277
-	if keyType == SharedKey {
-		if len(params) > 0 {
-			cr.WriteString("\n")
-
-			keys := []string{}
-			for key := range params {
-				keys = append(keys, key)
-			}
-			sort.Strings(keys)
-
-			completeParams := []string{}
-			for _, key := range keys {
-				if len(params[key]) > 1 {
-					sort.Strings(params[key])
-				}
-
-				completeParams = append(completeParams, fmt.Sprintf("%s:%s", key, strings.Join(params[key], ",")))
-			}
-			cr.WriteString(strings.Join(completeParams, "\n"))
-		}
-	} else {
-		// search for "comp" parameter, if exists then add it to canonicalizedresource
-		if v, ok := params["comp"]; ok {
-			cr.WriteString("?comp=" + v[0])
-		}
-	}
-
-	return string(cr.Bytes()), nil
-}
-
-func getCanonicalizedAccountName(accountName string) string {
-	// since we may be trying to access a secondary storage account, we need to
-	// remove the -secondary part of the storage name
-	return strings.TrimSuffix(accountName, "-secondary")
-}
-
-func buildCanonicalizedString(verb string, headers http.Header, canonicalizedResource string, keyType SharedKeyType) (string, error) {
-	contentLength := headers.Get(headerContentLength)
-	if contentLength == "0" {
-		contentLength = ""
-	}
-	date := headers.Get(headerDate)
-	if v := headers.Get(headerXMSDate); v != "" {
-		if keyType == SharedKey || keyType == SharedKeyLite {
-			date = ""
-		} else {
-			date = v
-		}
-	}
-	var canString string
-	switch keyType {
-	case SharedKey:
-		canString = strings.Join([]string{
-			verb,
-			headers.Get(headerContentEncoding),
-			headers.Get(headerContentLanguage),
-			contentLength,
-			headers.Get(headerContentMD5),
-			headers.Get(headerContentType),
-			date,
-			headers.Get(headerIfModifiedSince),
-			headers.Get(headerIfMatch),
-			headers.Get(headerIfNoneMatch),
-			headers.Get(headerIfUnmodifiedSince),
-			headers.Get(headerRange),
-			buildCanonicalizedHeader(headers),
-			canonicalizedResource,
-		}, "\n")
-	case SharedKeyForTable:
-		canString = strings.Join([]string{
-			verb,
-			headers.Get(headerContentMD5),
-			headers.Get(headerContentType),
-			date,
-			canonicalizedResource,
-		}, "\n")
-	case SharedKeyLite:
-		canString = strings.Join([]string{
-			verb,
-			headers.Get(headerContentMD5),
-			headers.Get(headerContentType),
-			date,
-			buildCanonicalizedHeader(headers),
-			canonicalizedResource,
-		}, "\n")
-	case SharedKeyLiteForTable:
-		canString = strings.Join([]string{
-			date,
-			canonicalizedResource,
-		}, "\n")
-	default:
-		return "", fmt.Errorf("key type '%s' is not supported", keyType)
-	}
-	return canString, nil
-}
-
-func buildCanonicalizedHeader(headers http.Header) string {
-	cm := make(map[string]string)
-
-	for k := range headers {
-		headerName := strings.TrimSpace(strings.ToLower(k))
-		if strings.HasPrefix(headerName, "x-ms-") {
-			cm[headerName] = headers.Get(k)
-		}
-	}
-
-	if len(cm) == 0 {
-		return ""
-	}
-
-	keys := []string{}
-	for key := range cm {
-		keys = append(keys, key)
-	}
-
-	sort.Strings(keys)
-
-	ch := bytes.NewBufferString("")
-
-	for _, key := range keys {
-		ch.WriteString(key)
-		ch.WriteRune(':')
-		ch.WriteString(cm[key])
-		ch.WriteRune('\n')
-	}
-
-	return strings.TrimSuffix(string(ch.Bytes()), "\n")
-}
-
-func createAuthorizationHeader(accountName string, accountKey []byte, canonicalizedString string, keyType SharedKeyType) string {
-	h := hmac.New(sha256.New, accountKey)
-	h.Write([]byte(canonicalizedString))
-	signature := base64.StdEncoding.EncodeToString(h.Sum(nil))
-	var key string
-	switch keyType {
-	case SharedKey, SharedKeyForTable:
-		key = "SharedKey"
-	case SharedKeyLite, SharedKeyLiteForTable:
-		key = "SharedKeyLite"
-	}
-	return fmt.Sprintf("%s %s:%s", key, getCanonicalizedAccountName(accountName), signature)
-}

vendor/github.com/Azure/go-autorest/autorest/autorest.go

@@ -1,150 +0,0 @@
-/*
-Package autorest implements an HTTP request pipeline suitable for use across multiple go-routines
-and provides the shared routines relied on by AutoRest (see https://github.com/Azure/autorest/)
-generated Go code.
-
-The package breaks sending and responding to HTTP requests into three phases: Preparing, Sending,
-and Responding. A typical pattern is:
-
-  req, err := Prepare(&http.Request{},
-    token.WithAuthorization())
-
-  resp, err := Send(req,
-    WithLogging(logger),
-    DoErrorIfStatusCode(http.StatusInternalServerError),
-    DoCloseIfError(),
-    DoRetryForAttempts(5, time.Second))
-
-  err = Respond(resp,
-    ByDiscardingBody(),
-    ByClosing())
-
-Each phase relies on decorators to modify and / or manage processing. Decorators may first modify
-and then pass the data along, pass the data first and then modify the result, or wrap themselves
-around passing the data (such as a logger might do). Decorators run in the order provided. For
-example, the following:
-
-  req, err := Prepare(&http.Request{},
-    WithBaseURL("https://microsoft.com/"),
-    WithPath("a"),
-    WithPath("b"),
-    WithPath("c"))
-
-will set the URL to:
-
-  https://microsoft.com/a/b/c
-
-Preparers and Responders may be shared and re-used (assuming the underlying decorators support
-sharing and re-use). Performant use is obtained by creating one or more Preparers and Responders
-shared among multiple go-routines, and a single Sender shared among multiple sending go-routines,
-all bound together by means of input / output channels.
-
-Decorators hold their passed state within a closure (such as the path components in the example
-above). Be careful to share Preparers and Responders only in a context where such held state
-applies. For example, it may not make sense to share a Preparer that applies a query string from a
-fixed set of values. Similarly, sharing a Responder that reads the response body into a passed
-struct (e.g., ByUnmarshallingJson) is likely incorrect.
-
-Lastly, the Swagger specification (https://swagger.io) that drives AutoRest
-(https://github.com/Azure/autorest/) precisely defines two date forms: date and date-time. The
-github.com/Azure/go-autorest/autorest/date package provides time.Time derivations to ensure
-correct parsing and formatting.
-
-Errors raised by autorest objects and methods will conform to the autorest.Error interface.
-
-See the included examples for more detail. For details on the suggested use of this package by
-generated clients, see the Client described below.
-*/
-package autorest
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"context"
-	"net/http"
-	"time"
-)
-
-const (
-	// HeaderLocation specifies the HTTP Location header.
-	HeaderLocation = "Location"
-
-	// HeaderRetryAfter specifies the HTTP Retry-After header.
-	HeaderRetryAfter = "Retry-After"
-)
-
-// ResponseHasStatusCode returns true if the status code in the HTTP Response is in the passed set
-// and false otherwise.
-func ResponseHasStatusCode(resp *http.Response, codes ...int) bool {
-	if resp == nil {
-		return false
-	}
-	return containsInt(codes, resp.StatusCode)
-}
-
-// GetLocation retrieves the URL from the Location header of the passed response.
-func GetLocation(resp *http.Response) string {
-	return resp.Header.Get(HeaderLocation)
-}
-
-// GetRetryAfter extracts the retry delay from the Retry-After header of the passed response. If
-// the header is absent or is malformed, it will return the supplied default delay time.Duration.
-func GetRetryAfter(resp *http.Response, defaultDelay time.Duration) time.Duration {
-	retry := resp.Header.Get(HeaderRetryAfter)
-	if retry == "" {
-		return defaultDelay
-	}
-
-	d, err := time.ParseDuration(retry + "s")
-	if err != nil {
-		return defaultDelay
-	}
-
-	return d
-}
-
-// NewPollingRequest allocates and returns a new http.Request to poll for the passed response.
-func NewPollingRequest(resp *http.Response, cancel <-chan struct{}) (*http.Request, error) {
-	location := GetLocation(resp)
-	if location == "" {
-		return nil, NewErrorWithResponse("autorest", "NewPollingRequest", resp, "Location header missing from response that requires polling")
-	}
-
-	req, err := Prepare(&http.Request{Cancel: cancel},
-		AsGet(),
-		WithBaseURL(location))
-	if err != nil {
-		return nil, NewErrorWithError(err, "autorest", "NewPollingRequest", nil, "Failure creating poll request to %s", location)
-	}
-
-	return req, nil
-}
-
-// NewPollingRequestWithContext allocates and returns a new http.Request with the specified context to poll for the passed response.
-func NewPollingRequestWithContext(ctx context.Context, resp *http.Response) (*http.Request, error) {
-	location := GetLocation(resp)
-	if location == "" {
-		return nil, NewErrorWithResponse("autorest", "NewPollingRequestWithContext", resp, "Location header missing from response that requires polling")
-	}
-
-	req, err := Prepare((&http.Request{}).WithContext(ctx),
-		AsGet(),
-		WithBaseURL(location))
-	if err != nil {
-		return nil, NewErrorWithError(err, "autorest", "NewPollingRequestWithContext", nil, "Failure creating poll request to %s", location)
-	}
-
-	return req, nil
-}

vendor/github.com/Azure/go-autorest/autorest/azure/async.go

@@ -1,995 +0,0 @@
-package azure
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/Azure/go-autorest/autorest"
-	"github.com/Azure/go-autorest/logger"
-	"github.com/Azure/go-autorest/tracing"
-)
-
-const (
-	headerAsyncOperation = "Azure-AsyncOperation"
-)
-
-const (
-	operationInProgress string = "InProgress"
-	operationCanceled   string = "Canceled"
-	operationFailed     string = "Failed"
-	operationSucceeded  string = "Succeeded"
-)
-
-var pollingCodes = [...]int{http.StatusNoContent, http.StatusAccepted, http.StatusCreated, http.StatusOK}
-
-// FutureAPI contains the set of methods on the Future type.
