Merge pull request #2867 from crazy-max/v0.19_backport_entitlement-path-fix

[v0.19 backport] bake: change evaluation of entitlement paths

.github/workflows/build.yml

@@ -28,8 +28,8 @@ on:
       - 'docs/**'
 
 env:
-  SETUP_BUILDX_VERSION: "edge"
-  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
+  BUILDX_VERSION: "latest"
+  BUILDKIT_IMAGE: "moby/buildkit:latest"
   SCOUT_VERSION: "1.11.0"
   REPO_SLUG: "docker/buildx-bin"
   DESTDIR: "./bin"
@@ -54,9 +54,9 @@ jobs:
           - master
           - latest
           - buildx-stable-1
-          - v0.18.2
           - v0.17.2
           - v0.16.0
+          - v0.15.2
         worker:
           - docker-container
           - remote
@@ -121,14 +121,13 @@ jobs:
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
         name: Build test image
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v5
         with:
-          source: .
           targets: integration-test
           set: |
             *.output=type=docker,name=${{ env.TEST_IMAGE_ID }}
@@ -235,63 +234,6 @@ jobs:
           name: test-reports-${{ env.TESTREPORTS_NAME }}
           path: ${{ env.TESTREPORTS_BASEDIR }}
 
-  test-bsd-unit:
-    runs-on: ubuntu-22.04
-    continue-on-error: true
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - freebsd
-          - openbsd
-    steps:
-      -
-        name: Prepare
-        run: |
-          echo "VAGRANT_FILE=hack/Vagrantfile.${{ matrix.os }}" >> $GITHUB_ENV
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Cache Vagrant boxes
-        uses: actions/cache@v4
-        with:
-          path: ~/.vagrant.d/boxes
-          key: ${{ runner.os }}-vagrant-${{ matrix.os }}-${{ hashFiles(env.VAGRANT_FILE) }}
-          restore-keys: |
-            ${{ runner.os }}-vagrant-${{ matrix.os }}-
-      -
-        name: Install vagrant
-        run: |
-          set -x
-          sudo apt-get update
-          sudo apt-get install -y libvirt-daemon libvirt-daemon-system vagrant vagrant-libvirt ruby-libvirt
-          sudo systemctl enable --now libvirtd
-          sudo chmod a+rw /var/run/libvirt/libvirt-sock
-          vagrant plugin install vagrant-libvirt
-          vagrant --version
-      -
-        name: Set up vagrant
-        run: |
-          ln -sf ${{ env.VAGRANT_FILE }} Vagrantfile
-          vagrant up --no-tty
-      -
-        name: Test
-        run: |
-          vagrant ssh -- "cd /vagrant; SKIP_INTEGRATION_TESTS=1 go test -mod=vendor -coverprofile=coverage.txt -covermode=atomic ${{ env.TESTFLAGS }} ./..."
-          vagrant ssh -c "sudo cat /vagrant/coverage.txt" > coverage.txt
-      -
-        name: Upload coverage
-        if: always()
-        uses: codecov/codecov-action@v5
-        with:
-          files: ./coverage.txt
-          env_vars: RUNNER_OS
-          flags: unit,${{ matrix.os }}
-          token: ${{ secrets.CODECOV_TOKEN }}
-        env:
-          RUNNER_OS: ${{ matrix.os }}
-
   govulncheck:
     runs-on: ubuntu-24.04
     permissions:
@@ -300,16 +242,19 @@ jobs:
       # required to write sarif report
       security-events: write
     steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
         name: Run
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v5
         with:
           targets: govulncheck
         env:
@@ -363,8 +308,8 @@ jobs:
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
         name: Build
@@ -389,6 +334,9 @@ jobs:
       - test-unit
     if: ${{ github.event_name != 'pull_request' && github.repository == 'docker/buildx' }}
     steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
       -
         name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -396,8 +344,8 @@ jobs:
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
         name: Docker meta
@@ -420,11 +368,11 @@ jobs:
           password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
       -
         name: Build and push image
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v5
         with:
           files: |
             ./docker-bake.hcl
-            cwd://${{ steps.meta.outputs.bake-file }}
+            ${{ steps.meta.outputs.bake-file }}
           targets: image-cross
           push: ${{ github.event_name != 'pull_request' }}
           sbom: true
@@ -443,6 +391,9 @@ jobs:
     needs:
       - bin-image
     steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
       -
         name: Login to DockerHub
         uses: docker/login-action@v3
@@ -497,7 +448,7 @@ jobs:
       -
         name: GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda  # v2.2.1
+        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974  # v2.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/docs-release.yml

@@ -19,10 +19,6 @@ on:
     types:
       - released
 
-env:
-  SETUP_BUILDX_VERSION: "edge"
-  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
-
 jobs:
   open-pr:
     runs-on: ubuntu-24.04
@@ -50,13 +46,9 @@ jobs:
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
-          buildkitd-flags: --debug
       -
         name: Generate yaml
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v5
         with:
           source: ${{ github.server_url }}/${{ github.repository }}.git#${{ env.RELEASE_NAME }}
           targets: update-docs
@@ -77,7 +69,7 @@ jobs:
           VENDOR_MODULE: github.com/docker/buildx@${{ env.RELEASE_NAME }}
       -
         name: Create PR on docs repo
-        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f  # v7.0.6
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
         with:
           token: ${{ secrets.GHPAT_DOCS_DISPATCH }}
           push-to-fork: docker-tools-robot/docker.github.io

.github/workflows/docs-upstream.yml

@@ -29,24 +29,21 @@ on:
       - '.github/workflows/docs-upstream.yml'
       - 'docs/**'
 
-env:
-  SETUP_BUILDX_VERSION: "edge"
-  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
-
 jobs:
   docs-yaml:
     runs-on: ubuntu-24.04
     steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
-          buildkitd-flags: --debug
+          version: latest
       -
         name: Build reference YAML docs
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v5
         with:
           targets: update-docs
           provenance: false

.github/workflows/e2e.yml

@@ -26,8 +26,6 @@ on:
       - 'docs/**'
 
 env:
-  SETUP_BUILDX_VERSION: "edge"
-  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   DESTDIR: "./bin"
   K3S_VERSION: "v1.21.2-k3s1"
 
@@ -35,16 +33,16 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
-          buildkitd-flags: --debug
+          version: latest
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v5
         with:
           targets: binaries
           set: |
@@ -177,75 +175,3 @@ jobs:
           DRIVER_OPT: ${{ matrix.driver-opt }}
           ENDPOINT: ${{ matrix.endpoint }}
           PLATFORMS: ${{ matrix.platforms }}
-
-  bake:
-    runs-on: ubuntu-24.04
-    needs:
-      - build
-    env:
-      DOCKER_BUILD_CHECKS_ANNOTATIONS: false
-      DOCKER_BUILD_SUMMARY: false
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          -
-            # https://github.com/docker/bake-action/blob/v5.11.0/.github/workflows/ci.yml#L227-L237
-            source: "https://github.com/docker/bake-action.git#v5.11.0:test/go"
-            overrides: |
-              *.output=/tmp/bake-build
-          -
-            # https://github.com/tonistiigi/xx/blob/2fc85604e7280bfb3f626569bd4c5413c43eb4af/.github/workflows/ld.yml#L90-L98
-            source: "https://github.com/tonistiigi/xx.git#2fc85604e7280bfb3f626569bd4c5413c43eb4af"
-            targets: |
-              ld64-static-tgz
-            overrides: |
-              ld64-static-tgz.output=type=local,dest=./dist
-              ld64-static-tgz.platform=linux/amd64
-              ld64-static-tgz.cache-from=type=gha,scope=xx-ld64-static-tgz
-              ld64-static-tgz.cache-to=type=gha,scope=xx-ld64-static-tgz
-          -
-            # https://github.com/moby/buildkit-bench/blob/54c194011c4fc99a94aa75d4b3d4f3ffd4c4ce27/docker-bake.hcl#L154-L160
-            source: "https://github.com/moby/buildkit-bench.git#54c194011c4fc99a94aa75d4b3d4f3ffd4c4ce27"
-            targets: |
-              tests-buildkit
-            envs: |
-              BUILDKIT_REFS=v0.18.2
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Environment variables
-        if: matrix.envs != ''
-        run: |
-          for l in "${{ matrix.envs }}"; do
-            echo "${l?}" >> $GITHUB_ENV
-          done
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Install buildx
-        uses: actions/download-artifact@v4
-        with:
-          name: binary
-          path: /home/runner/.docker/cli-plugins
-      -
-        name: Fix perms and check
-        run: |
-          chmod +x /home/runner/.docker/cli-plugins/docker-buildx
-          docker buildx version
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
-          buildkitd-flags: --debug
-      -
-        name: Build
-        uses: docker/bake-action@v6
-        with:
-          source: ${{ matrix.source }}
-          targets: ${{ matrix.targets }}
-          set: ${{ matrix.overrides }}

.github/workflows/validate.yml

@@ -25,10 +25,6 @@ on:
     paths-ignore:
       - '.github/releases.json'
 
-env:
-  SETUP_BUILDX_VERSION: "edge"
-  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
-
 jobs:
   prepare:
     runs-on: ubuntu-24.04
@@ -94,16 +90,17 @@ jobs:
           if [ "$GITHUB_REPOSITORY" = "docker/buildx" ]; then
             echo "GOLANGCI_LINT_MULTIPLATFORM=1" >> $GITHUB_ENV
           fi
+      -
+        name: Checkout
+        uses: actions/checkout@v4
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
-          buildkitd-flags: --debug
+          version: latest
       -
         name: Validate
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v5
         with:
           targets: ${{ matrix.target }}
           set: |

Dockerfile

@@ -1,20 +1,19 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.23
-ARG ALPINE_VERSION=3.21
 ARG XX_VERSION=1.6.1
 
 # for testing
-ARG DOCKER_VERSION=27.4.1
+ARG DOCKER_VERSION=27.4.0-rc.2
 ARG DOCKER_VERSION_ALT_26=26.1.3
 ARG DOCKER_CLI_VERSION=${DOCKER_VERSION}
 ARG GOTESTSUM_VERSION=v1.12.0
 ARG REGISTRY_VERSION=2.8.3
-ARG BUILDKIT_VERSION=v0.18.2
-ARG UNDOCK_VERSION=0.9.0
+ARG BUILDKIT_VERSION=v0.17.2
+ARG UNDOCK_VERSION=0.8.0
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS golatest
 FROM moby/moby-bin:$DOCKER_VERSION AS docker-engine
 FROM dockereng/cli-bin:$DOCKER_CLI_VERSION AS docker-cli
 FROM moby/moby-bin:$DOCKER_VERSION_ALT_26 AS docker-engine-alt
@@ -139,7 +138,7 @@ FROM integration-test-base AS integration-test
 COPY . .
 
 # Release
-FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS releaser
+FROM --platform=$BUILDPLATFORM alpine AS releaser
 WORKDIR /work
 ARG TARGETPLATFORM
 RUN --mount=from=binaries \
@@ -154,7 +153,7 @@ COPY --from=releaser /out/ /
 
 # Shell
 FROM docker:$DOCKER_VERSION AS dockerd-release
-FROM alpine:${ALPINE_VERSION} AS shell
+FROM alpine AS shell
 RUN apk add --no-cache iptables tmux git vim less openssh
 RUN mkdir -p /usr/local/lib/docker/cli-plugins && ln -s /usr/local/bin/buildx /usr/local/lib/docker/cli-plugins/docker-buildx
 COPY ./hack/demo-env/entrypoint.sh /usr/local/bin

bake/bake.go

@@ -2,7 +2,6 @@ package bake
 
 import (
 	"context"
-	"encoding"
 	"io"
 	"os"
 	"path"
@@ -54,8 +53,8 @@ func defaultFilenames() []string {
 	names = append(names, composecli.DefaultFileNames...)
 	names = append(names, []string{
 		"docker-bake.json",
-		"docker-bake.hcl",
 		"docker-bake.override.json",
+		"docker-bake.hcl",
 		"docker-bake.override.hcl",
 	}...)
 	return names
@@ -208,9 +207,8 @@ func ReadTargets(ctx context.Context, files []File, targets, overrides []string,
 	if err != nil {
 		return nil, nil, err
 	}
-
-	targetsMap := map[string]*Target{}
-	groupsMap := map[string]*Group{}
+	m := map[string]*Target{}
+	n := map[string]*Group{}
 	for _, target := range targets {
 		ts, gs := c.ResolveGroup(target)
 		for _, tname := range ts {
@@ -219,13 +217,13 @@ func ReadTargets(ctx context.Context, files []File, targets, overrides []string,
 				return nil, nil, err
 			}
 			if t != nil {
-				targetsMap[tname] = t
+				m[tname] = t
 			}
 		}
 		for _, gname := range gs {
 			for _, group := range c.Groups {
 				if group.Name == gname {
-					groupsMap[gname] = group
+					n[gname] = group
 					break
 				}
 			}
@@ -233,26 +231,25 @@ func ReadTargets(ctx context.Context, files []File, targets, overrides []string,
 	}
 
 	for _, target := range targets {
-		if _, ok := groupsMap["default"]; ok && target == "default" {
+		if target == "default" {
 			continue
 		}
-		if _, ok := groupsMap["default"]; !ok {
-			groupsMap["default"] = &Group{Name: "default"}
+		if _, ok := n["default"]; !ok {
+			n["default"] = &Group{Name: "default"}
 		}
-		groupsMap["default"].Targets = append(groupsMap["default"].Targets, target)
+		n["default"].Targets = append(n["default"].Targets, target)
 	}
-	if g, ok := groupsMap["default"]; ok {
+	if g, ok := n["default"]; ok {
 		g.Targets = dedupSlice(g.Targets)
-		sort.Strings(g.Targets)
 	}
 
-	for name, t := range targetsMap {
-		if err := c.loadLinks(name, t, targetsMap, o, nil, ent); err != nil {
+	for name, t := range m {
+		if err := c.loadLinks(name, t, m, o, nil, ent); err != nil {
 			return nil, nil, err
 		}
 	}
 
-	return targetsMap, groupsMap, nil
+	return m, n, nil
 }
 
 func dedupSlice(s []string) []string {
@@ -499,9 +496,7 @@ func (c Config) loadLinks(name string, t *Target, m map[string]*Target, o map[st
 				if err != nil {
 					return err
 				}
-				t2.Outputs = []*buildflags.ExportEntry{
-					{Type: "cacheonly"},
-				}
+				t2.Outputs = []string{"type=cacheonly"}
 				t2.linked = true
 				m[target] = t2
 			}
@@ -517,8 +512,8 @@ func (c Config) loadLinks(name string, t *Target, m map[string]*Target, o map[st
 			}
 
 			if len(t.Platforms) > 1 && len(t2.Platforms) > 1 {
-				if !isSubset(t.Platforms, t2.Platforms) {
-					return errors.Errorf("target %s can't be used by %s because its platforms %v are not a subset of %v", target, name, t.Platforms, t2.Platforms)
+				if !sliceEqual(t.Platforms, t2.Platforms) {
+					return errors.Errorf("target %s can't be used by %s because it is defined for different platforms %v and %v", target, name, t2.Platforms, t.Platforms)
 				}
 			}
 		}
@@ -700,30 +695,30 @@ type Target struct {
 	// Inherits is the only field that cannot be overridden with --set
 	Inherits []string `json:"inherits,omitempty" hcl:"inherits,optional" cty:"inherits"`
 
-	Annotations      []string                `json:"annotations,omitempty" hcl:"annotations,optional" cty:"annotations"`
-	Attest           buildflags.Attests      `json:"attest,omitempty" hcl:"attest,optional" cty:"attest"`
-	Context          *string                 `json:"context,omitempty" hcl:"context,optional" cty:"context"`
-	Contexts         map[string]string       `json:"contexts,omitempty" hcl:"contexts,optional" cty:"contexts"`
-	Dockerfile       *string                 `json:"dockerfile,omitempty" hcl:"dockerfile,optional" cty:"dockerfile"`
-	DockerfileInline *string                 `json:"dockerfile-inline,omitempty" hcl:"dockerfile-inline,optional" cty:"dockerfile-inline"`
-	Args             map[string]*string      `json:"args,omitempty" hcl:"args,optional" cty:"args"`
-	Labels           map[string]*string      `json:"labels,omitempty" hcl:"labels,optional" cty:"labels"`
-	Tags             []string                `json:"tags,omitempty" hcl:"tags,optional" cty:"tags"`
-	CacheFrom        buildflags.CacheOptions `json:"cache-from,omitempty" hcl:"cache-from,optional" cty:"cache-from"`
-	CacheTo          buildflags.CacheOptions `json:"cache-to,omitempty" hcl:"cache-to,optional" cty:"cache-to"`
-	Target           *string                 `json:"target,omitempty" hcl:"target,optional" cty:"target"`
-	Secrets          buildflags.Secrets      `json:"secret,omitempty" hcl:"secret,optional" cty:"secret"`
-	SSH              buildflags.SSHKeys      `json:"ssh,omitempty" hcl:"ssh,optional" cty:"ssh"`
-	Platforms        []string                `json:"platforms,omitempty" hcl:"platforms,optional" cty:"platforms"`
-	Outputs          buildflags.Exports      `json:"output,omitempty" hcl:"output,optional" cty:"output"`
-	Pull             *bool                   `json:"pull,omitempty" hcl:"pull,optional" cty:"pull"`
-	NoCache          *bool                   `json:"no-cache,omitempty" hcl:"no-cache,optional" cty:"no-cache"`
-	NetworkMode      *string                 `json:"network,omitempty" hcl:"network,optional" cty:"network"`
-	NoCacheFilter    []string                `json:"no-cache-filter,omitempty" hcl:"no-cache-filter,optional" cty:"no-cache-filter"`
-	ShmSize          *string                 `json:"shm-size,omitempty" hcl:"shm-size,optional" cty:"shm-size"`
-	Ulimits          []string                `json:"ulimits,omitempty" hcl:"ulimits,optional" cty:"ulimits"`
-	Call             *string                 `json:"call,omitempty" hcl:"call,optional" cty:"call"`
-	Entitlements     []string                `json:"entitlements,omitempty" hcl:"entitlements,optional" cty:"entitlements"`
+	Annotations      []string           `json:"annotations,omitempty" hcl:"annotations,optional" cty:"annotations"`
+	Attest           []string           `json:"attest,omitempty" hcl:"attest,optional" cty:"attest"`
+	Context          *string            `json:"context,omitempty" hcl:"context,optional" cty:"context"`
+	Contexts         map[string]string  `json:"contexts,omitempty" hcl:"contexts,optional" cty:"contexts"`
+	Dockerfile       *string            `json:"dockerfile,omitempty" hcl:"dockerfile,optional" cty:"dockerfile"`
+	DockerfileInline *string            `json:"dockerfile-inline,omitempty" hcl:"dockerfile-inline,optional" cty:"dockerfile-inline"`
+	Args             map[string]*string `json:"args,omitempty" hcl:"args,optional" cty:"args"`
+	Labels           map[string]*string `json:"labels,omitempty" hcl:"labels,optional" cty:"labels"`
+	Tags             []string           `json:"tags,omitempty" hcl:"tags,optional" cty:"tags"`
+	CacheFrom        []string           `json:"cache-from,omitempty"  hcl:"cache-from,optional" cty:"cache-from"`
+	CacheTo          []string           `json:"cache-to,omitempty"  hcl:"cache-to,optional" cty:"cache-to"`
+	Target           *string            `json:"target,omitempty" hcl:"target,optional" cty:"target"`
+	Secrets          []string           `json:"secret,omitempty" hcl:"secret,optional" cty:"secret"`
+	SSH              []string           `json:"ssh,omitempty" hcl:"ssh,optional" cty:"ssh"`
+	Platforms        []string           `json:"platforms,omitempty" hcl:"platforms,optional" cty:"platforms"`
+	Outputs          []string           `json:"output,omitempty" hcl:"output,optional" cty:"output"`
+	Pull             *bool              `json:"pull,omitempty" hcl:"pull,optional" cty:"pull"`
+	NoCache          *bool              `json:"no-cache,omitempty" hcl:"no-cache,optional" cty:"no-cache"`
+	NetworkMode      *string            `json:"network,omitempty" hcl:"network,optional" cty:"network"`
+	NoCacheFilter    []string           `json:"no-cache-filter,omitempty" hcl:"no-cache-filter,optional" cty:"no-cache-filter"`
+	ShmSize          *string            `json:"shm-size,omitempty" hcl:"shm-size,optional"`
+	Ulimits          []string           `json:"ulimits,omitempty" hcl:"ulimits,optional"`
+	Call             *string            `json:"call,omitempty" hcl:"call,optional" cty:"call"`
+	Entitlements     []string           `json:"entitlements,omitempty" hcl:"entitlements,optional" cty:"entitlements"`
 	// IMPORTANT: if you add more fields here, do not forget to update newOverrides/AddOverrides and docs/bake-reference.md.
 
 	// linked is a private field to mark a target used as a linked one
@@ -738,23 +733,23 @@ var (
 )
 
 func (t *Target) normalize() {
-	t.Annotations = removeDupesStr(t.Annotations)
-	t.Attest = t.Attest.Normalize()
-	t.Tags = removeDupesStr(t.Tags)
-	t.Secrets = t.Secrets.Normalize()
-	t.SSH = t.SSH.Normalize()
-	t.Platforms = removeDupesStr(t.Platforms)
-	t.CacheFrom = t.CacheFrom.Normalize()
-	t.CacheTo = t.CacheTo.Normalize()
-	t.Outputs = t.Outputs.Normalize()
-	t.NoCacheFilter = removeDupesStr(t.NoCacheFilter)
-	t.Ulimits = removeDupesStr(t.Ulimits)
+	t.Annotations = removeDupes(t.Annotations)
+	t.Attest = removeAttestDupes(t.Attest)
+	t.Tags = removeDupes(t.Tags)
+	t.Secrets = removeDupes(t.Secrets)
+	t.SSH = removeDupes(t.SSH)
+	t.Platforms = removeDupes(t.Platforms)
+	t.CacheFrom = removeDupes(t.CacheFrom)
+	t.CacheTo = removeDupes(t.CacheTo)
+	t.Outputs = removeDupes(t.Outputs)
+	t.NoCacheFilter = removeDupes(t.NoCacheFilter)
+	t.Ulimits = removeDupes(t.Ulimits)
 
 	if t.NetworkMode != nil && *t.NetworkMode == "host" {
 		t.Entitlements = append(t.Entitlements, "network.host")
 	}
 
-	t.Entitlements = removeDupesStr(t.Entitlements)
+	t.Entitlements = removeDupes(t.Entitlements)
 
 	for k, v := range t.Contexts {
 		if v == "" {
@@ -813,19 +808,20 @@ func (t *Target) Merge(t2 *Target) {
 		t.Annotations = append(t.Annotations, t2.Annotations...)
 	}
 	if t2.Attest != nil { // merge
-		t.Attest = t.Attest.Merge(t2.Attest)
+		t.Attest = append(t.Attest, t2.Attest...)
+		t.Attest = removeAttestDupes(t.Attest)
 	}
 	if t2.Secrets != nil { // merge
-		t.Secrets = t.Secrets.Merge(t2.Secrets)
+		t.Secrets = append(t.Secrets, t2.Secrets...)
 	}
 	if t2.SSH != nil { // merge
-		t.SSH = t.SSH.Merge(t2.SSH)
+		t.SSH = append(t.SSH, t2.SSH...)
 	}
 	if t2.Platforms != nil { // no merge
 		t.Platforms = t2.Platforms
 	}
 	if t2.CacheFrom != nil { // merge
-		t.CacheFrom = t.CacheFrom.Merge(t2.CacheFrom)
+		t.CacheFrom = append(t.CacheFrom, t2.CacheFrom...)
 	}
 	if t2.CacheTo != nil { // no merge
 		t.CacheTo = t2.CacheTo
@@ -896,12 +892,12 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
 		case "tags":
 			t.Tags = o.ArrValue
 		case "cache-from":
-			cacheFrom, err := parseCacheArrValues(o.ArrValue)
+			t.CacheFrom = o.ArrValue
+			cacheFrom, err := buildflags.ParseCacheEntry(o.ArrValue)
 			if err != nil {
 				return err
 			}
-			t.CacheFrom = cacheFrom
-			for _, c := range t.CacheFrom {
+			for _, c := range cacheFrom {
 				if c.Type == "local" {
 					if v, ok := c.Attrs["src"]; ok {
 						ent.FSRead = append(ent.FSRead, v)
@@ -909,12 +905,12 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
 				}
 			}
 		case "cache-to":
-			cacheTo, err := parseCacheArrValues(o.ArrValue)
+			t.CacheTo = o.ArrValue
+			cacheTo, err := buildflags.ParseCacheEntry(o.ArrValue)
 			if err != nil {
 				return err
 			}
-			t.CacheTo = cacheTo
-			for _, c := range t.CacheTo {
+			for _, c := range cacheTo {
 				if c.Type == "local" {
 					if v, ok := c.Attrs["dest"]; ok {
 						ent.FSWrite = append(ent.FSWrite, v)
@@ -926,34 +922,34 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
 		case "call":
 			t.Call = &value
 		case "secrets":
-			secrets, err := parseArrValue[buildflags.Secret](o.ArrValue)
+			t.Secrets = o.ArrValue
+			secrets, err := buildflags.ParseSecretSpecs(o.ArrValue)
 			if err != nil {
 				return errors.Wrap(err, "invalid value for outputs")
 			}
-			t.Secrets = secrets
-			for _, s := range t.Secrets {
+			for _, s := range secrets {
 				if s.FilePath != "" {
 					ent.FSRead = append(ent.FSRead, s.FilePath)
 				}
 			}
 		case "ssh":
-			ssh, err := parseArrValue[buildflags.SSH](o.ArrValue)
+			t.SSH = o.ArrValue
+			ssh, err := buildflags.ParseSSHSpecs(o.ArrValue)
 			if err != nil {
 				return errors.Wrap(err, "invalid value for outputs")
 			}
-			t.SSH = ssh
-			for _, s := range t.SSH {
+			for _, s := range ssh {
 				ent.FSRead = append(ent.FSRead, s.Paths...)
 			}
 		case "platform":
 			t.Platforms = o.ArrValue
 		case "output":
-			outputs, err := parseArrValue[buildflags.ExportEntry](o.ArrValue)
+			t.Outputs = o.ArrValue
+			outputs, err := buildflags.ParseExports(o.ArrValue)
 			if err != nil {
 				return errors.Wrap(err, "invalid value for outputs")
 			}
-			t.Outputs = outputs
-			for _, o := range t.Outputs {
+			for _, o := range outputs {
 				if o.Destination != "" {
 					ent.FSWrite = append(ent.FSWrite, o.Destination)
 				}
@@ -970,11 +966,7 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
 		case "annotations":
 			t.Annotations = append(t.Annotations, o.ArrValue...)
 		case "attest":
-			attest, err := parseArrValue[buildflags.Attest](o.ArrValue)
-			if err != nil {
-				return errors.Wrap(err, "invalid value for attest")
-			}
-			t.Attest = t.Attest.Merge(attest)
+			t.Attest = append(t.Attest, o.ArrValue...)
 		case "no-cache":
 			noCache, err := strconv.ParseBool(value)
 			if err != nil {
@@ -1179,16 +1171,6 @@ func updateContext(t *build.Inputs, inp *Input) {
 	t.ContextState = &st
 }
 
-func isRemoteContext(t build.Inputs, inp *Input) bool {
-	if build.IsRemoteURL(t.ContextPath) {
-		return true
-	}
-	if inp != nil && build.IsRemoteURL(inp.URL) && !strings.HasPrefix(t.ContextPath, "cwd://") {
-		return true
-	}
-	return false
-}
-
 func collectLocalPaths(t build.Inputs) []string {
 	var out []string
 	if t.ContextState == nil {
@@ -1348,35 +1330,28 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 	}
 	bo.Platforms = platforms
 
-	secrets := t.Secrets
-	if isRemoteContext(bi, inp) {
-		if _, ok := os.LookupEnv("BUILDX_BAKE_GIT_AUTH_TOKEN"); ok {
-			secrets = append(secrets, &buildflags.Secret{
-				ID:  llb.GitAuthTokenKey,
-				Env: "BUILDX_BAKE_GIT_AUTH_TOKEN",
-			})
-		}
-		if _, ok := os.LookupEnv("BUILDX_BAKE_GIT_AUTH_HEADER"); ok {
-			secrets = append(secrets, &buildflags.Secret{
-				ID:  llb.GitAuthHeaderKey,
-				Env: "BUILDX_BAKE_GIT_AUTH_HEADER",
-			})
-		}
+	secrets, err := buildflags.ParseSecretSpecs(t.Secrets)
+	if err != nil {
+		return nil, err
 	}
-	secrets = secrets.Normalize()
-	bo.SecretSpecs = secrets.ToPB()
-	secretAttachment, err := controllerapi.CreateSecrets(bo.SecretSpecs)
+	bo.SecretSpecs = secrets
+
+	secretAttachment, err := controllerapi.CreateSecrets(secrets)
 	if err != nil {
 		return nil, err
 	}
 	bo.Session = append(bo.Session, secretAttachment)
 
-	bo.SSHSpecs = t.SSH.ToPB()
-	if len(bo.SSHSpecs) == 0 && buildflags.IsGitSSH(bi.ContextPath) || (inp != nil && buildflags.IsGitSSH(inp.URL)) {
-		bo.SSHSpecs = []*controllerapi.SSH{{ID: "default"}}
+	sshSpecs, err := buildflags.ParseSSHSpecs(t.SSH)
+	if err != nil {
+		return nil, err
 	}
+	if len(sshSpecs) == 0 && (buildflags.IsGitSSH(bi.ContextPath) || (inp != nil && buildflags.IsGitSSH(inp.URL))) {
+		sshSpecs = append(sshSpecs, &controllerapi.SSH{ID: "default"})
+	}
+	bo.SSHSpecs = sshSpecs
 
-	sshAttachment, err := controllerapi.CreateSSH(bo.SSHSpecs)
+	sshAttachment, err := controllerapi.CreateSSH(sshSpecs)
 	if err != nil {
 		return nil, err
 	}
@@ -1392,14 +1367,24 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 		}
 	}
 
-	if t.CacheFrom != nil {
-		bo.CacheFrom = controllerapi.CreateCaches(t.CacheFrom.ToPB())
+	cacheImports, err := buildflags.ParseCacheEntry(t.CacheFrom)
+	if err != nil {
+		return nil, err
 	}
-	if t.CacheTo != nil {
-		bo.CacheTo = controllerapi.CreateCaches(t.CacheTo.ToPB())
+	bo.CacheFrom = controllerapi.CreateCaches(cacheImports)
+
+	cacheExports, err := buildflags.ParseCacheEntry(t.CacheTo)
+	if err != nil {
+		return nil, err
+	}
+	bo.CacheTo = controllerapi.CreateCaches(cacheExports)
+
+	outputs, err := buildflags.ParseExports(t.Outputs)
+	if err != nil {
+		return nil, err
 	}
 
-	bo.Exports, bo.ExportsLocalPathsTemporary, err = controllerapi.CreateExports(t.Outputs.ToPB())
+	bo.Exports, bo.ExportsLocalPathsTemporary, err = controllerapi.CreateExports(outputs)
 	if err != nil {
 		return nil, err
 	}
@@ -1414,7 +1399,11 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 		}
 	}
 
-	bo.Attests = controllerapi.CreateAttestations(t.Attest.ToPB())
+	attests, err := buildflags.ParseAttests(t.Attest)
+	if err != nil {
+		return nil, err
+	}
+	bo.Attests = controllerapi.CreateAttestations(attests)
 
 	bo.SourcePolicy, err = build.ReadSourcePolicy()
 	if err != nil {
@@ -1440,7 +1429,7 @@ func defaultTarget() *Target {
 	return &Target{}
 }
 
-func removeDupesStr(s []string) []string {
+func removeDupes(s []string) []string {
 	i := 0
 	seen := make(map[string]struct{}, len(s))
 	for _, v := range s {
@@ -1457,76 +1446,106 @@ func removeDupesStr(s []string) []string {
 	return s[:i]
 }
 
-func setPushOverride(outputs []*buildflags.ExportEntry, push bool) []*buildflags.ExportEntry {
-	if !push {
-		// Disable push for any relevant export types
-		for i := 0; i < len(outputs); {
-			output := outputs[i]
-			switch output.Type {
-			case "registry":
-				// Filter out registry output type
-				outputs[i], outputs[len(outputs)-1] = outputs[len(outputs)-1], outputs[i]
-				outputs = outputs[:len(outputs)-1]
-				continue
-			case "image":
-				// Override push attribute
-				output.Attrs["push"] = "false"
-			}
-			i++
-		}
-		return outputs
-	}
-
-	// Force push to be enabled
-	setPush := true
-	for _, output := range outputs {
-		if output.Type != "docker" {
-			// If there is an output type that is not docker, don't set "push"
-			setPush = false
+func removeAttestDupes(s []string) []string {
+	res := []string{}
+	m := map[string]int{}
+	for _, v := range s {
+		att, err := buildflags.ParseAttest(v)
+		if err != nil {
+			res = append(res, v)
+			continue
 		}
 
-		// Set push attribute for image
-		if output.Type == "image" {
-			output.Attrs["push"] = "true"
+		if i, ok := m[att.Type]; ok {
+			res[i] = v
+		} else {
+			m[att.Type] = len(res)
+			res = append(res, v)
 		}
 	}
-
-	if setPush {
-		// No existing output that pushes so add one
-		outputs = append(outputs, &buildflags.ExportEntry{
-			Type: "image",
-			Attrs: map[string]string{
-				"push": "true",
-			},
-		})
-	}
-	return outputs
+	return res
 }
 
-func setLoadOverride(outputs []*buildflags.ExportEntry, load bool) []*buildflags.ExportEntry {
+func parseOutput(str string) map[string]string {
+	fields, err := csvvalue.Fields(str, nil)
+	if err != nil {
+		return nil
+	}
+	res := map[string]string{}
+	for _, field := range fields {
+		parts := strings.SplitN(field, "=", 2)
+		if len(parts) == 2 {
+			res[parts[0]] = parts[1]
+		}
+	}
+	return res
+}
+
+func parseOutputType(str string) string {
+	if out := parseOutput(str); out != nil {
+		if v, ok := out["type"]; ok {
+			return v
+		}
+	}
+	return ""
+}
+
+func setPushOverride(outputs []string, push bool) []string {
+	var out []string
+	setPush := true
+	for _, output := range outputs {
+		typ := parseOutputType(output)
+		if typ == "image" || typ == "registry" {
+			// no need to set push if image or registry types already defined
+			setPush = false
+			if typ == "registry" {
+				if !push {
+					// don't set registry output if "push" is false
+					continue
+				}
+				// no need to set "push" attribute to true for registry
+				out = append(out, output)
+				continue
+			}
+			out = append(out, output+",push="+strconv.FormatBool(push))
+		} else {
+			if typ != "docker" {
+				// if there is any output that is not docker, don't set "push"
+				setPush = false
+			}
+			out = append(out, output)
+		}
+	}
+	if push && setPush {
+		out = append(out, "type=image,push=true")
+	}
+	return out
+}
+
+func setLoadOverride(outputs []string, load bool) []string {
 	if !load {
 		return outputs
 	}
-
+	setLoad := true
 	for _, output := range outputs {
-		switch output.Type {
-		case "docker":
-			// if dest is not set, we can reuse this entry and do not need to set load
-			if output.Destination == "" {
-				return outputs
+		if typ := parseOutputType(output); typ == "docker" {
+			if v := parseOutput(output); v != nil {
+				// dest set means we want to output as tar so don't set load
+				if _, ok := v["dest"]; !ok {
+					setLoad = false
+					break
+				}
 			}
-		case "image", "registry", "oci":
-			// Ignore
-		default:
+		} else if typ != "image" && typ != "registry" && typ != "oci" {
 			// if there is any output that is not an image, registry
 			// or oci, don't set "load" similar to push override
-			return outputs
+			setLoad = false
+			break
 		}
 	}
-
-	outputs = append(outputs, &buildflags.ExportEntry{
-		Type: "docker",
-	})
+	if setLoad {
+		outputs = append(outputs, "type=docker")
+	}
 	return outputs
 }
 