-type FutureAPI interface {
-	// Response returns the last HTTP response.
-	Response() *http.Response
-
-	// Status returns the last status message of the operation.
-	Status() string
-
-	// PollingMethod returns the method used to monitor the status of the asynchronous operation.
-	PollingMethod() PollingMethodType
-
-	// DoneWithContext queries the service to see if the operation has completed.
-	DoneWithContext(context.Context, autorest.Sender) (bool, error)
-
-	// GetPollingDelay returns a duration the application should wait before checking
-	// the status of the asynchronous request and true; this value is returned from
-	// the service via the Retry-After response header.  If the header wasn't returned
-	// then the function returns the zero-value time.Duration and false.
-	GetPollingDelay() (time.Duration, bool)
-
-	// WaitForCompletionRef will return when one of the following conditions is met: the long
-	// running operation has completed, the provided context is cancelled, or the client's
-	// polling duration has been exceeded.  It will retry failed polling attempts based on
-	// the retry value defined in the client up to the maximum retry attempts.
-	// If no deadline is specified in the context then the client.PollingDuration will be
-	// used to determine if a default deadline should be used.
-	// If PollingDuration is greater than zero the value will be used as the context's timeout.
-	// If PollingDuration is zero then no default deadline will be used.
-	WaitForCompletionRef(context.Context, autorest.Client) error
-
-	// MarshalJSON implements the json.Marshaler interface.
-	MarshalJSON() ([]byte, error)
-
-	// MarshalJSON implements the json.Unmarshaler interface.
-	UnmarshalJSON([]byte) error
-
-	// PollingURL returns the URL used for retrieving the status of the long-running operation.
-	PollingURL() string
-
-	// GetResult should be called once polling has completed successfully.
-	// It makes the final GET call to retrieve the resultant payload.
-	GetResult(autorest.Sender) (*http.Response, error)
-}
-
-var _ FutureAPI = (*Future)(nil)
-
-// Future provides a mechanism to access the status and results of an asynchronous request.
-// Since futures are stateful they should be passed by value to avoid race conditions.
-type Future struct {
-	pt pollingTracker
-}
-
-// NewFutureFromResponse returns a new Future object initialized
-// with the initial response from an asynchronous operation.
-func NewFutureFromResponse(resp *http.Response) (Future, error) {
-	pt, err := createPollingTracker(resp)
-	return Future{pt: pt}, err
-}
-
-// Response returns the last HTTP response.
-func (f Future) Response() *http.Response {
-	if f.pt == nil {
-		return nil
-	}
-	return f.pt.latestResponse()
-}
-
-// Status returns the last status message of the operation.
-func (f Future) Status() string {
-	if f.pt == nil {
-		return ""
-	}
-	return f.pt.pollingStatus()
-}
-
-// PollingMethod returns the method used to monitor the status of the asynchronous operation.
-func (f Future) PollingMethod() PollingMethodType {
-	if f.pt == nil {
-		return PollingUnknown
-	}
-	return f.pt.pollingMethod()
-}
-
-// DoneWithContext queries the service to see if the operation has completed.
-func (f *Future) DoneWithContext(ctx context.Context, sender autorest.Sender) (done bool, err error) {
-	ctx = tracing.StartSpan(ctx, "github.com/Azure/go-autorest/autorest/azure/async.DoneWithContext")
-	defer func() {
-		sc := -1
-		resp := f.Response()
-		if resp != nil {
-			sc = resp.StatusCode
-		}
-		tracing.EndSpan(ctx, sc, err)
-	}()
-
-	if f.pt == nil {
-		return false, autorest.NewError("Future", "Done", "future is not initialized")
-	}
-	if f.pt.hasTerminated() {
-		return true, f.pt.pollingError()
-	}
-	if err := f.pt.pollForStatus(ctx, sender); err != nil {
-		return false, err
-	}
-	if err := f.pt.checkForErrors(); err != nil {
-		return f.pt.hasTerminated(), err
-	}
-	if err := f.pt.updatePollingState(f.pt.provisioningStateApplicable()); err != nil {
-		return false, err
-	}
-	if err := f.pt.initPollingMethod(); err != nil {
-		return false, err
-	}
-	if err := f.pt.updatePollingMethod(); err != nil {
-		return false, err
-	}
-	return f.pt.hasTerminated(), f.pt.pollingError()
-}
-
-// GetPollingDelay returns a duration the application should wait before checking
-// the status of the asynchronous request and true; this value is returned from
-// the service via the Retry-After response header.  If the header wasn't returned
-// then the function returns the zero-value time.Duration and false.
-func (f Future) GetPollingDelay() (time.Duration, bool) {
-	if f.pt == nil {
-		return 0, false
-	}
-	resp := f.pt.latestResponse()
-	if resp == nil {
-		return 0, false
-	}
-
-	retry := resp.Header.Get(autorest.HeaderRetryAfter)
-	if retry == "" {
-		return 0, false
-	}
-
-	d, err := time.ParseDuration(retry + "s")
-	if err != nil {
-		panic(err)
-	}
-
-	return d, true
-}
-
-// WaitForCompletionRef will return when one of the following conditions is met: the long
-// running operation has completed, the provided context is cancelled, or the client's
-// polling duration has been exceeded.  It will retry failed polling attempts based on
-// the retry value defined in the client up to the maximum retry attempts.
-// If no deadline is specified in the context then the client.PollingDuration will be
-// used to determine if a default deadline should be used.
-// If PollingDuration is greater than zero the value will be used as the context's timeout.
-// If PollingDuration is zero then no default deadline will be used.
-func (f *Future) WaitForCompletionRef(ctx context.Context, client autorest.Client) (err error) {
-	ctx = tracing.StartSpan(ctx, "github.com/Azure/go-autorest/autorest/azure/async.WaitForCompletionRef")
-	defer func() {
-		sc := -1
-		resp := f.Response()
-		if resp != nil {
-			sc = resp.StatusCode
-		}
-		tracing.EndSpan(ctx, sc, err)
-	}()
-	cancelCtx := ctx
-	// if the provided context already has a deadline don't override it
-	_, hasDeadline := ctx.Deadline()
-	if d := client.PollingDuration; !hasDeadline && d != 0 {
-		var cancel context.CancelFunc
-		cancelCtx, cancel = context.WithTimeout(ctx, d)
-		defer cancel()
-	}
-	// if the initial response has a Retry-After, sleep for the specified amount of time before starting to poll
-	if delay, ok := f.GetPollingDelay(); ok {
-		logger.Instance.Writeln(logger.LogInfo, "WaitForCompletionRef: initial polling delay")
-		if delayElapsed := autorest.DelayForBackoff(delay, 0, cancelCtx.Done()); !delayElapsed {
-			err = cancelCtx.Err()
-			return
-		}
-	}
-	done, err := f.DoneWithContext(ctx, client)
-	for attempts := 0; !done; done, err = f.DoneWithContext(ctx, client) {
-		if attempts >= client.RetryAttempts {
-			return autorest.NewErrorWithError(err, "Future", "WaitForCompletion", f.pt.latestResponse(), "the number of retries has been exceeded")
-		}
-		// we want delayAttempt to be zero in the non-error case so
-		// that DelayForBackoff doesn't perform exponential back-off
-		var delayAttempt int
-		var delay time.Duration
-		if err == nil {
-			// check for Retry-After delay, if not present use the client's polling delay
-			var ok bool
-			delay, ok = f.GetPollingDelay()
-			if !ok {
-				logger.Instance.Writeln(logger.LogInfo, "WaitForCompletionRef: Using client polling delay")
-				delay = client.PollingDelay
-			}
-		} else {
-			// there was an error polling for status so perform exponential
-			// back-off based on the number of attempts using the client's retry
-			// duration.  update attempts after delayAttempt to avoid off-by-one.
-			logger.Instance.Writef(logger.LogError, "WaitForCompletionRef: %s\n", err)
-			delayAttempt = attempts
-			delay = client.RetryDuration
-			attempts++
-		}
-		// wait until the delay elapses or the context is cancelled
-		delayElapsed := autorest.DelayForBackoff(delay, delayAttempt, cancelCtx.Done())
-		if !delayElapsed {
-			return autorest.NewErrorWithError(cancelCtx.Err(), "Future", "WaitForCompletion", f.pt.latestResponse(), "context has been cancelled")
-		}
-	}
-	return
-}
-
-// MarshalJSON implements the json.Marshaler interface.
-func (f Future) MarshalJSON() ([]byte, error) {
-	return json.Marshal(f.pt)
-}
-
-// UnmarshalJSON implements the json.Unmarshaler interface.
-func (f *Future) UnmarshalJSON(data []byte) error {
-	// unmarshal into JSON object to determine the tracker type
-	obj := map[string]interface{}{}
-	err := json.Unmarshal(data, &obj)
-	if err != nil {
-		return err
-	}
-	if obj["method"] == nil {
-		return autorest.NewError("Future", "UnmarshalJSON", "missing 'method' property")
-	}
-	method := obj["method"].(string)
-	switch strings.ToUpper(method) {
-	case http.MethodDelete:
-		f.pt = &pollingTrackerDelete{}
-	case http.MethodPatch:
-		f.pt = &pollingTrackerPatch{}
-	case http.MethodPost:
-		f.pt = &pollingTrackerPost{}
-	case http.MethodPut:
-		f.pt = &pollingTrackerPut{}
-	default:
-		return autorest.NewError("Future", "UnmarshalJSON", "unsupoorted method '%s'", method)
-	}
-	// now unmarshal into the tracker
-	return json.Unmarshal(data, &f.pt)
-}
-
-// PollingURL returns the URL used for retrieving the status of the long-running operation.
-func (f Future) PollingURL() string {
-	if f.pt == nil {
-		return ""
-	}
-	return f.pt.pollingURL()
-}
-
-// GetResult should be called once polling has completed successfully.
-// It makes the final GET call to retrieve the resultant payload.
-func (f Future) GetResult(sender autorest.Sender) (*http.Response, error) {
-	if f.pt.finalGetURL() == "" {
-		// we can end up in this situation if the async operation returns a 200
-		// with no polling URLs.  in that case return the response which should
-		// contain the JSON payload (only do this for successful terminal cases).
-		if lr := f.pt.latestResponse(); lr != nil && f.pt.hasSucceeded() {
-			return lr, nil
-		}
-		return nil, autorest.NewError("Future", "GetResult", "missing URL for retrieving result")
-	}
-	req, err := http.NewRequest(http.MethodGet, f.pt.finalGetURL(), nil)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := sender.Do(req)
-	if err == nil && resp.Body != nil {
-		// copy the body and close it so callers don't have to
-		defer resp.Body.Close()
-		b, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return resp, err
-		}
-		resp.Body = ioutil.NopCloser(bytes.NewReader(b))
-	}
-	return resp, err
-}
-
-type pollingTracker interface {
-	// these methods can differ per tracker
-
-	// checks the response headers and status code to determine the polling mechanism
-	updatePollingMethod() error
-
-	// checks the response for tracker-specific error conditions
-	checkForErrors() error
-
-	// returns true if provisioning state should be checked
-	provisioningStateApplicable() bool
-
-	// methods common to all trackers
-
-	// initializes a tracker's polling URL and method, called for each iteration.
-	// these values can be overridden by each polling tracker as required.
-	initPollingMethod() error
-
-	// initializes the tracker's internal state, call this when the tracker is created
-	initializeState() error
-
-	// makes an HTTP request to check the status of the LRO
-	pollForStatus(ctx context.Context, sender autorest.Sender) error
-
-	// updates internal tracker state, call this after each call to pollForStatus
-	updatePollingState(provStateApl bool) error
-
-	// returns the error response from the service, can be nil
-	pollingError() error
-
-	// returns the polling method being used
-	pollingMethod() PollingMethodType
-
-	// returns the state of the LRO as returned from the service
-	pollingStatus() string
-
-	// returns the URL used for polling status
-	pollingURL() string
-
-	// returns the URL used for the final GET to retrieve the resource
-	finalGetURL() string
-
-	// returns true if the LRO is in a terminal state
-	hasTerminated() bool
-
-	// returns true if the LRO is in a failed terminal state
-	hasFailed() bool
-
-	// returns true if the LRO is in a successful terminal state
-	hasSucceeded() bool
-
-	// returns the cached HTTP response after a call to pollForStatus(), can be nil
-	latestResponse() *http.Response
-}
-
-type pollingTrackerBase struct {
-	// resp is the last response, either from the submission of the LRO or from polling
-	resp *http.Response
-
-	// method is the HTTP verb, this is needed for deserialization
-	Method string `json:"method"`
-
-	// rawBody is the raw JSON response body
-	rawBody map[string]interface{}
-
-	// denotes if polling is using async-operation or location header
-	Pm PollingMethodType `json:"pollingMethod"`
-
-	// the URL to poll for status
-	URI string `json:"pollingURI"`
-
-	// the state of the LRO as returned from the service
-	State string `json:"lroState"`
-
-	// the URL to GET for the final result
-	FinalGetURI string `json:"resultURI"`
-
-	// used to hold an error object returned from the service
-	Err *ServiceError `json:"error,omitempty"`
-}
-
-func (pt *pollingTrackerBase) initializeState() error {
-	// determine the initial polling state based on response body and/or HTTP status
-	// code.  this is applicable to the initial LRO response, not polling responses!
-	pt.Method = pt.resp.Request.Method
-	if err := pt.updateRawBody(); err != nil {
-		return err
-	}
-	switch pt.resp.StatusCode {
-	case http.StatusOK:
-		if ps := pt.getProvisioningState(); ps != nil {
-			pt.State = *ps
-			if pt.hasFailed() {
-				pt.updateErrorFromResponse()
-				return pt.pollingError()
-			}
-		} else {
-			pt.State = operationSucceeded
-		}
-	case http.StatusCreated:
-		if ps := pt.getProvisioningState(); ps != nil {
-			pt.State = *ps
-		} else {
-			pt.State = operationInProgress
-		}
-	case http.StatusAccepted:
-		pt.State = operationInProgress
-	case http.StatusNoContent:
-		pt.State = operationSucceeded
-	default:
-		pt.State = operationFailed
-		pt.updateErrorFromResponse()
-		return pt.pollingError()
-	}
-	return pt.initPollingMethod()
-}
-
-func (pt pollingTrackerBase) getProvisioningState() *string {
-	if pt.rawBody != nil && pt.rawBody["properties"] != nil {
-		p := pt.rawBody["properties"].(map[string]interface{})
-		if ps := p["provisioningState"]; ps != nil {
-			s := ps.(string)
-			return &s
-		}
-	}
-	return nil
-}
-
-func (pt *pollingTrackerBase) updateRawBody() error {
-	pt.rawBody = map[string]interface{}{}
-	if pt.resp.ContentLength != 0 {
-		defer pt.resp.Body.Close()
-		b, err := ioutil.ReadAll(pt.resp.Body)
-		if err != nil {
-			return autorest.NewErrorWithError(err, "pollingTrackerBase", "updateRawBody", nil, "failed to read response body")
-		}
-		// put the body back so it's available to other callers
-		pt.resp.Body = ioutil.NopCloser(bytes.NewReader(b))
-		// observed in 204 responses over HTTP/2.0; the content length is -1 but body is empty
-		if len(b) == 0 {
-			return nil
-		}
-		if err = json.Unmarshal(b, &pt.rawBody); err != nil {
-			return autorest.NewErrorWithError(err, "pollingTrackerBase", "updateRawBody", nil, "failed to unmarshal response body")
-		}
-	}
-	return nil
-}
-
-func (pt *pollingTrackerBase) pollForStatus(ctx context.Context, sender autorest.Sender) error {
-	req, err := http.NewRequest(http.MethodGet, pt.URI, nil)
-	if err != nil {
-		return autorest.NewErrorWithError(err, "pollingTrackerBase", "pollForStatus", nil, "failed to create HTTP request")
-	}
-
-	req = req.WithContext(ctx)
-	preparer := autorest.CreatePreparer(autorest.GetPrepareDecorators(ctx)...)
-	req, err = preparer.Prepare(req)
-	if err != nil {
-		return autorest.NewErrorWithError(err, "pollingTrackerBase", "pollForStatus", nil, "failed preparing HTTP request")
-	}
-	pt.resp, err = sender.Do(req)
-	if err != nil {
-		return autorest.NewErrorWithError(err, "pollingTrackerBase", "pollForStatus", nil, "failed to send HTTP request")
-	}
-	if autorest.ResponseHasStatusCode(pt.resp, pollingCodes[:]...) {
-		// reset the service error on success case
-		pt.Err = nil
-		err = pt.updateRawBody()
-	} else {
-		// check response body for error content
-		pt.updateErrorFromResponse()
-		err = pt.pollingError()
-	}
-	return err
-}
-
-// attempts to unmarshal a ServiceError type from the response body.
-// if that fails then make a best attempt at creating something meaningful.
-// NOTE: this assumes that the async operation has failed.
-func (pt *pollingTrackerBase) updateErrorFromResponse() {
-	var err error
-	if pt.resp.ContentLength != 0 {
-		type respErr struct {
-			ServiceError *ServiceError `json:"error"`
-		}
-		re := respErr{}
-		defer pt.resp.Body.Close()
-		var b []byte
-		if b, err = ioutil.ReadAll(pt.resp.Body); err != nil {
-			goto Default
-		}
-		// put the body back so it's available to other callers
-		pt.resp.Body = ioutil.NopCloser(bytes.NewReader(b))
-		if len(b) == 0 {
-			goto Default
-		}
-		if err = json.Unmarshal(b, &re); err != nil {
-			goto Default
-		}
-		// unmarshalling the error didn't yield anything, try unwrapped error
-		if re.ServiceError == nil {
-			err = json.Unmarshal(b, &re.ServiceError)
-			if err != nil {
-				goto Default
-			}
-		}
-		// the unmarshaller will ensure re.ServiceError is non-nil
-		// even if there was no content unmarshalled so check the code.
-		if re.ServiceError.Code != "" {
-			pt.Err = re.ServiceError
-			return
-		}
-	}
-Default:
-	se := &ServiceError{
-		Code:    pt.pollingStatus(),
-		Message: "The async operation failed.",
-	}
-	if err != nil {
-		se.InnerError = make(map[string]interface{})
-		se.InnerError["unmarshalError"] = err.Error()
-	}
-	// stick the response body into the error object in hopes
-	// it contains something useful to help diagnose the failure.