@@ -1544,9 +1563,14 @@ func sanitizeTargetName(target string) string {
 	return strings.ReplaceAll(target, ".", "_")
 }
 
-func isSubset(s1, s2 []string) bool {
-	for _, item := range s1 {
-		if !slices.Contains(s2, item) {
+func sliceEqual(s1, s2 []string) bool {
+	if len(s1) != len(s2) {
+		return false
+	}
+	sort.Strings(s1)
+	sort.Strings(s2)
+	for i := range s1 {
+		if s1[i] != s2[i] {
 			return false
 		}
 	}
@@ -1560,58 +1584,3 @@ func toNamedContexts(m map[string]string) map[string]build.NamedContext {
 	}
 	return m2
 }
-
-type arrValue[B any] interface {
-	encoding.TextUnmarshaler
-	*B
-}
-
-func parseArrValue[T any, PT arrValue[T]](s []string) ([]*T, error) {
-	outputs := make([]*T, 0, len(s))
-	for _, text := range s {
-		if text == "" {
-			continue
-		}
-
-		output := new(T)
-		if err := PT(output).UnmarshalText([]byte(text)); err != nil {
-			return nil, err
-		}
-		outputs = append(outputs, output)
-	}
-	return outputs, nil
-}
-
-func parseCacheArrValues(s []string) (buildflags.CacheOptions, error) {
-	var outs buildflags.CacheOptions
-	for _, in := range s {
-		if in == "" {
-			continue
-		}
-
-		if !strings.Contains(in, "=") {
-			// This is ref only format. Each field in the CSV is its own entry.
-			fields, err := csvvalue.Fields(in, nil)
-			if err != nil {
-				return nil, err
-			}
-
-			for _, field := range fields {
-				out := buildflags.CacheOptionsEntry{}
-				if err := out.UnmarshalText([]byte(field)); err != nil {
-					return nil, err
-				}
-				outs = append(outs, &out)
-			}
-			continue
-		}
-
-		// Normal entry.
-		out := buildflags.CacheOptionsEntry{}
-		if err := out.UnmarshalText([]byte(in)); err != nil {
-			return nil, err
-		}
-		outs = append(outs, &out)
-	}
-	return outs, nil
-}

bake/bake_test.go

@@ -2,7 +2,6 @@ package bake
 
 import (
 	"context"
-	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
@@ -229,7 +228,7 @@ func TestPushOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
-		require.Equal(t, "type=image,push=true", m["app"].Outputs[0].String())
+		require.Equal(t, "type=image,push=true", m["app"].Outputs[0])
 	})
 
 	t.Run("type image", func(t *testing.T) {
@@ -243,7 +242,7 @@ func TestPushOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
-		require.Equal(t, "type=image,compression=zstd,push=true", m["app"].Outputs[0].String())
+		require.Equal(t, "type=image,compression=zstd,push=true", m["app"].Outputs[0])
 	})
 
 	t.Run("type image push false", func(t *testing.T) {
@@ -257,7 +256,7 @@ func TestPushOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=false"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
-		require.Equal(t, "type=image,compression=zstd,push=false", m["app"].Outputs[0].String())
+		require.Equal(t, "type=image,compression=zstd,push=false", m["app"].Outputs[0])
 	})
 
 	t.Run("type registry", func(t *testing.T) {
@@ -271,7 +270,7 @@ func TestPushOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
-		require.Equal(t, "type=registry", m["app"].Outputs[0].String())
+		require.Equal(t, "type=registry", m["app"].Outputs[0])
 	})
 
 	t.Run("type registry push false", func(t *testing.T) {
@@ -301,9 +300,9 @@ func TestPushOverride(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m))
 		require.Equal(t, 1, len(m["foo"].Outputs))
-		require.Equal(t, []string{"type=local,dest=out"}, stringify(m["foo"].Outputs))
+		require.Equal(t, []string{"type=local,dest=out"}, m["foo"].Outputs)
 		require.Equal(t, 1, len(m["bar"].Outputs))
-		require.Equal(t, []string{"type=image,push=true"}, stringify(m["bar"].Outputs))
+		require.Equal(t, []string{"type=image,push=true"}, m["bar"].Outputs)
 	})
 }
 
@@ -318,7 +317,7 @@ func TestLoadOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
-		require.Equal(t, "type=docker", m["app"].Outputs[0].String())
+		require.Equal(t, "type=docker", m["app"].Outputs[0])
 	})
 
 	t.Run("type docker", func(t *testing.T) {
@@ -332,7 +331,7 @@ func TestLoadOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
-		require.Equal(t, []string{"type=docker"}, stringify(m["app"].Outputs))
+		require.Equal(t, []string{"type=docker"}, m["app"].Outputs)
 	})
 
 	t.Run("type image", func(t *testing.T) {
@@ -346,7 +345,7 @@ func TestLoadOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m["app"].Outputs))
-		require.Equal(t, []string{"type=docker", "type=image"}, stringify(m["app"].Outputs))
+		require.Equal(t, []string{"type=image", "type=docker"}, m["app"].Outputs)
 	})
 
 	t.Run("type image load false", func(t *testing.T) {
@@ -360,7 +359,7 @@ func TestLoadOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=false"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
-		require.Equal(t, []string{"type=image"}, stringify(m["app"].Outputs))
+		require.Equal(t, []string{"type=image"}, m["app"].Outputs)
 	})
 
 	t.Run("type registry", func(t *testing.T) {
@@ -374,7 +373,7 @@ func TestLoadOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m["app"].Outputs))
-		require.Equal(t, []string{"type=docker", "type=registry"}, stringify(m["app"].Outputs))
+		require.Equal(t, []string{"type=registry", "type=docker"}, m["app"].Outputs)
 	})
 
 	t.Run("type oci", func(t *testing.T) {
@@ -388,7 +387,7 @@ func TestLoadOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m["app"].Outputs))
-		require.Equal(t, []string{"type=docker", "type=oci,dest=out"}, stringify(m["app"].Outputs))
+		require.Equal(t, []string{"type=oci,dest=out", "type=docker"}, m["app"].Outputs)
 	})
 
 	t.Run("type docker with dest", func(t *testing.T) {
@@ -402,7 +401,7 @@ func TestLoadOverride(t *testing.T) {
 		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m["app"].Outputs))
-		require.Equal(t, []string{"type=docker", "type=docker,dest=out"}, stringify(m["app"].Outputs))
+		require.Equal(t, []string{"type=docker,dest=out", "type=docker"}, m["app"].Outputs)
 	})
 
 	t.Run("type local and empty target", func(t *testing.T) {
@@ -419,9 +418,9 @@ func TestLoadOverride(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m))
 		require.Equal(t, 1, len(m["foo"].Outputs))
-		require.Equal(t, []string{"type=local,dest=out"}, stringify(m["foo"].Outputs))
+		require.Equal(t, []string{"type=local,dest=out"}, m["foo"].Outputs)
 		require.Equal(t, 1, len(m["bar"].Outputs))
-		require.Equal(t, []string{"type=docker"}, stringify(m["bar"].Outputs))
+		require.Equal(t, []string{"type=docker"}, m["bar"].Outputs)
 	})
 }
 
@@ -441,10 +440,12 @@ func TestLoadAndPushOverride(t *testing.T) {
 		require.Equal(t, 2, len(m))
 
 		require.Equal(t, 1, len(m["foo"].Outputs))
-		require.Equal(t, []string{"type=local,dest=out"}, stringify(m["foo"].Outputs))
+		sort.Strings(m["foo"].Outputs)
+		require.Equal(t, []string{"type=local,dest=out"}, m["foo"].Outputs)
 
 		require.Equal(t, 2, len(m["bar"].Outputs))
-		require.Equal(t, []string{"type=docker", "type=image,push=true"}, stringify(m["bar"].Outputs))
+		sort.Strings(m["bar"].Outputs)
+		require.Equal(t, []string{"type=docker", "type=image,push=true"}, m["bar"].Outputs)
 	})
 
 	t.Run("type registry", func(t *testing.T) {
@@ -460,7 +461,8 @@ func TestLoadAndPushOverride(t *testing.T) {
 		require.Equal(t, 1, len(m))
 
 		require.Equal(t, 2, len(m["foo"].Outputs))
-		require.Equal(t, []string{"type=docker", "type=registry"}, stringify(m["foo"].Outputs))
+		sort.Strings(m["foo"].Outputs)
+		require.Equal(t, []string{"type=docker", "type=registry"}, m["foo"].Outputs)
 	})
 }
 
@@ -672,7 +674,7 @@ func TestOverrideMerge(t *testing.T) {
 
 	require.Equal(t, []string{"linux/arm", "linux/ppc64le"}, m["app"].Platforms)
 	require.Equal(t, 1, len(m["app"].Outputs))
-	require.Equal(t, "type=registry", m["app"].Outputs[0].String())
+	require.Equal(t, "type=registry", m["app"].Outputs[0])
 }
 
 func TestReadContexts(t *testing.T) {
@@ -838,7 +840,7 @@ func TestReadContextFromTargetChain(t *testing.T) {
 	mid, ok := m["mid"]
 	require.True(t, ok)
 	require.Equal(t, 1, len(mid.Outputs))
-	require.Equal(t, "type=cacheonly", mid.Outputs[0].String())
+	require.Equal(t, "type=cacheonly", mid.Outputs[0])
 	require.Equal(t, 1, len(mid.Contexts))
 
 	base, ok := m["base"]
@@ -910,28 +912,7 @@ func TestReadContextFromTargetInvalidPlatforms(t *testing.T) {
 	}
 	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil, &EntitlementConf{})
 	require.Error(t, err)
-	require.Contains(t, err.Error(), "are not a subset of")
-}
-
-func TestReadContextFromTargetSubsetPlatforms(t *testing.T) {
-	ctx := context.TODO()
-	fp := File{
-		Name: "docker-bake.hcl",
-		Data: []byte(`
-		target "mid" {
-			output = ["foo"]
-			platforms = ["linux/amd64", "linux/riscv64", "linux/arm64"]
-		}
-		target "app" {
-			contexts = {
-				bar: "target:mid"
-			}
-			platforms = ["linux/amd64", "linux/arm64"]
-		}
-		`),
-	}
-	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil, &EntitlementConf{})
-	require.NoError(t, err)
+	require.Contains(t, err.Error(), "defined for different platforms")
 }
 
 func TestReadTargetsDefault(t *testing.T) {
@@ -943,12 +924,11 @@ func TestReadTargetsDefault(t *testing.T) {
 		Data: []byte(`
 target "default" {
   dockerfile = "test"
-}`),
-	}
+}`)}
 
 	m, g, err := ReadTargets(ctx, []File{f}, []string{"default"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
-	require.Equal(t, 1, len(g))
+	require.Equal(t, 0, len(g))
 	require.Equal(t, 1, len(m))
 	require.Equal(t, "test", *m["default"].Dockerfile)
 }
@@ -962,8 +942,7 @@ func TestReadTargetsSpecified(t *testing.T) {
 		Data: []byte(`
 target "image" {
   dockerfile = "test"
-}`),
-	}
+}`)}
 
 	_, _, err := ReadTargets(ctx, []File{f}, []string{"default"}, nil, nil, &EntitlementConf{})
 	require.Error(t, err)
@@ -988,8 +967,7 @@ group "foo" {
 }
 target "image" {
   dockerfile = "test"
-}`),
-	}
+}`)}
 
 	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1015,8 +993,7 @@ target "foo" {
 }
 target "image" {
   dockerfile = "test"
-}`),
-	}
+}`)}
 
 	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1059,8 +1036,7 @@ target "image-release" {
   inherits = ["image"]
   output = ["type=image,push=true"]
   tags = ["user/app:latest"]
-}`),
-	}
+}`)}
 
 	fyml := File{
 		Name: "docker-compose.yml",
@@ -1084,8 +1060,7 @@ services:
       args:
         CT_ECR: foo
         CT_TAG: bar
-    image: ct-fake-aws:bar`),
-	}
+    image: ct-fake-aws:bar`)}
 
 	fjson := File{
 		Name: "docker-bake.json",
@@ -1106,8 +1081,7 @@ services:
 	     ]
 	   }
 	 }
-	}`),
-	}
+	}`)}
 
 	m, g, err := ReadTargets(ctx, []File{fhcl}, []string{"default"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1115,7 +1089,7 @@ services:
 	require.Equal(t, []string{"image"}, g["default"].Targets)
 	require.Equal(t, 1, len(m))
 	require.Equal(t, 1, len(m["image"].Outputs))
-	require.Equal(t, "type=docker", m["image"].Outputs[0].String())
+	require.Equal(t, "type=docker", m["image"].Outputs[0])
 
 	m, g, err = ReadTargets(ctx, []File{fhcl}, []string{"image-release"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1123,7 +1097,7 @@ services:
 	require.Equal(t, []string{"image-release"}, g["default"].Targets)
 	require.Equal(t, 1, len(m))
 	require.Equal(t, 1, len(m["image-release"].Outputs))
-	require.Equal(t, "type=image,push=true", m["image-release"].Outputs[0].String())
+	require.Equal(t, "type=image,push=true", m["image-release"].Outputs[0])
 
 	m, g, err = ReadTargets(ctx, []File{fhcl}, []string{"image", "image-release"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1132,7 +1106,7 @@ services:
 	require.Equal(t, 2, len(m))
 	require.Equal(t, ".", *m["image"].Context)
 	require.Equal(t, 1, len(m["image-release"].Outputs))
-	require.Equal(t, "type=image,push=true", m["image-release"].Outputs[0].String())
+	require.Equal(t, "type=image,push=true", m["image-release"].Outputs[0])
 
 	m, g, err = ReadTargets(ctx, []File{fyml, fhcl}, []string{"default"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1192,8 +1166,7 @@ target "foo" {
 }
 target "image" {
   output = ["type=docker"]
-}`),
-	}
+}`)}
 
 	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1227,8 +1200,7 @@ target "foo" {
 }
 target "image" {
   output = ["type=docker"]
-}`),
-	}
+}`)}
 
 	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1237,7 +1209,7 @@ target "image" {
 	require.Equal(t, []string{"foo", "image"}, g["foo"].Targets)
 	require.Equal(t, 2, len(m))
 	require.Equal(t, "bar", *m["foo"].Dockerfile)
-	require.Equal(t, "type=docker", m["image"].Outputs[0].String())
+	require.Equal(t, "type=docker", m["image"].Outputs[0])
 
 	m, g, err = ReadTargets(ctx, []File{f}, []string{"foo", "image"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
@@ -1246,7 +1218,7 @@ target "image" {
 	require.Equal(t, []string{"foo", "image"}, g["foo"].Targets)
 	require.Equal(t, 2, len(m))
 	require.Equal(t, "bar", *m["foo"].Dockerfile)
-	require.Equal(t, "type=docker", m["image"].Outputs[0].String())
+	require.Equal(t, "type=docker", m["image"].Outputs[0])
 }
 
 func TestNestedInherits(t *testing.T) {
@@ -1275,8 +1247,7 @@ target "c" {
 }
 target "d" {
   inherits = ["b", "c"]
-}`),
-	}
+}`)}
 
 	cases := []struct {
 		name      string
@@ -1344,8 +1315,7 @@ group "default" {
     "child1",
     "child2"
   ]
-}`),
-	}
+}`)}
 
 	cases := []struct {
 		name      string
@@ -1381,9 +1351,9 @@ group "default" {
 			require.Equal(t, []string{"child1", "child2"}, g["default"].Targets)
 			require.Equal(t, 2, len(m))
 			require.Equal(t, tt.wantch1, m["child1"].Args)
-			require.Equal(t, []string{"type=docker"}, stringify(m["child1"].Outputs))
+			require.Equal(t, []string{"type=docker"}, m["child1"].Outputs)
 			require.Equal(t, tt.wantch2, m["child2"].Args)
-			require.Equal(t, []string{"type=docker"}, stringify(m["child2"].Outputs))
+			require.Equal(t, []string{"type=docker"}, m["child2"].Outputs)
 		})
 	}
 }
@@ -1472,8 +1442,7 @@ group "e" {
 
 target "f" {
   context = "./foo"
-}`),
-	}
+}`)}
 
 	cases := []struct {
 		names   []string
@@ -1709,7 +1678,7 @@ func TestAttestDuplicates(t *testing.T) {
 	ctx := context.TODO()
 
 	m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil, &EntitlementConf{})
-	require.Equal(t, []string{"type=provenance,mode=max", "type=sbom,foo=bar"}, stringify(m["default"].Attest))
+	require.Equal(t, []string{"type=sbom,foo=bar", "type=provenance,mode=max"}, m["default"].Attest)
 	require.NoError(t, err)
 
 	opts, err := TargetsToBuildOpt(m, &Input{})
@@ -1720,7 +1689,7 @@ func TestAttestDuplicates(t *testing.T) {
 	}, opts["default"].Attests)
 
 	m, _, err = ReadTargets(ctx, []File{fp}, []string{"default"}, []string{"*.attest=type=sbom,disabled=true"}, nil, &EntitlementConf{})
-	require.Equal(t, []string{"type=provenance,mode=max", "type=sbom,disabled=true"}, stringify(m["default"].Attest))
+	require.Equal(t, []string{"type=sbom,disabled=true", "type=provenance,mode=max"}, m["default"].Attest)
 	require.NoError(t, err)
 
 	opts, err = TargetsToBuildOpt(m, &Input{})
@@ -1752,7 +1721,7 @@ func TestAnnotations(t *testing.T) {
 
 	require.Equal(t, 1, len(m))
 	require.Contains(t, m, "app")
-	require.Equal(t, "type=image,name=foo", m["app"].Outputs[0].String())
+	require.Equal(t, "type=image,name=foo", m["app"].Outputs[0])
 	require.Equal(t, "manifest[linux/amd64]:foo=bar", m["app"].Annotations[0])
 
 	require.Len(t, bo["app"].Exports, 1)
@@ -2055,10 +2024,9 @@ target "app" {
 	}
 
 	ctx := context.TODO()
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
+
+	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
 	require.NoError(t, err)
-	require.Contains(t, m, "app")
-	require.Len(t, m["app"].Outputs, 0)
 }
 
 // https://github.com/docker/buildx/issues/2858
@@ -2073,69 +2041,7 @@ target "app" {
 	}
 
 	ctx := context.TODO()
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{"app.output="}, nil, &EntitlementConf{})
+
+	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{"app.output="}, nil, &EntitlementConf{})
 	require.NoError(t, err)
-	require.Contains(t, m, "app")
-	require.Len(t, m["app"].Outputs, 0)
-}
-
-// https://github.com/docker/buildx/issues/2859
-func TestGroupTargetsWithDefault(t *testing.T) {
-	t.Run("OnTarget", func(t *testing.T) {
-		fp := File{
-			Name: "docker-bake.hcl",
-			Data: []byte(
-				`target "default" {
-					dockerfile = "Dockerfile"
-					platforms = ["linux/amd64"]
-				}
-				target "multiarch" {
-					dockerfile = "Dockerfile"
-					platforms = ["linux/amd64","linux/arm64","linux/arm/v7","linux/arm/v6"]
-				}`),
-		}
-		ctx := context.TODO()
-		_, g, err := ReadTargets(ctx, []File{fp}, []string{"default", "multiarch"}, nil, nil, &EntitlementConf{})
-		require.NoError(t, err)
-
-		require.Equal(t, 1, len(g))
-		require.Equal(t, 2, len(g["default"].Targets))
-		require.Equal(t, []string{"default", "multiarch"}, g["default"].Targets)
-	})
-
-	t.Run("OnGroup", func(t *testing.T) {
-		fp := File{
-			Name: "docker-bake.hcl",
-			Data: []byte(
-				`group "default" {
-					targets = ["app", "multiarch"]
-				}
-				target "app" {
-					dockerfile = "app.Dockerfile"
-				}
-				target "foo" {
-					dockerfile = "foo.Dockerfile"
-				}
-				target "multiarch" {
-					dockerfile = "Dockerfile"
-					platforms = ["linux/amd64","linux/arm64","linux/arm/v7","linux/arm/v6"]
-				}`),
-		}
-		ctx := context.TODO()
-		_, g, err := ReadTargets(ctx, []File{fp}, []string{"default", "foo"}, nil, nil, &EntitlementConf{})
-		require.NoError(t, err)
-
-		require.Equal(t, 1, len(g))
-		require.Equal(t, 3, len(g["default"].Targets))
-		require.Equal(t, []string{"app", "foo", "multiarch"}, g["default"].Targets)
-	})
-}
-
-func stringify[V fmt.Stringer](values []V) []string {
-	s := make([]string, len(values))
-	for i, v := range values {
-		s[i] = v.String()
-	}
-	sort.Strings(s)
-	return s
 }

bake/compose.go

@@ -5,14 +5,13 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"slices"
+	"sort"
 	"strings"
 
 	"github.com/compose-spec/compose-go/v2/consts"
 	"github.com/compose-spec/compose-go/v2/dotenv"
 	"github.com/compose-spec/compose-go/v2/loader"
 	composetypes "github.com/compose-spec/compose-go/v2/types"
-	"github.com/docker/buildx/util/buildflags"
 	dockeropts "github.com/docker/cli/opts"
 	"github.com/docker/go-units"
 	"github.com/pkg/errors"
@@ -120,16 +119,14 @@ func ParseCompose(cfgs []composetypes.ConfigFile, envs map[string]string) (*Conf
 				}
 			}
 
-			var ssh []*buildflags.SSH
+			var ssh []string
 			for _, bkey := range s.Build.SSH {
 				sshkey := composeToBuildkitSSH(bkey)
 				ssh = append(ssh, sshkey)
 			}
-			slices.SortFunc(ssh, func(a, b *buildflags.SSH) int {
-				return a.Less(b)
-			})
+			sort.Strings(ssh)
 
-			var secrets []*buildflags.Secret
+			var secrets []string
 			for _, bs := range s.Build.Secrets {
 				secret, err := composeToBuildkitSecret(bs, cfg.Secrets[bs.Source])
 				if err != nil {
@@ -145,16 +142,6 @@ func ParseCompose(cfgs []composetypes.ConfigFile, envs map[string]string) (*Conf
 				labels[k] = &v
 			}
 
-			cacheFrom, err := parseCacheArrValues(s.Build.CacheFrom)
-			if err != nil {
-				return nil, err
-			}
-
-			cacheTo, err := parseCacheArrValues(s.Build.CacheTo)
-			if err != nil {
-				return nil, err
-			}
-
 			g.Targets = append(g.Targets, targetName)
 			t := &Target{
 				Name:             targetName,
@@ -171,8 +158,8 @@ func ParseCompose(cfgs []composetypes.ConfigFile, envs map[string]string) (*Conf
 					val, ok := cfg.Environment[val]
 					return val, ok
 				})),
-				CacheFrom:   cacheFrom,
-				CacheTo:     cacheTo,
+				CacheFrom:   s.Build.CacheFrom,
+				CacheTo:     s.Build.CacheTo,
 				NetworkMode: networkModeP,
 				SSH:         ssh,
 				Secrets:     secrets,
@@ -310,10 +297,8 @@ type xbake struct {
 	// https://github.com/docker/docs/blob/main/content/build/bake/compose-file.md#extension-field-with-x-bake
 }
 
-type (
-	stringMap   map[string]string
-	stringArray []string
-)
+type stringMap map[string]string
+type stringArray []string
 
 func (sa *stringArray) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	var multi []string
@@ -349,45 +334,23 @@ func (t *Target) composeExtTarget(exts map[string]interface{}) error {
 		t.Tags = dedupSlice(append(t.Tags, xb.Tags...))
 	}
 	if len(xb.CacheFrom) > 0 {
-		cacheFrom, err := parseCacheArrValues(xb.CacheFrom)
-		if err != nil {
-			return err
-		}
-		t.CacheFrom = t.CacheFrom.Merge(cacheFrom)
+		t.CacheFrom = dedupSlice(append(t.CacheFrom, xb.CacheFrom...))
 	}
 	if len(xb.CacheTo) > 0 {
-		cacheTo, err := parseCacheArrValues(xb.CacheTo)
-		if err != nil {
-			return err
-		}
-		t.CacheTo = t.CacheTo.Merge(cacheTo)
+		t.CacheTo = dedupSlice(append(t.CacheTo, xb.CacheTo...))
 	}
 	if len(xb.Secrets) > 0 {
-		secrets, err := parseArrValue[buildflags.Secret](xb.Secrets)
-		if err != nil {
-			return err
-		}
-		t.Secrets = t.Secrets.Merge(secrets)
+		t.Secrets = dedupSlice(append(t.Secrets, xb.Secrets...))
 	}
 	if len(xb.SSH) > 0 {
-		ssh, err := parseArrValue[buildflags.SSH](xb.SSH)
-		if err != nil {
-			return err
-		}
-		t.SSH = t.SSH.Merge(ssh)
-		slices.SortFunc(t.SSH, func(a, b *buildflags.SSH) int {
-			return a.Less(b)
-		})
+		t.SSH = dedupSlice(append(t.SSH, xb.SSH...))
+		sort.Strings(t.SSH)
 	}
 	if len(xb.Platforms) > 0 {
 		t.Platforms = dedupSlice(append(t.Platforms, xb.Platforms...))
 	}
 	if len(xb.Outputs) > 0 {
-		outputs, err := parseArrValue[buildflags.ExportEntry](xb.Outputs)
-		if err != nil {
-			return err
-		}
-		t.Outputs = t.Outputs.Merge(outputs)
+		t.Outputs = dedupSlice(append(t.Outputs, xb.Outputs...))
 	}
 	if xb.Pull != nil {
 		t.Pull = xb.Pull
@@ -407,30 +370,35 @@ func (t *Target) composeExtTarget(exts map[string]interface{}) error {
 
 // composeToBuildkitSecret converts secret from compose format to buildkit's
 // csv format.
-func composeToBuildkitSecret(inp composetypes.ServiceSecretConfig, psecret composetypes.SecretConfig) (*buildflags.Secret, error) {
+func composeToBuildkitSecret(inp composetypes.ServiceSecretConfig, psecret composetypes.SecretConfig) (string, error) {
 	if psecret.External {
-		return nil, errors.Errorf("unsupported external secret %s", psecret.Name)
+		return "", errors.Errorf("unsupported external secret %s", psecret.Name)
 	}
 
-	secret := &buildflags.Secret{}
+	var bkattrs []string
 	if inp.Source != "" {
-		secret.ID = inp.Source
+		bkattrs = append(bkattrs, "id="+inp.Source)
 	}
 	if psecret.File != "" {
-		secret.FilePath = psecret.File
+		bkattrs = append(bkattrs, "src="+psecret.File)
 	}
 	if psecret.Environment != "" {
-		secret.Env = psecret.Environment
+		bkattrs = append(bkattrs, "env="+psecret.Environment)
 	}
-	return secret, nil
+
+	return strings.Join(bkattrs, ","), nil
 }
 
 // composeToBuildkitSSH converts secret from compose format to buildkit's
 // csv format.
-func composeToBuildkitSSH(sshKey composetypes.SSHKey) *buildflags.SSH {
-	bkssh := &buildflags.SSH{ID: sshKey.ID}
+func composeToBuildkitSSH(sshKey composetypes.SSHKey) string {
+	var bkattrs []string
+
+	bkattrs = append(bkattrs, sshKey.ID)
+
 	if sshKey.Path != "" {
-		bkssh.Paths = []string{sshKey.Path}
+		bkattrs = append(bkattrs, sshKey.Path)
 	}
-	return bkssh
+
+	return strings.Join(bkattrs, "=")
 }

bake/compose_test.go

@@ -12,7 +12,7 @@ import (
 )
 
 func TestParseCompose(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   db:
     build: ./db
@@ -33,7 +33,7 @@ services:
       cache_to:
         - type=local,dest=path/to/cache
       ssh:
-        - key=/path/to/key
+        - key=path/to/key
         - default
       secrets:
         - token
@@ -74,14 +74,14 @@ secrets:
 	require.Equal(t, "Dockerfile-alternate", *c.Targets[1].Dockerfile)
 	require.Equal(t, 1, len(c.Targets[1].Args))
 	require.Equal(t, ptrstr("123"), c.Targets[1].Args["buildno"])
-	require.Equal(t, []string{"type=local,src=path/to/cache"}, stringify(c.Targets[1].CacheFrom))
-	require.Equal(t, []string{"type=local,dest=path/to/cache"}, stringify(c.Targets[1].CacheTo))
+	require.Equal(t, []string{"type=local,src=path/to/cache"}, c.Targets[1].CacheFrom)
+	require.Equal(t, []string{"type=local,dest=path/to/cache"}, c.Targets[1].CacheTo)
 	require.Equal(t, "none", *c.Targets[1].NetworkMode)
-	require.Equal(t, []string{"default", "key=/path/to/key"}, stringify(c.Targets[1].SSH))
+	require.Equal(t, []string{"default", "key=path/to/key"}, c.Targets[1].SSH)
 	require.Equal(t, []string{
-		"id=aws,src=/root/.aws/credentials",
 		"id=token,env=ENV_TOKEN",
-	}, stringify(c.Targets[1].Secrets))
+		"id=aws,src=/root/.aws/credentials",
+	}, c.Targets[1].Secrets)
 
 	require.Equal(t, "webapp2", c.Targets[2].Name)
 	require.Equal(t, "dir", *c.Targets[2].Context)
@@ -89,7 +89,7 @@ secrets:
 }
 
 func TestNoBuildOutOfTreeService(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
     external:
         image: "verycooldb:1337"
@@ -103,7 +103,7 @@ services:
 }
 
 func TestParseComposeTarget(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   db:
     build:
@@ -129,7 +129,7 @@ services:
 }
 
 func TestComposeBuildWithoutContext(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   db:
     build:
@@ -153,7 +153,7 @@ services:
 }
 
 func TestBuildArgEnvCompose(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 version: "3.8"
 services:
   example:
@@ -179,7 +179,7 @@ services:
 }
 
 func TestInconsistentComposeFile(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   webapp:
     entrypoint: echo 1
@@ -190,7 +190,7 @@ services:
 }
 
 func TestAdvancedNetwork(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   db:
     networks:
@@ -215,7 +215,7 @@ networks:
 }
 
 func TestTags(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   example:
     image: example
@@ -233,7 +233,7 @@ services:
 }
 
 func TestDependsOnList(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 version: "3.8"
 
 services:
@@ -269,7 +269,7 @@ networks:
 }
 
 func TestComposeExt(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   addon:
     image: ct-addon:bar
@@ -283,7 +283,7 @@ services:
       tags:
         - ct-addon:baz
       ssh:
-        key: /path/to/key
+        key: path/to/key
       args:
         CT_ECR: foo
         CT_TAG: bar
@@ -336,23 +336,23 @@ services:
 	require.Equal(t, map[string]*string{"CT_ECR": ptrstr("foo"), "CT_TAG": ptrstr("bar")}, c.Targets[0].Args)
 	require.Equal(t, []string{"ct-addon:baz", "ct-addon:foo", "ct-addon:alp"}, c.Targets[0].Tags)
 	require.Equal(t, []string{"linux/amd64", "linux/arm64"}, c.Targets[0].Platforms)
-	require.Equal(t, []string{"type=local,src=path/to/cache", "user/app:cache"}, stringify(c.Targets[0].CacheFrom))
-	require.Equal(t, []string{"type=local,dest=path/to/cache", "user/app:cache"}, stringify(c.Targets[0].CacheTo))
-	require.Equal(t, []string{"default", "key=/path/to/key", "other=path/to/otherkey"}, stringify(c.Targets[0].SSH))
+	require.Equal(t, []string{"user/app:cache", "type=local,src=path/to/cache"}, c.Targets[0].CacheFrom)
+	require.Equal(t, []string{"user/app:cache", "type=local,dest=path/to/cache"}, c.Targets[0].CacheTo)
+	require.Equal(t, []string{"default", "key=path/to/key", "other=path/to/otherkey"}, c.Targets[0].SSH)
 	require.Equal(t, newBool(true), c.Targets[0].Pull)
 	require.Equal(t, map[string]string{"alpine": "docker-image://alpine:3.13"}, c.Targets[0].Contexts)
 	require.Equal(t, []string{"ct-fake-aws:bar"}, c.Targets[1].Tags)
-	require.Equal(t, []string{"id=mysecret,src=/local/secret", "id=mysecret2,src=/local/secret2"}, stringify(c.Targets[1].Secrets))
-	require.Equal(t, []string{"default"}, stringify(c.Targets[1].SSH))
+	require.Equal(t, []string{"id=mysecret,src=/local/secret", "id=mysecret2,src=/local/secret2"}, c.Targets[1].Secrets)
+	require.Equal(t, []string{"default"}, c.Targets[1].SSH)
 	require.Equal(t, []string{"linux/arm64"}, c.Targets[1].Platforms)
-	require.Equal(t, []string{"type=docker"}, stringify(c.Targets[1].Outputs))
+	require.Equal(t, []string{"type=docker"}, c.Targets[1].Outputs)
 	require.Equal(t, newBool(true), c.Targets[1].NoCache)
 	require.Equal(t, ptrstr("128MiB"), c.Targets[1].ShmSize)
 	require.Equal(t, []string{"nofile=1024:1024"}, c.Targets[1].Ulimits)
 }
 
 func TestComposeExtDedup(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   webapp:
     image: app:bar
@@ -383,9 +383,9 @@ services:
 	require.NoError(t, err)
 	require.Equal(t, 1, len(c.Targets))
 	require.Equal(t, []string{"ct-addon:foo", "ct-addon:baz"}, c.Targets[0].Tags)
-	require.Equal(t, []string{"type=local,src=path/to/cache", "user/app:cache"}, stringify(c.Targets[0].CacheFrom))
-	require.Equal(t, []string{"type=local,dest=path/to/cache", "user/app:cache"}, stringify(c.Targets[0].CacheTo))
-	require.Equal(t, []string{"default", "key=path/to/key"}, stringify(c.Targets[0].SSH))
+	require.Equal(t, []string{"user/app:cache", "type=local,src=path/to/cache"}, c.Targets[0].CacheFrom)
+	require.Equal(t, []string{"user/app:cache", "type=local,dest=path/to/cache"}, c.Targets[0].CacheTo)
+	require.Equal(t, []string{"default", "key=path/to/key"}, c.Targets[0].SSH)
 }
 
 func TestEnv(t *testing.T) {
@@ -396,7 +396,7 @@ func TestEnv(t *testing.T) {
 	_, err = envf.WriteString("FOO=bsdf -csdf\n")
 	require.NoError(t, err)
 
-	dt := []byte(`
+	var dt = []byte(`
 services:
   scratch:
     build:
@@ -424,7 +424,7 @@ func TestDotEnv(t *testing.T) {
 	err := os.WriteFile(filepath.Join(tmpdir, ".env"), []byte("FOO=bar"), 0644)
 	require.NoError(t, err)
 
-	dt := []byte(`
+	var dt = []byte(`
 services:
   scratch:
     build:
@@ -443,7 +443,7 @@ services:
 }
 
 func TestPorts(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   foo:
     build:
@@ -664,7 +664,7 @@ target "default" {
 }
 
 func TestComposeNullArgs(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   scratch:
     build:
@@ -680,7 +680,7 @@ services:
 }
 
 func TestDependsOn(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   foo:
     build:
@@ -711,7 +711,7 @@ services:
 `), 0644)
 	require.NoError(t, err)
 
-	dt := []byte(`
+	var dt = []byte(`
 include:
   - compose-foo.yml
 
@@ -740,7 +740,7 @@ services:
 }
 
 func TestDevelop(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   scratch:
     build:
@@ -759,7 +759,7 @@ services:
 }
 
 func TestCgroup(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   scratch:
     build:
@@ -772,7 +772,7 @@ services:
 }
 
 func TestProjectName(t *testing.T) {
-	dt := []byte(`
+	var dt = []byte(`
 services:
   scratch:
     build:

bake/entitlements.go

@@ -145,9 +145,7 @@ func (c EntitlementConf) check(bo build.Options, expected *EntitlementConf) erro
 			roPaths[p] = struct{}{}
 		}
 		if len(ssh.Paths) == 0 {
-			if !c.SSH {
-				expected.SSH = true
-			}
+			expected.SSH = true
 		}
 	}
 