-	if len(pt.rawBody) > 0 {
-		se.AdditionalInfo = []map[string]interface{}{
-			pt.rawBody,
-		}
-	}
-	pt.Err = se
-}
-
-func (pt *pollingTrackerBase) updatePollingState(provStateApl bool) error {
-	if pt.Pm == PollingAsyncOperation && pt.rawBody["status"] != nil {
-		pt.State = pt.rawBody["status"].(string)
-	} else {
-		if pt.resp.StatusCode == http.StatusAccepted {
-			pt.State = operationInProgress
-		} else if provStateApl {
-			if ps := pt.getProvisioningState(); ps != nil {
-				pt.State = *ps
-			} else {
-				pt.State = operationSucceeded
-			}
-		} else {
-			return autorest.NewError("pollingTrackerBase", "updatePollingState", "the response from the async operation has an invalid status code")
-		}
-	}
-	// if the operation has failed update the error state
-	if pt.hasFailed() {
-		pt.updateErrorFromResponse()
-	}
-	return nil
-}
-
-func (pt pollingTrackerBase) pollingError() error {
-	if pt.Err == nil {
-		return nil
-	}
-	return pt.Err
-}
-
-func (pt pollingTrackerBase) pollingMethod() PollingMethodType {
-	return pt.Pm
-}
-
-func (pt pollingTrackerBase) pollingStatus() string {
-	return pt.State
-}
-
-func (pt pollingTrackerBase) pollingURL() string {
-	return pt.URI
-}
-
-func (pt pollingTrackerBase) finalGetURL() string {
-	return pt.FinalGetURI
-}
-
-func (pt pollingTrackerBase) hasTerminated() bool {
-	return strings.EqualFold(pt.State, operationCanceled) || strings.EqualFold(pt.State, operationFailed) || strings.EqualFold(pt.State, operationSucceeded)
-}
-
-func (pt pollingTrackerBase) hasFailed() bool {
-	return strings.EqualFold(pt.State, operationCanceled) || strings.EqualFold(pt.State, operationFailed)
-}
-
-func (pt pollingTrackerBase) hasSucceeded() bool {
-	return strings.EqualFold(pt.State, operationSucceeded)
-}
-
-func (pt pollingTrackerBase) latestResponse() *http.Response {
-	return pt.resp
-}
-
-// error checking common to all trackers
-func (pt pollingTrackerBase) baseCheckForErrors() error {
-	// for Azure-AsyncOperations the response body cannot be nil or empty
-	if pt.Pm == PollingAsyncOperation {
-		if pt.resp.Body == nil || pt.resp.ContentLength == 0 {
-			return autorest.NewError("pollingTrackerBase", "baseCheckForErrors", "for Azure-AsyncOperation response body cannot be nil")
-		}
-		if pt.rawBody["status"] == nil {
-			return autorest.NewError("pollingTrackerBase", "baseCheckForErrors", "missing status property in Azure-AsyncOperation response body")
-		}
-	}
-	return nil
-}
-
-// default initialization of polling URL/method.  each verb tracker will update this as required.
-func (pt *pollingTrackerBase) initPollingMethod() error {
-	if ao, err := getURLFromAsyncOpHeader(pt.resp); err != nil {
-		return err
-	} else if ao != "" {
-		pt.URI = ao
-		pt.Pm = PollingAsyncOperation
-		return nil
-	}
-	if lh, err := getURLFromLocationHeader(pt.resp); err != nil {
-		return err
-	} else if lh != "" {
-		pt.URI = lh
-		pt.Pm = PollingLocation
-		return nil
-	}
-	// it's ok if we didn't find a polling header, this will be handled elsewhere
-	return nil
-}
-
-// DELETE
-
-type pollingTrackerDelete struct {
-	pollingTrackerBase
-}
-
-func (pt *pollingTrackerDelete) updatePollingMethod() error {
-	// for 201 the Location header is required
-	if pt.resp.StatusCode == http.StatusCreated {
-		if lh, err := getURLFromLocationHeader(pt.resp); err != nil {
-			return err
-		} else if lh == "" {
-			return autorest.NewError("pollingTrackerDelete", "updateHeaders", "missing Location header in 201 response")
-		} else {
-			pt.URI = lh
-		}
-		pt.Pm = PollingLocation
-		pt.FinalGetURI = pt.URI
-	}
-	// for 202 prefer the Azure-AsyncOperation header but fall back to Location if necessary
-	if pt.resp.StatusCode == http.StatusAccepted {
-		ao, err := getURLFromAsyncOpHeader(pt.resp)
-		if err != nil {
-			return err
-		} else if ao != "" {
-			pt.URI = ao
-			pt.Pm = PollingAsyncOperation
-		}
-		// if the Location header is invalid and we already have a polling URL
-		// then we don't care if the Location header URL is malformed.
-		if lh, err := getURLFromLocationHeader(pt.resp); err != nil && pt.URI == "" {
-			return err
-		} else if lh != "" {
-			if ao == "" {
-				pt.URI = lh
-				pt.Pm = PollingLocation
-			}
-			// when both headers are returned we use the value in the Location header for the final GET
-			pt.FinalGetURI = lh
-		}
-		// make sure a polling URL was found
-		if pt.URI == "" {
-			return autorest.NewError("pollingTrackerPost", "updateHeaders", "didn't get any suitable polling URLs in 202 response")
-		}
-	}
-	return nil
-}
-
-func (pt pollingTrackerDelete) checkForErrors() error {
-	return pt.baseCheckForErrors()
-}
-
-func (pt pollingTrackerDelete) provisioningStateApplicable() bool {
-	return pt.resp.StatusCode == http.StatusOK || pt.resp.StatusCode == http.StatusNoContent
-}
-
-// PATCH
-
-type pollingTrackerPatch struct {
-	pollingTrackerBase
-}
-
-func (pt *pollingTrackerPatch) updatePollingMethod() error {
-	// by default we can use the original URL for polling and final GET
-	if pt.URI == "" {
-		pt.URI = pt.resp.Request.URL.String()
-	}
-	if pt.FinalGetURI == "" {
-		pt.FinalGetURI = pt.resp.Request.URL.String()
-	}
-	if pt.Pm == PollingUnknown {
-		pt.Pm = PollingRequestURI
-	}
-	// for 201 it's permissible for no headers to be returned
-	if pt.resp.StatusCode == http.StatusCreated {
-		if ao, err := getURLFromAsyncOpHeader(pt.resp); err != nil {
-			return err
-		} else if ao != "" {
-			pt.URI = ao
-			pt.Pm = PollingAsyncOperation
-		}
-	}
-	// for 202 prefer the Azure-AsyncOperation header but fall back to Location if necessary
-	// note the absence of the "final GET" mechanism for PATCH
-	if pt.resp.StatusCode == http.StatusAccepted {
-		ao, err := getURLFromAsyncOpHeader(pt.resp)
-		if err != nil {
-			return err
-		} else if ao != "" {
-			pt.URI = ao
-			pt.Pm = PollingAsyncOperation
-		}
-		if ao == "" {
-			if lh, err := getURLFromLocationHeader(pt.resp); err != nil {
-				return err
-			} else if lh == "" {
-				return autorest.NewError("pollingTrackerPatch", "updateHeaders", "didn't get any suitable polling URLs in 202 response")
-			} else {
-				pt.URI = lh
-				pt.Pm = PollingLocation
-			}
-		}
-	}
-	return nil
-}
-
-func (pt pollingTrackerPatch) checkForErrors() error {
-	return pt.baseCheckForErrors()
-}
-
-func (pt pollingTrackerPatch) provisioningStateApplicable() bool {
-	return pt.resp.StatusCode == http.StatusOK || pt.resp.StatusCode == http.StatusCreated
-}
-
-// POST
-
-type pollingTrackerPost struct {
-	pollingTrackerBase
-}
-
-func (pt *pollingTrackerPost) updatePollingMethod() error {
-	// 201 requires Location header
-	if pt.resp.StatusCode == http.StatusCreated {
-		if lh, err := getURLFromLocationHeader(pt.resp); err != nil {
-			return err
-		} else if lh == "" {
-			return autorest.NewError("pollingTrackerPost", "updateHeaders", "missing Location header in 201 response")
-		} else {
-			pt.URI = lh
-			pt.FinalGetURI = lh
-			pt.Pm = PollingLocation
-		}
-	}
-	// for 202 prefer the Azure-AsyncOperation header but fall back to Location if necessary
-	if pt.resp.StatusCode == http.StatusAccepted {
-		ao, err := getURLFromAsyncOpHeader(pt.resp)
-		if err != nil {
-			return err
-		} else if ao != "" {
-			pt.URI = ao
-			pt.Pm = PollingAsyncOperation
-		}
-		// if the Location header is invalid and we already have a polling URL
-		// then we don't care if the Location header URL is malformed.
-		if lh, err := getURLFromLocationHeader(pt.resp); err != nil && pt.URI == "" {
-			return err
-		} else if lh != "" {
-			if ao == "" {
-				pt.URI = lh
-				pt.Pm = PollingLocation
-			}
-			// when both headers are returned we use the value in the Location header for the final GET
-			pt.FinalGetURI = lh
-		}
-		// make sure a polling URL was found
-		if pt.URI == "" {
-			return autorest.NewError("pollingTrackerPost", "updateHeaders", "didn't get any suitable polling URLs in 202 response")
-		}
-	}
-	return nil
-}
-
-func (pt pollingTrackerPost) checkForErrors() error {
-	return pt.baseCheckForErrors()
-}
-
-func (pt pollingTrackerPost) provisioningStateApplicable() bool {
-	return pt.resp.StatusCode == http.StatusOK || pt.resp.StatusCode == http.StatusNoContent
-}
-
-// PUT
-
-type pollingTrackerPut struct {
-	pollingTrackerBase
-}
-
-func (pt *pollingTrackerPut) updatePollingMethod() error {
-	// by default we can use the original URL for polling and final GET
-	if pt.URI == "" {
-		pt.URI = pt.resp.Request.URL.String()
-	}
-	if pt.FinalGetURI == "" {
-		pt.FinalGetURI = pt.resp.Request.URL.String()
-	}
-	if pt.Pm == PollingUnknown {
-		pt.Pm = PollingRequestURI
-	}
-	// for 201 it's permissible for no headers to be returned
-	if pt.resp.StatusCode == http.StatusCreated {
-		if ao, err := getURLFromAsyncOpHeader(pt.resp); err != nil {
-			return err
-		} else if ao != "" {
-			pt.URI = ao
-			pt.Pm = PollingAsyncOperation
-		}
-	}
-	// for 202 prefer the Azure-AsyncOperation header but fall back to Location if necessary
-	if pt.resp.StatusCode == http.StatusAccepted {
-		ao, err := getURLFromAsyncOpHeader(pt.resp)
-		if err != nil {
-			return err
-		} else if ao != "" {
-			pt.URI = ao
-			pt.Pm = PollingAsyncOperation
-		}
-		// if the Location header is invalid and we already have a polling URL
-		// then we don't care if the Location header URL is malformed.