@@ -259,7 +257,7 @@ func (c EntitlementConf) Prompt(ctx context.Context, isRemote bool, out io.Write
 		fmt.Fprintf(out, "%s %s %s\n\n", strings.Join(args[:idx+1], " "), strings.Join(slices.Concat(flags, flagsFS), " "), strings.Join(args[idx+1:], " "))
 	}
 
-	fsEntitlementsEnabled := true
+	fsEntitlementsEnabled := false
 	if isRemote {
 		if v, ok := os.LookupEnv("BAKE_ALLOW_REMOTE_FS_ACCESS"); ok {
 			vv, err := strconv.ParseBool(v)
@@ -267,6 +265,8 @@ func (c EntitlementConf) Prompt(ctx context.Context, isRemote bool, out io.Write
 				return errors.Wrapf(err, "failed to parse BAKE_ALLOW_REMOTE_FS_ACCESS value %q", v)
 			}
 			fsEntitlementsEnabled = !vv
+		} else {
+			fsEntitlementsEnabled = true
 		}
 	}
 	v, fsEntitlementsSet := os.LookupEnv("BUILDX_BAKE_ENTITLEMENTS_FS")
@@ -279,11 +279,11 @@ func (c EntitlementConf) Prompt(ctx context.Context, isRemote bool, out io.Write
 	}
 
 	if !fsEntitlementsEnabled && len(msgs) == 0 {
+		if !fsEntitlementsSet {
+			fmt.Fprintf(out, "This warning will become an error in a future release. To enable filesystem entitlements checks at the moment, set BUILDX_BAKE_ENTITLEMENTS_FS=1 .\n\n")
+		}
 		return nil
 	}
-	if fsEntitlementsEnabled && !fsEntitlementsSet && len(msgsFS) != 0 {
-		fmt.Fprintf(out, "To disable filesystem entitlements checks, you can set BUILDX_BAKE_ENTITLEMENTS_FS=0 .\n\n")
-	}
 
 	if term {
 		fmt.Fprintf(out, "Do you want to grant requested privileges and continue? [y/N] ")

bake/hcl_test.go

@@ -17,7 +17,6 @@ func TestHCLBasic(t *testing.T) {
 		target "db" {
 			context = "./db"
 			tags = ["docker.io/tonistiigi/db"]
-			output = ["type=image"]
 		}
 
 		target "webapp" {
@@ -26,9 +25,6 @@ func TestHCLBasic(t *testing.T) {
 			args = {
 				buildno = "123"
 			}
-			output = [
-				{ type = "image" }
-			]
 		}
 
 		target "cross" {
@@ -601,121 +597,6 @@ func TestHCLAttrsCustomType(t *testing.T) {
 	require.Equal(t, ptrstr("linux/arm64"), c.Targets[0].Args["v1"])
 }
 
-func TestHCLAttrsCapsuleType(t *testing.T) {
-	dt := []byte(`
-	target "app" {
-		attest = [
-			{ type = "provenance", mode = "max" },
-			"type=sbom,disabled=true",
-		]
-
-		cache-from = [
-			{ type = "registry", ref = "user/app:cache" },
-			"type=local,src=path/to/cache",
-		]
-
-		cache-to = [
-			{ type = "local", dest = "path/to/cache" },
-		]
-
-		output = [
-			{ type = "oci", dest = "../out.tar" },
-			"type=local,dest=../out",
-		]
-
-		secret = [
-			{ id = "mysecret", src = "/local/secret" },
-			{ id = "mysecret2", env = "TOKEN" },
-		]
-
-		ssh = [
-			{ id = "default" },
-			{ id = "key", paths = ["path/to/key"] },
-		]
-	}
-	`)
-
-	c, err := ParseFile(dt, "docker-bake.hcl")
-	require.NoError(t, err)
-
-	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, []string{"type=provenance,mode=max", "type=sbom,disabled=true"}, stringify(c.Targets[0].Attest))
-	require.Equal(t, []string{"type=local,dest=../out", "type=oci,dest=../out.tar"}, stringify(c.Targets[0].Outputs))
-	require.Equal(t, []string{"type=local,src=path/to/cache", "user/app:cache"}, stringify(c.Targets[0].CacheFrom))
-	require.Equal(t, []string{"type=local,dest=path/to/cache"}, stringify(c.Targets[0].CacheTo))
-	require.Equal(t, []string{"id=mysecret,src=/local/secret", "id=mysecret2,env=TOKEN"}, stringify(c.Targets[0].Secrets))
-	require.Equal(t, []string{"default", "key=path/to/key"}, stringify(c.Targets[0].SSH))
-}
-
-func TestHCLAttrsCapsuleTypeVars(t *testing.T) {
-	dt := []byte(`
-	variable "foo" {
-		default = "bar"
-	}
-
-	target "app" {
-		cache-from = [
-			{ type = "registry", ref = "user/app:cache" },
-			"type=local,src=path/to/cache",
-		]
-
-		cache-to = [ target.app.cache-from[0] ]
-
-		output = [
-			{ type = "oci", dest = "../out.tar" },
-			"type=local,dest=../out",
-		]
-
-		secret = [
-			{ id = "mysecret", src = "/local/secret" },
-		]
-
-		ssh = [
-			{ id = "default" },
-			{ id = "key", paths = ["path/to/${target.app.output[0].type}"] },
-		]
-	}
-
-	target "web" {
-		cache-from = target.app.cache-from
-
-		output = [ "type=oci,dest=../${foo}.tar" ]
-
-		secret = [
-			{ id = target.app.output[0].type, src = "/${target.app.cache-from[1].type}/secret" },
-		]
-	}
-	`)
-
-	c, err := ParseFile(dt, "docker-bake.hcl")
-	require.NoError(t, err)
-
-	require.Equal(t, 2, len(c.Targets))
-
-	findTarget := func(t *testing.T, name string) *Target {
-		t.Helper()
-		for _, tgt := range c.Targets {
-			if tgt.Name == name {
-				return tgt
-			}
-		}
-		t.Fatalf("could not find target %q", name)
-		return nil
-	}
-
-	app := findTarget(t, "app")
-	require.Equal(t, []string{"type=local,dest=../out", "type=oci,dest=../out.tar"}, stringify(app.Outputs))
-	require.Equal(t, []string{"type=local,src=path/to/cache", "user/app:cache"}, stringify(app.CacheFrom))
-	require.Equal(t, []string{"user/app:cache"}, stringify(app.CacheTo))
-	require.Equal(t, []string{"id=mysecret,src=/local/secret"}, stringify(app.Secrets))
-	require.Equal(t, []string{"default", "key=path/to/oci"}, stringify(app.SSH))
-
-	web := findTarget(t, "web")
-	require.Equal(t, []string{"type=oci,dest=../bar.tar"}, stringify(web.Outputs))
-	require.Equal(t, []string{"type=local,src=path/to/cache", "user/app:cache"}, stringify(web.CacheFrom))
-	require.Equal(t, []string{"id=oci,src=/local/secret"}, stringify(web.Secrets))
-}
-
 func TestHCLMultiFileAttrs(t *testing.T) {
 	dt := []byte(`
 		variable "FOO" {

bake/hclparser/LICENSE

@@ -1,355 +0,0 @@
-Copyright (c) 2014 HashiCorp, Inc.
-
-Mozilla Public License, version 2.0
-
-1. Definitions
-
-1.1. “Contributor”
-
-     means each individual or legal entity that creates, contributes to the
-     creation of, or owns Covered Software.
-
-1.2. “Contributor Version”
-
-     means the combination of the Contributions of others (if any) used by a
-     Contributor and that particular Contributor’s Contribution.
-
-1.3. “Contribution”
-
-     means Covered Software of a particular Contributor.
-
-1.4. “Covered Software”
-
-     means Source Code Form to which the initial Contributor has attached the
-     notice in Exhibit A, the Executable Form of such Source Code Form, and
-     Modifications of such Source Code Form, in each case including portions
-     thereof.
-
-1.5. “Incompatible With Secondary Licenses”
-     means
-
-     a. that the initial Contributor has attached the notice described in
-        Exhibit B to the Covered Software; or
-
-     b. that the Covered Software was made available under the terms of version
-        1.1 or earlier of the License, but not also under the terms of a
-        Secondary License.
-
-1.6. “Executable Form”
-
-     means any form of the work other than Source Code Form.
-
-1.7. “Larger Work”
-
-     means a work that combines Covered Software with other material, in a separate
-     file or files, that is not Covered Software.
-
-1.8. “License”
-
-     means this document.
-
-1.9. “Licensable”
-
-     means having the right to grant, to the maximum extent possible, whether at the
-     time of the initial grant or subsequently, any and all of the rights conveyed by
-     this License.
-
-1.10. “Modifications”
-
-     means any of the following:
-
-     a. any file in Source Code Form that results from an addition to, deletion
-        from, or modification of the contents of Covered Software; or
-
-     b. any new file in Source Code Form that contains any Covered Software.
-
-1.11. “Patent Claims” of a Contributor
-
-      means any patent claim(s), including without limitation, method, process,
-      and apparatus claims, in any patent Licensable by such Contributor that
-      would be infringed, but for the grant of the License, by the making,
-      using, selling, offering for sale, having made, import, or transfer of
-      either its Contributions or its Contributor Version.
-
-1.12. “Secondary License”
-
-      means either the GNU General Public License, Version 2.0, the GNU Lesser
-      General Public License, Version 2.1, the GNU Affero General Public
-      License, Version 3.0, or any later versions of those licenses.
-
-1.13. “Source Code Form”
-
-      means the form of the work preferred for making modifications.
-
-1.14. “You” (or “Your”)
-
-      means an individual or a legal entity exercising rights under this
-      License. For legal entities, “You” includes any entity that controls, is
-      controlled by, or is under common control with You. For purposes of this
-      definition, “control” means (a) the power, direct or indirect, to cause
-      the direction or management of such entity, whether by contract or
-      otherwise, or (b) ownership of more than fifty percent (50%) of the
-      outstanding shares or beneficial ownership of such entity.
-
-
-2. License Grants and Conditions
-
-2.1. Grants
-
-     Each Contributor hereby grants You a world-wide, royalty-free,
-     non-exclusive license:
-
-     a. under intellectual property rights (other than patent or trademark)
-        Licensable by such Contributor to use, reproduce, make available,
-        modify, display, perform, distribute, and otherwise exploit its
-        Contributions, either on an unmodified basis, with Modifications, or as
-        part of a Larger Work; and
-
-     b. under Patent Claims of such Contributor to make, use, sell, offer for
-        sale, have made, import, and otherwise transfer either its Contributions
-        or its Contributor Version.
-
-2.2. Effective Date
-
-     The licenses granted in Section 2.1 with respect to any Contribution become
-     effective for each Contribution on the date the Contributor first distributes
-     such Contribution.
-
-2.3. Limitations on Grant Scope
-
-     The licenses granted in this Section 2 are the only rights granted under this
-     License. No additional rights or licenses will be implied from the distribution
-     or licensing of Covered Software under this License. Notwithstanding Section
-     2.1(b) above, no patent license is granted by a Contributor:
-
-     a. for any code that a Contributor has removed from Covered Software; or
-
-     b. for infringements caused by: (i) Your and any other third party’s
-        modifications of Covered Software, or (ii) the combination of its
-        Contributions with other software (except as part of its Contributor
-        Version); or
-
-     c. under Patent Claims infringed by Covered Software in the absence of its
-        Contributions.
-
-     This License does not grant any rights in the trademarks, service marks, or
-     logos of any Contributor (except as may be necessary to comply with the
-     notice requirements in Section 3.4).
-
-2.4. Subsequent Licenses
-
-     No Contributor makes additional grants as a result of Your choice to
-     distribute the Covered Software under a subsequent version of this License
-     (see Section 10.2) or under the terms of a Secondary License (if permitted
-     under the terms of Section 3.3).
-
-2.5. Representation
-
-     Each Contributor represents that the Contributor believes its Contributions
-     are its original creation(s) or it has sufficient rights to grant the
-     rights to its Contributions conveyed by this License.
-
-2.6. Fair Use
-
-     This License is not intended to limit any rights You have under applicable
-     copyright doctrines of fair use, fair dealing, or other equivalents.
-
-2.7. Conditions
-
-     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
-     Section 2.1.
-
-
-3. Responsibilities
-
-3.1. Distribution of Source Form
-
-     All distribution of Covered Software in Source Code Form, including any
-     Modifications that You create or to which You contribute, must be under the
-     terms of this License. You must inform recipients that the Source Code Form
-     of the Covered Software is governed by the terms of this License, and how
-     they can obtain a copy of this License. You may not attempt to alter or
-     restrict the recipients’ rights in the Source Code Form.
-
-3.2. Distribution of Executable Form
-
-     If You distribute Covered Software in Executable Form then:
-
-     a. such Covered Software must also be made available in Source Code Form,
-        as described in Section 3.1, and You must inform recipients of the
-        Executable Form how they can obtain a copy of such Source Code Form by
-        reasonable means in a timely manner, at a charge no more than the cost
-        of distribution to the recipient; and
-
-     b. You may distribute such Executable Form under the terms of this License,
-        or sublicense it under different terms, provided that the license for
-        the Executable Form does not attempt to limit or alter the recipients’
-        rights in the Source Code Form under this License.
-
-3.3. Distribution of a Larger Work
-
-     You may create and distribute a Larger Work under terms of Your choice,
-     provided that You also comply with the requirements of this License for the
-     Covered Software. If the Larger Work is a combination of Covered Software
-     with a work governed by one or more Secondary Licenses, and the Covered
-     Software is not Incompatible With Secondary Licenses, this License permits
-     You to additionally distribute such Covered Software under the terms of
-     such Secondary License(s), so that the recipient of the Larger Work may, at
-     their option, further distribute the Covered Software under the terms of
-     either this License or such Secondary License(s).
-
-3.4. Notices
-
-     You may not remove or alter the substance of any license notices (including
-     copyright notices, patent notices, disclaimers of warranty, or limitations
-     of liability) contained within the Source Code Form of the Covered
-     Software, except that You may alter any license notices to the extent
-     required to remedy known factual inaccuracies.
-
-3.5. Application of Additional Terms
-
-     You may choose to offer, and to charge a fee for, warranty, support,
-     indemnity or liability obligations to one or more recipients of Covered
-     Software. However, You may do so only on Your own behalf, and not on behalf
-     of any Contributor. You must make it absolutely clear that any such
-     warranty, support, indemnity, or liability obligation is offered by You
-     alone, and You hereby agree to indemnify every Contributor for any
-     liability incurred by such Contributor as a result of warranty, support,
-     indemnity or liability terms You offer. You may include additional
-     disclaimers of warranty and limitations of liability specific to any
-     jurisdiction.
-
-4. Inability to Comply Due to Statute or Regulation
-
-   If it is impossible for You to comply with any of the terms of this License
-   with respect to some or all of the Covered Software due to statute, judicial
-   order, or regulation then You must: (a) comply with the terms of this License
-   to the maximum extent possible; and (b) describe the limitations and the code
-   they affect. Such description must be placed in a text file included with all
-   distributions of the Covered Software under this License. Except to the
-   extent prohibited by statute or regulation, such description must be
-   sufficiently detailed for a recipient of ordinary skill to be able to
-   understand it.
-
-5. Termination
-
-5.1. The rights granted under this License will terminate automatically if You
-     fail to comply with any of its terms. However, if You become compliant,
-     then the rights granted under this License from a particular Contributor
-     are reinstated (a) provisionally, unless and until such Contributor
-     explicitly and finally terminates Your grants, and (b) on an ongoing basis,
-     if such Contributor fails to notify You of the non-compliance by some
-     reasonable means prior to 60 days after You have come back into compliance.
-     Moreover, Your grants from a particular Contributor are reinstated on an
-     ongoing basis if such Contributor notifies You of the non-compliance by
-     some reasonable means, this is the first time You have received notice of
-     non-compliance with this License from such Contributor, and You become
-     compliant prior to 30 days after Your receipt of the notice.
-
-5.2. If You initiate litigation against any entity by asserting a patent
-     infringement claim (excluding declaratory judgment actions, counter-claims,
-     and cross-claims) alleging that a Contributor Version directly or
-     indirectly infringes any patent, then the rights granted to You by any and
-     all Contributors for the Covered Software under Section 2.1 of this License
-     shall terminate.
-
-5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
-     license agreements (excluding distributors and resellers) which have been
-     validly granted by You or Your distributors under this License prior to
-     termination shall survive termination.
-
-6. Disclaimer of Warranty
-
-   Covered Software is provided under this License on an “as is” basis, without
-   warranty of any kind, either expressed, implied, or statutory, including,
-   without limitation, warranties that the Covered Software is free of defects,
-   merchantable, fit for a particular purpose or non-infringing. The entire
-   risk as to the quality and performance of the Covered Software is with You.
-   Should any Covered Software prove defective in any respect, You (not any
-   Contributor) assume the cost of any necessary servicing, repair, or
-   correction. This disclaimer of warranty constitutes an essential part of this
-   License. No use of  any Covered Software is authorized under this License
-   except under this disclaimer.
-
-7. Limitation of Liability
-
-   Under no circumstances and under no legal theory, whether tort (including
-   negligence), contract, or otherwise, shall any Contributor, or anyone who
-   distributes Covered Software as permitted above, be liable to You for any
-   direct, indirect, special, incidental, or consequential damages of any
-   character including, without limitation, damages for lost profits, loss of
-   goodwill, work stoppage, computer failure or malfunction, or any and all
-   other commercial damages or losses, even if such party shall have been
-   informed of the possibility of such damages. This limitation of liability
-   shall not apply to liability for death or personal injury resulting from such
-   party’s negligence to the extent applicable law prohibits such limitation.
-   Some jurisdictions do not allow the exclusion or limitation of incidental or
-   consequential damages, so this exclusion and limitation may not apply to You.
-
-8. Litigation
-
-   Any litigation relating to this License may be brought only in the courts of
-   a jurisdiction where the defendant maintains its principal place of business
-   and such litigation shall be governed by laws of that jurisdiction, without
-   reference to its conflict-of-law provisions. Nothing in this Section shall
-   prevent a party’s ability to bring cross-claims or counter-claims.
-
-9. Miscellaneous
-
-   This License represents the complete agreement concerning the subject matter
-   hereof. If any provision of this License is held to be unenforceable, such
-   provision shall be reformed only to the extent necessary to make it
-   enforceable. Any law or regulation which provides that the language of a
-   contract shall be construed against the drafter shall not be used to construe
-   this License against a Contributor.
-
-
-10. Versions of the License
-
-10.1. New Versions
-
-      Mozilla Foundation is the license steward. Except as provided in Section
-      10.3, no one other than the license steward has the right to modify or
-      publish new versions of this License. Each version will be given a
-      distinguishing version number.
-
-10.2. Effect of New Versions
-
-      You may distribute the Covered Software under the terms of the version of
-      the License under which You originally received the Covered Software, or
-      under the terms of any subsequent version published by the license
-      steward.
-
-10.3. Modified Versions
-
-      If you create software not governed by this License, and you want to
-      create a new license for such software, you may create and use a modified
-      version of this License if you rename the license and remove any
-      references to the name of the license steward (except to note that such
-      modified license differs from this License).
-
-10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
-      If You choose to distribute Source Code Form that is Incompatible With
-      Secondary Licenses under the terms of this version of the License, the
-      notice described in Exhibit B of this License must be attached.
-
-Exhibit A - Source Code Form License Notice
-
-      This Source Code Form is subject to the
-      terms of the Mozilla Public License, v.
-      2.0. If a copy of the MPL was not
-      distributed with this file, You can
-      obtain one at
-      http://mozilla.org/MPL/2.0/.
-
-If it is not possible or desirable to put the notice in a particular file, then
-You may include the notice in a location (such as a LICENSE file in a relevant
-directory) where a recipient would be likely to look for such a notice.
-
-You may add additional accurate notices of copyright ownership.
-
-Exhibit B - “Incompatible With Secondary Licenses” Notice
-
-      This Source Code Form is “Incompatible
-      With Secondary Licenses”, as defined by
-      the Mozilla Public License, v. 2.0.

bake/hclparser/gohcl/decode.go

@@ -1,348 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package gohcl
-
-import (
-	"fmt"
-	"reflect"
-
-	"github.com/hashicorp/hcl/v2"
-	"github.com/zclconf/go-cty/cty"
-	"github.com/zclconf/go-cty/cty/convert"
-	"github.com/zclconf/go-cty/cty/gocty"
-)
-
-// DecodeOptions allows customizing sections of the decoding process.
-type DecodeOptions struct {
-	ImpliedType func(gv interface{}) (cty.Type, error)
-	Convert     func(in cty.Value, want cty.Type) (cty.Value, error)
-}
-
-func (o DecodeOptions) DecodeBody(body hcl.Body, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics {
-	o = o.withDefaults()
-
-	rv := reflect.ValueOf(val)
-	if rv.Kind() != reflect.Ptr {
-		panic(fmt.Sprintf("target value must be a pointer, not %s", rv.Type().String()))
-	}
-
-	return o.decodeBodyToValue(body, ctx, rv.Elem())
-}
-
-// DecodeBody extracts the configuration within the given body into the given
-// value. This value must be a non-nil pointer to either a struct or
-// a map, where in the former case the configuration will be decoded using
-// struct tags and in the latter case only attributes are allowed and their
-// values are decoded into the map.
-//
-// The given EvalContext is used to resolve any variables or functions in
-// expressions encountered while decoding. This may be nil to require only
-// constant values, for simple applications that do not support variables or
-// functions.
-//
-// The returned diagnostics should be inspected with its HasErrors method to
-// determine if the populated value is valid and complete. If error diagnostics
-// are returned then the given value may have been partially-populated but
-// may still be accessed by a careful caller for static analysis and editor
-// integration use-cases.
-func DecodeBody(body hcl.Body, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics {
-	return DecodeOptions{}.DecodeBody(body, ctx, val)
-}
-
-func (o DecodeOptions) decodeBodyToValue(body hcl.Body, ctx *hcl.EvalContext, val reflect.Value) hcl.Diagnostics {
-	et := val.Type()
-	switch et.Kind() {
-	case reflect.Struct:
-		return o.decodeBodyToStruct(body, ctx, val)
-	case reflect.Map:
-		return o.decodeBodyToMap(body, ctx, val)
-	default:
-		panic(fmt.Sprintf("target value must be pointer to struct or map, not %s", et.String()))
-	}
-}
-
-func (o DecodeOptions) decodeBodyToStruct(body hcl.Body, ctx *hcl.EvalContext, val reflect.Value) hcl.Diagnostics {
-	schema, partial := ImpliedBodySchema(val.Interface())
-
-	var content *hcl.BodyContent
-	var leftovers hcl.Body
-	var diags hcl.Diagnostics
-	if partial {
-		content, leftovers, diags = body.PartialContent(schema)
-	} else {
-		content, diags = body.Content(schema)
-	}
-	if content == nil {
-		return diags
-	}
-
-	tags := getFieldTags(val.Type())
-
-	if tags.Body != nil {
-		fieldIdx := *tags.Body
-		field := val.Type().Field(fieldIdx)
-		fieldV := val.Field(fieldIdx)
-		switch {
-		case bodyType.AssignableTo(field.Type):
-			fieldV.Set(reflect.ValueOf(body))
-
-		default:
-			diags = append(diags, o.decodeBodyToValue(body, ctx, fieldV)...)
-		}
-	}
-
-	if tags.Remain != nil {
-		fieldIdx := *tags.Remain
-		field := val.Type().Field(fieldIdx)
-		fieldV := val.Field(fieldIdx)
-		switch {
-		case bodyType.AssignableTo(field.Type):
-			fieldV.Set(reflect.ValueOf(leftovers))
-		case attrsType.AssignableTo(field.Type):
-			attrs, attrsDiags := leftovers.JustAttributes()
-			if len(attrsDiags) > 0 {
-				diags = append(diags, attrsDiags...)
-			}
-			fieldV.Set(reflect.ValueOf(attrs))
-		default:
-			diags = append(diags, o.decodeBodyToValue(leftovers, ctx, fieldV)...)
-		}
-	}
-
-	for name, fieldIdx := range tags.Attributes {
-		attr := content.Attributes[name]
-		field := val.Type().Field(fieldIdx)
-		fieldV := val.Field(fieldIdx)
-
-		if attr == nil {
-			if !exprType.AssignableTo(field.Type) {
-				continue
-			}
-
-			// As a special case, if the target is of type hcl.Expression then
-			// we'll assign an actual expression that evalues to a cty null,
-			// so the caller can deal with it within the cty realm rather
-			// than within the Go realm.
-			synthExpr := hcl.StaticExpr(cty.NullVal(cty.DynamicPseudoType), body.MissingItemRange())
-			fieldV.Set(reflect.ValueOf(synthExpr))
-			continue
-		}
-
-		switch {
-		case attrType.AssignableTo(field.Type):
-			fieldV.Set(reflect.ValueOf(attr))
-		case exprType.AssignableTo(field.Type):
-			fieldV.Set(reflect.ValueOf(attr.Expr))
-		default:
-			diags = append(diags, o.DecodeExpression(
-				attr.Expr, ctx, fieldV.Addr().Interface(),
-			)...)
-		}
-	}
-
-	blocksByType := content.Blocks.ByType()
-
-	for typeName, fieldIdx := range tags.Blocks {
-		blocks := blocksByType[typeName]
-		field := val.Type().Field(fieldIdx)
-
-		ty := field.Type
-		isSlice := false
-		isPtr := false
-		if ty.Kind() == reflect.Slice {
-			isSlice = true
-			ty = ty.Elem()
-		}
-		if ty.Kind() == reflect.Ptr {
-			isPtr = true
-			ty = ty.Elem()
-		}
-
-		if len(blocks) > 1 && !isSlice {
-			diags = append(diags, &hcl.Diagnostic{
-				Severity: hcl.DiagError,
-				Summary:  fmt.Sprintf("Duplicate %s block", typeName),
-				Detail: fmt.Sprintf(
-					"Only one %s block is allowed. Another was defined at %s.",
-					typeName, blocks[0].DefRange.String(),
-				),
-				Subject: &blocks[1].DefRange,
-			})
-			continue
-		}
-
-		if len(blocks) == 0 {
-			if isSlice || isPtr {
-				if val.Field(fieldIdx).IsNil() {
-					val.Field(fieldIdx).Set(reflect.Zero(field.Type))
-				}
-			} else {
-				diags = append(diags, &hcl.Diagnostic{
-					Severity: hcl.DiagError,
-					Summary:  fmt.Sprintf("Missing %s block", typeName),
-					Detail:   fmt.Sprintf("A %s block is required.", typeName),
-					Subject:  body.MissingItemRange().Ptr(),
-				})
-			}
-			continue
-		}
-
-		switch {
-		case isSlice:
-			elemType := ty
-			if isPtr {
-				elemType = reflect.PointerTo(ty)
-			}
-			sli := val.Field(fieldIdx)
-			if sli.IsNil() {
-				sli = reflect.MakeSlice(reflect.SliceOf(elemType), len(blocks), len(blocks))
-			}
-
-			for i, block := range blocks {
-				if isPtr {
-					if i >= sli.Len() {
-						sli = reflect.Append(sli, reflect.New(ty))
-					}
-					v := sli.Index(i)
-					if v.IsNil() {
-						v = reflect.New(ty)
-					}
-					diags = append(diags, o.decodeBlockToValue(block, ctx, v.Elem())...)
-					sli.Index(i).Set(v)
-				} else {
-					if i >= sli.Len() {
-						sli = reflect.Append(sli, reflect.Indirect(reflect.New(ty)))
-					}
-					diags = append(diags, o.decodeBlockToValue(block, ctx, sli.Index(i))...)
-				}
-			}
-
-			if sli.Len() > len(blocks) {
-				sli.SetLen(len(blocks))
-			}
-
-			val.Field(fieldIdx).Set(sli)
-
-		default:
-			block := blocks[0]
-			if isPtr {
-				v := val.Field(fieldIdx)
-				if v.IsNil() {
-					v = reflect.New(ty)
-				}
-				diags = append(diags, o.decodeBlockToValue(block, ctx, v.Elem())...)
-				val.Field(fieldIdx).Set(v)
-			} else {
-				diags = append(diags, o.decodeBlockToValue(block, ctx, val.Field(fieldIdx))...)
-			}
-		}
-	}
-
-	return diags
-}
-
-func (o DecodeOptions) decodeBodyToMap(body hcl.Body, ctx *hcl.EvalContext, v reflect.Value) hcl.Diagnostics {
-	attrs, diags := body.JustAttributes()
-	if attrs == nil {
-		return diags
-	}
-
-	mv := reflect.MakeMap(v.Type())
-
-	for k, attr := range attrs {
-		switch {
-		case attrType.AssignableTo(v.Type().Elem()):
-			mv.SetMapIndex(reflect.ValueOf(k), reflect.ValueOf(attr))
-		case exprType.AssignableTo(v.Type().Elem()):
-			mv.SetMapIndex(reflect.ValueOf(k), reflect.ValueOf(attr.Expr))
-		default:
-			ev := reflect.New(v.Type().Elem())
-			diags = append(diags, o.DecodeExpression(attr.Expr, ctx, ev.Interface())...)
-			mv.SetMapIndex(reflect.ValueOf(k), ev.Elem())
-		}
-	}
-
-	v.Set(mv)
-
-	return diags
-}
-
-func (o DecodeOptions) decodeBlockToValue(block *hcl.Block, ctx *hcl.EvalContext, v reflect.Value) hcl.Diagnostics {
-	diags := o.decodeBodyToValue(block.Body, ctx, v)
-
-	if len(block.Labels) > 0 {
-		blockTags := getFieldTags(v.Type())
-		for li, lv := range block.Labels {
-			lfieldIdx := blockTags.Labels[li].FieldIndex
-			v.Field(lfieldIdx).Set(reflect.ValueOf(lv))
-		}
-	}
-
-	return diags
-}
-
-func (o DecodeOptions) DecodeExpression(expr hcl.Expression, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics {
-	o = o.withDefaults()
-
-	srcVal, diags := expr.Value(ctx)
-
-	convTy, err := o.ImpliedType(val)
-	if err != nil {
-		panic(fmt.Sprintf("unsuitable DecodeExpression target: %s", err))
-	}
-
-	srcVal, err = o.Convert(srcVal, convTy)
-	if err != nil {
-		diags = append(diags, &hcl.Diagnostic{
-			Severity: hcl.DiagError,
-			Summary:  "Unsuitable value type",
-			Detail:   fmt.Sprintf("Unsuitable value: %s", err.Error()),
-			Subject:  expr.StartRange().Ptr(),
-			Context:  expr.Range().Ptr(),
-		})
-		return diags
-	}
-
-	err = gocty.FromCtyValue(srcVal, val)
-	if err != nil {
-		diags = append(diags, &hcl.Diagnostic{
-			Severity: hcl.DiagError,
-			Summary:  "Unsuitable value type",
-			Detail:   fmt.Sprintf("Unsuitable value: %s", err.Error()),
-			Subject:  expr.StartRange().Ptr(),
-			Context:  expr.Range().Ptr(),
-		})
-	}
-
-	return diags
-}
-
-// DecodeExpression extracts the value of the given expression into the given
-// value. This value must be something that gocty is able to decode into,
-// since the final decoding is delegated to that package.
-//
-// The given EvalContext is used to resolve any variables or functions in
-// expressions encountered while decoding. This may be nil to require only
-// constant values, for simple applications that do not support variables or
-// functions.
-//
-// The returned diagnostics should be inspected with its HasErrors method to
-// determine if the populated value is valid and complete. If error diagnostics
-// are returned then the given value may have been partially-populated but
-// may still be accessed by a careful caller for static analysis and editor
-// integration use-cases.
-func DecodeExpression(expr hcl.Expression, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics {
-	return DecodeOptions{}.DecodeExpression(expr, ctx, val)
-}
-
-func (o DecodeOptions) withDefaults() DecodeOptions {
-	if o.ImpliedType == nil {
-		o.ImpliedType = gocty.ImpliedType
-	}
-
-	if o.Convert == nil {
-		o.Convert = convert.Convert
-	}
-	return o
-}