-		if lh, err := getURLFromLocationHeader(pt.resp); err != nil && pt.URI == "" {
-			return err
-		} else if lh != "" {
-			if ao == "" {
-				pt.URI = lh
-				pt.Pm = PollingLocation
-			}
-		}
-		// make sure a polling URL was found
-		if pt.URI == "" {
-			return autorest.NewError("pollingTrackerPut", "updateHeaders", "didn't get any suitable polling URLs in 202 response")
-		}
-	}
-	return nil
-}
-
-func (pt pollingTrackerPut) checkForErrors() error {
-	err := pt.baseCheckForErrors()
-	if err != nil {
-		return err
-	}
-	// if there are no LRO headers then the body cannot be empty
-	ao, err := getURLFromAsyncOpHeader(pt.resp)
-	if err != nil {
-		return err
-	}
-	lh, err := getURLFromLocationHeader(pt.resp)
-	if err != nil {
-		return err
-	}
-	if ao == "" && lh == "" && len(pt.rawBody) == 0 {
-		return autorest.NewError("pollingTrackerPut", "checkForErrors", "the response did not contain a body")
-	}
-	return nil
-}
-
-func (pt pollingTrackerPut) provisioningStateApplicable() bool {
-	return pt.resp.StatusCode == http.StatusOK || pt.resp.StatusCode == http.StatusCreated
-}
-
-// creates a polling tracker based on the verb of the original request
-func createPollingTracker(resp *http.Response) (pollingTracker, error) {
-	var pt pollingTracker
-	switch strings.ToUpper(resp.Request.Method) {
-	case http.MethodDelete:
-		pt = &pollingTrackerDelete{pollingTrackerBase: pollingTrackerBase{resp: resp}}
-	case http.MethodPatch:
-		pt = &pollingTrackerPatch{pollingTrackerBase: pollingTrackerBase{resp: resp}}
-	case http.MethodPost:
-		pt = &pollingTrackerPost{pollingTrackerBase: pollingTrackerBase{resp: resp}}
-	case http.MethodPut:
-		pt = &pollingTrackerPut{pollingTrackerBase: pollingTrackerBase{resp: resp}}
-	default:
-		return nil, autorest.NewError("azure", "createPollingTracker", "unsupported HTTP method %s", resp.Request.Method)
-	}
-	if err := pt.initializeState(); err != nil {
-		return pt, err
-	}
-	// this initializes the polling header values, we do this during creation in case the
-	// initial response send us invalid values; this way the API call will return a non-nil
-	// error (not doing this means the error shows up in Future.Done)
-	return pt, pt.updatePollingMethod()
-}
-
-// gets the polling URL from the Azure-AsyncOperation header.
-// ensures the URL is well-formed and absolute.
-func getURLFromAsyncOpHeader(resp *http.Response) (string, error) {
-	s := resp.Header.Get(http.CanonicalHeaderKey(headerAsyncOperation))
-	if s == "" {
-		return "", nil
-	}
-	if !isValidURL(s) {
-		return "", autorest.NewError("azure", "getURLFromAsyncOpHeader", "invalid polling URL '%s'", s)
-	}
-	return s, nil
-}
-
-// gets the polling URL from the Location header.
-// ensures the URL is well-formed and absolute.
-func getURLFromLocationHeader(resp *http.Response) (string, error) {
-	s := resp.Header.Get(http.CanonicalHeaderKey(autorest.HeaderLocation))
-	if s == "" {
-		return "", nil
-	}
-	if !isValidURL(s) {
-		return "", autorest.NewError("azure", "getURLFromLocationHeader", "invalid polling URL '%s'", s)
-	}
-	return s, nil
-}
-
-// verify that the URL is valid and absolute
-func isValidURL(s string) bool {
-	u, err := url.Parse(s)
-	return err == nil && u.IsAbs()
-}
-
-// PollingMethodType defines a type used for enumerating polling mechanisms.
-type PollingMethodType string
-
-const (
-	// PollingAsyncOperation indicates the polling method uses the Azure-AsyncOperation header.
-	PollingAsyncOperation PollingMethodType = "AsyncOperation"
-
-	// PollingLocation indicates the polling method uses the Location header.
-	PollingLocation PollingMethodType = "Location"
-
-	// PollingRequestURI indicates the polling method uses the original request URI.
-	PollingRequestURI PollingMethodType = "RequestURI"
-
-	// PollingUnknown indicates an unknown polling method and is the default value.
-	PollingUnknown PollingMethodType = ""
-)
-
-// AsyncOpIncompleteError is the type that's returned from a future that has not completed.
-type AsyncOpIncompleteError struct {
-	// FutureType is the name of the type composed of a azure.Future.
-	FutureType string
-}
-
-// Error returns an error message including the originating type name of the error.
-func (e AsyncOpIncompleteError) Error() string {
-	return fmt.Sprintf("%s: asynchronous operation has not completed", e.FutureType)
-}
-
-// NewAsyncOpIncompleteError creates a new AsyncOpIncompleteError with the specified parameters.
-func NewAsyncOpIncompleteError(futureType string) AsyncOpIncompleteError {
-	return AsyncOpIncompleteError{
-		FutureType: futureType,
-	}
-}

vendor/github.com/Azure/go-autorest/autorest/azure/azure.go

@@ -1,388 +0,0 @@
-// Package azure provides Azure-specific implementations used with AutoRest.
-// See the included examples for more detail.
-package azure
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"regexp"
-	"strconv"
-	"strings"
-
-	"github.com/Azure/go-autorest/autorest"
-)
-
-const (
-	// HeaderClientID is the Azure extension header to set a user-specified request ID.
-	HeaderClientID = "x-ms-client-request-id"
-
-	// HeaderReturnClientID is the Azure extension header to set if the user-specified request ID
-	// should be included in the response.
-	HeaderReturnClientID = "x-ms-return-client-request-id"
-
-	// HeaderContentType is the type of the content in the HTTP response.
-	HeaderContentType = "Content-Type"
-
-	// HeaderRequestID is the Azure extension header of the service generated request ID returned
-	// in the response.
-	HeaderRequestID = "x-ms-request-id"
-)
-
-// ServiceError encapsulates the error response from an Azure service.
-// It adhears to the OData v4 specification for error responses.
-type ServiceError struct {
-	Code           string                   `json:"code"`
-	Message        string                   `json:"message"`
-	Target         *string                  `json:"target"`
-	Details        []map[string]interface{} `json:"details"`
-	InnerError     map[string]interface{}   `json:"innererror"`
-	AdditionalInfo []map[string]interface{} `json:"additionalInfo"`
-}
-
-func (se ServiceError) Error() string {
-	result := fmt.Sprintf("Code=%q Message=%q", se.Code, se.Message)
-
-	if se.Target != nil {
-		result += fmt.Sprintf(" Target=%q", *se.Target)
-	}
-
-	if se.Details != nil {
-		d, err := json.Marshal(se.Details)
-		if err != nil {
-			result += fmt.Sprintf(" Details=%v", se.Details)
-		}
-		result += fmt.Sprintf(" Details=%s", d)
-	}
-
-	if se.InnerError != nil {
-		d, err := json.Marshal(se.InnerError)
-		if err != nil {
-			result += fmt.Sprintf(" InnerError=%v", se.InnerError)
-		}
-		result += fmt.Sprintf(" InnerError=%s", d)
-	}
-
-	if se.AdditionalInfo != nil {
-		d, err := json.Marshal(se.AdditionalInfo)
-		if err != nil {
-			result += fmt.Sprintf(" AdditionalInfo=%v", se.AdditionalInfo)
-		}
-		result += fmt.Sprintf(" AdditionalInfo=%s", d)
-	}
-
-	return result
-}
-
-// UnmarshalJSON implements the json.Unmarshaler interface for the ServiceError type.
-func (se *ServiceError) UnmarshalJSON(b []byte) error {
-	// http://docs.oasis-open.org/odata/odata-json-format/v4.0/os/odata-json-format-v4.0-os.html#_Toc372793091
-
-	type serviceErrorInternal struct {
-		Code           string                   `json:"code"`
-		Message        string                   `json:"message"`
-		Target         *string                  `json:"target,omitempty"`
-		AdditionalInfo []map[string]interface{} `json:"additionalInfo,omitempty"`
-		// not all services conform to the OData v4 spec.