bake/hclparser/gohcl/decode_test.go

@@ -1,806 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package gohcl
-
-import (
-	"encoding/json"
-	"fmt"
-	"reflect"
-	"testing"
-
-	"github.com/davecgh/go-spew/spew"
-	"github.com/hashicorp/hcl/v2"
-	hclJSON "github.com/hashicorp/hcl/v2/json"
-	"github.com/zclconf/go-cty/cty"
-)
-
-func TestDecodeBody(t *testing.T) {
-	deepEquals := func(other interface{}) func(v interface{}) bool {
-		return func(v interface{}) bool {
-			return reflect.DeepEqual(v, other)
-		}
-	}
-
-	type withNameExpression struct {
-		Name hcl.Expression `hcl:"name"`
-	}
-
-	type withTwoAttributes struct {
-		A string `hcl:"a,optional"`
-		B string `hcl:"b,optional"`
-	}
-
-	type withNestedBlock struct {
-		Plain  string             `hcl:"plain,optional"`
-		Nested *withTwoAttributes `hcl:"nested,block"`
-	}
-
-	type withListofNestedBlocks struct {
-		Nested []*withTwoAttributes `hcl:"nested,block"`
-	}
-
-	type withListofNestedBlocksNoPointers struct {
-		Nested []withTwoAttributes `hcl:"nested,block"`
-	}
-
-	tests := []struct {
-		Body      map[string]interface{}
-		Target    func() interface{}
-		Check     func(v interface{}) bool
-		DiagCount int
-	}{
-		{
-			map[string]interface{}{},
-			makeInstantiateType(struct{}{}),
-			deepEquals(struct{}{}),
-			0,
-		},
-		{
-			map[string]interface{}{},
-			makeInstantiateType(struct {
-				Name string `hcl:"name"`
-			}{}),
-			deepEquals(struct {
-				Name string `hcl:"name"`
-			}{}),
-			1, // name is required
-		},
-		{
-			map[string]interface{}{},
-			makeInstantiateType(struct {
-				Name *string `hcl:"name"`
-			}{}),
-			deepEquals(struct {
-				Name *string `hcl:"name"`
-			}{}),
-			0,
-		}, // name nil
-		{
-			map[string]interface{}{},
-			makeInstantiateType(struct {
-				Name string `hcl:"name,optional"`
-			}{}),
-			deepEquals(struct {
-				Name string `hcl:"name,optional"`
-			}{}),
-			0,
-		}, // name optional
-		{
-			map[string]interface{}{},
-			makeInstantiateType(withNameExpression{}),
-			func(v interface{}) bool {
-				if v == nil {
-					return false
-				}
-
-				wne, valid := v.(withNameExpression)
-				if !valid {
-					return false
-				}
-
-				if wne.Name == nil {
-					return false
-				}
-
-				nameVal, _ := wne.Name.Value(nil)
-				return nameVal.IsNull()
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-			},
-			makeInstantiateType(withNameExpression{}),
-			func(v interface{}) bool {
-				if v == nil {
-					return false
-				}
-
-				wne, valid := v.(withNameExpression)
-				if !valid {
-					return false
-				}
-
-				if wne.Name == nil {
-					return false
-				}
-
-				nameVal, _ := wne.Name.Value(nil)
-				return nameVal.Equals(cty.StringVal("Ermintrude")).True()
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-			},
-			makeInstantiateType(struct {
-				Name string `hcl:"name"`
-			}{}),
-			deepEquals(struct {
-				Name string `hcl:"name"`
-			}{"Ermintrude"}),
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-				"age":  23,
-			},
-			makeInstantiateType(struct {
-				Name string `hcl:"name"`
-			}{}),
-			deepEquals(struct {
-				Name string `hcl:"name"`
-			}{"Ermintrude"}),
-			1, // Extraneous "age" property
-		},
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-				"age":  50,
-			},
-			makeInstantiateType(struct {
-				Name  string         `hcl:"name"`
-				Attrs hcl.Attributes `hcl:",remain"`
-			}{}),
-			func(gotI interface{}) bool {
-				got := gotI.(struct {
-					Name  string         `hcl:"name"`
-					Attrs hcl.Attributes `hcl:",remain"`
-				})
-				return got.Name == "Ermintrude" && len(got.Attrs) == 1 && got.Attrs["age"] != nil
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-				"age":  50,
-			},
-			makeInstantiateType(struct {
-				Name   string   `hcl:"name"`
-				Remain hcl.Body `hcl:",remain"`
-			}{}),
-			func(gotI interface{}) bool {
-				got := gotI.(struct {
-					Name   string   `hcl:"name"`
-					Remain hcl.Body `hcl:",remain"`
-				})
-
-				attrs, _ := got.Remain.JustAttributes()
-
-				return got.Name == "Ermintrude" && len(attrs) == 1 && attrs["age"] != nil
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name":   "Ermintrude",
-				"living": true,
-			},
-			makeInstantiateType(struct {
-				Name   string               `hcl:"name"`
-				Remain map[string]cty.Value `hcl:",remain"`
-			}{}),
-			deepEquals(struct {
-				Name   string               `hcl:"name"`
-				Remain map[string]cty.Value `hcl:",remain"`
-			}{
-				Name: "Ermintrude",
-				Remain: map[string]cty.Value{
-					"living": cty.True,
-				},
-			}),
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-				"age":  50,
-			},
-			makeInstantiateType(struct {
-				Name   string   `hcl:"name"`
-				Body   hcl.Body `hcl:",body"`
-				Remain hcl.Body `hcl:",remain"`
-			}{}),
-			func(gotI interface{}) bool {
-				got := gotI.(struct {
-					Name   string   `hcl:"name"`
-					Body   hcl.Body `hcl:",body"`
-					Remain hcl.Body `hcl:",remain"`
-				})
-
-				attrs, _ := got.Body.JustAttributes()
-
-				return got.Name == "Ermintrude" && len(attrs) == 2 &&
-					attrs["name"] != nil && attrs["age"] != nil
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": map[string]interface{}{},
-			},
-			makeInstantiateType(struct {
-				Noodle struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				// Generating no diagnostics is good enough for this one.
-				return true
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{{}},
-			},
-			makeInstantiateType(struct {
-				Noodle struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				// Generating no diagnostics is good enough for this one.
-				return true
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{{}, {}},
-			},
-			makeInstantiateType(struct {
-				Noodle struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				// Generating one diagnostic is good enough for this one.
-				return true
-			},
-			1,
-		},
-		{
-			map[string]interface{}{},
-			makeInstantiateType(struct {
-				Noodle struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				// Generating one diagnostic is good enough for this one.
-				return true
-			},
-			1,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{},
-			},
-			makeInstantiateType(struct {
-				Noodle struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				// Generating one diagnostic is good enough for this one.
-				return true
-			},
-			1,
-		},
-		{
-			map[string]interface{}{
-				"noodle": map[string]interface{}{},
-			},
-			makeInstantiateType(struct {
-				Noodle *struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				return gotI.(struct {
-					Noodle *struct{} `hcl:"noodle,block"`
-				}).Noodle != nil
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{{}},
-			},
-			makeInstantiateType(struct {
-				Noodle *struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				return gotI.(struct {
-					Noodle *struct{} `hcl:"noodle,block"`
-				}).Noodle != nil
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{},
-			},
-			makeInstantiateType(struct {
-				Noodle *struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				return gotI.(struct {
-					Noodle *struct{} `hcl:"noodle,block"`
-				}).Noodle == nil
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{{}, {}},
-			},
-			makeInstantiateType(struct {
-				Noodle *struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				// Generating one diagnostic is good enough for this one.
-				return true
-			},
-			1,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{},
-			},
-			makeInstantiateType(struct {
-				Noodle []struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				noodle := gotI.(struct {
-					Noodle []struct{} `hcl:"noodle,block"`
-				}).Noodle
-				return len(noodle) == 0
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{{}},
-			},
-			makeInstantiateType(struct {
-				Noodle []struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				noodle := gotI.(struct {
-					Noodle []struct{} `hcl:"noodle,block"`
-				}).Noodle
-				return len(noodle) == 1
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": []map[string]interface{}{{}, {}},
-			},
-			makeInstantiateType(struct {
-				Noodle []struct{} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				noodle := gotI.(struct {
-					Noodle []struct{} `hcl:"noodle,block"`
-				}).Noodle
-				return len(noodle) == 2
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": map[string]interface{}{},
-			},
-			makeInstantiateType(struct {
-				Noodle struct {
-					Name string `hcl:"name,label"`
-				} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				//nolint:misspell
-				// Generating two diagnostics is good enough for this one.
-				// (one for the missing noodle block and the other for
-				// the JSON serialization detecting the missing level of
-				// heirarchy for the label.)
-				return true
-			},
-			2,
-		},
-		{
-			map[string]interface{}{
-				"noodle": map[string]interface{}{
-					"foo_foo": map[string]interface{}{},
-				},
-			},
-			makeInstantiateType(struct {
-				Noodle struct {
-					Name string `hcl:"name,label"`
-				} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				noodle := gotI.(struct {
-					Noodle struct {
-						Name string `hcl:"name,label"`
-					} `hcl:"noodle,block"`
-				}).Noodle
-				return noodle.Name == "foo_foo"
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": map[string]interface{}{
-					"foo_foo": map[string]interface{}{},
-					"bar_baz": map[string]interface{}{},
-				},
-			},
-			makeInstantiateType(struct {
-				Noodle struct {
-					Name string `hcl:"name,label"`
-				} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				// One diagnostic is enough for this one.
-				return true
-			},
-			1,
-		},
-		{
-			map[string]interface{}{
-				"noodle": map[string]interface{}{
-					"foo_foo": map[string]interface{}{},
-					"bar_baz": map[string]interface{}{},
-				},
-			},
-			makeInstantiateType(struct {
-				Noodles []struct {
-					Name string `hcl:"name,label"`
-				} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				noodles := gotI.(struct {
-					Noodles []struct {
-						Name string `hcl:"name,label"`
-					} `hcl:"noodle,block"`
-				}).Noodles
-				return len(noodles) == 2 && (noodles[0].Name == "foo_foo" || noodles[0].Name == "bar_baz") && (noodles[1].Name == "foo_foo" || noodles[1].Name == "bar_baz") && noodles[0].Name != noodles[1].Name
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"noodle": map[string]interface{}{
-					"foo_foo": map[string]interface{}{
-						"type": "rice",
-					},
-				},
-			},
-			makeInstantiateType(struct {
-				Noodle struct {
-					Name string `hcl:"name,label"`
-					Type string `hcl:"type"`
-				} `hcl:"noodle,block"`
-			}{}),
-			func(gotI interface{}) bool {
-				noodle := gotI.(struct {
-					Noodle struct {
-						Name string `hcl:"name,label"`
-						Type string `hcl:"type"`
-					} `hcl:"noodle,block"`
-				}).Noodle
-				return noodle.Name == "foo_foo" && noodle.Type == "rice"
-			},
-			0,
-		},
-
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-				"age":  34,
-			},
-			makeInstantiateType(map[string]string(nil)),
-			deepEquals(map[string]string{
-				"name": "Ermintrude",
-				"age":  "34",
-			}),
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-				"age":  89,
-			},
-			makeInstantiateType(map[string]*hcl.Attribute(nil)),
-			func(gotI interface{}) bool {
-				got := gotI.(map[string]*hcl.Attribute)
-				return len(got) == 2 && got["name"] != nil && got["age"] != nil
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name": "Ermintrude",
-				"age":  13,
-			},
-			makeInstantiateType(map[string]hcl.Expression(nil)),
-			func(gotI interface{}) bool {
-				got := gotI.(map[string]hcl.Expression)
-				return len(got) == 2 && got["name"] != nil && got["age"] != nil
-			},
-			0,
-		},
-		{
-			map[string]interface{}{
-				"name":   "Ermintrude",
-				"living": true,
-			},
-			makeInstantiateType(map[string]cty.Value(nil)),
-			deepEquals(map[string]cty.Value{
-				"name":   cty.StringVal("Ermintrude"),
-				"living": cty.True,
-			}),
-			0,
-		},
-		{
-			// Retain "nested" block while decoding
-			map[string]interface{}{
-				"plain": "foo",
-			},
-			func() interface{} {
-				return &withNestedBlock{
-					Plain: "bar",
-					Nested: &withTwoAttributes{
-						A: "bar",
-					},
-				}
-			},
-			func(gotI interface{}) bool {
-				foo := gotI.(withNestedBlock)
-				return foo.Plain == "foo" && foo.Nested != nil && foo.Nested.A == "bar"
-			},
-			0,
-		},
-		{
-			// Retain values in "nested" block while decoding
-			map[string]interface{}{
-				"nested": map[string]interface{}{
-					"a": "foo",
-				},
-			},
-			func() interface{} {
-				return &withNestedBlock{
-					Nested: &withTwoAttributes{
-						B: "bar",
-					},
-				}
-			},
-			func(gotI interface{}) bool {
-				foo := gotI.(withNestedBlock)
-				return foo.Nested.A == "foo" && foo.Nested.B == "bar"
-			},
-			0,
-		},
-		{
-			// Retain values in "nested" block list while decoding
-			map[string]interface{}{
-				"nested": []map[string]interface{}{
-					{
-						"a": "foo",
-					},
-				},
-			},
-			func() interface{} {
-				return &withListofNestedBlocks{
-					Nested: []*withTwoAttributes{
-						{
-							B: "bar",
-						},
-					},
-				}
-			},
-			func(gotI interface{}) bool {
-				n := gotI.(withListofNestedBlocks)
-				return n.Nested[0].A == "foo" && n.Nested[0].B == "bar"
-			},
-			0,
-		},
-		{
-			// Remove additional elements from the list while decoding nested blocks
-			map[string]interface{}{
-				"nested": []map[string]interface{}{
-					{
-						"a": "foo",
-					},
-				},
-			},
-			func() interface{} {
-				return &withListofNestedBlocks{
-					Nested: []*withTwoAttributes{
-						{
-							B: "bar",
-						},
-						{
-							B: "bar",
-						},
-					},
-				}
-			},
-			func(gotI interface{}) bool {
-				n := gotI.(withListofNestedBlocks)
-				return len(n.Nested) == 1
-			},
-			0,
-		},
-		{
-			// Make sure decoding value slices works the same as pointer slices.
-			map[string]interface{}{
-				"nested": []map[string]interface{}{
-					{
-						"b": "bar",
-					},
-					{
-						"b": "baz",
-					},
-				},
-			},
-			func() interface{} {
-				return &withListofNestedBlocksNoPointers{
-					Nested: []withTwoAttributes{
-						{
-							B: "foo",
-						},
-					},
-				}
-			},
-			func(gotI interface{}) bool {
-				n := gotI.(withListofNestedBlocksNoPointers)
-				return n.Nested[0].B == "bar" && len(n.Nested) == 2
-			},
-			0,
-		},
-	}
-
-	for i, test := range tests {
-		// For convenience here we're going to use the JSON parser
-		// to process the given body.
-		buf, err := json.Marshal(test.Body)
-		if err != nil {
-			t.Fatalf("error JSON-encoding body for test %d: %s", i, err)
-		}
-
-		t.Run(string(buf), func(t *testing.T) {
-			file, diags := hclJSON.Parse(buf, "test.json")
-			if len(diags) != 0 {
-				t.Fatalf("diagnostics while parsing: %s", diags.Error())
-			}
-
-			targetVal := reflect.ValueOf(test.Target())
-
-			diags = DecodeBody(file.Body, nil, targetVal.Interface())
-			if len(diags) != test.DiagCount {
-				t.Errorf("wrong number of diagnostics %d; want %d", len(diags), test.DiagCount)
-				for _, diag := range diags {
-					t.Logf(" - %s", diag.Error())
-				}
-			}
-			got := targetVal.Elem().Interface()
-			if !test.Check(got) {
-				t.Errorf("wrong result\ngot:  %s", spew.Sdump(got))
-			}
-		})
-	}
-}
-
-func TestDecodeExpression(t *testing.T) {
-	tests := []struct {
-		Value     cty.Value
-		Target    interface{}
-		Want      interface{}
-		DiagCount int
-	}{
-		{
-			cty.StringVal("hello"),
-			"",
-			"hello",
-			0,
-		},
-		{
-			cty.StringVal("hello"),
-			cty.NilVal,
-			cty.StringVal("hello"),
-			0,
-		},
-		{
-			cty.NumberIntVal(2),
-			"",
-			"2",
-			0,
-		},
-		{
-			cty.StringVal("true"),
-			false,
-			true,
-			0,
-		},
-		{
-			cty.NullVal(cty.String),
-			"",
-			"",
-			1, // null value is not allowed
-		},
-		{
-			cty.UnknownVal(cty.String),
-			"",
-			"",
-			1, // value must be known
-		},
-		{
-			cty.ListVal([]cty.Value{cty.True}),
-			false,
-			false,
-			1, // bool required
-		},
-	}
-
-	for i, test := range tests {
-		t.Run(fmt.Sprintf("%02d", i), func(t *testing.T) {
-			expr := &fixedExpression{test.Value}
-
-			targetVal := reflect.New(reflect.TypeOf(test.Target))
-
-			diags := DecodeExpression(expr, nil, targetVal.Interface())
-			if len(diags) != test.DiagCount {
-				t.Errorf("wrong number of diagnostics %d; want %d", len(diags), test.DiagCount)
-				for _, diag := range diags {
-					t.Logf(" - %s", diag.Error())
-				}
-			}
-			got := targetVal.Elem().Interface()
-			if !reflect.DeepEqual(got, test.Want) {
-				t.Errorf("wrong result\ngot:  %#v\nwant: %#v", got, test.Want)
-			}
-		})
-	}
-}
-
-type fixedExpression struct {
-	val cty.Value
-}
-
-func (e *fixedExpression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
-	return e.val, nil
-}
-
-func (e *fixedExpression) Range() (r hcl.Range) {
-	return
-}
-
-func (e *fixedExpression) StartRange() (r hcl.Range) {
-	return
-}
-
-func (e *fixedExpression) Variables() []hcl.Traversal {
-	return nil
-}
-
-func makeInstantiateType(target interface{}) func() interface{} {
-	return func() interface{} {
-		return reflect.New(reflect.TypeOf(target)).Interface()
-	}
-}

bake/hclparser/gohcl/doc.go

@@ -1,65 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-// Package gohcl allows decoding HCL configurations into Go data structures.
-//
-// It provides a convenient and concise way of describing the schema for
-// configuration and then accessing the resulting data via native Go
-// types.
-//
-// A struct field tag scheme is used, similar to other decoding and
-// unmarshalling libraries. The tags are formatted as in the following example:
-//
-//	ThingType string `hcl:"thing_type,attr"`
-//
-// Within each tag there are two comma-separated tokens. The first is the
-// name of the corresponding construct in configuration, while the second
-// is a keyword giving the kind of construct expected. The following
-// kind keywords are supported:
-//
-//	attr (the default) indicates that the value is to be populated from an attribute
-//	block indicates that the value is to populated from a block
-//	label indicates that the value is to populated from a block label
-//	optional is the same as attr, but the field is optional
-//	remain indicates that the value is to be populated from the remaining body after populating other fields
-//
-// "attr" fields may either be of type *hcl.Expression, in which case the raw
-// expression is assigned, or of any type accepted by gocty, in which case
-// gocty will be used to assign the value to a native Go type.
-//
-// "block" fields may be a struct that recursively uses the same tags, or a
-// slice of such structs, in which case multiple blocks of the corresponding
-// type are decoded into the slice.
-//
-// "body" can be placed on a single field of type hcl.Body to capture
-// the full hcl.Body that was decoded for a block. This does not allow leftover
-// values like "remain", so a decoding error will still be returned if leftover
-// fields are given. If you want to capture the decoding body PLUS leftover
-// fields, you must specify a "remain" field as well to prevent errors. The
-// body field and the remain field will both contain the leftover fields.
-//
-// "label" fields are considered only in a struct used as the type of a field
-// marked as "block", and are used sequentially to capture the labels of
-// the blocks being decoded. In this case, the name token is used only as
-// an identifier for the label in diagnostic messages.
-//
-// "optional" fields behave like "attr" fields, but they are optional
-// and will not give parsing errors if they are missing.
-//
-// "remain" can be placed on a single field that may be either of type
-// hcl.Body or hcl.Attributes, in which case any remaining body content is
-// placed into this field for delayed processing. If no "remain" field is
-// present then any attributes or blocks not matched by another valid tag
-// will cause an error diagnostic.
-//
-// Only a subset of this tagging/typing vocabulary is supported for the
-// "Encode" family of functions. See the EncodeIntoBody docs for full details
-// on the constraints there.
-//
-// Broadly-speaking this package deals with two types of error. The first is
-// errors in the configuration itself, which are returned as diagnostics
-// written with the configuration author as the target audience. The second
-// is bugs in the calling program, such as invalid struct tags, which are
-// surfaced via panics since there can be no useful runtime handling of such
-// errors and they should certainly not be returned to the user as diagnostics.
-package gohcl

bake/hclparser/gohcl/encode.go

@@ -1,192 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package gohcl
-
-import (
-	"fmt"
-	"reflect"
-	"sort"
-
-	"github.com/hashicorp/hcl/v2/hclwrite"
-	"github.com/zclconf/go-cty/cty/gocty"
-)
-
-// EncodeIntoBody replaces the contents of the given hclwrite Body with
-// attributes and blocks derived from the given value, which must be a
-// struct value or a pointer to a struct value with the struct tags defined
-// in this package.
-//
-// This function can work only with fully-decoded data. It will ignore any
-// fields tagged as "remain", any fields that decode attributes into either
-// hcl.Attribute or hcl.Expression values, and any fields that decode blocks
-// into hcl.Attributes values. This function does not have enough information
-// to complete the decoding of these types.
-//
-// Any fields tagged as "label" are ignored by this function. Use EncodeAsBlock
-// to produce a whole hclwrite.Block including block labels.
-//
-// As long as a suitable value is given to encode and the destination body
-// is non-nil, this function will always complete. It will panic in case of
-// any errors in the calling program, such as passing an inappropriate type
-// or a nil body.
-//
-// The layout of the resulting HCL source is derived from the ordering of
-// the struct fields, with blank lines around nested blocks of different types.
-// Fields representing attributes should usually precede those representing
-// blocks so that the attributes can group togather in the result. For more
-// control, use the hclwrite API directly.
-func EncodeIntoBody(val interface{}, dst *hclwrite.Body) {
-	rv := reflect.ValueOf(val)
-	ty := rv.Type()
-	if ty.Kind() == reflect.Ptr {
-		rv = rv.Elem()
-		ty = rv.Type()
-	}
-	if ty.Kind() != reflect.Struct {
-		panic(fmt.Sprintf("value is %s, not struct", ty.Kind()))
-	}
-
-	tags := getFieldTags(ty)
-	populateBody(rv, ty, tags, dst)
-}
-
-// EncodeAsBlock creates a new hclwrite.Block populated with the data from
-// the given value, which must be a struct or pointer to struct with the
-// struct tags defined in this package.
-//
-// If the given struct type has fields tagged with "label" tags then they
-// will be used in order to annotate the created block with labels.
-//
-// This function has the same constraints as EncodeIntoBody and will panic
-// if they are violated.
-func EncodeAsBlock(val interface{}, blockType string) *hclwrite.Block {
-	rv := reflect.ValueOf(val)
-	ty := rv.Type()
-	if ty.Kind() == reflect.Ptr {
-		rv = rv.Elem()
-		ty = rv.Type()
-	}
-	if ty.Kind() != reflect.Struct {
-		panic(fmt.Sprintf("value is %s, not struct", ty.Kind()))
-	}
-
-	tags := getFieldTags(ty)
-	labels := make([]string, len(tags.Labels))
-	for i, lf := range tags.Labels {
-		lv := rv.Field(lf.FieldIndex)
-		// We just stringify whatever we find. It should always be a string
-		// but if not then we'll still do something reasonable.
-		labels[i] = fmt.Sprintf("%s", lv.Interface())
-	}
-
-	block := hclwrite.NewBlock(blockType, labels)
-	populateBody(rv, ty, tags, block.Body())
-	return block
-}
-
-func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwrite.Body) {
-	nameIdxs := make(map[string]int, len(tags.Attributes)+len(tags.Blocks))
-	namesOrder := make([]string, 0, len(tags.Attributes)+len(tags.Blocks))
-	for n, i := range tags.Attributes {
-		nameIdxs[n] = i
-		namesOrder = append(namesOrder, n)
-	}
-	for n, i := range tags.Blocks {
-		nameIdxs[n] = i
-		namesOrder = append(namesOrder, n)
-	}
-	sort.SliceStable(namesOrder, func(i, j int) bool {
-		ni, nj := namesOrder[i], namesOrder[j]
-		return nameIdxs[ni] < nameIdxs[nj]
-	})
-
-	dst.Clear()
-
-	prevWasBlock := false
-	for _, name := range namesOrder {
-		fieldIdx := nameIdxs[name]
-		field := ty.Field(fieldIdx)
-		fieldTy := field.Type
-		fieldVal := rv.Field(fieldIdx)
-
-		if fieldTy.Kind() == reflect.Ptr {
-			fieldTy = fieldTy.Elem()
-			fieldVal = fieldVal.Elem()
-		}
-
-		if _, isAttr := tags.Attributes[name]; isAttr {
-			if exprType.AssignableTo(fieldTy) || attrType.AssignableTo(fieldTy) {
-				continue // ignore undecoded fields
-			}
-			if !fieldVal.IsValid() {
-				continue // ignore (field value is nil pointer)
-			}
-			if fieldTy.Kind() == reflect.Ptr && fieldVal.IsNil() {
-				continue // ignore
-			}
-			if prevWasBlock {
-				dst.AppendNewline()
-				prevWasBlock = false
-			}
-
-			valTy, err := gocty.ImpliedType(fieldVal.Interface())
-			if err != nil {
-				panic(fmt.Sprintf("cannot encode %T as HCL expression: %s", fieldVal.Interface(), err))
-			}
-
-			val, err := gocty.ToCtyValue(fieldVal.Interface(), valTy)
-			if err != nil {
-				// This should never happen, since we should always be able
-				// to decode into the implied type.
-				panic(fmt.Sprintf("failed to encode %T as %#v: %s", fieldVal.Interface(), valTy, err))
-			}
-
-			dst.SetAttributeValue(name, val)
-		} else { // must be a block, then
-			elemTy := fieldTy
-			isSeq := false
-			if elemTy.Kind() == reflect.Slice || elemTy.Kind() == reflect.Array {
-				isSeq = true
-				elemTy = elemTy.Elem()
-			}
-
-			if bodyType.AssignableTo(elemTy) || attrsType.AssignableTo(elemTy) {
-				continue // ignore undecoded fields
-			}
-			prevWasBlock = false
-
-			if isSeq {
-				l := fieldVal.Len()
-				for i := 0; i < l; i++ {
-					elemVal := fieldVal.Index(i)
-					if !elemVal.IsValid() {
-						continue // ignore (elem value is nil pointer)
-					}
-					if elemTy.Kind() == reflect.Ptr && elemVal.IsNil() {
-						continue // ignore
-					}
-					block := EncodeAsBlock(elemVal.Interface(), name)
-					if !prevWasBlock {
-						dst.AppendNewline()
-						prevWasBlock = true
-					}
-					dst.AppendBlock(block)
-				}
-			} else {
-				if !fieldVal.IsValid() {
-					continue // ignore (field value is nil pointer)
-				}
-				if elemTy.Kind() == reflect.Ptr && fieldVal.IsNil() {
-					continue // ignore
-				}
-				block := EncodeAsBlock(fieldVal.Interface(), name)
-				if !prevWasBlock {
-					dst.AppendNewline()
-					prevWasBlock = true
-				}
-				dst.AppendBlock(block)
-			}
-		}
-	}
-}

bake/hclparser/gohcl/encode_test.go

@@ -1,67 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package gohcl_test
-
-import (
-	"fmt"
-
-	"github.com/hashicorp/hcl/v2/gohcl"
-	"github.com/hashicorp/hcl/v2/hclwrite"
-)
-
-func ExampleEncodeIntoBody() {
-	type Service struct {
-		Name string   `hcl:"name,label"`
-		Exe  []string `hcl:"executable"`
-	}
-	type Constraints struct {
-		OS   string `hcl:"os"`
-		Arch string `hcl:"arch"`
-	}
-	type App struct {
-		Name        string       `hcl:"name"`
-		Desc        string       `hcl:"description"`
-		Constraints *Constraints `hcl:"constraints,block"`
-		Services    []Service    `hcl:"service,block"`
-	}
-
-	app := App{
-		Name: "awesome-app",
-		Desc: "Such an awesome application",
-		Constraints: &Constraints{
-			OS:   "linux",
-			Arch: "amd64",
-		},
-		Services: []Service{
-			{
-				Name: "web",
-				Exe:  []string{"./web", "--listen=:8080"},
-			},
-			{
-				Name: "worker",
-				Exe:  []string{"./worker"},
-			},
-		},
-	}
-
-	f := hclwrite.NewEmptyFile()
-	gohcl.EncodeIntoBody(&app, f.Body())
-	fmt.Printf("%s", f.Bytes())
-
-	// Output:
-	// name        = "awesome-app"
-	// description = "Such an awesome application"
-	//
-	// constraints {
-	//   os   = "linux"
-	//   arch = "amd64"
-	// }
-	//
-	// service "web" {
-	//   executable = ["./web", "--listen=:8080"]
-	// }
-	// service "worker" {
-	//   executable = ["./worker"]
-	// }
-}

bake/hclparser/gohcl/schema.go

@@ -1,185 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package gohcl
-
-import (
-	"fmt"
-	"reflect"
-	"sort"
-	"strings"
-
-	"github.com/hashicorp/hcl/v2"
-)
-
-// ImpliedBodySchema produces a hcl.BodySchema derived from the type of the
-// given value, which must be a struct value or a pointer to one. If an
-// inappropriate value is passed, this function will panic.
-//
-// The second return argument indicates whether the given struct includes
-// a "remain" field, and thus the returned schema is non-exhaustive.
-//
-// This uses the tags on the fields of the struct to discover how each
-// field's value should be expressed within configuration. If an invalid
-// mapping is attempted, this function will panic.
-func ImpliedBodySchema(val interface{}) (schema *hcl.BodySchema, partial bool) {
-	ty := reflect.TypeOf(val)
-
-	if ty.Kind() == reflect.Ptr {
-		ty = ty.Elem()
-	}
-
-	if ty.Kind() != reflect.Struct {
-		panic(fmt.Sprintf("given value must be struct, not %T", val))
-	}
-
-	var attrSchemas []hcl.AttributeSchema
-	var blockSchemas []hcl.BlockHeaderSchema
-
-	tags := getFieldTags(ty)
-
-	attrNames := make([]string, 0, len(tags.Attributes))
-	for n := range tags.Attributes {
-		attrNames = append(attrNames, n)
-	}
-	sort.Strings(attrNames)
-	for _, n := range attrNames {
-		idx := tags.Attributes[n]
-		optional := tags.Optional[n]
-		field := ty.Field(idx)
-
-		var required bool
-
-		switch {
-		case field.Type.AssignableTo(exprType):
-			//nolint:misspell
-			// If we're decoding to hcl.Expression then absense can be
-			// indicated via a null value, so we don't specify that
-			// the field is required during decoding.
-			required = false
-		case field.Type.Kind() != reflect.Ptr && !optional:
-			required = true
-		default:
-			required = false
-		}
-
-		attrSchemas = append(attrSchemas, hcl.AttributeSchema{
-			Name:     n,
-			Required: required,
-		})
-	}
-
-	blockNames := make([]string, 0, len(tags.Blocks))
-	for n := range tags.Blocks {
-		blockNames = append(blockNames, n)
-	}
-	sort.Strings(blockNames)
-	for _, n := range blockNames {
-		idx := tags.Blocks[n]
-		field := ty.Field(idx)
-		fty := field.Type
-		if fty.Kind() == reflect.Slice {
-			fty = fty.Elem()
-		}
-		if fty.Kind() == reflect.Ptr {
-			fty = fty.Elem()
-		}
-		if fty.Kind() != reflect.Struct {
-			panic(fmt.Sprintf(
-				"hcl 'block' tag kind cannot be applied to %s field %s: struct required", field.Type.String(), field.Name,
-			))
-		}
-		ftags := getFieldTags(fty)
-		var labelNames []string
-		if len(ftags.Labels) > 0 {
-			labelNames = make([]string, len(ftags.Labels))
-			for i, l := range ftags.Labels {
-				labelNames[i] = l.Name
-			}
-		}
-
-		blockSchemas = append(blockSchemas, hcl.BlockHeaderSchema{
-			Type:       n,
-			LabelNames: labelNames,
-		})
-	}
-
-	partial = tags.Remain != nil
-	schema = &hcl.BodySchema{
-		Attributes: attrSchemas,
-		Blocks:     blockSchemas,
-	}
-	return schema, partial
-}
-
-type fieldTags struct {
-	Attributes map[string]int
-	Blocks     map[string]int
-	Labels     []labelField
-	Remain     *int
-	Body       *int
-	Optional   map[string]bool
-}
-
-type labelField struct {
-	FieldIndex int
-	Name       string
-}
-
-func getFieldTags(ty reflect.Type) *fieldTags {
-	ret := &fieldTags{
-		Attributes: map[string]int{},
-		Blocks:     map[string]int{},
-		Optional:   map[string]bool{},
-	}
-
-	ct := ty.NumField()
-	for i := 0; i < ct; i++ {
-		field := ty.Field(i)
-		tag := field.Tag.Get("hcl")
-		if tag == "" {
-			continue
-		}
-
-		comma := strings.Index(tag, ",")
-		var name, kind string
-		if comma != -1 {
-			name = tag[:comma]
-			kind = tag[comma+1:]
-		} else {
-			name = tag
-			kind = "attr"
-		}
-
-		switch kind {
-		case "attr":
-			ret.Attributes[name] = i
-		case "block":
-			ret.Blocks[name] = i
-		case "label":
-			ret.Labels = append(ret.Labels, labelField{
-				FieldIndex: i,
-				Name:       name,
-			})
-		case "remain":
-			if ret.Remain != nil {
-				panic("only one 'remain' tag is permitted")
-			}
-			idx := i // copy, because this loop will continue assigning to i
-			ret.Remain = &idx
-		case "body":
-			if ret.Body != nil {
-				panic("only one 'body' tag is permitted")
-			}
-			idx := i // copy, because this loop will continue assigning to i
-			ret.Body = &idx
-		case "optional":
-			ret.Attributes[name] = i
-			ret.Optional[name] = true
-		default:
-			panic(fmt.Sprintf("invalid hcl field tag kind %q on %s %q", kind, field.Type.String(), field.Name))
-		}
-	}
-
-	return ret
-}

bake/hclparser/gohcl/schema_test.go

@@ -1,233 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package gohcl
-
-import (
-	"fmt"
-	"reflect"
-	"testing"
-
-	"github.com/davecgh/go-spew/spew"
-	"github.com/hashicorp/hcl/v2"
-)
-
-func TestImpliedBodySchema(t *testing.T) {
-	tests := []struct {
-		val         interface{}
-		wantSchema  *hcl.BodySchema
-		wantPartial bool
-	}{
-		{
-			struct{}{},
-			&hcl.BodySchema{},
-			false,
-		},
-		{
-			struct {
-				Ignored bool
-			}{},
-			&hcl.BodySchema{},
-			false,
-		},
-		{
-			struct {
-				Attr1 bool `hcl:"attr1"`
-				Attr2 bool `hcl:"attr2"`
-			}{},
-			&hcl.BodySchema{
-				Attributes: []hcl.AttributeSchema{
-					{
-						Name:     "attr1",
-						Required: true,
-					},
-					{
-						Name:     "attr2",
-						Required: true,
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Attr *bool `hcl:"attr,attr"`
-			}{},
-			&hcl.BodySchema{
-				Attributes: []hcl.AttributeSchema{
-					{
-						Name:     "attr",
-						Required: false,
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Thing struct{} `hcl:"thing,block"`
-			}{},
-			&hcl.BodySchema{
-				Blocks: []hcl.BlockHeaderSchema{
-					{
-						Type: "thing",
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Thing struct {
-					Type string `hcl:"type,label"`
-					Name string `hcl:"name,label"`
-				} `hcl:"thing,block"`
-			}{},
-			&hcl.BodySchema{
-				Blocks: []hcl.BlockHeaderSchema{
-					{
-						Type:       "thing",
-						LabelNames: []string{"type", "name"},
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Thing []struct {
-					Type string `hcl:"type,label"`
-					Name string `hcl:"name,label"`
-				} `hcl:"thing,block"`
-			}{},
-			&hcl.BodySchema{
-				Blocks: []hcl.BlockHeaderSchema{
-					{
-						Type:       "thing",
-						LabelNames: []string{"type", "name"},
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Thing *struct {
-					Type string `hcl:"type,label"`
-					Name string `hcl:"name,label"`
-				} `hcl:"thing,block"`
-			}{},
-			&hcl.BodySchema{
-				Blocks: []hcl.BlockHeaderSchema{
-					{
-						Type:       "thing",
-						LabelNames: []string{"type", "name"},
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Thing struct {
-					Name      string `hcl:"name,label"`
-					Something string `hcl:"something"`
-				} `hcl:"thing,block"`
-			}{},
-			&hcl.BodySchema{
-				Blocks: []hcl.BlockHeaderSchema{
-					{
-						Type:       "thing",
-						LabelNames: []string{"name"},
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Doodad string `hcl:"doodad"`
-				Thing  struct {
-					Name string `hcl:"name,label"`
-				} `hcl:"thing,block"`
-			}{},
-			&hcl.BodySchema{
-				Attributes: []hcl.AttributeSchema{
-					{
-						Name:     "doodad",
-						Required: true,
-					},
-				},
-				Blocks: []hcl.BlockHeaderSchema{
-					{
-						Type:       "thing",
-						LabelNames: []string{"name"},
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Doodad string `hcl:"doodad"`
-				Config string `hcl:",remain"`
-			}{},
-			&hcl.BodySchema{
-				Attributes: []hcl.AttributeSchema{
-					{
-						Name:     "doodad",
-						Required: true,
-					},
-				},
-			},
-			true,
-		},
-		{
-			struct {
-				Expr hcl.Expression `hcl:"expr"`
-			}{},
-			&hcl.BodySchema{
-				Attributes: []hcl.AttributeSchema{
-					{
-						Name:     "expr",
-						Required: false,
-					},
-				},
-			},
-			false,
-		},
-		{
-			struct {
-				Meh string `hcl:"meh,optional"`
-			}{},
-			&hcl.BodySchema{
-				Attributes: []hcl.AttributeSchema{
-					{
-						Name:     "meh",
-						Required: false,
-					},
-				},
-			},
-			false,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(fmt.Sprintf("%#v", test.val), func(t *testing.T) {
-			schema, partial := ImpliedBodySchema(test.val)
-			if !reflect.DeepEqual(schema, test.wantSchema) {
-				t.Errorf(
-					"wrong schema\ngot:  %s\nwant: %s",
-					spew.Sdump(schema), spew.Sdump(test.wantSchema),
-				)
-			}
-
-			if partial != test.wantPartial {
-				t.Errorf(
-					"wrong partial flag\ngot:  %#v\nwant: %#v",
-					partial, test.wantPartial,
-				)
-			}
-		})
-	}
-}

bake/hclparser/gohcl/types.go

@@ -1,19 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package gohcl
-
-import (
-	"reflect"
-
-	"github.com/hashicorp/hcl/v2"
-)
-
-var victimExpr hcl.Expression
-var victimBody hcl.Body
-
-var exprType = reflect.TypeOf(&victimExpr).Elem()
-var bodyType = reflect.TypeOf(&victimBody).Elem()
-var blockType = reflect.TypeOf((*hcl.Block)(nil)) //nolint:unused
-var attrType = reflect.TypeOf((*hcl.Attribute)(nil))
-var attrsType = reflect.TypeOf(hcl.Attributes(nil))

bake/hclparser/hclparser.go

@@ -10,11 +10,12 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/docker/buildx/bake/hclparser/gohcl"
 	"github.com/docker/buildx/util/userfunc"
 	"github.com/hashicorp/hcl/v2"
+	"github.com/hashicorp/hcl/v2/gohcl"
 	"github.com/pkg/errors"
 	"github.com/zclconf/go-cty/cty"
+	"github.com/zclconf/go-cty/cty/gocty"
 )
 
 type Opt struct {
@@ -453,7 +454,7 @@ func (p *parser) resolveBlock(block *hcl.Block, target *hcl.BodySchema) (err err
 		}
 
 		// decode!
-		diag = decodeBody(body(), ectx, output.Interface())
+		diag = gohcl.DecodeBody(body(), ectx, output.Interface())
 		if diag.HasErrors() {
 			return diag
 		}
@@ -475,11 +476,11 @@ func (p *parser) resolveBlock(block *hcl.Block, target *hcl.BodySchema) (err err
 		}
 
 		// store the result into the evaluation context (so it can be referenced)
-		outputType, err := ImpliedType(output.Interface())
+		outputType, err := gocty.ImpliedType(output.Interface())
 		if err != nil {
 			return err
 		}
-		outputValue, err := ToCtyValue(output.Interface(), outputType)
+		outputValue, err := gocty.ToCtyValue(output.Interface(), outputType)
 		if err != nil {
 			return err
 		}
@@ -491,12 +492,7 @@ func (p *parser) resolveBlock(block *hcl.Block, target *hcl.BodySchema) (err err
 			m = map[string]cty.Value{}
 		}
 		m[name] = outputValue
-
-		// The logical contents of this structure is similar to a map,
-		// but it's possible for some attributes to be different in a way that's
-		// illegal for a map so we use an object here instead which is structurally
-		// equivalent but allows disparate types for different keys.
-		p.ectx.Variables[block.Type] = cty.ObjectVal(m)
+		p.ectx.Variables[block.Type] = cty.MapVal(m)
 	}
 
 	return nil
@@ -579,9 +575,9 @@ func (p *parser) validateVariables(vars map[string]*variable, ectx *hcl.EvalCont
 }
 
 type Variable struct {
-	Name        string  `json:"name"`
-	Description string  `json:"description,omitempty"`
-	Value       *string `json:"value,omitempty"`
+	Name        string
+	Description string
+	Value       *string
 }
 
 type ParseMeta struct {
@@ -987,8 +983,3 @@ func key(ks ...any) uint64 {
 	}
 	return hash.Sum64()
 }
-
-func decodeBody(body hcl.Body, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics {
-	dec := gohcl.DecodeOptions{ImpliedType: ImpliedType}
-	return dec.DecodeBody(body, ctx, val)
-}

bake/hclparser/type_implied.go

@@ -1,160 +0,0 @@
-// MIT License
-//
-// Copyright (c) 2017-2018 Martin Atkins
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all
-// copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
-
-package hclparser
-
-import (
-	"reflect"
-
-	"github.com/zclconf/go-cty/cty"
-)
-
-// ImpliedType takes an arbitrary Go value (as an interface{}) and attempts
-// to find a suitable cty.Type instance that could be used for a conversion
-// with ToCtyValue.
-//
-// This allows -- for simple situations at least -- types to be defined just
-// once in Go and the cty types derived from the Go types, but in the process
-// it makes some assumptions that may be undesirable so applications are
-// encouraged to build their cty types directly if exacting control is
-// required.
-//
-// Not all Go types can be represented as cty types, so an error may be
-// returned which is usually considered to be a bug in the calling program.
-// In particular, ImpliedType will never use capsule types in its returned
-// type, because it cannot know the capsule types supported by the calling
-// program.
-func ImpliedType(gv interface{}) (cty.Type, error) {
-	rt := reflect.TypeOf(gv)
-	var path cty.Path
-	return impliedType(rt, path)
-}
-
-func impliedType(rt reflect.Type, path cty.Path) (cty.Type, error) {
-	if ety, err := impliedTypeExt(rt, path); err == nil {
-		return ety, nil
-	}
-
-	switch rt.Kind() {
-	case reflect.Ptr:
-		return impliedType(rt.Elem(), path)
-
-	// Primitive types
-	case reflect.Bool:
-		return cty.Bool, nil
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		return cty.Number, nil
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		return cty.Number, nil
-	case reflect.Float32, reflect.Float64:
-		return cty.Number, nil
-	case reflect.String:
-		return cty.String, nil
-
-	// Collection types
-	case reflect.Slice:
-		path := append(path, cty.IndexStep{Key: cty.UnknownVal(cty.Number)})
-		ety, err := impliedType(rt.Elem(), path)
-		if err != nil {
-			return cty.NilType, err
-		}
-		return cty.List(ety), nil
-	case reflect.Map:
-		if !stringType.AssignableTo(rt.Key()) {
-			return cty.NilType, path.NewErrorf("no cty.Type for %s (must have string keys)", rt)
-		}
-		path := append(path, cty.IndexStep{Key: cty.UnknownVal(cty.String)})
-		ety, err := impliedType(rt.Elem(), path)
-		if err != nil {
-			return cty.NilType, err
-		}
-		return cty.Map(ety), nil
-
-	// Structural types
-	case reflect.Struct:
-		return impliedStructType(rt, path)
-
-	default:
-		return cty.NilType, path.NewErrorf("no cty.Type for %s", rt)
-	}
-}
-
-func impliedStructType(rt reflect.Type, path cty.Path) (cty.Type, error) {
-	if valueType.AssignableTo(rt) {
-		// Special case: cty.Value represents cty.DynamicPseudoType, for
-		// type conformance checking.
-		return cty.DynamicPseudoType, nil
-	}
-
-	fieldIdxs := structTagIndices(rt)
-	if len(fieldIdxs) == 0 {
-		return cty.NilType, path.NewErrorf("no cty.Type for %s (no cty field tags)", rt)
-	}
-
-	atys := make(map[string]cty.Type, len(fieldIdxs))
-
-	{
-		// Temporary extension of path for attributes
-		path := append(path, nil)
-
-		for k, fi := range fieldIdxs {
-			path[len(path)-1] = cty.GetAttrStep{Name: k}
-
-			ft := rt.Field(fi).Type
-			aty, err := impliedType(ft, path)
-			if err != nil {
-				return cty.NilType, err
-			}
-
-			atys[k] = aty
-		}
-	}
-
-	return cty.Object(atys), nil
-}
-
-var (
-	valueType  = reflect.TypeOf(cty.Value{})
-	stringType = reflect.TypeOf("")
-)
-
-// structTagIndices interrogates the fields of the given type (which must
-// be a struct type, or we'll panic) and returns a map from the cty
-// attribute names declared via struct tags to the indices of the
-// fields holding those tags.
-//
-// This function will panic if two fields within the struct are tagged with
-// the same cty attribute name.
-func structTagIndices(st reflect.Type) map[string]int {
-	ct := st.NumField()
-	ret := make(map[string]int, ct)
-
-	for i := 0; i < ct; i++ {
-		field := st.Field(i)
-		attrName := field.Tag.Get("cty")
-		if attrName != "" {
-			ret[attrName] = i
-		}
-	}
-
-	return ret
-}

bake/hclparser/type_implied_ext.go

@@ -1,166 +0,0 @@
-package hclparser
-
-import (
-	"reflect"
-	"sync"
-
-	"github.com/containerd/errdefs"
-	"github.com/zclconf/go-cty/cty"
-	"github.com/zclconf/go-cty/cty/convert"
-	"github.com/zclconf/go-cty/cty/gocty"
-)
-
-type ToCtyValueConverter interface {
-	// ToCtyValue will convert this capsule value into a native
-	// cty.Value. This should not return a capsule type.
-	ToCtyValue() cty.Value
-}
-
-type FromCtyValueConverter interface {
-	// FromCtyValue will initialize this value using a cty.Value.
-	FromCtyValue(in cty.Value, path cty.Path) error
-}
-
-type extensionType int
-
-const (
-	unwrapCapsuleValueExtension extensionType = iota
-)
-
-func impliedTypeExt(rt reflect.Type, _ cty.Path) (cty.Type, error) {
-	if rt.Kind() != reflect.Pointer {
-		rt = reflect.PointerTo(rt)
-	}
-
-	if isCapsuleType(rt) {
-		return capsuleValueCapsuleType(rt), nil
-	}
-	return cty.NilType, errdefs.ErrNotImplemented
-}
-
-func isCapsuleType(rt reflect.Type) bool {
-	fromCtyValueType := reflect.TypeFor[FromCtyValueConverter]()
-	toCtyValueType := reflect.TypeFor[ToCtyValueConverter]()
-	return rt.Implements(fromCtyValueType) && rt.Implements(toCtyValueType)
-}
-
-var capsuleValueTypes sync.Map
-
-func capsuleValueCapsuleType(rt reflect.Type) cty.Type {
-	if rt.Kind() != reflect.Pointer {
-		panic("capsule value must be a pointer")
-	}
-
-	elem := rt.Elem()
-	if val, loaded := capsuleValueTypes.Load(elem); loaded {
-		return val.(cty.Type)
-	}
-
-	toCtyValueType := reflect.TypeFor[ToCtyValueConverter]()
-
-	// First time used. Initialize new capsule ops.
-	ops := &cty.CapsuleOps{
-		ConversionTo: func(_ cty.Type) func(cty.Value, cty.Path) (any, error) {
-			return func(in cty.Value, p cty.Path) (any, error) {
-				rv := reflect.New(elem).Interface()
-				if err := rv.(FromCtyValueConverter).FromCtyValue(in, p); err != nil {
-					return nil, err
-				}
-				return rv, nil
-			}
-		},
-		ConversionFrom: func(want cty.Type) func(any, cty.Path) (cty.Value, error) {
-			return func(in any, _ cty.Path) (cty.Value, error) {
-				rv := reflect.ValueOf(in).Convert(toCtyValueType)
-				v := rv.Interface().(ToCtyValueConverter).ToCtyValue()
-				return convert.Convert(v, want)
-			}
-		},
-		ExtensionData: func(key any) any {
-			switch key {
-			case unwrapCapsuleValueExtension:
-				zero := reflect.Zero(elem).Interface()
-				if conv, ok := zero.(ToCtyValueConverter); ok {
-					return conv.ToCtyValue().Type()
-				}
-
-				zero = reflect.Zero(rt).Interface()
-				if conv, ok := zero.(ToCtyValueConverter); ok {
-					return conv.ToCtyValue().Type()
-				}
-			}
-			return nil
-		},
-	}
-
-	// Attempt to store the new type. Use whichever was loaded first in the case
-	// of a race condition.
-	ety := cty.CapsuleWithOps(elem.Name(), elem, ops)
-	val, _ := capsuleValueTypes.LoadOrStore(elem, ety)
-	return val.(cty.Type)
-}
-
-// UnwrapCtyValue will unwrap capsule type values into their native cty value
-// equivalents if possible.
-func UnwrapCtyValue(in cty.Value) cty.Value {
-	want := toCtyValueType(in.Type())
-	if in.Type().Equals(want) {
-		return in
-	} else if out, err := convert.Convert(in, want); err == nil {
-		return out
-	}
-	return cty.NullVal(want)
-}
-
-func toCtyValueType(in cty.Type) cty.Type {
-	if et := in.MapElementType(); et != nil {
-		return cty.Map(toCtyValueType(*et))
-	}
-
-	if et := in.SetElementType(); et != nil {
-		return cty.Set(toCtyValueType(*et))
-	}
-
-	if et := in.ListElementType(); et != nil {
-		return cty.List(toCtyValueType(*et))
-	}
-
-	if in.IsObjectType() {
-		var optional []string
-		inAttrTypes := in.AttributeTypes()
-		outAttrTypes := make(map[string]cty.Type, len(inAttrTypes))
-		for name, typ := range inAttrTypes {
-			outAttrTypes[name] = toCtyValueType(typ)
-			if in.AttributeOptional(name) {
-				optional = append(optional, name)
-			}
-		}
-		return cty.ObjectWithOptionalAttrs(outAttrTypes, optional)
-	}
-
-	if in.IsTupleType() {
-		inTypes := in.TupleElementTypes()
-		outTypes := make([]cty.Type, len(inTypes))
-		for i, typ := range inTypes {
-			outTypes[i] = toCtyValueType(typ)
-		}
-		return cty.Tuple(outTypes)
-	}
-
-	if in.IsCapsuleType() {
-		if out := in.CapsuleExtensionData(unwrapCapsuleValueExtension); out != nil {
-			return out.(cty.Type)
-		}
-		return cty.DynamicPseudoType
-	}
-
-	return in
-}
-
-func ToCtyValue(val any, ty cty.Type) (cty.Value, error) {
-	out, err := gocty.ToCtyValue(val, ty)
-	if err != nil {
-		return out, err
-	}
-	return UnwrapCtyValue(out), nil
-}

build/build.go

@@ -15,7 +15,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/containerd/containerd/v2/core/images"
+	"github.com/containerd/containerd/images"
 	"github.com/distribution/reference"
 	"github.com/docker/buildx/builder"
 	controllerapi "github.com/docker/buildx/controller/pb"

build/opt.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/containerd/containerd/v2/core/content"
-	"github.com/containerd/containerd/v2/plugins/content/local"
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/content/local"
 	"github.com/containerd/platforms"
 	"github.com/distribution/reference"
 	"github.com/docker/buildx/builder"

build/provenance.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/containerd/containerd/v2/core/content"
-	"github.com/containerd/containerd/v2/core/content/proxy"
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/content/proxy"
 	"github.com/docker/buildx/util/confutil"
 	"github.com/docker/buildx/util/progress"
 	controlapi "github.com/moby/buildkit/api/services/control"

builder/builder_test.go

@@ -29,10 +29,7 @@ func TestCsvToMap(t *testing.T) {
 }
 
 func TestParseBuildkitdFlags(t *testing.T) {
-	dirConf := t.TempDir()
-
-	buildkitdConfPath := path.Join(dirConf, "buildkitd-conf.toml")
-	require.NoError(t, os.WriteFile(buildkitdConfPath, []byte(`
+	buildkitdConf := `
 # debug enables additional debug logging
 debug = true
 # insecure-entitlements allows insecure entitlements, disabled by default.
@@ -40,18 +37,10 @@ insecure-entitlements = [ "network.host", "security.insecure" ]
 [log]
   # log formatter: json or text
   format = "text"
-`), 0644))
-
-	buildkitdConfBrokenPath := path.Join(dirConf, "buildkitd-conf-broken.toml")
-	require.NoError(t, os.WriteFile(buildkitdConfBrokenPath, []byte(`
-[worker.oci]
-  gc = "maybe"
-`), 0644))
-
-	buildkitdConfUnknownFieldPath := path.Join(dirConf, "buildkitd-unknown-field.toml")
-	require.NoError(t, os.WriteFile(buildkitdConfUnknownFieldPath, []byte(`
-foo = "bar"
-`), 0644))
+`
+	dirConf := t.TempDir()
+	buildkitdConfPath := path.Join(dirConf, "buildkitd-conf.toml")
+	require.NoError(t, os.WriteFile(buildkitdConfPath, []byte(buildkitdConf), 0644))
 
 	testCases := []struct {
 		name                string
@@ -168,26 +157,6 @@ foo = "bar"
 			nil,
 			true,
 		},
-		{
-			"error parsing buildkit config",
-			"",
-			"docker-container",
-			nil,
-			buildkitdConfBrokenPath,
-			nil,
-			true,
-		},
-		{
-			"unknown field in buildkit config",
-			"",
-			"docker-container",
-			nil,
-			buildkitdConfUnknownFieldPath,
-			[]string{
-				"--allow-insecure-entitlement=network.host",
-			},
-			false,
-		},
 	}
 	for _, tt := range testCases {
 		tt := tt

cmd/buildx/main.go

@@ -20,6 +20,9 @@ import (
 	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel"
 
+	//nolint:staticcheck // vendored dependencies may still use this
+	"github.com/containerd/containerd/pkg/seed"
+
 	_ "k8s.io/client-go/plugin/pkg/client/auth/oidc"
 
 	_ "github.com/docker/buildx/driver/docker"
@@ -32,6 +35,9 @@ import (
 )
 
 func init() {
+	//nolint:staticcheck
+	seed.WithTimeAndRand()
+
 	stack.SetVersionInfo(version.Version, version.Revision)
 }
 

commands/bake.go

@@ -25,6 +25,7 @@ import (
 	"github.com/docker/buildx/controller/pb"
 	"github.com/docker/buildx/localstate"
 	"github.com/docker/buildx/util/buildflags"
+	"github.com/docker/buildx/util/cobrautil"
 	"github.com/docker/buildx/util/cobrautil/completion"
 	"github.com/docker/buildx/util/confutil"
 	"github.com/docker/buildx/util/desktop"
@@ -37,30 +38,24 @@ import (
 	"github.com/moby/buildkit/util/progress/progressui"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
-	"github.com/tonistiigi/go-csvvalue"
 	"go.opentelemetry.io/otel/attribute"
 )
 
 type bakeOptions struct {
-	files     []string
-	overrides []string
-
-	sbom       string
-	provenance string
-	allow      []string
+	files       []string
+	overrides   []string
+	printOnly   bool
+	listTargets bool
+	listVars    bool
+	sbom        string
+	provenance  string
+	allow       []string
 
 	builder      string
 	metadataFile string
 	exportPush   bool
 	exportLoad   bool
 	callFunc     string
-
-	print bool
-	list  string
-
-	// TODO: remove deprecated flags
-	listTargets bool
-	listVars    bool
 }
 
 func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in bakeOptions, cFlags commonFlags) (err error) {
@@ -126,13 +121,9 @@ func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in ba
 	var nodes []builder.Node
 	var progressConsoleDesc, progressTextDesc string
 
-	if in.print && in.list != "" {
-		return errors.New("--print and --list are mutually exclusive")
-	}
-
 	// instance only needed for reading remote bake files or building
 	var driverType string
-	if url != "" || !(in.print || in.list != "") {
+	if url != "" || !(in.printOnly || in.listTargets || in.listVars) {
 		b, err := builder.New(dockerCli,
 			builder.WithName(in.builder),
 			builder.WithContextPathHash(contextPathHash),
@@ -193,7 +184,7 @@ func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in ba
 		"BAKE_LOCAL_PLATFORM": platforms.Format(platforms.DefaultSpec()),
 	}
 
-	if in.list != "" {
+	if in.listTargets || in.listVars {
 		cfg, pm, err := bake.ParseFiles(files, defaults)
 		if err != nil {
 			return err
@@ -201,15 +192,10 @@ func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in ba
 		if err = printer.Wait(); err != nil {
 			return err
 		}
-		list, err := parseList(in.list)
-		if err != nil {
-			return err
-		}
-		switch list.Type {
-		case "targets":
-			return printTargetList(dockerCli.Out(), list.Format, cfg)
-		case "variables":
-			return printVars(dockerCli.Out(), list.Format, pm.AllVariables)
+		if in.listTargets {
+			return printTargetList(dockerCli.Out(), cfg)
+		} else if in.listVars {
+			return printVars(dockerCli.Out(), pm.AllVariables)
 		}
 	}
 
@@ -245,7 +231,7 @@ func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in ba
 		Target: tgts,
 	}
 
-	if in.print {
+	if in.printOnly {
 		if err = printer.Wait(); err != nil {
 			return err
 		}
@@ -441,13 +427,6 @@ func bakeCmd(dockerCli command.Cli, rootOpts *rootOptions) *cobra.Command {
 			if !cmd.Flags().Lookup("pull").Changed {
 				cFlags.pull = nil
 			}
-			if options.list == "" {
-				if options.listTargets {
-					options.list = "targets"
-				} else if options.listVars {
-					options.list = "variables"
-				}
-			}
 			options.builder = rootOpts.builder
 			options.metadataFile = cFlags.metadataFile
 			// Other common flags (noCache, pull and progress) are processed in runBake function.
@@ -460,6 +439,7 @@ func bakeCmd(dockerCli command.Cli, rootOpts *rootOptions) *cobra.Command {
 
 	flags.StringArrayVarP(&options.files, "file", "f", []string{}, "Build definition file")
 	flags.BoolVar(&options.exportLoad, "load", false, `Shorthand for "--set=*.output=type=docker"`)
+	flags.BoolVar(&options.printOnly, "print", false, "Print the options without building")
 	flags.BoolVar(&options.exportPush, "push", false, `Shorthand for "--set=*.output=type=registry"`)
 	flags.StringVar(&options.sbom, "sbom", "", `Shorthand for "--set=*.attest=type=sbom"`)
 	flags.StringVar(&options.provenance, "provenance", "", `Shorthand for "--set=*.attest=type=provenance"`)
@@ -470,16 +450,13 @@ func bakeCmd(dockerCli command.Cli, rootOpts *rootOptions) *cobra.Command {
 	flags.VarPF(callAlias(&options.callFunc, "check"), "check", "", `Shorthand for "--call=check"`)
 	flags.Lookup("check").NoOptDefVal = "true"
 
-	flags.BoolVar(&options.print, "print", false, "Print the options without building")
-	flags.StringVar(&options.list, "list", "", "List targets or variables")
-
-	// TODO: remove deprecated flags
 	flags.BoolVar(&options.listTargets, "list-targets", false, "List available targets")
+	cobrautil.MarkFlagsExperimental(flags, "list-targets")
 	flags.MarkHidden("list-targets")
-	flags.MarkDeprecated("list-targets", "list-targets is deprecated, use list=targets instead")
+
 	flags.BoolVar(&options.listVars, "list-variables", false, "List defined variables")
+	cobrautil.MarkFlagsExperimental(flags, "list-variables")
 	flags.MarkHidden("list-variables")
-	flags.MarkDeprecated("list-variables", "list-variables is deprecated, use list=variables instead")
 
 	commonBuildFlags(&cFlags, flags)
 
@@ -580,70 +557,10 @@ func readBakeFiles(ctx context.Context, nodes []builder.Node, url string, names
 	return
 }
 
-type listEntry struct {
-	Type   string
-	Format string
-}
-
-func parseList(input string) (listEntry, error) {
-	res := listEntry{}
-
-	fields, err := csvvalue.Fields(input, nil)
-	if err != nil {
-		return res, err
-	}
-
-	if len(fields) == 1 && fields[0] == input && !strings.HasPrefix(input, "type=") {
-		res.Type = input
-	}
-
-	if res.Type == "" {
-		for _, field := range fields {
-			key, value, ok := strings.Cut(field, "=")
-			if !ok {
-				return res, errors.Errorf("invalid value %s", field)
-			}
-			key = strings.TrimSpace(strings.ToLower(key))
-			switch key {
-			case "type":
-				res.Type = value
-			case "format":
-				res.Format = value
-			default:
-				return res, errors.Errorf("unexpected key '%s' in '%s'", key, field)
-			}
-		}
-	}
-	if res.Format == "" {
-		res.Format = "table"
-	}
-
-	switch res.Type {
-	case "targets", "variables":
-	default:
-		return res, errors.Errorf("invalid list type %q", res.Type)
-	}
-
-	switch res.Format {
-	case "table", "json":
-	default:
-		return res, errors.Errorf("invalid list format %q", res.Format)
-	}
-
-	return res, nil
-}
-
-func printVars(w io.Writer, format string, vars []*hclparser.Variable) error {
+func printVars(w io.Writer, vars []*hclparser.Variable) error {
 	slices.SortFunc(vars, func(a, b *hclparser.Variable) int {
 		return cmp.Compare(a.Name, b.Name)
 	})
-
-	if format == "json" {
-		enc := json.NewEncoder(w)
-		enc.SetIndent("", "  ")
-		return enc.Encode(vars)
-	}
-
 	tw := tabwriter.NewWriter(w, 1, 8, 1, '\t', 0)
 	defer tw.Flush()
 
@@ -661,7 +578,12 @@ func printVars(w io.Writer, format string, vars []*hclparser.Variable) error {
 	return nil
 }
 
-func printTargetList(w io.Writer, format string, cfg *bake.Config) error {
+func printTargetList(w io.Writer, cfg *bake.Config) error {
+	tw := tabwriter.NewWriter(w, 1, 8, 1, '\t', 0)
+	defer tw.Flush()
+
+	tw.Write([]byte("TARGET\tDESCRIPTION\n"))
+
 	type targetOrGroup struct {
 		name   string
 		target *bake.Target
@@ -680,20 +602,6 @@ func printTargetList(w io.Writer, format string, cfg *bake.Config) error {
 		return cmp.Compare(a.name, b.name)
 	})
 
-	var tw *tabwriter.Writer
-	if format == "table" {
-		tw = tabwriter.NewWriter(w, 1, 8, 1, '\t', 0)
-		defer tw.Flush()
-		tw.Write([]byte("TARGET\tDESCRIPTION\n"))
-	}
-
-	type targetList struct {
-		Name        string `json:"name"`
-		Description string `json:"description,omitempty"`
-		Group       bool   `json:"group,omitempty"`
-	}
-	var targetsList []targetList
-
 	for _, tgt := range list {
 		if strings.HasPrefix(tgt.name, "_") {
 			// convention for a private target
@@ -702,9 +610,9 @@ func printTargetList(w io.Writer, format string, cfg *bake.Config) error {
 		var descr string
 		if tgt.target != nil {
 			descr = tgt.target.Description
-			targetsList = append(targetsList, targetList{Name: tgt.name, Description: descr})
 		} else if tgt.group != nil {
 			descr = tgt.group.Description
+
 			if len(tgt.group.Targets) > 0 {
 				slices.Sort(tgt.group.Targets)
 				names := strings.Join(tgt.group.Targets, ", ")
@@ -714,17 +622,8 @@ func printTargetList(w io.Writer, format string, cfg *bake.Config) error {
 					descr = names
 				}
 			}
-			targetsList = append(targetsList, targetList{Name: tgt.name, Description: descr, Group: true})
 		}
-		if format == "table" {
-			fmt.Fprintf(tw, "%s\t%s\n", tgt.name, descr)
-		}
-	}
-
-	if format == "json" {
-		enc := json.NewEncoder(w)
-		enc.SetIndent("", "  ")
-		return enc.Encode(targetsList)
+		fmt.Fprintf(tw, "%s\t%s\n", tgt.name, descr)
 	}
 
 	return nil

commands/build.go

@@ -720,7 +720,7 @@ type commonFlags struct {
 
 func commonBuildFlags(options *commonFlags, flags *pflag.FlagSet) {
 	options.noCache = flags.Bool("no-cache", false, "Do not use cache when building the image")
-	flags.StringVar(&options.progress, "progress", "auto", `Set type of progress output ("auto", "quiet", "plain", "tty", "rawjson"). Use plain to show container output`)
+	flags.StringVar(&options.progress, "progress", "auto", `Set type of progress output ("auto", "plain", "tty", "rawjson"). Use plain to show container output`)
 	options.pull = flags.Bool("pull", false, "Always attempt to pull all referenced images")
 	flags.StringVar(&options.metadataFile, "metadata-file", "", "Write build result metadata to a file")
 }

controller/pb/export.go

@@ -46,7 +46,6 @@ func CreateExports(entries []*ExportEntry) ([]client.ExportEntry, []string, erro
 			supportDir = !tar
 		case "registry":
 			out.Type = client.ExporterImage
-			out.Attrs["push"] = "true"
 		}
 
 		if supportDir {

controller/remote/client.go

@@ -6,8 +6,8 @@ import (
 	"sync"
 	"time"
 
-	"github.com/containerd/containerd/v2/defaults"
-	"github.com/containerd/containerd/v2/pkg/dialer"
+	"github.com/containerd/containerd/defaults"
+	"github.com/containerd/containerd/pkg/dialer"
 	"github.com/docker/buildx/build"
 	"github.com/docker/buildx/controller/pb"
 	"github.com/docker/buildx/util/progress"

docs/bake-reference.md

@@ -19,8 +19,8 @@ By default, Bake uses the following lookup order to find the configuration file:
 3. `docker-compose.yml`
 4. `docker-compose.yaml`
 5. `docker-bake.json`
-6. `docker-bake.hcl`
-7. `docker-bake.override.json`
+6. `docker-bake.override.json`
+7. `docker-bake.hcl`
 8. `docker-bake.override.hcl`
 
 You can specify the file location explicitly using the `--file` flag:

docs/reference/buildx_bake.md

@@ -13,25 +13,24 @@ Build from a file
 
 ### Options
 
-| Name                                | Type          | Default | Description                                                                                                  |
-|:------------------------------------|:--------------|:--------|:-------------------------------------------------------------------------------------------------------------|
-| `--allow`                           | `stringArray` |         | Allow build to access specified resources                                                                    |
-| [`--builder`](#builder)             | `string`      |         | Override the configured builder instance                                                                     |
-| [`--call`](#call)                   | `string`      | `build` | Set method for evaluating build (`check`, `outline`, `targets`)                                              |
-| [`--check`](#check)                 | `bool`        |         | Shorthand for `--call=check`                                                                                 |
-| `-D`, `--debug`                     | `bool`        |         | Enable debug logging                                                                                         |
-| [`-f`](#file), [`--file`](#file)    | `stringArray` |         | Build definition file                                                                                        |
-| [`--list`](#list)                   | `string`      |         | List targets or variables                                                                                    |
-| `--load`                            | `bool`        |         | Shorthand for `--set=*.output=type=docker`                                                                   |
-| [`--metadata-file`](#metadata-file) | `string`      |         | Write build result metadata to a file                                                                        |
-| [`--no-cache`](#no-cache)           | `bool`        |         | Do not use cache when building the image                                                                     |
-| [`--print`](#print)                 | `bool`        |         | Print the options without building                                                                           |
-| [`--progress`](#progress)           | `string`      | `auto`  | Set type of progress output (`auto`, `quiet`, `plain`, `tty`, `rawjson`). Use plain to show container output |
-| [`--provenance`](#provenance)       | `string`      |         | Shorthand for `--set=*.attest=type=provenance`                                                               |
-| [`--pull`](#pull)                   | `bool`        |         | Always attempt to pull all referenced images                                                                 |
-| `--push`                            | `bool`        |         | Shorthand for `--set=*.output=type=registry`                                                                 |
-| [`--sbom`](#sbom)                   | `string`      |         | Shorthand for `--set=*.attest=type=sbom`                                                                     |
-| [`--set`](#set)                     | `stringArray` |         | Override target value (e.g., `targetpattern.key=value`)                                                      |
+| Name                                | Type          | Default | Description                                                                                         |
+|:------------------------------------|:--------------|:--------|:----------------------------------------------------------------------------------------------------|
+| `--allow`                           | `stringArray` |         | Allow build to access specified resources                                                           |
+| [`--builder`](#builder)             | `string`      |         | Override the configured builder instance                                                            |
+| [`--call`](#call)                   | `string`      | `build` | Set method for evaluating build (`check`, `outline`, `targets`)                                     |
+| [`--check`](#check)                 | `bool`        |         | Shorthand for `--call=check`                                                                        |
+| `-D`, `--debug`                     | `bool`        |         | Enable debug logging                                                                                |
+| [`-f`](#file), [`--file`](#file)    | `stringArray` |         | Build definition file                                                                               |
+| `--load`                            | `bool`        |         | Shorthand for `--set=*.output=type=docker`                                                          |
+| [`--metadata-file`](#metadata-file) | `string`      |         | Write build result metadata to a file                                                               |
+| [`--no-cache`](#no-cache)           | `bool`        |         | Do not use cache when building the image                                                            |
+| [`--print`](#print)                 | `bool`        |         | Print the options without building                                                                  |
+| [`--progress`](#progress)           | `string`      | `auto`  | Set type of progress output (`auto`, `plain`, `tty`, `rawjson`). Use plain to show container output |
+| [`--provenance`](#provenance)       | `string`      |         | Shorthand for `--set=*.attest=type=provenance`                                                      |
+| [`--pull`](#pull)                   | `bool`        |         | Always attempt to pull all referenced images                                                        |
+| `--push`                            | `bool`        |         | Shorthand for `--set=*.output=type=registry`                                                        |
+| [`--sbom`](#sbom)                   | `string`      |         | Shorthand for `--set=*.attest=type=sbom`                                                            |
+| [`--set`](#set)                     | `stringArray` |         | Override target value (e.g., `targetpattern.key=value`)                                             |
 
 
 <!---MARKER_GEN_END-->
@@ -102,42 +101,6 @@ $ docker buildx bake -f docker-bake.dev.hcl db webapp-release
 See the [Bake file reference](https://docs.docker.com/build/bake/reference/)
 for more details.
 