-		// the following fields are where we've seen discrepancies
-
-		// spec calls for []map[string]interface{} but have seen map[string]interface{}
-		Details interface{} `json:"details,omitempty"`
-
-		// spec calls for map[string]interface{} but have seen []map[string]interface{} and string
-		InnerError interface{} `json:"innererror,omitempty"`
-	}
-
-	sei := serviceErrorInternal{}
-	if err := json.Unmarshal(b, &sei); err != nil {
-		return err
-	}
-
-	// copy the fields we know to be correct
-	se.AdditionalInfo = sei.AdditionalInfo
-	se.Code = sei.Code
-	se.Message = sei.Message
-	se.Target = sei.Target
-
-	// converts an []interface{} to []map[string]interface{}
-	arrayOfObjs := func(v interface{}) ([]map[string]interface{}, bool) {
-		arrayOf, ok := v.([]interface{})
-		if !ok {
-			return nil, false
-		}
-		final := []map[string]interface{}{}
-		for _, item := range arrayOf {
-			as, ok := item.(map[string]interface{})
-			if !ok {
-				return nil, false
-			}
-			final = append(final, as)
-		}
-		return final, true
-	}
-
-	// convert the remaining fields, falling back to raw JSON if necessary
-
-	if c, ok := arrayOfObjs(sei.Details); ok {
-		se.Details = c
-	} else if c, ok := sei.Details.(map[string]interface{}); ok {
-		se.Details = []map[string]interface{}{c}
-	} else if sei.Details != nil {
-		// stuff into Details
-		se.Details = []map[string]interface{}{
-			{"raw": sei.Details},
-		}
-	}
-
-	if c, ok := sei.InnerError.(map[string]interface{}); ok {
-		se.InnerError = c
-	} else if c, ok := arrayOfObjs(sei.InnerError); ok {
-		// if there's only one error extract it
-		if len(c) == 1 {
-			se.InnerError = c[0]
-		} else {
-			// multiple errors, stuff them into the value
-			se.InnerError = map[string]interface{}{
-				"multi": c,
-			}
-		}
-	} else if c, ok := sei.InnerError.(string); ok {
-		se.InnerError = map[string]interface{}{"error": c}
-	} else if sei.InnerError != nil {
-		// stuff into InnerError
-		se.InnerError = map[string]interface{}{
-			"raw": sei.InnerError,
-		}
-	}
-	return nil
-}
-
-// RequestError describes an error response returned by Azure service.
-type RequestError struct {
-	autorest.DetailedError
-
-	// The error returned by the Azure service.
-	ServiceError *ServiceError `json:"error" xml:"Error"`
-
-	// The request id (from the x-ms-request-id-header) of the request.
-	RequestID string
-}
-
-// Error returns a human-friendly error message from service error.
-func (e RequestError) Error() string {
-	return fmt.Sprintf("autorest/azure: Service returned an error. Status=%v %v",
-		e.StatusCode, e.ServiceError)
-}
-
-// IsAzureError returns true if the passed error is an Azure Service error; false otherwise.
-func IsAzureError(e error) bool {
-	_, ok := e.(*RequestError)
-	return ok
-}
-
-// Resource contains details about an Azure resource.
-type Resource struct {
-	SubscriptionID string
-	ResourceGroup  string
-	Provider       string
-	ResourceType   string
-	ResourceName   string
-}
-
-// String function returns a string in form of azureResourceID
-func (r Resource) String() string {
-	return fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/%s/%s/%s", r.SubscriptionID, r.ResourceGroup, r.Provider, r.ResourceType, r.ResourceName)
-}
-
-// ParseResourceID parses a resource ID into a ResourceDetails struct.
-// See https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions-resource?tabs=json#resourceid.
-func ParseResourceID(resourceID string) (Resource, error) {
-
-	const resourceIDPatternText = `(?i)subscriptions/(.+)/resourceGroups/(.+)/providers/(.+?)/(.+?)/(.+)`
-	resourceIDPattern := regexp.MustCompile(resourceIDPatternText)
-	match := resourceIDPattern.FindStringSubmatch(resourceID)
-
-	if len(match) == 0 {
-		return Resource{}, fmt.Errorf("parsing failed for %s. Invalid resource Id format", resourceID)
-	}
-
-	v := strings.Split(match[5], "/")
-	resourceName := v[len(v)-1]
-
-	result := Resource{
-		SubscriptionID: match[1],
-		ResourceGroup:  match[2],
-		Provider:       match[3],
-		ResourceType:   match[4],
-		ResourceName:   resourceName,
-	}
-
-	return result, nil
-}
-
-// NewErrorWithError creates a new Error conforming object from the
-// passed packageType, method, statusCode of the given resp (UndefinedStatusCode
-// if resp is nil), message, and original error. message is treated as a format
-// string to which the optional args apply.
-func NewErrorWithError(original error, packageType string, method string, resp *http.Response, message string, args ...interface{}) RequestError {
-	if v, ok := original.(*RequestError); ok {
-		return *v
-	}
-
-	statusCode := autorest.UndefinedStatusCode
-	if resp != nil {
-		statusCode = resp.StatusCode
-	}
-	return RequestError{
-		DetailedError: autorest.DetailedError{
-			Original:    original,
-			PackageType: packageType,
-			Method:      method,
-			StatusCode:  statusCode,
-			Message:     fmt.Sprintf(message, args...),
-		},
-	}
-}
-
-// WithReturningClientID returns a PrepareDecorator that adds an HTTP extension header of
-// x-ms-client-request-id whose value is the passed, undecorated UUID (e.g.,
-// "0F39878C-5F76-4DB8-A25D-61D2C193C3CA"). It also sets the x-ms-return-client-request-id
-// header to true such that UUID accompanies the http.Response.
-func WithReturningClientID(uuid string) autorest.PrepareDecorator {
-	preparer := autorest.CreatePreparer(
-		WithClientID(uuid),
-		WithReturnClientID(true))
-
-	return func(p autorest.Preparer) autorest.Preparer {
-		return autorest.PreparerFunc(func(r *http.Request) (*http.Request, error) {
-			r, err := p.Prepare(r)
-			if err != nil {
-				return r, err
-			}
-			return preparer.Prepare(r)
-		})
-	}
-}
-
-// WithClientID returns a PrepareDecorator that adds an HTTP extension header of
-// x-ms-client-request-id whose value is passed, undecorated UUID (e.g.,
-// "0F39878C-5F76-4DB8-A25D-61D2C193C3CA").
-func WithClientID(uuid string) autorest.PrepareDecorator {
-	return autorest.WithHeader(HeaderClientID, uuid)
-}
-
-// WithReturnClientID returns a PrepareDecorator that adds an HTTP extension header of
-// x-ms-return-client-request-id whose boolean value indicates if the value of the
-// x-ms-client-request-id header should be included in the http.Response.
-func WithReturnClientID(b bool) autorest.PrepareDecorator {
-	return autorest.WithHeader(HeaderReturnClientID, strconv.FormatBool(b))
-}
-
-// ExtractClientID extracts the client identifier from the x-ms-client-request-id header set on the
-// http.Request sent to the service (and returned in the http.Response)
-func ExtractClientID(resp *http.Response) string {
-	return autorest.ExtractHeaderValue(HeaderClientID, resp)
-}
-
-// ExtractRequestID extracts the Azure server generated request identifier from the
-// x-ms-request-id header.
-func ExtractRequestID(resp *http.Response) string {
-	return autorest.ExtractHeaderValue(HeaderRequestID, resp)
-}
-
-// WithErrorUnlessStatusCode returns a RespondDecorator that emits an
-// azure.RequestError by reading the response body unless the response HTTP status code
-// is among the set passed.
-//
-// If there is a chance service may return responses other than the Azure error
-// format and the response cannot be parsed into an error, a decoding error will
-// be returned containing the response body. In any case, the Responder will
-// return an error if the status code is not satisfied.
-//
-// If this Responder returns an error, the response body will be replaced with
-// an in-memory reader, which needs no further closing.
-func WithErrorUnlessStatusCode(codes ...int) autorest.RespondDecorator {
-	return func(r autorest.Responder) autorest.Responder {
-		return autorest.ResponderFunc(func(resp *http.Response) error {
-			err := r.Respond(resp)
-			if err == nil && !autorest.ResponseHasStatusCode(resp, codes...) {
-				var e RequestError
-				defer resp.Body.Close()
-
-				encodedAs := autorest.EncodedAsJSON
-				if strings.Contains(resp.Header.Get("Content-Type"), "xml") {
-					encodedAs = autorest.EncodedAsXML
-				}
-
-				// Copy and replace the Body in case it does not contain an error object.
-				// This will leave the Body available to the caller.
-				b, decodeErr := autorest.CopyAndDecode(encodedAs, resp.Body, &e)
-				resp.Body = ioutil.NopCloser(&b)
-				if decodeErr != nil {
-					return fmt.Errorf("autorest/azure: error response cannot be parsed: %q error: %v", b, decodeErr)
-				}
-				if e.ServiceError == nil {
-					// Check if error is unwrapped ServiceError
-					decoder := autorest.NewDecoder(encodedAs, bytes.NewReader(b.Bytes()))
-					if err := decoder.Decode(&e.ServiceError); err != nil {
-						return fmt.Errorf("autorest/azure: error response cannot be parsed: %q error: %v", b, err)
-					}
-
-					// for example, should the API return the literal value `null` as the response
-					if e.ServiceError == nil {
-						e.ServiceError = &ServiceError{
-							Code:    "Unknown",
-							Message: "Unknown service error",
-							Details: []map[string]interface{}{
-								{
-									"HttpResponse.Body": b.String(),
-								},
-							},
-						}
-					}
-				}
-
-				if e.ServiceError != nil && e.ServiceError.Message == "" {
-					// if we're here it means the returned error wasn't OData v4 compliant.
-					// try to unmarshal the body in hopes of getting something.