-### <a name="list"></a> List targets and variables (--list)
-
-The `--list` flag displays all available targets or variables in the Bake
-configuration, along with a description (if set using the `description`
-property in the Bake file).
-
-To list all targets:
-
-```console {title="List targets"}
-$ docker buildx bake --list=targets
-TARGET              DESCRIPTION
-binaries
-default             binaries
-update-docs
-validate
-validate-golangci   Validate .golangci.yml schema (does not run Go linter)
-```
-
-To list variables:
-
-```console
-$ docker buildx bake --list=variables
-VARIABLE      VALUE                DESCRIPTION
-REGISTRY      docker.io/username   Registry and namespace
-IMAGE_NAME    my-app               Image name
-GO_VERSION    <null>
-```
-
-By default, the output of `docker buildx bake --list` is presented in a table
-format. Alternatively, you can use a long-form CSV syntax and specify a
-`format` attribute to output the list in JSON.
-
-```console
-$ docker buildx bake --list=type=targets,format=json
-```
-
 ### <a name="metadata-file"></a> Write build results metadata to a file (--metadata-file)
 
 Similar to [`buildx build --metadata-file`](buildx_build.md#metadata-file) but

docs/reference/buildx_build.md

@@ -13,46 +13,46 @@ Start a build
 
 ### Options
 
-| Name                                    | Type          | Default   | Description                                                                                                  |
-|:----------------------------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------|
-| [`--add-host`](#add-host)               | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                          |
-| [`--allow`](#allow)                     | `stringSlice` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`)                               |
-| [`--annotation`](#annotation)           | `stringArray` |           | Add annotation to the image                                                                                  |
-| [`--attest`](#attest)                   | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                                 |
-| [`--build-arg`](#build-arg)             | `stringArray` |           | Set build-time variables                                                                                     |
-| [`--build-context`](#build-context)     | `stringArray` |           | Additional build contexts (e.g., name=path)                                                                  |
-| [`--builder`](#builder)                 | `string`      |           | Override the configured builder instance                                                                     |
-| [`--cache-from`](#cache-from)           | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                                |
-| [`--cache-to`](#cache-to)               | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                            |
-| [`--call`](#call)                       | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                              |
-| [`--cgroup-parent`](#cgroup-parent)     | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                                |
-| [`--check`](#check)                     | `bool`        |           | Shorthand for `--call=check`                                                                                 |
-| `-D`, `--debug`                         | `bool`        |           | Enable debug logging                                                                                         |
-| `--detach`                              | `bool`        |           | Detach buildx server (supported only on linux) (EXPERIMENTAL)                                                |
-| [`-f`](#file), [`--file`](#file)        | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                          |
-| `--iidfile`                             | `string`      |           | Write the image ID to a file                                                                                 |
-| `--label`                               | `stringArray` |           | Set metadata for an image                                                                                    |
-| [`--load`](#load)                       | `bool`        |           | Shorthand for `--output=type=docker`                                                                         |
-| [`--metadata-file`](#metadata-file)     | `string`      |           | Write build result metadata to a file                                                                        |
-| [`--network`](#network)                 | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                              |
-| `--no-cache`                            | `bool`        |           | Do not use cache when building the image                                                                     |
-| [`--no-cache-filter`](#no-cache-filter) | `stringArray` |           | Do not cache specified stages                                                                                |
-| [`-o`](#output), [`--output`](#output)  | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                          |
-| [`--platform`](#platform)               | `stringArray` |           | Set target platform for build                                                                                |
-| [`--progress`](#progress)               | `string`      | `auto`    | Set type of progress output (`auto`, `quiet`, `plain`, `tty`, `rawjson`). Use plain to show container output |
-| [`--provenance`](#provenance)           | `string`      |           | Shorthand for `--attest=type=provenance`                                                                     |
-| `--pull`                                | `bool`        |           | Always attempt to pull all referenced images                                                                 |
-| [`--push`](#push)                       | `bool`        |           | Shorthand for `--output=type=registry`                                                                       |
-| `-q`, `--quiet`                         | `bool`        |           | Suppress the build output and print image ID on success                                                      |
-| `--root`                                | `string`      |           | Specify root directory of server to connect (EXPERIMENTAL)                                                   |
-| [`--sbom`](#sbom)                       | `string`      |           | Shorthand for `--attest=type=sbom`                                                                           |
-| [`--secret`](#secret)                   | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                                    |
-| `--server-config`                       | `string`      |           | Specify buildx server config file (used only when launching new server) (EXPERIMENTAL)                       |
-| [`--shm-size`](#shm-size)               | `bytes`       | `0`       | Shared memory size for build containers                                                                      |
-| [`--ssh`](#ssh)                         | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`)          |
-| [`-t`](#tag), [`--tag`](#tag)           | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                               |
-| [`--target`](#target)                   | `string`      |           | Set the target build stage to build                                                                          |
-| [`--ulimit`](#ulimit)                   | `ulimit`      |           | Ulimit options                                                                                               |
+| Name                                    | Type          | Default   | Description                                                                                         |
+|:----------------------------------------|:--------------|:----------|:----------------------------------------------------------------------------------------------------|
+| [`--add-host`](#add-host)               | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                 |
+| [`--allow`](#allow)                     | `stringSlice` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`)                      |
+| [`--annotation`](#annotation)           | `stringArray` |           | Add annotation to the image                                                                         |
+| [`--attest`](#attest)                   | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                        |
+| [`--build-arg`](#build-arg)             | `stringArray` |           | Set build-time variables                                                                            |
+| [`--build-context`](#build-context)     | `stringArray` |           | Additional build contexts (e.g., name=path)                                                         |
+| [`--builder`](#builder)                 | `string`      |           | Override the configured builder instance                                                            |
+| [`--cache-from`](#cache-from)           | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                       |
+| [`--cache-to`](#cache-to)               | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                   |
+| [`--call`](#call)                       | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                     |
+| [`--cgroup-parent`](#cgroup-parent)     | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                       |
+| [`--check`](#check)                     | `bool`        |           | Shorthand for `--call=check`                                                                        |
+| `-D`, `--debug`                         | `bool`        |           | Enable debug logging                                                                                |
+| `--detach`                              | `bool`        |           | Detach buildx server (supported only on linux) (EXPERIMENTAL)                                       |
+| [`-f`](#file), [`--file`](#file)        | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                 |
+| `--iidfile`                             | `string`      |           | Write the image ID to a file                                                                        |
+| `--label`                               | `stringArray` |           | Set metadata for an image                                                                           |
+| [`--load`](#load)                       | `bool`        |           | Shorthand for `--output=type=docker`                                                                |
+| [`--metadata-file`](#metadata-file)     | `string`      |           | Write build result metadata to a file                                                               |
+| [`--network`](#network)                 | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                     |
+| `--no-cache`                            | `bool`        |           | Do not use cache when building the image                                                            |
+| [`--no-cache-filter`](#no-cache-filter) | `stringArray` |           | Do not cache specified stages                                                                       |
+| [`-o`](#output), [`--output`](#output)  | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                 |
+| [`--platform`](#platform)               | `stringArray` |           | Set target platform for build                                                                       |
+| [`--progress`](#progress)               | `string`      | `auto`    | Set type of progress output (`auto`, `plain`, `tty`, `rawjson`). Use plain to show container output |
+| [`--provenance`](#provenance)           | `string`      |           | Shorthand for `--attest=type=provenance`                                                            |
+| `--pull`                                | `bool`        |           | Always attempt to pull all referenced images                                                        |
+| [`--push`](#push)                       | `bool`        |           | Shorthand for `--output=type=registry`                                                              |
+| `-q`, `--quiet`                         | `bool`        |           | Suppress the build output and print image ID on success                                             |
+| `--root`                                | `string`      |           | Specify root directory of server to connect (EXPERIMENTAL)                                          |
+| [`--sbom`](#sbom)                       | `string`      |           | Shorthand for `--attest=type=sbom`                                                                  |
+| [`--secret`](#secret)                   | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                           |
+| `--server-config`                       | `string`      |           | Specify buildx server config file (used only when launching new server) (EXPERIMENTAL)              |
+| [`--shm-size`](#shm-size)               | `bytes`       | `0`       | Shared memory size for build containers                                                             |
+| [`--ssh`](#ssh)                         | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`) |
+| [`-t`](#tag), [`--tag`](#tag)           | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                      |
+| [`--target`](#target)                   | `string`      |           | Set the target build stage to build                                                                 |
+| [`--ulimit`](#ulimit)                   | `ulimit`      |           | Ulimit options                                                                                      |
 
 
 <!---MARKER_GEN_END-->
@@ -828,12 +828,8 @@ $ docker buildx build --platform=darwin .
 --progress=VALUE
 ```
 
-Set type of progress output. Supported values are:
-- `auto` (default): Uses the `tty` mode if the client is a TTY, or `plain` otherwise
-- `tty`: An interactive stream of the output with color and redrawing
-- `plain`: Prints the raw build progress in a plaintext format
-- `quiet`: Suppress the build output and print image ID on success (same as `--quiet`)
-- `rawjson`: Prints the raw build progress as JSON lines
+Set type of progress output (`auto`, `plain`, `tty`, `rawjson`). Use `plain` to show container
+output (default `auto`).
 
 > [!NOTE]
 > You can also use the `BUILDKIT_PROGRESS` environment variable to set its value.

docs/reference/buildx_debug_build.md

@@ -9,46 +9,46 @@ Start a build
 
 ### Options
 
-| Name                | Type          | Default   | Description                                                                                                  |
-|:--------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------|
-| `--add-host`        | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                          |
-| `--allow`           | `stringSlice` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`)                               |
-| `--annotation`      | `stringArray` |           | Add annotation to the image                                                                                  |
-| `--attest`          | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                                 |
-| `--build-arg`       | `stringArray` |           | Set build-time variables                                                                                     |
-| `--build-context`   | `stringArray` |           | Additional build contexts (e.g., name=path)                                                                  |
-| `--builder`         | `string`      |           | Override the configured builder instance                                                                     |
-| `--cache-from`      | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                                |
-| `--cache-to`        | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                            |
-| `--call`            | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                              |
-| `--cgroup-parent`   | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                                |
-| `--check`           | `bool`        |           | Shorthand for `--call=check`                                                                                 |
-| `-D`, `--debug`     | `bool`        |           | Enable debug logging                                                                                         |
-| `--detach`          | `bool`        |           | Detach buildx server (supported only on linux) (EXPERIMENTAL)                                                |
-| `-f`, `--file`      | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                          |
-| `--iidfile`         | `string`      |           | Write the image ID to a file                                                                                 |
-| `--label`           | `stringArray` |           | Set metadata for an image                                                                                    |
-| `--load`            | `bool`        |           | Shorthand for `--output=type=docker`                                                                         |
-| `--metadata-file`   | `string`      |           | Write build result metadata to a file                                                                        |
-| `--network`         | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                              |
-| `--no-cache`        | `bool`        |           | Do not use cache when building the image                                                                     |
-| `--no-cache-filter` | `stringArray` |           | Do not cache specified stages                                                                                |
-| `-o`, `--output`    | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                          |
-| `--platform`        | `stringArray` |           | Set target platform for build                                                                                |
-| `--progress`        | `string`      | `auto`    | Set type of progress output (`auto`, `quiet`, `plain`, `tty`, `rawjson`). Use plain to show container output |
-| `--provenance`      | `string`      |           | Shorthand for `--attest=type=provenance`                                                                     |
-| `--pull`            | `bool`        |           | Always attempt to pull all referenced images                                                                 |
-| `--push`            | `bool`        |           | Shorthand for `--output=type=registry`                                                                       |
-| `-q`, `--quiet`     | `bool`        |           | Suppress the build output and print image ID on success                                                      |
-| `--root`            | `string`      |           | Specify root directory of server to connect (EXPERIMENTAL)                                                   |
-| `--sbom`            | `string`      |           | Shorthand for `--attest=type=sbom`                                                                           |
-| `--secret`          | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                                    |
-| `--server-config`   | `string`      |           | Specify buildx server config file (used only when launching new server) (EXPERIMENTAL)                       |
-| `--shm-size`        | `bytes`       | `0`       | Shared memory size for build containers                                                                      |
-| `--ssh`             | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`)          |
-| `-t`, `--tag`       | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                               |
-| `--target`          | `string`      |           | Set the target build stage to build                                                                          |
-| `--ulimit`          | `ulimit`      |           | Ulimit options                                                                                               |
+| Name                | Type          | Default   | Description                                                                                         |
+|:--------------------|:--------------|:----------|:----------------------------------------------------------------------------------------------------|
+| `--add-host`        | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                 |
+| `--allow`           | `stringSlice` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`)                      |
+| `--annotation`      | `stringArray` |           | Add annotation to the image                                                                         |
+| `--attest`          | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                        |
+| `--build-arg`       | `stringArray` |           | Set build-time variables                                                                            |
+| `--build-context`   | `stringArray` |           | Additional build contexts (e.g., name=path)                                                         |
+| `--builder`         | `string`      |           | Override the configured builder instance                                                            |
+| `--cache-from`      | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                       |
+| `--cache-to`        | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                   |
+| `--call`            | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                     |
+| `--cgroup-parent`   | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                       |
+| `--check`           | `bool`        |           | Shorthand for `--call=check`                                                                        |
+| `-D`, `--debug`     | `bool`        |           | Enable debug logging                                                                                |
+| `--detach`          | `bool`        |           | Detach buildx server (supported only on linux) (EXPERIMENTAL)                                       |
+| `-f`, `--file`      | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                 |
+| `--iidfile`         | `string`      |           | Write the image ID to a file                                                                        |
+| `--label`           | `stringArray` |           | Set metadata for an image                                                                           |
+| `--load`            | `bool`        |           | Shorthand for `--output=type=docker`                                                                |
+| `--metadata-file`   | `string`      |           | Write build result metadata to a file                                                               |
+| `--network`         | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                     |
+| `--no-cache`        | `bool`        |           | Do not use cache when building the image                                                            |
+| `--no-cache-filter` | `stringArray` |           | Do not cache specified stages                                                                       |
+| `-o`, `--output`    | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                 |
+| `--platform`        | `stringArray` |           | Set target platform for build                                                                       |
+| `--progress`        | `string`      | `auto`    | Set type of progress output (`auto`, `plain`, `tty`, `rawjson`). Use plain to show container output |
+| `--provenance`      | `string`      |           | Shorthand for `--attest=type=provenance`                                                            |
+| `--pull`            | `bool`        |           | Always attempt to pull all referenced images                                                        |
+| `--push`            | `bool`        |           | Shorthand for `--output=type=registry`                                                              |
+| `-q`, `--quiet`     | `bool`        |           | Suppress the build output and print image ID on success                                             |
+| `--root`            | `string`      |           | Specify root directory of server to connect (EXPERIMENTAL)                                          |
+| `--sbom`            | `string`      |           | Shorthand for `--attest=type=sbom`                                                                  |
+| `--secret`          | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                           |
+| `--server-config`   | `string`      |           | Specify buildx server config file (used only when launching new server) (EXPERIMENTAL)              |
+| `--shm-size`        | `bytes`       | `0`       | Shared memory size for build containers                                                             |
+| `--ssh`             | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`) |
+| `-t`, `--tag`       | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                      |
+| `--target`          | `string`      |           | Set the target build stage to build                                                                 |
+| `--ulimit`          | `ulimit`      |           | Ulimit options                                                                                      |
 
 
 <!---MARKER_GEN_END-->

go.mod

@@ -5,30 +5,29 @@ go 1.22.0
 require (
 	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/Microsoft/go-winio v0.6.2
-	github.com/aws/aws-sdk-go-v2/config v1.27.27
-	github.com/compose-spec/compose-go/v2 v2.4.7
+	github.com/aws/aws-sdk-go-v2/config v1.26.6
+	github.com/compose-spec/compose-go/v2 v2.4.4
 	github.com/containerd/console v1.0.4
-	github.com/containerd/containerd/v2 v2.0.2
+	github.com/containerd/containerd v1.7.24
 	github.com/containerd/continuity v0.4.5
-	github.com/containerd/errdefs v1.0.0
+	github.com/containerd/errdefs v0.3.0
 	github.com/containerd/log v0.1.0
-	github.com/containerd/platforms v1.0.0-rc.1
+	github.com/containerd/platforms v0.2.1
 	github.com/containerd/typeurl/v2 v2.2.3
-	github.com/creack/pty v1.1.24
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
+	github.com/creack/pty v1.1.21
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v27.5.0+incompatible
-	github.com/docker/cli-docs-tool v0.9.0
-	github.com/docker/docker v27.5.0+incompatible
+	github.com/docker/cli v27.4.0-rc.2+incompatible
+	github.com/docker/cli-docs-tool v0.8.0
+	github.com/docker/docker v27.4.0-rc.2+incompatible
 	github.com/docker/go-units v0.5.0
 	github.com/gofrs/flock v0.12.1
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/google/uuid v1.6.0
-	github.com/hashicorp/go-cty-funcs v0.0.0-20241120183456-c51673e0b3dd
-	github.com/hashicorp/hcl/v2 v2.23.0
+	github.com/hashicorp/go-cty-funcs v0.0.0-20230405223818-a090f58aa992
+	github.com/hashicorp/hcl/v2 v2.20.1
 	github.com/in-toto/in-toto-golang v0.5.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/moby/buildkit v0.19.0-rc2
+	github.com/moby/buildkit v0.18.0
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/moby/sys/signal v0.7.1
 	github.com/morikuni/aec v1.0.0
@@ -41,54 +40,54 @@ require (
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.10.0
-	github.com/tonistiigi/fsutil v0.0.0-20250113203817-b14e27f4135a
+	github.com/stretchr/testify v1.9.0
+	github.com/tonistiigi/fsutil v0.0.0-20241121093142-31cf1f437184
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4
-	github.com/zclconf/go-cty v1.16.0
-	go.opentelemetry.io/otel v1.31.0
-	go.opentelemetry.io/otel/metric v1.31.0
-	go.opentelemetry.io/otel/sdk v1.31.0
-	go.opentelemetry.io/otel/trace v1.31.0
+	github.com/zclconf/go-cty v1.14.4
+	go.opentelemetry.io/otel v1.28.0
+	go.opentelemetry.io/otel/metric v1.28.0
+	go.opentelemetry.io/otel/sdk v1.28.0
+	go.opentelemetry.io/otel/trace v1.28.0
 	golang.org/x/mod v0.21.0
-	golang.org/x/sync v0.10.0
-	golang.org/x/sys v0.28.0
-	golang.org/x/term v0.27.0
-	golang.org/x/text v0.21.0
-	google.golang.org/grpc v1.68.1
+	golang.org/x/sync v0.8.0
+	golang.org/x/sys v0.26.0
+	golang.org/x/term v0.24.0
+	golang.org/x/text v0.18.0
+	google.golang.org/grpc v1.66.3
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
-	google.golang.org/protobuf v1.35.2
+	google.golang.org/protobuf v1.35.1
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.31.2
-	k8s.io/apimachinery v0.31.2
-	k8s.io/client-go v0.31.2
+	k8s.io/api v0.29.2
+	k8s.io/apimachinery v0.29.2
+	k8s.io/client-go v0.29.2
 )
 
 require (
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/apparentlymart/go-cidr v1.0.1 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.30.3 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
-	github.com/aws/smithy-go v1.20.3 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.24.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.16.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
+	github.com/aws/smithy-go v1.19.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/containerd/containerd/api v1.8.0 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/containerd/ttrpc v1.2.7 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/containerd/containerd/api v1.7.19 // indirect
+	github.com/containerd/ttrpc v1.2.5 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
@@ -97,12 +96,11 @@ require (
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fvbommel/sortorder v1.0.1 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -111,7 +109,7 @@ require (
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -129,7 +127,7 @@ require (
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
-	github.com/moby/spdystream v0.4.0 // indirect
+	github.com/moby/spdystream v0.2.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/user v0.3.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
@@ -138,8 +136,8 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.20.2 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
@@ -151,34 +149,34 @@ require (
 	github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205 // indirect
 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
-	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.31.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.31.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.31.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.28.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
-	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/crypto v0.27.0 // indirect
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
-	golang.org/x/net v0.33.0 // indirect
-	golang.org/x/oauth2 v0.23.0 // indirect
+	golang.org/x/net v0.29.0 // indirect
+	golang.org/x/oauth2 v0.21.0 // indirect
 	golang.org/x/time v0.6.0 // indirect
 	golang.org/x/tools v0.25.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect
+	google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	k8s.io/klog/v2 v2.110.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
+	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )

go.sum

@@ -1,7 +1,11 @@
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
-github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2 h1:dIScnXFlF784X79oi7MzVT6GWqr/W1uUt0pB5CsDs9M=
-github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2/go.mod h1:gCLVsLfv1egrcZu+GoJATN5ts75F2s62ih/457eWzOw=
+cloud.google.com/go v0.112.0 h1:tpFCD7hpHFlQ8yPwT3x+QeXqc2T6+n6T+hmABHfDUSM=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
+cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 h1:59MxjQVfjXsBpLy+dbd2/ELV5ofnUkUZBvWSC85sheA=
+github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0/go.mod h1:OahwfttHWG6eJ0clwcfBAHoDI6X/LV/15hx/wlMZSrU=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
@@ -10,8 +14,8 @@ github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0
 github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.12.9 h1:2zJy5KA+l0loz1HzEGqyNnjd3fyZA31ZBCGKacp6lLg=
-github.com/Microsoft/hcsshim v0.12.9/go.mod h1:fJ0gkFAna6ukt0bLdKB8djt4XIJhF/vEPuoIWYVvZ8Y=
+github.com/Microsoft/hcsshim v0.12.8 h1:BtDWYlFMcWhorrvSSo2M7z0csPdw6t7no/C3FsSvqiI=
+github.com/Microsoft/hcsshim v0.12.8/go.mod h1:cibQ4BqhJ32FXDwPdQhKhwrwophnh3FuT4nwQZF907w=
 github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
@@ -28,32 +32,32 @@ github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go-v2 v1.30.3 h1:jUeBtG0Ih+ZIFH0F4UkmL9w3cSpaMv9tYYDbzILP8dY=
-github.com/aws/aws-sdk-go-v2 v1.30.3/go.mod h1:nIQjQVp5sfpQcTc9mPSr1B0PaWK5ByX9MOoDadSN4lc=
-github.com/aws/aws-sdk-go-v2/config v1.27.27 h1:HdqgGt1OAP0HkEDDShEl0oSYa9ZZBSOmKpdpsDMdO90=
-github.com/aws/aws-sdk-go-v2/config v1.27.27/go.mod h1:MVYamCg76dFNINkZFu4n4RjDixhVr51HLj4ErWzrVwg=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.27 h1:2raNba6gr2IfA0eqqiP2XiQ0UVOpGPgDSi0I9iAP+UI=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.27/go.mod h1:gniiwbGahQByxan6YjQUMcW4Aov6bLC3m+evgcoN4r4=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 h1:KreluoV8FZDEtI6Co2xuNk/UqI9iwMrOx/87PBNIKqw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11/go.mod h1:SeSUYBLsMYFoRvHE0Tjvn7kbxaUhl75CJi1sbfhMxkU=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 h1:SoNJ4RlFEQEbtDcCEt+QG56MY4fm4W8rYirAmq+/DdU=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15/go.mod h1:U9ke74k1n2bf+RIgoX1SXFed1HLs51OgUSs+Ph0KJP8=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 h1:C6WHdGnTDIYETAm5iErQUiVNsclNx9qbJVPIt03B6bI=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15/go.mod h1:ZQLZqhcu+JhSrA9/NXRm8SkDvsycE+JkV3WGY41e+IM=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 h1:dT3MqvGhSoaIhRseqw2I0yH81l7wiR2vjs57O51EAm8=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3/go.mod h1:GlAeCkHwugxdHaueRr4nhPuY+WW+gR8UjlcqzPr1SPI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 h1:HGErhhrxZlQ044RiM+WdoZxp0p+EGM62y3L6pwA4olE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17/go.mod h1:RkZEx4l0EHYDJpWppMJ3nD9wZJAa8/0lq9aVC+r2UII=
-github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 h1:BXx0ZIxvrJdSgSvKTZ+yRBeSqqgPM89VPlulEcl37tM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.22.4/go.mod h1:ooyCOXjvJEsUw7x+ZDHeISPMhtwI3ZCB7ggFMcFfWLU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 h1:yiwVzJW2ZxZTurVbYWA7QOrAaCYQR72t0wrSBfoesUE=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4/go.mod h1:0oxfLkpz3rQ/CHlx5hB7H69YUpFiI1tql6Q6Ne+1bCw=
-github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 h1:ZsDKRLXGWHk8WdtyYMoGNO7bTudrvuKpDKgMVRlepGE=
-github.com/aws/aws-sdk-go-v2/service/sts v1.30.3/go.mod h1:zwySh8fpFyXp9yOr/KVzxOl8SRqgf/IDw5aUt9UKFcQ=
-github.com/aws/smithy-go v1.20.3 h1:ryHwveWzPV5BIof6fyDvor6V3iUL7nTfiTKXHiW05nE=
-github.com/aws/smithy-go v1.20.3/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
+github.com/aws/aws-sdk-go-v2 v1.24.1 h1:xAojnj+ktS95YZlDf0zxWBkbFtymPeDP+rvUQIH3uAU=
+github.com/aws/aws-sdk-go-v2 v1.24.1/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
+github.com/aws/aws-sdk-go-v2/config v1.26.6 h1:Z/7w9bUqlRI0FFQpetVuFYEsjzE3h7fpU6HuGmfPL/o=
+github.com/aws/aws-sdk-go-v2/config v1.26.6/go.mod h1:uKU6cnDmYCvJ+pxO9S4cWDb2yWWIH5hra+32hVh1MI4=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.16 h1:8q6Rliyv0aUFAVtzaldUEcS+T5gbadPbWdV1WcAddK8=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.16/go.mod h1:UHVZrdUsv63hPXFo1H7c5fEneoVo9UXiz36QG1GEPi0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 h1:c5I5iH+DZcH3xOIMlz3/tCKJDaHFwYEmxvlh2fAcFo8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11/go.mod h1:cRrYDYAMUohBJUtUnOhydaMHtiK/1NZ0Otc9lIb6O0Y=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 h1:vF+Zgd9s+H4vOXd5BMaPWykta2a6Ih0AKLq/X6NYKn4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10/go.mod h1:6BkRjejp/GR4411UGqkX8+wFMbFbqsUIimfK4XjOKR4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 h1:nYPe006ktcqUji8S2mqXf9c/7NdiKriOwMvWQHgYztw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10/go.mod h1:6UV4SZkVvmODfXKql4LCbaZUpF7HO2BX38FgBf9ZOLw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3 h1:n3GDfwqF2tzEkXlv5cuy4iy7LpKDtqDMcNLfZDu9rls=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 h1:/b31bi3YVNlkzkBrm9LfpaKoaYZUxIAj4sHfOTmLfqw=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4/go.mod h1:2aGXHFmbInwgP9ZfpmdIfOELL79zhdNYNmReK8qDfdQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 h1:DBYTXwIGQSGs9w4jKm60F5dmCQ3EEruxdc0MFh+3EY4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10/go.mod h1:wohMUQiFdzo0NtxbBg0mSRGZ4vL3n0dKjLTINdcIino=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 h1:eajuO3nykDPdYicLlP3AGgOyVN3MOlFmZv7WGTuJPow=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.7/go.mod h1:+mJNDdF+qiUlNKNC3fxn74WWNN+sOiGOEImje+3ScPM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 h1:QPMJf+Jw8E1l7zqhZmMlFw6w1NmfkfiSK8mS4zOx3BA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7/go.mod h1:ykf3COxYI0UJmxcfcxcVuz7b6uADi1FkiUz6Eb7AgM8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 h1:NzO4Vrau795RkUdSHKEwiR01FaGzGOH1EETJ+5QHnm0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.7/go.mod h1:6h2YuIoxaMSCFf5fi1EgZAwdfkGMgDY+DVfa61uLe4U=
+github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
+github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
 github.com/beorn7/perks v0.0.0-20150223135152-b965b613227f/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
@@ -75,63 +79,61 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
+github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b h1:ga8SEFjZ60pxLcmhnThWgvH2wg8376yUJmPhEH4H3kw=
+github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
-github.com/compose-spec/compose-go/v2 v2.4.7 h1:WNpz5bIbKG+G+w9pfu72B1ZXr+Og9jez8TMEo8ecXPk=
-github.com/compose-spec/compose-go/v2 v2.4.7/go.mod h1:lFN0DrMxIncJGYAXTfWuajfwj5haBJqrBkarHcnjJKc=
+github.com/compose-spec/compose-go/v2 v2.4.4 h1:cvHBl5Jf1iNBmRrZCICmHvaoskYc1etTPEMLKVwokAY=
+github.com/compose-spec/compose-go/v2 v2.4.4/go.mod h1:lFN0DrMxIncJGYAXTfWuajfwj5haBJqrBkarHcnjJKc=
+github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/cgroups/v3 v3.0.3 h1:S5ByHZ/h9PMe5IOQoN7E+nMc2UcLEM/V48DGDJ9kip0=
 github.com/containerd/cgroups/v3 v3.0.3/go.mod h1:8HBe7V3aWGLFPd/k03swSIsGjZhHI2WzJmticMgVuz0=
 github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
-github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
-github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
-github.com/containerd/containerd/v2 v2.0.2 h1:GmH/tRBlTvrXOLwSpWE2vNAm8+MqI6nmxKpKBNKY8Wc=
-github.com/containerd/containerd/v2 v2.0.2/go.mod h1:wIqEvQ/6cyPFUGJ5yMFanspPabMLor+bF865OHvNTTI=
+github.com/containerd/containerd v1.7.24 h1:zxszGrGjrra1yYJW/6rhm9cJ1ZQ8rkKBR48brqsa7nA=
+github.com/containerd/containerd v1.7.24/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
+github.com/containerd/containerd/api v1.7.19 h1:VWbJL+8Ap4Ju2mx9c9qS1uFSB1OVYr5JJrW2yT5vFoA=
+github.com/containerd/containerd/api v1.7.19/go.mod h1:fwGavl3LNwAV5ilJ0sbrABL44AQxmNjDRcwheXDb6Ig=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
-github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
-github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
-github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
-github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
+github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/nydus-snapshotter v0.15.0 h1:RqZRs1GPeM6T3wmuxJV9u+2Rg4YETVMwTmiDeX+iWC8=
-github.com/containerd/nydus-snapshotter v0.15.0/go.mod h1:biq0ijpeZe0I5yZFSJyHzFSjjRZQ7P7y/OuHyd7hYOw=
-github.com/containerd/platforms v1.0.0-rc.1 h1:83KIq4yy1erSRgOVHNk1HYdPvzdJ5CnsWaRoJX4C41E=
-github.com/containerd/platforms v1.0.0-rc.1/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
-github.com/containerd/plugin v1.0.0 h1:c8Kf1TNl6+e2TtMHZt+39yAPDbouRH9WAToRjex483Y=
-github.com/containerd/plugin v1.0.0/go.mod h1:hQfJe5nmWfImiqT1q8Si3jLv3ynMUIBB47bQ+KexvO8=
-github.com/containerd/stargz-snapshotter v0.16.3 h1:zbQMm8dRuPHEOD4OqAYGajJJUwCeUzt4j7w9Iaw58u4=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
-github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
-github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
+github.com/containerd/nydus-snapshotter v0.14.0 h1:6/eAi6d7MjaeLLuMO8Udfe5GVsDudmrDNO4SGETMBco=
+github.com/containerd/nydus-snapshotter v0.14.0/go.mod h1:TT4jv2SnIDxEBu4H2YOvWQHPOap031ydTaHTuvc5VQk=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
+github.com/containerd/stargz-snapshotter v0.15.1 h1:fpsP4kf/Z4n2EYnU0WT8ZCE3eiKDwikDhL6VwxIlgeA=
+github.com/containerd/stargz-snapshotter/estargz v0.15.1 h1:eXJjw9RbkLFgioVaTG+G/ZW/0kEe2oEKCdS/ZxIyoCU=
+github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
+github.com/containerd/ttrpc v1.2.5 h1:IFckT1EFQoFBMG4c3sMdT8EP3/aKfumK1msY+Ze4oLU=
+github.com/containerd/ttrpc v1.2.5/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
-github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
+github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
-github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/creack/pty v1.1.21 h1:1/QdRyBaHHJP61QkWMXlOIBfsgdDeeKfK8SYVUWJKf0=
+github.com/creack/pty v1.1.21/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.5.0+incompatible h1:aMphQkcGtpHixwwhAXJT1rrK/detk2JIvDaFkLctbGM=
-github.com/docker/cli v27.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli-docs-tool v0.9.0 h1:CVwQbE+ZziwlPqrJ7LRyUF6GvCA+6gj7MTCsayaK9t0=
-github.com/docker/cli-docs-tool v0.9.0/go.mod h1:ClrwlNW+UioiRyH9GiAOe1o3J/TsY3Tr1ipoypjAUtc=
+github.com/docker/cli v27.4.0-rc.2+incompatible h1:A0GZwegDlt2wdt3tpmrUzkVOZmbhvd7i05wPSf7Oo74=
+github.com/docker/cli v27.4.0-rc.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli-docs-tool v0.8.0 h1:YcDWl7rQJC3lJ7WVZRwSs3bc9nka97QLWfyJQli8yJU=
+github.com/docker/cli-docs-tool v0.8.0/go.mod h1:8TQQ3E7mOXoYUs811LiPdUnAhXrcVsBIrW21a5pUbdk=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v27.5.0+incompatible h1:um++2NcQtGRTz5eEgO6aJimo6/JxrTXC941hd05JO6U=
-github.com/docker/docker v27.5.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.4.0-rc.2+incompatible h1:9OJjVGtelk/zGC3TyKweJ29b9Axzh0s/0vtU4mneumE=
+github.com/docker/docker v27.4.0-rc.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
@@ -139,6 +141,8 @@ github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
@@ -149,20 +153,19 @@ github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNE
 github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7BvyPhdbLxMXIYTFPLsyJRFMsKmOZnQmzh6Gb+uquuM=
 github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
 github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
+github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
 github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/fvbommel/sortorder v1.0.1 h1:dSnXLt4mJYH25uDDGa3biZNQsozaUWDSWeKJ0qqFfzE=
 github.com/fvbommel/sortorder v1.0.1/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -171,14 +174,13 @@ github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-sql-driver/mysql v1.3.0 h1:pgwjLi/dvffoP9aabwkT3AKpXQM93QARkjFhDDqC1UE=
 github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
-github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-viper/mapstructure/v2 v2.0.0 h1:dhn8MZ1gZ0mzeodTG3jt5Vj/o87xZKuNAprG2mQfMfc=
@@ -211,8 +213,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
+github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 h1:k7nVchz72niMH6YLQNvHSdIE7iqsQxK1P41mySCvssg=
+github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -221,10 +223,11 @@ github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/gorilla/mux v1.7.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -232,12 +235,12 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-cty-funcs v0.0.0-20241120183456-c51673e0b3dd h1:nwSMaLX+rf/ZPHTJHWO9K73be04SritSKvKuvpBvC2A=
-github.com/hashicorp/go-cty-funcs v0.0.0-20241120183456-c51673e0b3dd/go.mod h1:Abjk0jbRkDaNCzsRhOv2iDCofYpX1eVsjozoiK63qLA=
+github.com/hashicorp/go-cty-funcs v0.0.0-20230405223818-a090f58aa992 h1:fYOrSfO5C9PmFGtmRWSYGqq52SOoE2dXMtAn2Xzh1LQ=
+github.com/hashicorp/go-cty-funcs v0.0.0-20230405223818-a090f58aa992/go.mod h1:Abjk0jbRkDaNCzsRhOv2iDCofYpX1eVsjozoiK63qLA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/hcl/v2 v2.23.0 h1:Fphj1/gCylPxHutVSEOf2fBOh1VE4AuLV7+kbJf3qos=
-github.com/hashicorp/hcl/v2 v2.23.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
+github.com/hashicorp/hcl/v2 v2.20.1 h1:M6hgdyz7HYt1UN9e61j+qKJBqR3orTWbI1HKBJEdxtc=
+github.com/hashicorp/hcl/v2 v2.20.1/go.mod h1:TZDqQ4kNKCbh1iJp99FdPiUaVDDUPivbqxZulxDYqL4=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
@@ -298,16 +301,16 @@ github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/z
 github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.19.0-rc2 h1:7sAuQ5bDNIbdfmc7UDbrWJ2UPOR5w9rNWgnrEoC5aoo=
-github.com/moby/buildkit v0.19.0-rc2/go.mod h1:4WYJLet/NI2p1o2rPQ6CIFpyyyvwvPz/TVISmwqqpHI=
+github.com/moby/buildkit v0.18.0 h1:KSelhNINJcNA3FCWBbGCytvicjP+kjU5kZlZhkTUkVo=
+github.com/moby/buildkit v0.18.0/go.mod h1:vCR5CX8NGsPTthTg681+9kdmfvkvqJBXEv71GZe5msU=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/spdystream v0.4.0 h1:Vy79D6mHeJJjiPdFEL2yku1kl0chZpJfZcPpb16BRl8=
-github.com/moby/spdystream v0.4.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
+github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
@@ -338,12 +341,12 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLA
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.0 h1:Iw5WCbBcaAAd0fpRb1c9r5YCylv4XDoCSigm1zLevwU=
 github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
-github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
-github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
+github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
+github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
-github.com/onsi/gomega v1.19.0 h1:4ieX6qQjPP/BfC3mpsAtIGGlxTWPeA3Inl/7DtXw1tw=
-github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
+github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
+github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
 github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
@@ -352,10 +355,8 @@ github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQ
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE7dzrbT927iTk=
 github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 h1:DmNGcqH3WDbV5k8OJ+esPWbqUOX5rMLR2PMvziDMJi0=
-github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626/go.mod h1:BRHJJd0E+cx42OybVYSgUvZmU0B8P9gZuRXlZUP7TKI=
-github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jDMcgULaH8=
-github.com/opencontainers/selinux v1.11.1/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
+github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
+github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
 github.com/opentracing/opentracing-go v1.1.0 h1:pWlfV3Bxv7k65HYwkikxat0+s3pV4bsqf19k25Ur8rU=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
@@ -366,15 +367,14 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
-github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
-github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_golang v1.20.2 h1:5ctymQzZlyOON1666svgwn3s6IKWgfbjsejTMiXIyjg=
+github.com/prometheus/client_golang v1.20.2/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -393,8 +393,8 @@ github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0leargg
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/secure-systems-lab/go-securesystemslib v0.4.0 h1:b23VGrQhTA8cN2CbBw7/FulN9fTtqYUdS5+Oxzt+DUE=
@@ -435,27 +435,23 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/theupdateframework/notary v0.7.0 h1:QyagRZ7wlSpjT5N2qQAh/pN+DVqgekv4DzbAiAiEL3c=
 github.com/theupdateframework/notary v0.7.0/go.mod h1:c9DRxcmhHmVLDay4/2fUYdISnHqbFDGRSlXPO0AhYWw=
 github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205 h1:eUk79E1w8yMtXeHSzjKorxuC8qJOnyXQnLaJehxpJaI=
 github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205/go.mod h1:3Iuxbr0P7D3zUzBMAZB+ois3h/et0shEz0qApgHYGpY=
-github.com/tonistiigi/fsutil v0.0.0-20250113203817-b14e27f4135a h1:EfGw4G0x/8qXWgtcZ6KVaPS+wpWOQMaypczzP8ojkMY=
-github.com/tonistiigi/fsutil v0.0.0-20250113203817-b14e27f4135a/go.mod h1:Dl/9oEjK7IqnjAm21Okx/XIxUCFJzvh+XdVHUlBwXTw=
+github.com/tonistiigi/fsutil v0.0.0-20241121093142-31cf1f437184 h1:RgyoSI38Y36zjQaszel/0RAcIehAnjA1B0RiUV9SDO4=
+github.com/tonistiigi/fsutil v0.0.0-20241121093142-31cf1f437184/go.mod h1:Dl/9oEjK7IqnjAm21Okx/XIxUCFJzvh+XdVHUlBwXTw=
 github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 h1:7I5c2Ig/5FgqkYOh/N87NzoyI9U15qUPXhDD8uCupv8=
 github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4/go.mod h1:278M4p8WsNh3n4a1eqiFcV2FGk7wE5fwUpUom9mK9lE=
 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/v/cCndK0AMpt1wiVFb/YYmqB3/QG0=
 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea/go.mod h1:WPnis/6cRcDZSUvVmezrxJPkiO87ThFYsoUiMwWNDJk=
 github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab h1:H6aJ0yKQ0gF49Qb2z5hI1UHxSQt4JMyxebFR15KnApw=
 github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab/go.mod h1:ulncasL3N9uLrVann0m+CDlJKWsIAP34MPcOJF6VRvc=
-github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
-github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
+github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=
+github.com/vbatts/tar-split v0.11.5/go.mod h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
@@ -466,38 +462,38 @@ github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQ
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/zclconf/go-cty v1.4.0/go.mod h1:nHzOclRkoj++EU9ZjSrZvRG0BXIWt8c7loYc0qXAFGQ=
-github.com/zclconf/go-cty v1.16.0 h1:xPKEhst+BW5D0wxebMZkxgapvOE/dw7bFTlgSc9nD6w=
-github.com/zclconf/go-cty v1.16.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
-github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
-github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
+github.com/zclconf/go-cty v1.14.4 h1:uXXczd9QDGsgu0i/QFR/hzI5NYCHLf6NQw/atrbnhq8=
+github.com/zclconf/go-cty v1.14.4/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b h1:FosyBZYxY34Wul7O/MSKey3txpPYyCqVO5ZyceuQJEI=
+github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0 h1:yMkBS9yViCc7U7yeLzJPM2XizlfdVvBRSmsQDWu6qc0=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0/go.mod h1:n8MR6/liuGB5EmTETUBeU5ZgqMOlqKRxUaqPQBOANZ8=
-go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0 h1:4BZHA+B1wXEQoGNHxW8mURaLhcdGwvRnmhGbm+odRbc=
-go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0/go.mod h1:3qi2EEwMgB4xnKgPLqsDP3j9qxnHDZeHsnAxfjQqTko=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 h1:UP6IpuHFkUgOQL9FFQFrZ+5LiwhhYRbi7VZSIx6Nj5s=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0/go.mod h1:qxuZLtbq5QDtdeSHsS7bcf6EH6uO6jUAgk764zd3rhM=
-go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
-go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.31.0 h1:FZ6ei8GFW7kyPYdxJaV2rgI6M+4tvZzhYsQ2wgyVC08=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.31.0/go.mod h1:MdEu/mC6j3D+tTEfvI15b5Ci2Fn7NneJ71YMoiS3tpI=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.31.0 h1:ZsXq73BERAiNuuFXYqP4MR5hBrjXfMGSO+Cx7qoOZiM=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.31.0/go.mod h1:hg1zaDMpyZJuUzjFxFsRYBoccE86tM9Uf4IqNMUxvrY=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0 h1:K0XaT3DwHAcV4nKLzcQvwAgSyisUghWoY20I7huthMk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0/go.mod h1:B5Ki776z/MBnVha1Nzwp5arlzBbE3+1jk+pGmaP5HME=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0 h1:FFeLy03iVTXP6ffeN2iXrxfGsZGCjVx0/4KlizjyBwU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0/go.mod h1:TMu73/k1CP8nBUpDLc71Wj/Kf7ZS9FK5b53VapRsP9o=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0 h1:lUsI2TYsQw2r1IASwoROaCnjdj2cvC2+Jbxvk6nHnWU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0/go.mod h1:2HpZxxQurfGxJlJDblybejHB6RX6pmExPNe517hREw4=
-go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
-go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
-go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
-go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
-go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
-go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
-go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
-go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 h1:SpGay3w+nEwMpfVnbqOLH5gY52/foP8RE8UzTZ1pdSE=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1/go.mod h1:4UoMYEZOC0yN/sPGH76KPkkU7zgiEWYWL9vwmbnTJPE=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 h1:gbhw/u49SS3gkPWiYweQNJGm/uJN5GkI/FrosxSHT7A=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1/go.mod h1:GnOaBaFQ2we3b9AGWJpsBa7v1S5RlQzlC3O7dRMxZhM=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 h1:4K4tsIXefpVJtvA/8srF4V4y0akAoPHkIslgAkjixJA=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0/go.mod h1:jjdQuTGVsXV4vSs+CJ2qYDeDPf9yIJV23qlIzBm73Vg=
+go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
+go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 h1:jd0+5t/YynESZqsSyPz+7PAFdEop0dlN0+PkyHYo8oI=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0/go.mod h1:U707O40ee1FpQGyhvqnzmCJm1Wh6OX6GGBVn0E6Uyyk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0 h1:bflGWrfYyuulcdxf14V6n9+CoQcu5SAAdHmDPAJnlps=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0/go.mod h1:qcTO4xHAxZLaLxPd60TdE88rxtItPHgHWqOhOGRr0as=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0 h1:R3X6ZXmNPRR8ul6i3WgFURCHzaXjHdm0karRG/+dj3s=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0/go.mod h1:QWFXnDavXWwMx2EEcZsf3yxgEKAqsxQ+Syjp+seyInw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0 h1:j9+03ymgYhPKmeXGk5Zu+cIZOlVzd9Zv7QIiyItjFBU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0/go.mod h1:Y5+XiUG4Emn1hTfciPzGPJaSI+RpDts6BnCIir0SLqk=
+go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
+go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
+go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE=
+go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg=
+go.opentelemetry.io/otel/sdk/metric v1.28.0 h1:OkuaKgKrgAbYrrY0t92c+cC+2F6hsFNnCQArXCKlg08=
+go.opentelemetry.io/otel/sdk/metric v1.28.0/go.mod h1:cWPjykihLAPvXKi4iZc1dpER3Jdq2Z0YLse3moQUCpg=
+go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
+go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
 go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
 go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -510,8 +506,8 @@ golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200422194213-44a606286825/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
+golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
 golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 h1:e66Fs6Z+fZTbFBAxKfP3PALWBtpfqks2bwGcexMxgtk=
 golang.org/x/exp v0.0.0-20240909161429-701f63a606c0/go.mod h1:2TbTHSBQa924w8M6Xs1QcRcFwyucIwBGpK1p2f1YFFY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -525,18 +521,18 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
-golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
+golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
+golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
+golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -549,16 +545,16 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
+golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
+golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
+golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -572,17 +568,19 @@ golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 h1:T6rh4haD3GVYsgEfWExoCZA2o2FmbNyKpTuAxbEFPTg=
-google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:wp2WsuBYj6j8wUdo3ToZsdxxixbvQNAHqVJrTgi5E5M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 h1:zciRKQ4kBpFgpfC5QQCVtnnNAcLIqweL7plyZRQHVpI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
+google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 h1:KAeGQVN3M9nD0/bQXnr/ClcEMJ968gUXJQ9pwfSynuQ=
+google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
+google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 h1:0+ozOGcrp+Y8Aq8TLNN2Aliibms5LEzsq99ZZmAGYm0=
+google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094/go.mod h1:fJ/e3If/Q67Mj99hin0hMhiNyCRmt6BQ2aWIJshUSJw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
-google.golang.org/grpc v1.68.1 h1:oI5oTa11+ng8r8XMMN7jAOmWfPZWbYpCFaMUTACxkM0=
-google.golang.org/grpc v1.68.1/go.mod h1:+q1XYFJjShcqn0QZHvCyeR4CXPA+llXIeUIfIe00waw=
+google.golang.org/grpc v1.66.3 h1:TWlsh8Mv0QI/1sIbs1W36lqRclxrmF+eFJ4DbI0fuhA=
+google.golang.org/grpc v1.66.3/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
-google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
-google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
+google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/cenkalti/backoff.v2 v2.2.1 h1:eJ9UAg01/HIHG987TwxvnzK2MgxXq97YY6rYDpY9aII=
@@ -610,25 +608,21 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-k8s.io/api v0.31.2 h1:3wLBbL5Uom/8Zy98GRPXpJ254nEFpl+hwndmk9RwmL0=
-k8s.io/api v0.31.2/go.mod h1:bWmGvrGPssSK1ljmLzd3pwCQ9MgoTsRCuK35u6SygUk=
-k8s.io/apimachinery v0.31.2 h1:i4vUt2hPK56W6mlT7Ry+AO8eEsyxMD1U44NR22CLTYw=
-k8s.io/apimachinery v0.31.2/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-k8s.io/client-go v0.31.2 h1:Y2F4dxU5d3AQj+ybwSMqQnpZH9F30//1ObxOKlTI9yc=
-k8s.io/client-go v0.31.2/go.mod h1:NPa74jSVR/+eez2dFsEIHNa+3o09vtNaWwWwb1qSxSs=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
-k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/api v0.29.2 h1:hBC7B9+MU+ptchxEqTNW2DkUosJpp1P+Wn6YncZ474A=
+k8s.io/api v0.29.2/go.mod h1:sdIaaKuU7P44aoyyLlikSLayT6Vb7bvJNCX105xZXY0=
+k8s.io/apimachinery v0.29.2 h1:EWGpfJ856oj11C52NRCHuU7rFDwxev48z+6DSlGNsV8=
+k8s.io/apimachinery v0.29.2/go.mod h1:6HVkd1FwxIagpYrHSwJlQqZI3G9LfYWRPAkUvLnXTKU=
+k8s.io/client-go v0.29.2 h1:FEg85el1TeZp+/vYJM7hkDlSTFZ+c5nnK44DJ4FyoRg=
+k8s.io/client-go v0.29.2/go.mod h1:knlvFZE58VpqbQpJNbCbctTVXcd35mMyAAwBdpt4jrA=
+k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0=
+k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo=
+k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
+k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
+k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
+k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-tags.cncf.io/container-device-interface v0.8.0 h1:8bCFo/g9WODjWx3m6EYl3GfUG31eKJbaggyBDxEldRc=
-tags.cncf.io/container-device-interface v0.8.0/go.mod h1:Apb7N4VdILW0EVdEMRYXIDVRZfNJZ+kmEUss2kRRQ6Y=
-tags.cncf.io/container-device-interface/specs-go v0.8.0 h1:QYGFzGxvYK/ZLMrjhvY0RjpUavIn4KcmRmVP/JjdBTA=
-tags.cncf.io/container-device-interface/specs-go v0.8.0/go.mod h1:BhJIkjjPh4qpys+qm4DAYtUyryaTDg9zris+AczXyws=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=

hack/Vagrantfile.freebsd

@@ -1,18 +0,0 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
-
-Vagrant.configure("2") do |config|
-  config.vm.box = "generic/freebsd14"
-  config.vm.boot_timeout = 900
-  config.vm.synced_folder ".", "/vagrant", type: "rsync"
-  config.ssh.keep_alive = true
-
-  config.vm.provision "init", type: "shell", run: "once" do |sh|
-    sh.inline = <<~SHELL
-      pkg bootstrap
-      pkg install -y go123 git
-      ln -s /usr/local/bin/go123 /usr/local/bin/go
-      go install gotest.tools/gotestsum@#{ENV['GOTESTSUM_VERSION']}
-    SHELL
-  end
-end

hack/Vagrantfile.openbsd

@@ -1,21 +0,0 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
-
-Vagrant.configure("2") do |config|
-  config.vm.box = "pygolo/openbsd7"
-  config.vm.box_version = "7.5"
-  config.vm.boot_timeout = 900
-  config.vm.synced_folder ".", "/vagrant", type: "rsync"
-  config.ssh.keep_alive = true
-
-  config.vm.provision "init", type: "shell", run: "once" do |sh|
-    sh.inline = <<~SHELL
-      pkg_add -x git
-
-      ftp https://go.dev/dl/go1.23.3.openbsd-amd64.tar.gz
-      tar -C /usr/local -xzf go1.23.3.openbsd-amd64.tar.gz
-      ln -s /usr/local/go/bin/go /usr/local/bin/go
-      go install gotest.tools/gotestsum@#{ENV['GOTESTSUM_VERSION']}
-    SHELL
-  end
-end

hack/dockerfiles/authors.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG ALPINE_VERSION=3.21
+ARG ALPINE_VERSION=3.20
 
 FROM alpine:${ALPINE_VERSION} AS gen
 RUN apk add --no-cache git

hack/dockerfiles/docs.Dockerfile

@@ -1,17 +1,15 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.23
-ARG ALPINE_VERSION=3.21
-
 ARG FORMATS=md,yaml
 
-FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS docsgen
+FROM golang:${GO_VERSION}-alpine AS docsgen
 WORKDIR /src
 RUN --mount=target=. \
   --mount=target=/root/.cache,type=cache \
   go build -mod=vendor -o /out/docsgen ./docs/generate.go
 