-					rawBody := map[string]interface{}{}
-					decoder := autorest.NewDecoder(encodedAs, bytes.NewReader(b.Bytes()))
-					if err := decoder.Decode(&rawBody); err != nil {
-						return fmt.Errorf("autorest/azure: error response cannot be parsed: %q error: %v", b, err)
-					}
-
-					e.ServiceError = &ServiceError{
-						Code:    "Unknown",
-						Message: "Unknown service error",
-					}
-					if len(rawBody) > 0 {
-						e.ServiceError.Details = []map[string]interface{}{rawBody}
-					}
-				}
-				e.Response = resp
-				e.RequestID = ExtractRequestID(resp)
-				if e.StatusCode == nil {
-					e.StatusCode = resp.StatusCode
-				}
-				err = &e
-			}
-			return err
-		})
-	}
-}

vendor/github.com/Azure/go-autorest/autorest/azure/environments.go

@@ -1,331 +0,0 @@
-package azure
-
-// Copyright 2017 Microsoft Corporation
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-import (
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"strings"
-)
-
-const (
-	// EnvironmentFilepathName captures the name of the environment variable containing the path to the file
-	// to be used while populating the Azure Environment.
-	EnvironmentFilepathName = "AZURE_ENVIRONMENT_FILEPATH"
-
-	// NotAvailable is used for endpoints and resource IDs that are not available for a given cloud.
-	NotAvailable = "N/A"
-)
-
-var environments = map[string]Environment{
-	"AZURECHINACLOUD":        ChinaCloud,
-	"AZUREGERMANCLOUD":       GermanCloud,
-	"AZURECLOUD":             PublicCloud,
-	"AZUREPUBLICCLOUD":       PublicCloud,
-	"AZUREUSGOVERNMENT":      USGovernmentCloud,
-	"AZUREUSGOVERNMENTCLOUD": USGovernmentCloud, //TODO: deprecate
-}
-
-// ResourceIdentifier contains a set of Azure resource IDs.
-type ResourceIdentifier struct {
-	Graph               string `json:"graph"`
-	KeyVault            string `json:"keyVault"`
-	Datalake            string `json:"datalake"`
-	Batch               string `json:"batch"`
-	OperationalInsights string `json:"operationalInsights"`
-	OSSRDBMS            string `json:"ossRDBMS"`
-	Storage             string `json:"storage"`
-	Synapse             string `json:"synapse"`
-	ServiceBus          string `json:"serviceBus"`
-	SQLDatabase         string `json:"sqlDatabase"`
-	CosmosDB            string `json:"cosmosDB"`
-	ManagedHSM          string `json:"managedHSM"`
-	MicrosoftGraph      string `json:"microsoftGraph"`
-}
-
-// Environment represents a set of endpoints for each of Azure's Clouds.
-type Environment struct {
-	Name                         string             `json:"name"`
-	ManagementPortalURL          string             `json:"managementPortalURL"`
-	PublishSettingsURL           string             `json:"publishSettingsURL"`
-	ServiceManagementEndpoint    string             `json:"serviceManagementEndpoint"`
-	ResourceManagerEndpoint      string             `json:"resourceManagerEndpoint"`
-	ActiveDirectoryEndpoint      string             `json:"activeDirectoryEndpoint"`
-	GalleryEndpoint              string             `json:"galleryEndpoint"`
-	KeyVaultEndpoint             string             `json:"keyVaultEndpoint"`
-	ManagedHSMEndpoint           string             `json:"managedHSMEndpoint"`
-	GraphEndpoint                string             `json:"graphEndpoint"`
-	ServiceBusEndpoint           string             `json:"serviceBusEndpoint"`
-	BatchManagementEndpoint      string             `json:"batchManagementEndpoint"`
-	MicrosoftGraphEndpoint       string             `json:"microsoftGraphEndpoint"`
-	StorageEndpointSuffix        string             `json:"storageEndpointSuffix"`
-	CosmosDBDNSSuffix            string             `json:"cosmosDBDNSSuffix"`
-	MariaDBDNSSuffix             string             `json:"mariaDBDNSSuffix"`
-	MySQLDatabaseDNSSuffix       string             `json:"mySqlDatabaseDNSSuffix"`
-	PostgresqlDatabaseDNSSuffix  string             `json:"postgresqlDatabaseDNSSuffix"`
-	SQLDatabaseDNSSuffix         string             `json:"sqlDatabaseDNSSuffix"`
-	TrafficManagerDNSSuffix      string             `json:"trafficManagerDNSSuffix"`
-	KeyVaultDNSSuffix            string             `json:"keyVaultDNSSuffix"`
-	ManagedHSMDNSSuffix          string             `json:"managedHSMDNSSuffix"`
-	ServiceBusEndpointSuffix     string             `json:"serviceBusEndpointSuffix"`
-	ServiceManagementVMDNSSuffix string             `json:"serviceManagementVMDNSSuffix"`
-	ResourceManagerVMDNSSuffix   string             `json:"resourceManagerVMDNSSuffix"`
-	ContainerRegistryDNSSuffix   string             `json:"containerRegistryDNSSuffix"`
-	TokenAudience                string             `json:"tokenAudience"`
-	APIManagementHostNameSuffix  string             `json:"apiManagementHostNameSuffix"`
-	SynapseEndpointSuffix        string             `json:"synapseEndpointSuffix"`
-	DatalakeSuffix               string             `json:"datalakeSuffix"`
-	ResourceIdentifiers          ResourceIdentifier `json:"resourceIdentifiers"`
-}
-
-var (
-	// PublicCloud is the default public Azure cloud environment
-	PublicCloud = Environment{
-		Name:                         "AzurePublicCloud",
-		ManagementPortalURL:          "https://manage.windowsazure.com/",
-		PublishSettingsURL:           "https://manage.windowsazure.com/publishsettings/index",
-		ServiceManagementEndpoint:    "https://management.core.windows.net/",
-		ResourceManagerEndpoint:      "https://management.azure.com/",
-		ActiveDirectoryEndpoint:      "https://login.microsoftonline.com/",
-		GalleryEndpoint:              "https://gallery.azure.com/",
-		KeyVaultEndpoint:             "https://vault.azure.net/",
-		ManagedHSMEndpoint:           "https://managedhsm.azure.net/",
-		GraphEndpoint:                "https://graph.windows.net/",
-		ServiceBusEndpoint:           "https://servicebus.windows.net/",
-		BatchManagementEndpoint:      "https://batch.core.windows.net/",
-		MicrosoftGraphEndpoint:       "https://graph.microsoft.com/",
-		StorageEndpointSuffix:        "core.windows.net",
-		CosmosDBDNSSuffix:            "documents.azure.com",
-		MariaDBDNSSuffix:             "mariadb.database.azure.com",
-		MySQLDatabaseDNSSuffix:       "mysql.database.azure.com",
-		PostgresqlDatabaseDNSSuffix:  "postgres.database.azure.com",
-		SQLDatabaseDNSSuffix:         "database.windows.net",
-		TrafficManagerDNSSuffix:      "trafficmanager.net",
-		KeyVaultDNSSuffix:            "vault.azure.net",
-		ManagedHSMDNSSuffix:          "managedhsm.azure.net",
-		ServiceBusEndpointSuffix:     "servicebus.windows.net",
-		ServiceManagementVMDNSSuffix: "cloudapp.net",
-		ResourceManagerVMDNSSuffix:   "cloudapp.azure.com",
-		ContainerRegistryDNSSuffix:   "azurecr.io",
-		TokenAudience:                "https://management.azure.com/",
-		APIManagementHostNameSuffix:  "azure-api.net",
-		SynapseEndpointSuffix:        "dev.azuresynapse.net",
-		DatalakeSuffix:               "azuredatalakestore.net",
-		ResourceIdentifiers: ResourceIdentifier{
-			Graph:               "https://graph.windows.net/",
-			KeyVault:            "https://vault.azure.net",
-			Datalake:            "https://datalake.azure.net/",
-			Batch:               "https://batch.core.windows.net/",
-			OperationalInsights: "https://api.loganalytics.io",
-			OSSRDBMS:            "https://ossrdbms-aad.database.windows.net",
-			Storage:             "https://storage.azure.com/",
-			Synapse:             "https://dev.azuresynapse.net",
-			ServiceBus:          "https://servicebus.azure.net/",
-			SQLDatabase:         "https://database.windows.net/",
-			CosmosDB:            "https://cosmos.azure.com",
-			ManagedHSM:          "https://managedhsm.azure.net",
-			MicrosoftGraph:      "https://graph.microsoft.com/",
-		},
-	}
-
-	// USGovernmentCloud is the cloud environment for the US Government
-	USGovernmentCloud = Environment{
-		Name:                         "AzureUSGovernmentCloud",
-		ManagementPortalURL:          "https://manage.windowsazure.us/",
-		PublishSettingsURL:           "https://manage.windowsazure.us/publishsettings/index",
-		ServiceManagementEndpoint:    "https://management.core.usgovcloudapi.net/",
-		ResourceManagerEndpoint:      "https://management.usgovcloudapi.net/",
-		ActiveDirectoryEndpoint:      "https://login.microsoftonline.us/",
-		GalleryEndpoint:              "https://gallery.usgovcloudapi.net/",
-		KeyVaultEndpoint:             "https://vault.usgovcloudapi.net/",
-		ManagedHSMEndpoint:           NotAvailable,
-		GraphEndpoint:                "https://graph.windows.net/",
-		ServiceBusEndpoint:           "https://servicebus.usgovcloudapi.net/",
-		BatchManagementEndpoint:      "https://batch.core.usgovcloudapi.net/",
-		MicrosoftGraphEndpoint:       "https://graph.microsoft.us/",
-		StorageEndpointSuffix:        "core.usgovcloudapi.net",
-		CosmosDBDNSSuffix:            "documents.azure.us",
-		MariaDBDNSSuffix:             "mariadb.database.usgovcloudapi.net",
-		MySQLDatabaseDNSSuffix:       "mysql.database.usgovcloudapi.net",
-		PostgresqlDatabaseDNSSuffix:  "postgres.database.usgovcloudapi.net",
-		SQLDatabaseDNSSuffix:         "database.usgovcloudapi.net",
-		TrafficManagerDNSSuffix:      "usgovtrafficmanager.net",
-		KeyVaultDNSSuffix:            "vault.usgovcloudapi.net",
-		ManagedHSMDNSSuffix:          NotAvailable,
-		ServiceBusEndpointSuffix:     "servicebus.usgovcloudapi.net",
-		ServiceManagementVMDNSSuffix: "usgovcloudapp.net",
-		ResourceManagerVMDNSSuffix:   "cloudapp.usgovcloudapi.net",
-		ContainerRegistryDNSSuffix:   "azurecr.us",
-		TokenAudience:                "https://management.usgovcloudapi.net/",
-		APIManagementHostNameSuffix:  "azure-api.us",
-		SynapseEndpointSuffix:        "dev.azuresynapse.usgovcloudapi.net",
-		DatalakeSuffix:               NotAvailable,
-		ResourceIdentifiers: ResourceIdentifier{
-			Graph:               "https://graph.windows.net/",
-			KeyVault:            "https://vault.usgovcloudapi.net",
-			Datalake:            NotAvailable,
-			Batch:               "https://batch.core.usgovcloudapi.net/",
-			OperationalInsights: "https://api.loganalytics.us",
-			OSSRDBMS:            "https://ossrdbms-aad.database.usgovcloudapi.net",
-			Storage:             "https://storage.azure.com/",
-			Synapse:             "https://dev.azuresynapse.usgovcloudapi.net",
-			ServiceBus:          "https://servicebus.azure.net/",
-			SQLDatabase:         "https://database.usgovcloudapi.net/",
-			CosmosDB:            "https://cosmos.azure.com",
-			ManagedHSM:          NotAvailable,
-			MicrosoftGraph:      "https://graph.microsoft.us/",
-		},
-	}
-
-	// ChinaCloud is the cloud environment operated in China
-	ChinaCloud = Environment{
-		Name:                         "AzureChinaCloud",
-		ManagementPortalURL:          "https://manage.chinacloudapi.com/",
-		PublishSettingsURL:           "https://manage.chinacloudapi.com/publishsettings/index",
-		ServiceManagementEndpoint:    "https://management.core.chinacloudapi.cn/",
-		ResourceManagerEndpoint:      "https://management.chinacloudapi.cn/",
-		ActiveDirectoryEndpoint:      "https://login.chinacloudapi.cn/",
-		GalleryEndpoint:              "https://gallery.chinacloudapi.cn/",
-		KeyVaultEndpoint:             "https://vault.azure.cn/",
-		ManagedHSMEndpoint:           NotAvailable,
-		GraphEndpoint:                "https://graph.chinacloudapi.cn/",
-		ServiceBusEndpoint:           "https://servicebus.chinacloudapi.cn/",
-		BatchManagementEndpoint:      "https://batch.chinacloudapi.cn/",
-		MicrosoftGraphEndpoint:       "https://microsoftgraph.chinacloudapi.cn/",
-		StorageEndpointSuffix:        "core.chinacloudapi.cn",
-		CosmosDBDNSSuffix:            "documents.azure.cn",
-		MariaDBDNSSuffix:             "mariadb.database.chinacloudapi.cn",
-		MySQLDatabaseDNSSuffix:       "mysql.database.chinacloudapi.cn",
-		PostgresqlDatabaseDNSSuffix:  "postgres.database.chinacloudapi.cn",
-		SQLDatabaseDNSSuffix:         "database.chinacloudapi.cn",
-		TrafficManagerDNSSuffix:      "trafficmanager.cn",
-		KeyVaultDNSSuffix:            "vault.azure.cn",
-		ManagedHSMDNSSuffix:          NotAvailable,
-		ServiceBusEndpointSuffix:     "servicebus.chinacloudapi.cn",
-		ServiceManagementVMDNSSuffix: "chinacloudapp.cn",
-		ResourceManagerVMDNSSuffix:   "cloudapp.chinacloudapi.cn",
-		ContainerRegistryDNSSuffix:   "azurecr.cn",
-		TokenAudience:                "https://management.chinacloudapi.cn/",
-		APIManagementHostNameSuffix:  "azure-api.cn",
-		SynapseEndpointSuffix:        "dev.azuresynapse.azure.cn",
-		DatalakeSuffix:               NotAvailable,
-		ResourceIdentifiers: ResourceIdentifier{
-			Graph:               "https://graph.chinacloudapi.cn/",
-			KeyVault:            "https://vault.azure.cn",
-			Datalake:            NotAvailable,
-			Batch:               "https://batch.chinacloudapi.cn/",
-			OperationalInsights: NotAvailable,
-			OSSRDBMS:            "https://ossrdbms-aad.database.chinacloudapi.cn",
-			Storage:             "https://storage.azure.com/",
-			Synapse:             "https://dev.azuresynapse.net",
-			ServiceBus:          "https://servicebus.azure.net/",
-			SQLDatabase:         "https://database.chinacloudapi.cn/",
-			CosmosDB:            "https://cosmos.azure.com",
-			ManagedHSM:          NotAvailable,
-			MicrosoftGraph:      "https://microsoftgraph.chinacloudapi.cn",
-		},
-	}
-
-	// GermanCloud is the cloud environment operated in Germany
-	GermanCloud = Environment{
-		Name:                         "AzureGermanCloud",
-		ManagementPortalURL:          "http://portal.microsoftazure.de/",
-		PublishSettingsURL:           "https://manage.microsoftazure.de/publishsettings/index",
-		ServiceManagementEndpoint:    "https://management.core.cloudapi.de/",
-		ResourceManagerEndpoint:      "https://management.microsoftazure.de/",
-		ActiveDirectoryEndpoint:      "https://login.microsoftonline.de/",
-		GalleryEndpoint:              "https://gallery.cloudapi.de/",
-		KeyVaultEndpoint:             "https://vault.microsoftazure.de/",
-		ManagedHSMEndpoint:           NotAvailable,
-		GraphEndpoint:                "https://graph.cloudapi.de/",
-		ServiceBusEndpoint:           "https://servicebus.cloudapi.de/",
-		BatchManagementEndpoint:      "https://batch.cloudapi.de/",
-		MicrosoftGraphEndpoint:       NotAvailable,
-		StorageEndpointSuffix:        "core.cloudapi.de",
-		CosmosDBDNSSuffix:            "documents.microsoftazure.de",
-		MariaDBDNSSuffix:             "mariadb.database.cloudapi.de",
-		MySQLDatabaseDNSSuffix:       "mysql.database.cloudapi.de",
-		PostgresqlDatabaseDNSSuffix:  "postgres.database.cloudapi.de",
-		SQLDatabaseDNSSuffix:         "database.cloudapi.de",
-		TrafficManagerDNSSuffix:      "azuretrafficmanager.de",
-		KeyVaultDNSSuffix:            "vault.microsoftazure.de",
-		ManagedHSMDNSSuffix:          NotAvailable,
-		ServiceBusEndpointSuffix:     "servicebus.cloudapi.de",
-		ServiceManagementVMDNSSuffix: "azurecloudapp.de",
-		ResourceManagerVMDNSSuffix:   "cloudapp.microsoftazure.de",
-		ContainerRegistryDNSSuffix:   NotAvailable,
-		TokenAudience:                "https://management.microsoftazure.de/",
-		APIManagementHostNameSuffix:  NotAvailable,
-		SynapseEndpointSuffix:        NotAvailable,
-		DatalakeSuffix:               NotAvailable,
-		ResourceIdentifiers: ResourceIdentifier{
-			Graph:               "https://graph.cloudapi.de/",
-			KeyVault:            "https://vault.microsoftazure.de",
-			Datalake:            NotAvailable,
-			Batch:               "https://batch.cloudapi.de/",
-			OperationalInsights: NotAvailable,
-			OSSRDBMS:            "https://ossrdbms-aad.database.cloudapi.de",
-			Storage:             "https://storage.azure.com/",
-			Synapse:             NotAvailable,
-			ServiceBus:          "https://servicebus.azure.net/",
-			SQLDatabase:         "https://database.cloudapi.de/",
-			CosmosDB:            "https://cosmos.azure.com",
-			ManagedHSM:          NotAvailable,
-			MicrosoftGraph:      NotAvailable,
-		},
-	}
-)
-
-// EnvironmentFromName returns an Environment based on the common name specified.
-func EnvironmentFromName(name string) (Environment, error) {
-	// IMPORTANT
-	// As per @radhikagupta5:
-	// This is technical debt, fundamentally here because Kubernetes is not currently accepting
-	// contributions to the providers. Once that is an option, the provider should be updated to
-	// directly call `EnvironmentFromFile`. Until then, we rely on dispatching Azure Stack environment creation
-	// from this method based on the name that is provided to us.
-	if strings.EqualFold(name, "AZURESTACKCLOUD") {
-		return EnvironmentFromFile(os.Getenv(EnvironmentFilepathName))
-	}
-
-	name = strings.ToUpper(name)
-	env, ok := environments[name]
-	if !ok {
-		return env, fmt.Errorf("autorest/azure: There is no cloud environment matching the name %q", name)
-	}
-
-	return env, nil
-}
-
-// EnvironmentFromFile loads an Environment from a configuration file available on disk.
-// This function is particularly useful in the Hybrid Cloud model, where one must define their own
-// endpoints.
-func EnvironmentFromFile(location string) (unmarshaled Environment, err error) {
-	fileContents, err := ioutil.ReadFile(location)
-	if err != nil {
-		return
-	}
-
-	err = json.Unmarshal(fileContents, &unmarshaled)
-
-	return
-}
-
-// SetEnvironment updates the environment map with the specified values.
-func SetEnvironment(name string, env Environment) {
-	environments[strings.ToUpper(name)] = env
-}