-FROM alpine:${ALPINE_VERSION} AS gen
+FROM alpine AS gen
 RUN apk add --no-cache rsync git
 WORKDIR /src
 COPY --from=docsgen /out/docsgen /usr/bin

hack/dockerfiles/govulncheck.Dockerfile

@@ -1,12 +1,10 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.23
-ARG ALPINE_VERSION=3.21
-
 ARG GOVULNCHECK_VERSION=v1.1.3
 ARG FORMAT="text"
 
-FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
+FROM golang:${GO_VERSION}-alpine AS base
 WORKDIR /go/src/github.com/docker/buildx
 RUN apk add --no-cache jq moreutils
 ARG GOVULNCHECK_VERSION

hack/dockerfiles/lint.Dockerfile

@@ -1,9 +1,7 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.23
-ARG ALPINE_VERSION=3.21
-ARG XX_VERSION=1.6.1
-
+ARG XX_VERSION=1.5.0
 ARG GOLANGCI_LINT_VERSION=1.62.0
 ARG GOPLS_VERSION=v0.26.0
 # disabled: deprecated unusedvariable simplifyrange
@@ -11,7 +9,7 @@ ARG GOPLS_ANALYZERS="embeddirective fillreturns infertypeargs nonewvars norangeo
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golang-base
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS golang-base
 RUN apk add --no-cache git gcc musl-dev
 
 FROM golang-base AS lint-base
@@ -76,4 +74,4 @@ RUN --mount=target=. \
   done
 EOF
 
-FROM lint
+FROM lint

hack/dockerfiles/vendor.Dockerfile

@@ -1,11 +1,9 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.23
-ARG ALPINE_VERSION=3.21
-
 ARG MODOUTDATED_VERSION=v0.9.0
 
-FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
+FROM golang:${GO_VERSION}-alpine AS base
 RUN apk add --no-cache git rsync
 WORKDIR /src
 

hack/test-driver

@@ -167,8 +167,7 @@ buildxCmd bake ${bakePlatformFlag} \
   --file="${bakedef}" \
   --builder="${builderName}" \
   --set "*.context=${context}" \
-  --metadata-file="${context}/metadata-bake-def.json" \
-  --allow fs="${context}"
+  --metadata-file="${context}/metadata-bake-def.json"
 cat "${context}/metadata-bake-def.json"
 
 # bake all target
@@ -176,7 +175,6 @@ buildxCmd bake ${bakePlatformFlag} \
   --file="${bakedef}" \
   --builder="${builderName}" \
   --set "*.context=${context}" \
-  --allow fs="${context}" \
   --metadata-file="${context}/metadata-bake-all.json" \
   all
 cat "${context}/metadata-bake-all.json"

tests/bake.go

@@ -2,11 +2,7 @@ package tests
 
 import (
 	"bytes"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
 	"encoding/json"
-	"encoding/pem"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -37,7 +33,6 @@ func bakeCmd(sb integration.Sandbox, opts ...cmdOpt) (string, error) {
 
 var bakeTests = []func(t *testing.T, sb integration.Sandbox){
 	testBakePrint,
-	testBakePrintSensitive,
 	testBakeLocal,
 	testBakeLocalMulti,
 	testBakeRemote,
@@ -60,8 +55,6 @@ var bakeTests = []func(t *testing.T, sb integration.Sandbox){
 	testBakeDefinitionExistingOutsideNoParallel,
 	testBakeDefinitionSymlinkOutsideNoParallel,
 	testBakeDefinitionSymlinkOutsideGrantedNoParallel,
-	testBakeSSHPathNoParallel,
-	testBakeSSHDefaultNoParallel,
 	testBakeShmSize,
 	testBakeUlimits,
 	testBakeMetadataProvenance,
@@ -93,8 +86,7 @@ target "build" {
     HELLO = "foo"
   }
 }
-`),
-		},
+`)},
 		{
 			"Compose",
 			"compose.yml",
@@ -105,8 +97,7 @@ services:
       context: .
       args:
         HELLO: foo
-`),
-		},
+`)},
 	}
 
 	for _, tc := range testCases {
@@ -167,125 +158,6 @@ RUN echo "Hello ${HELLO}"
 	}
 }
 
-func testBakePrintSensitive(t *testing.T, sb integration.Sandbox) {
-	testCases := []struct {
-		name string
-		f    string
-		dt   []byte
-	}{
-		{
-			"HCL",
-			"docker-bake.hcl",
-			[]byte(`
-target "build" {
-  args = {
-    HELLO = "foo"
-  }
-
-  cache-from = [
-    "type=gha,token=abc",
-    "type=s3,region=us-west-2,bucket=my_bucket,name=my_image",
-  ]
-}
-`),
-		},
-		{
-			"Compose",
-			"compose.yml",
-			[]byte(`
-services:
-  build:
-    build:
-      context: .
-      args:
-        HELLO: foo
-      cache_from:
-        - type=gha,token=abc
-        - type=s3,region=us-west-2,bucket=my_bucket,name=my_image
-`),
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := tmpdir(
-				t,
-				fstest.CreateFile(tc.f, tc.dt, 0600),
-				fstest.CreateFile("Dockerfile", []byte(`
-FROM busybox
-ARG HELLO
-RUN echo "Hello ${HELLO}"
-	`), 0600),
-			)
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--print", "build"),
-				withEnv(
-					"ACTIONS_RUNTIME_TOKEN=sensitive_token",
-					"ACTIONS_CACHE_URL=https://cache.github.com",
-					"AWS_ACCESS_KEY_ID=definitely_dont_look_here",
-					"AWS_SECRET_ACCESS_KEY=hackers_please_dont_steal",
-					"AWS_SESSION_TOKEN=not_a_mitm_attack",
-				),
-			)
-			stdout := bytes.Buffer{}
-			stderr := bytes.Buffer{}
-			cmd.Stdout = &stdout
-			cmd.Stderr = &stderr
-			require.NoError(t, cmd.Run(), stdout.String(), stderr.String())
-
-			var def struct {
-				Group  map[string]*bake.Group  `json:"group,omitempty"`
-				Target map[string]*bake.Target `json:"target"`
-			}
-			require.NoError(t, json.Unmarshal(stdout.Bytes(), &def))
-
-			require.Len(t, def.Group, 1)
-			require.Contains(t, def.Group, "default")
-
-			require.Equal(t, []string{"build"}, def.Group["default"].Targets)
-			require.Len(t, def.Target, 1)
-			require.Contains(t, def.Target, "build")
-			require.Equal(t, ".", *def.Target["build"].Context)
-			require.Equal(t, "Dockerfile", *def.Target["build"].Dockerfile)
-			require.Equal(t, map[string]*string{"HELLO": ptrstr("foo")}, def.Target["build"].Args)
-			require.NotNil(t, def.Target["build"].CacheFrom)
-			require.Len(t, def.Target["build"].CacheFrom, 2)
-
-			require.JSONEq(t, `{
-  "group": {
-    "default": {
-      "targets": [
-        "build"
-      ]
-    }
-  },
-  "target": {
-    "build": {
-      "context": ".",
-      "dockerfile": "Dockerfile",
-      "args": {
-        "HELLO": "foo"
-      },
-      "cache-from": [
-        {
-          "type": "gha",
-          "token": "abc"
-        },
-        {
-          "type": "s3",
-          "region": "us-west-2",
-          "bucket": "my_bucket",
-          "name": "my_image"
-        }
-      ]
-    }
-  }
-}
-`, stdout.String())
-		})
-	}
-}
-
 func testBakeLocal(t *testing.T, sb integration.Sandbox) {
 	dockerfile := []byte(`
 FROM scratch
@@ -1097,95 +969,6 @@ target "default" {
 	}
 }
 
-func testBakeSSHPathNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY Dockerfile /foo
-	`)
-			keyDir := t.TempDir()
-			err := writeTempPrivateKey(filepath.Join(keyDir, "id_rsa"))
-			require.NoError(t, err)
-			bakefile := []byte(fmt.Sprintf(`
-target "default" {
-	ssh = ["key=%s"]
-}
-`, filepath.Join(keyDir, "id_rsa")))
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-			)
-
-			// not allowed
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
-			out, err := cmd.CombinedOutput()
-			if ent {
-				require.Error(t, err, string(out))
-				require.Contains(t, string(out), "ERROR: additional privileges requested")
-				require.Contains(t, string(out), "Read access to path")
-				require.Contains(t, string(out), "/id_rsa")
-			} else {
-				require.NoError(t, err, string(out))
-			}
-
-			// directory allowed
-			cmd = buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--allow", "fs.read="+keyDir))
-			out, err = cmd.CombinedOutput()
-			require.NoError(t, err, string(out))
-
-			// file allowed
-			cmd = buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--allow", "fs.read="+filepath.Join(keyDir, "id_rsa")))
-			out, err = cmd.CombinedOutput()
-			require.NoError(t, err, string(out))
-		})
-	}
-}
-
-func testBakeSSHDefaultNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY Dockerfile /foo
-	`)
-			keyDir := t.TempDir()
-			// not a socket but key behaves the same and doesn't create parse error
-			err := writeTempPrivateKey(filepath.Join(keyDir, "ssh-agent.sock"))
-			require.NoError(t, err)
-			t.Setenv("SSH_AUTH_SOCK", filepath.Join(keyDir, "ssh-agent.sock"))
-			bakefile := []byte(`
-target "default" {
-	ssh = ["default"]
-}
-`)
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-			)
-
-			// not allowed
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
-			out, err := cmd.CombinedOutput()
-			if ent {
-				require.Error(t, err, string(out))
-				require.Contains(t, string(out), "ERROR: additional privileges requested")
-				require.Contains(t, string(out), "Forwarding default SSH agent socket")
-			} else {
-				require.NoError(t, err, string(out))
-			}
-
-			cmd = buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--allow=ssh"))
-			out, err = cmd.CombinedOutput()
-			require.NoError(t, err, string(out))
-		})
-	}
-}
-
 func testBakeUlimits(t *testing.T, sb integration.Sandbox) {
 	dockerfile := []byte(`
 FROM busybox AS build
@@ -1599,7 +1382,7 @@ target "abc" {
 	out, err := bakeCmd(
 		sb,
 		withDir(dir),
-		withArgs("--list=targets"),
+		withArgs("--list-targets"),
 	)
 	require.NoError(t, err, out)
 
@@ -1628,7 +1411,7 @@ target "default" {
 	out, err := bakeCmd(
 		sb,
 		withDir(dir),
-		withArgs("--list=variables"),
+		withArgs("--list-variables"),
 	)
 	require.NoError(t, err, out)
 
@@ -1969,15 +1752,3 @@ target "third" {
 		require.Contains(t, stdout.String(), dockerfilePathThird+":3")
 	})
 }
-
-func writeTempPrivateKey(fp string) error {
-	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return err
-	}
-	privateKeyPEM := pem.EncodeToMemory(&pem.Block{
-		Type:  "RSA PRIVATE KEY",
-		Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
-	})
-	return os.WriteFile(fp, privateKeyPEM, 0600)
-}

tests/imagetools.go

@@ -5,7 +5,7 @@ import (
 	"os/exec"
 	"testing"
 
-	"github.com/containerd/containerd/v2/core/images"
+	"github.com/containerd/containerd/images"
 	"github.com/containerd/continuity/fs/fstest"
 	"github.com/containerd/platforms"
 	"github.com/moby/buildkit/util/testutil/integration"

tests/workers/backend.go

@@ -19,10 +19,6 @@ func (s *backend) Address() string {
 	return s.builder
 }
 
-func (s *backend) DebugAddress() string {
-	return ""
-}
-
 func (s *backend) DockerAddress() string {
 	return s.context
 }

util/buildflags/attests.go

@@ -1,9 +1,7 @@
 package buildflags
 
 import (
-	"encoding/json"
 	"fmt"
-	"maps"
 	"strconv"
 	"strings"
 
@@ -12,167 +10,6 @@ import (
 	"github.com/tonistiigi/go-csvvalue"
 )
 
-type Attests []*Attest
-
-func (a Attests) Merge(other Attests) Attests {
-	if other == nil {
-		a.Normalize()
-		return a
-	} else if a == nil {
-		other.Normalize()
-		return other
-	}
-
-	return append(a, other...).Normalize()
-}
-
-func (a Attests) Normalize() Attests {
-	if len(a) == 0 {
-		return nil
-	}
-	return removeAttestDupes(a)
-}
-
-func (a Attests) ToPB() []*controllerapi.Attest {
-	if len(a) == 0 {
-		return nil
-	}
-
-	entries := make([]*controllerapi.Attest, len(a))
-	for i, entry := range a {
-		entries[i] = entry.ToPB()
-	}
-	return entries
-}
-
-type Attest struct {
-	Type     string            `json:"type"`
-	Disabled bool              `json:"disabled,omitempty"`
-	Attrs    map[string]string `json:"attrs,omitempty"`
-}
-
-func (a *Attest) Equal(other *Attest) bool {
-	if a.Type != other.Type || a.Disabled != other.Disabled {
-		return false
-	}
-	return maps.Equal(a.Attrs, other.Attrs)
-}
-
-func (a *Attest) String() string {
-	var b csvBuilder
-	if a.Type != "" {
-		b.Write("type", a.Type)
-	}
-	if a.Disabled {
-		b.Write("disabled", "true")
-	}
-	if len(a.Attrs) > 0 {
-		b.WriteAttributes(a.Attrs)
-	}
-	return b.String()
-}
-
-func (a *Attest) ToPB() *controllerapi.Attest {
-	var b csvBuilder
-	if a.Type != "" {
-		b.Write("type", a.Type)
-	}
-	if a.Disabled {
-		b.Write("disabled", "true")
-	}
-	b.WriteAttributes(a.Attrs)
-
-	return &controllerapi.Attest{
-		Type:     a.Type,
-		Disabled: a.Disabled,
-		Attrs:    b.String(),
-	}
-}
-
-func (a *Attest) MarshalJSON() ([]byte, error) {
-	m := make(map[string]interface{}, len(a.Attrs)+2)
-	for k, v := range m {
-		m[k] = v
-	}
-	m["type"] = a.Type
-	if a.Disabled {
-		m["disabled"] = true
-	}
-	return json.Marshal(m)
-}
-
-func (a *Attest) UnmarshalJSON(data []byte) error {
-	var m map[string]interface{}
-	if err := json.Unmarshal(data, &m); err != nil {
-		return err
-	}
-
-	if typ, ok := m["type"]; ok {
-		a.Type, ok = typ.(string)
-		if !ok {
-			return errors.Errorf("attest type must be a string")
-		}
-		delete(m, "type")
-	}
-
-	if disabled, ok := m["disabled"]; ok {
-		a.Disabled, ok = disabled.(bool)
-		if !ok {
-			return errors.Errorf("attest disabled attribute must be a boolean")
-		}
-		delete(m, "disabled")
-	}
-
-	attrs := make(map[string]string, len(m))
-	for k, v := range m {
-		s, ok := v.(string)
-		if !ok {
-			return errors.Errorf("attest attribute %q must be a string", k)
-		}
-		attrs[k] = s
-	}
-	a.Attrs = attrs
-	return nil
-}
-
-func (a *Attest) UnmarshalText(text []byte) error {
-	in := string(text)
-	fields, err := csvvalue.Fields(in, nil)
-	if err != nil {
-		return err
-	}
-
-	a.Attrs = map[string]string{}
-	for _, field := range fields {
-		key, value, ok := strings.Cut(field, "=")
-		if !ok {
-			return errors.Errorf("invalid value %s", field)
-		}
-		key = strings.TrimSpace(strings.ToLower(key))
-
-		switch key {
-		case "type":
-			a.Type = value
-		case "disabled":
-			disabled, err := strconv.ParseBool(value)
-			if err != nil {
-				return errors.Wrapf(err, "invalid value %s", field)
-			}
-			a.Disabled = disabled
-		default:
-			a.Attrs[key] = value
-		}
-	}
-	return a.validate()
-}
-
-func (a *Attest) validate() error {
-	if a.Type == "" {
-		return errors.Errorf("attestation type not specified")
-	}
-	return nil
-}
-
 func CanonicalizeAttest(attestType string, in string) string {
 	if in == "" {
 		return ""
@@ -184,34 +21,21 @@ func CanonicalizeAttest(attestType string, in string) string {
 }
 
 func ParseAttests(in []string) ([]*controllerapi.Attest, error) {
-	var outs []*Attest
-	for _, s := range in {
-		var out Attest
-		if err := out.UnmarshalText([]byte(s)); err != nil {
+	out := []*controllerapi.Attest{}
+	found := map[string]struct{}{}
+	for _, in := range in {
+		in := in
+		attest, err := ParseAttest(in)
+		if err != nil {
 			return nil, err
 		}
-		outs = append(outs, &out)
-	}
-	return ConvertAttests(outs)
-}
 
-// ConvertAttests converts Attestations for the controller API from
-// the ones in this package.
-//
-// Attestations of the same type will cause an error. Some tools,
-// like bake, remove the duplicates before calling this function.
-func ConvertAttests(in []*Attest) ([]*controllerapi.Attest, error) {
-	out := make([]*controllerapi.Attest, 0, len(in))
-
-	// Check for dupplicate attestations while we convert them
-	// to the controller API.
-	found := map[string]struct{}{}
-	for _, attest := range in {
 		if _, ok := found[attest.Type]; ok {
 			return nil, errors.Errorf("duplicate attestation field %s", attest.Type)
 		}
 		found[attest.Type] = struct{}{}
-		out = append(out, attest.ToPB())
+
+		out = append(out, attest)
 	}
 	return out, nil
 }
@@ -253,17 +77,3 @@ func ParseAttest(in string) (*controllerapi.Attest, error) {
 
 	return &attest, nil
 }
-
-func removeAttestDupes(s []*Attest) []*Attest {
-	res := []*Attest{}
-	m := map[string]int{}
-	for _, att := range s {
-		if i, ok := m[att.Type]; ok {
-			res[i] = att
-		} else {
-			m[att.Type] = len(res)
-			res = append(res, att)
-		}
-	}
-	return res
-}

util/buildflags/attests_cty.go

@@ -1,97 +0,0 @@
-package buildflags
-
-import (
-	"strconv"
-	"sync"
-
-	"github.com/zclconf/go-cty/cty"
-	"github.com/zclconf/go-cty/cty/convert"
-)
-
-var attestType = sync.OnceValue(func() cty.Type {
-	return cty.Map(cty.String)
-})
-
-func (e *Attests) FromCtyValue(in cty.Value, p cty.Path) error {
-	got := in.Type()
-	if got.IsTupleType() || got.IsListType() {
-		return e.fromCtyValue(in, p)
-	}
-
-	want := cty.List(attestType())
-	return p.NewErrorf("%s", convert.MismatchMessage(got, want))
-}
-
-func (e *Attests) fromCtyValue(in cty.Value, p cty.Path) error {
-	*e = make([]*Attest, 0, in.LengthInt())
-	for elem := in.ElementIterator(); elem.Next(); {
-		_, value := elem.Element()
-
-		entry := &Attest{}
-		if err := entry.FromCtyValue(value, p); err != nil {
-			return err
-		}
-		*e = append(*e, entry)
-	}
-	return nil
-}
-
-func (e Attests) ToCtyValue() cty.Value {
-	if len(e) == 0 {
-		return cty.ListValEmpty(attestType())
-	}
-
-	vals := make([]cty.Value, len(e))
-	for i, entry := range e {
-		vals[i] = entry.ToCtyValue()
-	}
-	return cty.ListVal(vals)
-}
-
-func (e *Attest) FromCtyValue(in cty.Value, p cty.Path) error {
-	if in.Type() == cty.String {
-		if err := e.UnmarshalText([]byte(in.AsString())); err != nil {
-			return p.NewError(err)
-		}
-		return nil
-	}
-
-	conv, err := convert.Convert(in, cty.Map(cty.String))
-	if err != nil {
-		return err
-	}
-
-	e.Attrs = map[string]string{}
-	for it := conv.ElementIterator(); it.Next(); {
-		k, v := it.Element()
-		switch key := k.AsString(); key {
-		case "type":
-			e.Type = v.AsString()
-		case "disabled":
-			b, err := strconv.ParseBool(v.AsString())
-			if err != nil {
-				return err
-			}
-			e.Disabled = b
-		default:
-			e.Attrs[key] = v.AsString()
-		}
-	}
-	return nil
-}
-
-func (e *Attest) ToCtyValue() cty.Value {
-	if e == nil {
-		return cty.NullVal(cty.Map(cty.String))
-	}
-
-	vals := make(map[string]cty.Value, len(e.Attrs)+2)
-	for k, v := range e.Attrs {
-		vals[k] = cty.StringVal(v)
-	}
-	vals["type"] = cty.StringVal(e.Type)
-	if e.Disabled {
-		vals["disabled"] = cty.StringVal("true")
-	}
-	return cty.MapVal(vals)
-}

util/buildflags/cache.go

@@ -2,8 +2,6 @@ package buildflags
 
 import (
 	"context"
-	"encoding/json"
-	"maps"
 	"os"
 	"strings"
 
@@ -11,181 +9,69 @@ import (
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/pkg/errors"
 	"github.com/tonistiigi/go-csvvalue"
-	"github.com/zclconf/go-cty/cty"
-	jsoncty "github.com/zclconf/go-cty/cty/json"
 )
 
-type CacheOptions []*CacheOptionsEntry
-
-func (o CacheOptions) Merge(other CacheOptions) CacheOptions {
-	if other == nil {
-		return o.Normalize()
-	} else if o == nil {
-		return other.Normalize()
-	}
-
-	return append(o, other...).Normalize()
-}
-
-func (o CacheOptions) Normalize() CacheOptions {
-	if len(o) == 0 {
-		return nil
-	}
-	return removeDupes(o)
-}
-
-func (o CacheOptions) ToPB() []*controllerapi.CacheOptionsEntry {
-	if len(o) == 0 {
-		return nil
-	}
-
-	var outs []*controllerapi.CacheOptionsEntry
-	for _, entry := range o {
-		pb := entry.ToPB()
-		if !isActive(pb) {
+func ParseCacheEntry(in []string) ([]*controllerapi.CacheOptionsEntry, error) {
+	outs := make([]*controllerapi.CacheOptionsEntry, 0, len(in))
+	for _, in := range in {
+		if in == "" {
 			continue
 		}
-		outs = append(outs, pb)
-	}
-	return outs
-}
-
-type CacheOptionsEntry struct {
-	Type  string            `json:"type"`
-	Attrs map[string]string `json:"attrs,omitempty"`
-}
-
-func (e *CacheOptionsEntry) Equal(other *CacheOptionsEntry) bool {
-	if e.Type != other.Type {
-		return false
-	}
-	return maps.Equal(e.Attrs, other.Attrs)
-}
-
-func (e *CacheOptionsEntry) String() string {
-	// Special registry syntax.
-	if e.Type == "registry" && len(e.Attrs) == 1 {
-		if ref, ok := e.Attrs["ref"]; ok {
-			return ref
-		}
-	}
-
-	var b csvBuilder
-	if e.Type != "" {
-		b.Write("type", e.Type)
-	}
-	if len(e.Attrs) > 0 {
-		b.WriteAttributes(e.Attrs)
-	}
-	return b.String()
-}
-
-func (e *CacheOptionsEntry) ToPB() *controllerapi.CacheOptionsEntry {
-	ci := &controllerapi.CacheOptionsEntry{
-		Type:  e.Type,
-		Attrs: maps.Clone(e.Attrs),
-	}
-	addGithubToken(ci)
-	addAwsCredentials(ci)
-	return ci
-}
-
-func (e *CacheOptionsEntry) MarshalJSON() ([]byte, error) {
-	m := maps.Clone(e.Attrs)
-	if m == nil {
-		m = map[string]string{}
-	}
-	m["type"] = e.Type
-	return json.Marshal(m)
-}
-
-func (e *CacheOptionsEntry) UnmarshalJSON(data []byte) error {
-	var m map[string]string
-	if err := json.Unmarshal(data, &m); err != nil {
-		return err
-	}
-
-	e.Type = m["type"]
-	delete(m, "type")
-
-	e.Attrs = m
-	return e.validate(data)
-}
-
-func (e *CacheOptionsEntry) UnmarshalText(text []byte) error {
-	in := string(text)
-	fields, err := csvvalue.Fields(in, nil)
-	if err != nil {
-		return err
-	}
-
-	if len(fields) == 1 && !strings.Contains(fields[0], "=") {
-		e.Type = "registry"
-		e.Attrs = map[string]string{"ref": fields[0]}
-		return nil
-	}
-
-	e.Type = ""
-	e.Attrs = map[string]string{}
-
-	for _, field := range fields {
-		parts := strings.SplitN(field, "=", 2)
-		if len(parts) != 2 {
-			return errors.Errorf("invalid value %s", field)
-		}
-		key := strings.ToLower(parts[0])
-		value := parts[1]
-		switch key {
-		case "type":
-			e.Type = value
-		default:
-			e.Attrs[key] = value
-		}
-	}
-
-	if e.Type == "" {
-		return errors.Errorf("type required form> %q", in)
-	}
-	return e.validate(text)
-}
-
-func (e *CacheOptionsEntry) validate(gv interface{}) error {
-	if e.Type == "" {
-		var text []byte
-		switch gv := gv.(type) {
-		case []byte:
-			text = gv
-		case string:
-			text = []byte(gv)
-		case cty.Value:
-			text, _ = jsoncty.Marshal(gv, gv.Type())
-		default:
-			text, _ = json.Marshal(gv)
-		}
-		return errors.Errorf("type required form> %q", string(text))
-	}
-	return nil
-}
-
-func ParseCacheEntry(in []string) ([]*controllerapi.CacheOptionsEntry, error) {
-	if len(in) == 0 {
-		return nil, nil
-	}
-
-	opts := make(CacheOptions, 0, len(in))
-	for _, in := range in {
-		var out CacheOptionsEntry
-		if err := out.UnmarshalText([]byte(in)); err != nil {
+		fields, err := csvvalue.Fields(in, nil)
+		if err != nil {
 			return nil, err
 		}
-		opts = append(opts, &out)
+		if isRefOnlyFormat(fields) {
+			for _, field := range fields {
+				outs = append(outs, &controllerapi.CacheOptionsEntry{
+					Type:  "registry",
+					Attrs: map[string]string{"ref": field},
+				})
+			}
+			continue
+		}
+
+		out := controllerapi.CacheOptionsEntry{
+			Attrs: map[string]string{},
+		}
+		for _, field := range fields {
+			parts := strings.SplitN(field, "=", 2)
+			if len(parts) != 2 {
+				return nil, errors.Errorf("invalid value %s", field)
+			}
+			key := strings.ToLower(parts[0])
+			value := parts[1]
+			switch key {
+			case "type":
+				out.Type = value
+			default:
+				out.Attrs[key] = value
+			}
+		}
+		if out.Type == "" {
+			return nil, errors.Errorf("type required form> %q", in)
+		}
+		if !addGithubToken(&out) {
+			continue
+		}
+		addAwsCredentials(&out)
+		outs = append(outs, &out)
 	}
-	return opts.ToPB(), nil
+	return outs, nil
 }
 
-func addGithubToken(ci *controllerapi.CacheOptionsEntry) {
+func isRefOnlyFormat(in []string) bool {
+	for _, v := range in {
+		if strings.Contains(v, "=") {
+			return false
+		}
+	}
+	return true
+}
+
+func addGithubToken(ci *controllerapi.CacheOptionsEntry) bool {
 	if ci.Type != "gha" {
-		return
+		return true
 	}
 	if _, ok := ci.Attrs["token"]; !ok {
 		if v, ok := os.LookupEnv("ACTIONS_RUNTIME_TOKEN"); ok {
@@ -197,6 +83,7 @@ func addGithubToken(ci *controllerapi.CacheOptionsEntry) {
 			ci.Attrs["url"] = v
 		}
 	}
+	return ci.Attrs["token"] != "" && ci.Attrs["url"] != ""
 }
 
 func addAwsCredentials(ci *controllerapi.CacheOptionsEntry) {
@@ -228,11 +115,3 @@ func addAwsCredentials(ci *controllerapi.CacheOptionsEntry) {
 		ci.Attrs["session_token"] = credentials.SessionToken
 	}
 }
-
-func isActive(pb *controllerapi.CacheOptionsEntry) bool {
-	// Always active if not gha.
-	if pb.Type != "gha" {
-		return true
-	}
-	return pb.Attrs["token"] != "" && pb.Attrs["url"] != ""
-}

util/buildflags/cache_cty.go

@@ -1,86 +0,0 @@
-package buildflags
-
-import (
-	"sync"
-
-	"github.com/zclconf/go-cty/cty"
-	"github.com/zclconf/go-cty/cty/convert"
-)
-
-var cacheOptionsEntryType = sync.OnceValue(func() cty.Type {
-	return cty.Map(cty.String)
-})
-
-func (o *CacheOptions) FromCtyValue(in cty.Value, p cty.Path) error {
-	got := in.Type()
-	if got.IsTupleType() || got.IsListType() {
-		return o.fromCtyValue(in, p)
-	}
-
-	want := cty.List(cacheOptionsEntryType())
-	return p.NewErrorf("%s", convert.MismatchMessage(got, want))
-}
-
-func (o *CacheOptions) fromCtyValue(in cty.Value, p cty.Path) error {
-	*o = make([]*CacheOptionsEntry, 0, in.LengthInt())
-	for elem := in.ElementIterator(); elem.Next(); {
-		_, value := elem.Element()
-
-		if isEmpty(value) {
-			continue
-		}
-
-		entry := &CacheOptionsEntry{}
-		if err := entry.FromCtyValue(value, p); err != nil {
-			return err
-		}
-		*o = append(*o, entry)
-	}
-	return nil
-}
-
-func (o CacheOptions) ToCtyValue() cty.Value {
-	if len(o) == 0 {
-		return cty.ListValEmpty(cacheOptionsEntryType())
-	}
-
-	vals := make([]cty.Value, len(o))
-	for i, entry := range o {
-		vals[i] = entry.ToCtyValue()
-	}
-	return cty.ListVal(vals)
-}
-
-func (o *CacheOptionsEntry) FromCtyValue(in cty.Value, p cty.Path) error {
-	if in.Type() == cty.String {
-		if err := o.UnmarshalText([]byte(in.AsString())); err != nil {
-			return p.NewError(err)
-		}
-		return nil
-	}
-
-	conv, err := convert.Convert(in, cty.Map(cty.String))
-	if err != nil {
-		return err
-	}
-
-	m := conv.AsValueMap()
-	if err := getAndDelete(m, "type", &o.Type); err != nil {
-		return err
-	}
-	o.Attrs = asMap(m)
-	return o.validate(in)
-}
-
-func (o *CacheOptionsEntry) ToCtyValue() cty.Value {
-	if o == nil {
-		return cty.NullVal(cty.Map(cty.String))
-	}
-
-	vals := make(map[string]cty.Value, len(o.Attrs)+1)
-	for k, v := range o.Attrs {
-		vals[k] = cty.StringVal(v)
-	}
-	vals["type"] = cty.StringVal(o.Type)
-	return cty.MapVal(vals)
-}

util/buildflags/cache_test.go

@@ -1,39 +0,0 @@
-package buildflags
-
-import (
-	"testing"
-
-	"github.com/docker/buildx/controller/pb"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCacheOptions_DerivedVars(t *testing.T) {
-	t.Setenv("ACTIONS_RUNTIME_TOKEN", "sensitive_token")
-	t.Setenv("ACTIONS_CACHE_URL", "https://cache.github.com")
-	t.Setenv("AWS_ACCESS_KEY_ID", "definitely_dont_look_here")
-	t.Setenv("AWS_SECRET_ACCESS_KEY", "hackers_please_dont_steal")
-	t.Setenv("AWS_SESSION_TOKEN", "not_a_mitm_attack")
-
-	cacheFrom, err := ParseCacheEntry([]string{"type=gha", "type=s3,region=us-west-2,bucket=my_bucket,name=my_image"})
-	require.NoError(t, err)
-	require.Equal(t, []*pb.CacheOptionsEntry{
-		{
-			Type: "gha",
-			Attrs: map[string]string{
-				"token": "sensitive_token",
-				"url":   "https://cache.github.com",
-			},
-		},
-		{
-			Type: "s3",
-			Attrs: map[string]string{
-				"region":            "us-west-2",
-				"bucket":            "my_bucket",
-				"name":              "my_image",
-				"access_key_id":     "definitely_dont_look_here",
-				"secret_access_key": "hackers_please_dont_steal",
-				"session_token":     "not_a_mitm_attack",
-			},
-		},
-	}, cacheFrom)
-}

util/buildflags/context.go

@@ -11,13 +11,8 @@ func ParseContextNames(values []string) (map[string]string, error) {
 	if len(values) == 0 {
 		return nil, nil
 	}
-
 	result := make(map[string]string, len(values))
 	for _, value := range values {
-		if value == "" {
-			continue
-		}
-
 		kv := strings.SplitN(value, "=", 2)
 		if len(kv) != 2 {
 			return nil, errors.Errorf("invalid context value: %s, expected key=value", value)

util/buildflags/entitlements.go

@@ -5,10 +5,6 @@ import "github.com/moby/buildkit/util/entitlements"
 func ParseEntitlements(in []string) ([]entitlements.Entitlement, error) {
 	out := make([]entitlements.Entitlement, 0, len(in))
 	for _, v := range in {
-		if v == "" {
-			continue
-		}
-
 		e, err := entitlements.Parse(v)
 		if err != nil {
 			return nil, err

util/buildflags/export.go

@@ -1,10 +1,7 @@
 package buildflags
 
 import (
-	"encoding/json"
-	"maps"
 	"regexp"
-	"sort"
 	"strings"
 
 	"github.com/containerd/platforms"
@@ -16,171 +13,72 @@ import (
 	"github.com/tonistiigi/go-csvvalue"
 )
 
-type Exports []*ExportEntry
-
-func (e Exports) Merge(other Exports) Exports {
-	if other == nil {
-		e.Normalize()
-		return e
-	} else if e == nil {
-		other.Normalize()
-		return other
-	}
-
-	return append(e, other...).Normalize()
-}
-
-func (e Exports) Normalize() Exports {
-	if len(e) == 0 {
-		return nil
-	}
-	return removeDupes(e)
-}
-
-func (e Exports) ToPB() []*controllerapi.ExportEntry {
-	if len(e) == 0 {
-		return nil
-	}
-
-	entries := make([]*controllerapi.ExportEntry, len(e))
-	for i, entry := range e {
-		entries[i] = entry.ToPB()
-	}
-	return entries
-}
-
-type ExportEntry struct {
-	Type        string            `json:"type"`
-	Attrs       map[string]string `json:"attrs,omitempty"`
-	Destination string            `json:"dest,omitempty"`
-}
-
-func (e *ExportEntry) Equal(other *ExportEntry) bool {
-	if e.Type != other.Type || e.Destination != other.Destination {
-		return false
-	}
-	return maps.Equal(e.Attrs, other.Attrs)
-}
-
-func (e *ExportEntry) String() string {
-	var b csvBuilder
-	if e.Type != "" {
-		b.Write("type", e.Type)
-	}
-	if e.Destination != "" {
-		b.Write("dest", e.Destination)
-	}
-	if len(e.Attrs) > 0 {
-		b.WriteAttributes(e.Attrs)
-	}
-	return b.String()
-}
-
-func (e *ExportEntry) ToPB() *controllerapi.ExportEntry {
-	return &controllerapi.ExportEntry{
-		Type:        e.Type,
-		Attrs:       maps.Clone(e.Attrs),
-		Destination: e.Destination,
-	}
-}
-
-func (e *ExportEntry) MarshalJSON() ([]byte, error) {
-	m := maps.Clone(e.Attrs)
-	if m == nil {
-		m = map[string]string{}
-	}
-	m["type"] = e.Type
-	if e.Destination != "" {
-		m["dest"] = e.Destination
-	}
-	return json.Marshal(m)
-}
-
-func (e *ExportEntry) UnmarshalJSON(data []byte) error {
-	var m map[string]string
-	if err := json.Unmarshal(data, &m); err != nil {
-		return err
-	}
-
-	e.Type = m["type"]
-	delete(m, "type")
-
-	e.Destination = m["dest"]
-	delete(m, "dest")
-
-	e.Attrs = m
-	return e.validate()
-}
-
-func (e *ExportEntry) UnmarshalText(text []byte) error {
-	s := string(text)
-	fields, err := csvvalue.Fields(s, nil)
-	if err != nil {
-		return err
-	}
-
-	// Clear the target entry.
-	e.Type = ""
-	e.Attrs = map[string]string{}
-	e.Destination = ""
-
-	if len(fields) == 1 && fields[0] == s && !strings.HasPrefix(s, "type=") {
-		if s != "-" {
-			e.Type = client.ExporterLocal
-			e.Destination = s
-			return nil
-		}
-
-		e.Type = client.ExporterTar
-		e.Destination = s
-	}
-
-	if e.Type == "" {
-		for _, field := range fields {
-			parts := strings.SplitN(field, "=", 2)
-			if len(parts) != 2 {
-				return errors.Errorf("invalid value %s", field)
-			}
-			key := strings.TrimSpace(strings.ToLower(parts[0]))
-			value := parts[1]
-			switch key {
-			case "type":
-				e.Type = value
-			case "dest":
-				e.Destination = value
-			default:
-				e.Attrs[key] = value
-			}
-		}
-	}
-	return e.validate()
-}
-
-func (e *ExportEntry) validate() error {
-	if e.Type == "" {
-		return errors.Errorf("type is required for output")
-	}
-	return nil
-}
-
 func ParseExports(inp []string) ([]*controllerapi.ExportEntry, error) {
+	var outs []*controllerapi.ExportEntry
 	if len(inp) == 0 {
 		return nil, nil
 	}
-
-	export := make(Exports, 0, len(inp))
 	for _, s := range inp {
 		if s == "" {
 			continue
 		}
-
-		var out ExportEntry
-		if err := out.UnmarshalText([]byte(s)); err != nil {
+		fields, err := csvvalue.Fields(s, nil)
+		if err != nil {
 			return nil, err
 		}
-		export = append(export, &out)
+
+		out := controllerapi.ExportEntry{
+			Attrs: map[string]string{},
+		}
+		if len(fields) == 1 && fields[0] == s && !strings.HasPrefix(s, "type=") {
+			if s != "-" {
+				outs = append(outs, &controllerapi.ExportEntry{
+					Type:        client.ExporterLocal,
+					Destination: s,
+				})
+				continue
+			}
+			out = controllerapi.ExportEntry{
+				Type:        client.ExporterTar,
+				Destination: s,
+			}
+		}
+
+		if out.Type == "" {
+			for _, field := range fields {
+				parts := strings.SplitN(field, "=", 2)
+				if len(parts) != 2 {
+					return nil, errors.Errorf("invalid value %s", field)
+				}
+				key := strings.TrimSpace(strings.ToLower(parts[0]))
+				value := parts[1]
+				switch key {
+				case "type":
+					out.Type = value
+				default:
+					out.Attrs[key] = value
+				}
+			}
+		}
+		if out.Type == "" {
+			return nil, errors.Errorf("type is required for output")
+		}
+
+		if out.Type == "registry" {
+			out.Type = client.ExporterImage
+			if _, ok := out.Attrs["push"]; !ok {
+				out.Attrs["push"] = "true"
+			}
+		}
+
+		if dest, ok := out.Attrs["dest"]; ok {
+			out.Destination = dest
+			delete(out.Attrs, "dest")
+		}
+
+		outs = append(outs, &out)
 	}
-	return export.ToPB(), nil
+	return outs, nil
 }
 
 func ParseAnnotations(inp []string) (map[exptypes.AnnotationKey]string, error) {
@@ -191,10 +89,6 @@ func ParseAnnotations(inp []string) (map[exptypes.AnnotationKey]string, error) {
 
 	annotations := make(map[exptypes.AnnotationKey]string)
 	for _, inp := range inp {
-		if inp == "" {
-			continue
-		}
-
 		k, v, ok := strings.Cut(inp, "=")
 		if !ok {
 			return nil, errors.Errorf("invalid annotation %q, expected key=value", inp)
@@ -250,32 +144,3 @@ func ParseAnnotations(inp []string) (map[exptypes.AnnotationKey]string, error) {
 	}
 	return annotations, nil
 }
-
-type csvBuilder struct {
-	sb strings.Builder
-}
-
-func (w *csvBuilder) Write(key, value string) {
-	if w.sb.Len() > 0 {
-		w.sb.WriteByte(',')
-	}
-	w.sb.WriteString(key)
-	w.sb.WriteByte('=')
-	w.sb.WriteString(value)
-}
-
-func (w *csvBuilder) WriteAttributes(attrs map[string]string) {
-	keys := make([]string, 0, len(attrs))
-	for key := range attrs {
-		keys = append(keys, key)
-	}
-	sort.Strings(keys)
-
-	for _, key := range keys {
-		w.Write(key, attrs[key])
-	}
-}
-
-func (w *csvBuilder) String() string {
-	return w.sb.String()
-}

util/buildflags/export_cty.go

@@ -1,90 +0,0 @@
-package buildflags
-
-import (
-	"sync"
-
-	"github.com/zclconf/go-cty/cty"
-	"github.com/zclconf/go-cty/cty/convert"
-)
-
-var exportEntryType = sync.OnceValue(func() cty.Type {
-	return cty.Map(cty.String)
-})
-
-func (e *Exports) FromCtyValue(in cty.Value, p cty.Path) error {
-	got := in.Type()
-	if got.IsTupleType() || got.IsListType() {
-		return e.fromCtyValue(in, p)
-	}
-
-	want := cty.List(exportEntryType())
-	return p.NewErrorf("%s", convert.MismatchMessage(got, want))
-}
-
-func (e *Exports) fromCtyValue(in cty.Value, p cty.Path) error {
-	*e = make([]*ExportEntry, 0, in.LengthInt())
-	for elem := in.ElementIterator(); elem.Next(); {
-		_, value := elem.Element()
-
-		if isEmpty(value) {
-			continue
-		}
-
-		entry := &ExportEntry{}
-		if err := entry.FromCtyValue(value, p); err != nil {
-			return err
-		}
-		*e = append(*e, entry)
-	}
-	return nil
-}
-
-func (e Exports) ToCtyValue() cty.Value {
-	if len(e) == 0 {
-		return cty.ListValEmpty(exportEntryType())
-	}
-
-	vals := make([]cty.Value, len(e))
-	for i, entry := range e {
-		vals[i] = entry.ToCtyValue()
-	}
-	return cty.ListVal(vals)
-}
-
-func (e *ExportEntry) FromCtyValue(in cty.Value, p cty.Path) error {
-	if in.Type() == cty.String {
-		if err := e.UnmarshalText([]byte(in.AsString())); err != nil {
-			return p.NewError(err)
-		}
-		return nil
-	}
-
-	conv, err := convert.Convert(in, cty.Map(cty.String))
-	if err != nil {
-		return err
-	}
-
-	m := conv.AsValueMap()
-	if err := getAndDelete(m, "type", &e.Type); err != nil {
-		return err
-	}
-	if err := getAndDelete(m, "dest", &e.Destination); err != nil {
-		return err
-	}
-	e.Attrs = asMap(m)
-	return e.validate()
-}
-
-func (e *ExportEntry) ToCtyValue() cty.Value {
-	if e == nil {
-		return cty.NullVal(cty.Map(cty.String))
-	}
-
-	vals := make(map[string]cty.Value, len(e.Attrs)+2)
-	for k, v := range e.Attrs {
-		vals[k] = cty.StringVal(v)
-	}
-	vals["type"] = cty.StringVal(e.Type)
-	vals["dest"] = cty.StringVal(e.Destination)
-	return cty.MapVal(vals)
-}

util/buildflags/secrets.go

@@ -8,120 +8,12 @@ import (
 	"github.com/tonistiigi/go-csvvalue"
 )
 
-type Secrets []*Secret
-
-func (s Secrets) Merge(other Secrets) Secrets {
-	if other == nil {
-		s.Normalize()
-		return s
-	} else if s == nil {
-		other.Normalize()
-		return other
-	}
-
-	return append(s, other...).Normalize()
-}
-
-func (s Secrets) Normalize() Secrets {
-	if len(s) == 0 {
-		return nil
-	}
-	return removeDupes(s)
-}
-
-func (s Secrets) ToPB() []*controllerapi.Secret {
-	if len(s) == 0 {
-		return nil
-	}
-
-	entries := make([]*controllerapi.Secret, len(s))
-	for i, entry := range s {
-		entries[i] = entry.ToPB()
-	}
-	return entries
-}
-
-type Secret struct {
-	ID       string `json:"id,omitempty"`
-	FilePath string `json:"src,omitempty"`
-	Env      string `json:"env,omitempty"`
-}
-
-func (s *Secret) Equal(other *Secret) bool {
-	return s.ID == other.ID && s.FilePath == other.FilePath && s.Env == other.Env
-}
-
-func (s *Secret) String() string {
-	var b csvBuilder
-	if s.ID != "" {
-		b.Write("id", s.ID)
-	}
-	if s.FilePath != "" {
-		b.Write("src", s.FilePath)
-	}
-	if s.Env != "" {
-		b.Write("env", s.Env)
-	}
-	return b.String()
-}
-
-func (s *Secret) ToPB() *controllerapi.Secret {
-	return &controllerapi.Secret{
-		ID:       s.ID,
-		FilePath: s.FilePath,
-		Env:      s.Env,
-	}
-}
-
-func (s *Secret) UnmarshalText(text []byte) error {
-	value := string(text)
-	fields, err := csvvalue.Fields(value, nil)
-	if err != nil {
-		return errors.Wrap(err, "failed to parse csv secret")
-	}
-
-	*s = Secret{}
-
-	var typ string
-	for _, field := range fields {
-		parts := strings.SplitN(field, "=", 2)
-		key := strings.ToLower(parts[0])
-
-		if len(parts) != 2 {
-			return errors.Errorf("invalid field '%s' must be a key=value pair", field)
-		}
-
-		value := parts[1]
-		switch key {
-		case "type":
-			if value != "file" && value != "env" {
-				return errors.Errorf("unsupported secret type %q", value)
-			}
-			typ = value
-		case "id":
-			s.ID = value
-		case "source", "src":
-			s.FilePath = value
-		case "env":
-			s.Env = value
-		default:
-			return errors.Errorf("unexpected key '%s' in '%s'", key, field)
-		}
-	}
-	if typ == "env" && s.Env == "" {
-		s.Env = s.FilePath
-		s.FilePath = ""
-	}
-	return nil
-}
-
 func ParseSecretSpecs(sl []string) ([]*controllerapi.Secret, error) {
 	fs := make([]*controllerapi.Secret, 0, len(sl))
 	for _, v := range sl {
 		if v == "" {
 			continue
 		}
-
 		s, err := parseSecret(v)
 		if err != nil {
 			return nil, err
@@ -132,9 +24,42 @@ func ParseSecretSpecs(sl []string) ([]*controllerapi.Secret, error) {
 }
 
 func parseSecret(value string) (*controllerapi.Secret, error) {
-	var s Secret
-	if err := s.UnmarshalText([]byte(value)); err != nil {
-		return nil, err
+	fields, err := csvvalue.Fields(value, nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to parse csv secret")
 	}
-	return s.ToPB(), nil
+
+	fs := controllerapi.Secret{}
+
+	var typ string
+	for _, field := range fields {
+		parts := strings.SplitN(field, "=", 2)
+		key := strings.ToLower(parts[0])
+
+		if len(parts) != 2 {
+			return nil, errors.Errorf("invalid field '%s' must be a key=value pair", field)
+		}
+
+		value := parts[1]
+		switch key {
+		case "type":
+			if value != "file" && value != "env" {
+				return nil, errors.Errorf("unsupported secret type %q", value)
+			}
+			typ = value
+		case "id":
+			fs.ID = value
+		case "source", "src":
+			fs.FilePath = value
+		case "env":
+			fs.Env = value
+		default:
+			return nil, errors.Errorf("unexpected key '%s' in '%s'", key, field)
+		}
+	}
+	if typ == "env" && fs.Env == "" {
+		fs.Env = fs.FilePath
+		fs.FilePath = ""
+	}
+	return &fs, nil
 }

util/buildflags/secrets_cty.go

@@ -1,96 +0,0 @@
-package buildflags
-
-import (
-	"sync"
-
-	"github.com/zclconf/go-cty/cty"
-	"github.com/zclconf/go-cty/cty/convert"
-)
-
-var secretType = sync.OnceValue(func() cty.Type {
-	return cty.ObjectWithOptionalAttrs(
-		map[string]cty.Type{
-			"id":  cty.String,
-			"src": cty.String,
-			"env": cty.String,
-		},
-		[]string{"id", "src", "env"},
-	)
-})
-
-func (s *Secrets) FromCtyValue(in cty.Value, p cty.Path) error {
-	got := in.Type()
-	if got.IsTupleType() || got.IsListType() {
-		return s.fromCtyValue(in, p)
-	}
-
-	want := cty.List(secretType())
-	return p.NewErrorf("%s", convert.MismatchMessage(got, want))
-}
-
-func (s *Secrets) fromCtyValue(in cty.Value, p cty.Path) error {
-	*s = make([]*Secret, 0, in.LengthInt())
-	for elem := in.ElementIterator(); elem.Next(); {
-		_, value := elem.Element()
-
-		if isEmpty(value) {
-			continue
-		}
-
-		entry := &Secret{}
-		if err := entry.FromCtyValue(value, p); err != nil {
-			return err
-		}
-		*s = append(*s, entry)
-	}
-	return nil
-}
-
-func (s Secrets) ToCtyValue() cty.Value {
-	if len(s) == 0 {
-		return cty.ListValEmpty(secretType())
-	}
-
-	vals := make([]cty.Value, len(s))
-	for i, entry := range s {
-		vals[i] = entry.ToCtyValue()
-	}
-	return cty.ListVal(vals)
-}
-
-func (e *Secret) FromCtyValue(in cty.Value, p cty.Path) error {
-	if in.Type() == cty.String {
-		if err := e.UnmarshalText([]byte(in.AsString())); err != nil {
-			return p.NewError(err)
-		}
-		return nil
-	}
-
-	conv, err := convert.Convert(in, secretType())
-	if err != nil {
-		return err
-	}
-
-	if id := conv.GetAttr("id"); !id.IsNull() {
-		e.ID = id.AsString()
-	}
-	if src := conv.GetAttr("src"); !src.IsNull() {
-		e.FilePath = src.AsString()
-	}
-	if env := conv.GetAttr("env"); !env.IsNull() {
-		e.Env = env.AsString()
-	}
-	return nil
-}
-
-func (e *Secret) ToCtyValue() cty.Value {
-	if e == nil {
-		return cty.NullVal(secretType())
-	}
-
-	return cty.ObjectVal(map[string]cty.Value{
-		"id":  cty.StringVal(e.ID),
-		"src": cty.StringVal(e.FilePath),
-		"env": cty.StringVal(e.Env),
-	})
-}

util/buildflags/ssh.go

@@ -1,93 +1,12 @@
 package buildflags
 
 import (
-	"cmp"
-	"slices"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/moby/buildkit/util/gitutil"
 )
 
-type SSHKeys []*SSH
-
-func (s SSHKeys) Merge(other SSHKeys) SSHKeys {
-	if other == nil {
-		s.Normalize()
-		return s
-	} else if s == nil {
-		other.Normalize()
-		return other
-	}
-
-	return append(s, other...).Normalize()
-}
-
-func (s SSHKeys) Normalize() SSHKeys {
-	if len(s) == 0 {
-		return nil
-	}
-	return removeDupes(s)
-}
-
-func (s SSHKeys) ToPB() []*controllerapi.SSH {
-	if len(s) == 0 {
-		return nil
-	}
-
-	entries := make([]*controllerapi.SSH, len(s))
-	for i, entry := range s {
-		entries[i] = entry.ToPB()
-	}
-	return entries
-}
-
-type SSH struct {
-	ID    string   `json:"id,omitempty" cty:"id"`
-	Paths []string `json:"paths,omitempty" cty:"paths"`
-}
-
-func (s *SSH) Equal(other *SSH) bool {
-	return s.Less(other) == 0
-}
-
-func (s *SSH) Less(other *SSH) int {
-	if s.ID != other.ID {
-		return cmp.Compare(s.ID, other.ID)
-	}
-	return slices.Compare(s.Paths, other.Paths)
-}
-
-func (s *SSH) String() string {
-	if len(s.Paths) == 0 {
-		return s.ID
-	}
-
-	var b csvBuilder
-	paths := strings.Join(s.Paths, ",")
-	b.Write(s.ID, paths)
-	return b.String()
-}
-
-func (s *SSH) ToPB() *controllerapi.SSH {
-	return &controllerapi.SSH{
-		ID:    s.ID,
-		Paths: s.Paths,
-	}
-}
-
-func (s *SSH) UnmarshalText(text []byte) error {
-	parts := strings.SplitN(string(text), "=", 2)
-
-	s.ID = parts[0]
-	if len(parts) > 1 {
-		s.Paths = strings.Split(parts[1], ",")
-	} else {
-		s.Paths = nil
-	}
-	return nil
-}
-
 func ParseSSHSpecs(sl []string) ([]*controllerapi.SSH, error) {
 	var outs []*controllerapi.SSH
 	if len(sl) == 0 {
@@ -98,12 +17,14 @@ func ParseSSHSpecs(sl []string) ([]*controllerapi.SSH, error) {
 		if s == "" {
 			continue
 		}
-
-		var out SSH
-		if err := out.UnmarshalText([]byte(s)); err != nil {
-			return nil, err
+		parts := strings.SplitN(s, "=", 2)
+		out := controllerapi.SSH{
+			ID: parts[0],
 		}
-		outs = append(outs, out.ToPB())
+		if len(parts) > 1 {
+			out.Paths = strings.Split(parts[1], ",")
+		}
+		outs = append(outs, &out)
 	}
 	return outs, nil
 }

util/buildflags/ssh_cty.go

@@ -1,105 +0,0 @@
-package buildflags
-
-import (
-	"sync"
-
-	"github.com/zclconf/go-cty/cty"
-	"github.com/zclconf/go-cty/cty/convert"
-	"github.com/zclconf/go-cty/cty/gocty"
-)
-
-var sshType = sync.OnceValue(func() cty.Type {
-	return cty.ObjectWithOptionalAttrs(
-		map[string]cty.Type{
-			"id":    cty.String,
-			"paths": cty.List(cty.String),
-		},
-		[]string{"id", "paths"},
-	)
-})
-
-func (s *SSHKeys) FromCtyValue(in cty.Value, p cty.Path) error {
-	got := in.Type()
-	if got.IsTupleType() || got.IsListType() {
-		return s.fromCtyValue(in, p)
-	}
-
-	want := cty.List(sshType())
-	return p.NewErrorf("%s", convert.MismatchMessage(got, want))
-}
-
-func (s *SSHKeys) fromCtyValue(in cty.Value, p cty.Path) error {
-	*s = make([]*SSH, 0, in.LengthInt())
-	for elem := in.ElementIterator(); elem.Next(); {
-		_, value := elem.Element()
-
-		if isEmpty(value) {
-			continue
-		}
-
-		entry := &SSH{}
-		if err := entry.FromCtyValue(value, p); err != nil {
-			return err
-		}
-		*s = append(*s, entry)
-	}
-	return nil
-}
-
-func (s SSHKeys) ToCtyValue() cty.Value {
-	if len(s) == 0 {
-		return cty.ListValEmpty(sshType())
-	}
-
-	vals := make([]cty.Value, len(s))
-	for i, entry := range s {
-		vals[i] = entry.ToCtyValue()
-	}
-	return cty.ListVal(vals)
-}
-
-func (e *SSH) FromCtyValue(in cty.Value, p cty.Path) error {
-	if in.Type() == cty.String {
-		if err := e.UnmarshalText([]byte(in.AsString())); err != nil {
-			return p.NewError(err)
-		}
-		return nil
-	}
-
-	conv, err := convert.Convert(in, sshType())
-	if err != nil {
-		return err
-	}
-
-	if id := conv.GetAttr("id"); !id.IsNull() {
-		e.ID = id.AsString()
-	}
-	if paths := conv.GetAttr("paths"); !paths.IsNull() {
-		if err := gocty.FromCtyValue(paths, &e.Paths); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (e *SSH) ToCtyValue() cty.Value {
-	if e == nil {
-		return cty.NullVal(sshType())
-	}
-
-	var ctyPaths cty.Value
-	if len(e.Paths) > 0 {
-		paths := make([]cty.Value, len(e.Paths))
-		for i, path := range e.Paths {
-			paths[i] = cty.StringVal(path)
-		}
-		ctyPaths = cty.ListVal(paths)
-	} else {
-		ctyPaths = cty.ListValEmpty(cty.String)
-	}
-
-	return cty.ObjectVal(map[string]cty.Value{
-		"id":    cty.StringVal(e.ID),
-		"paths": ctyPaths,
-	})
-}

util/buildflags/utils.go

@@ -1,54 +0,0 @@
-package buildflags
-
-import (
-	"github.com/zclconf/go-cty/cty"
-	"github.com/zclconf/go-cty/cty/gocty"
-)
-
-type comparable[E any] interface {
-	Equal(other E) bool
-}
-
-func removeDupes[E comparable[E]](s []E) []E {
-	// Move backwards through the slice.
-	// For each element, any elements after the current element are unique.
-	// If we find our current element conflicts with an existing element,
-	// then we swap the offender with the end of the slice and chop it off.
-
-	// Start at the second to last element.
-	// The last element is always unique.
-	for i := len(s) - 2; i >= 0; i-- {
-		elem := s[i]
-		// Check for duplicates after our current element.
-		for j := i + 1; j < len(s); j++ {
-			if elem.Equal(s[j]) {
-				// Found a duplicate, exchange the
-				// duplicate with the last element.
-				s[j], s[len(s)-1] = s[len(s)-1], s[j]
-				s = s[:len(s)-1]
-				break
-			}
-		}
-	}
-	return s
-}
-
-func getAndDelete(m map[string]cty.Value, attr string, gv interface{}) error {
-	if v, ok := m[attr]; ok {
-		delete(m, attr)
-		return gocty.FromCtyValue(v, gv)
-	}
-	return nil
-}
-
-func asMap(m map[string]cty.Value) map[string]string {
-	out := make(map[string]string, len(m))
-	for k, v := range m {
-		out[k] = v.AsString()
-	}
-	return out
-}
-
-func isEmpty(v cty.Value) bool {
-	return v.Type() == cty.String && v.AsString() == ""
-}

util/confutil/config.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/docker/pkg/ioutils"
-	"github.com/moby/buildkit/cmd/buildkitd/config"
 	"github.com/pelletier/go-toml"
 	"github.com/pkg/errors"
 	fs "github.com/tonistiigi/fsutil/copy"
@@ -152,11 +151,7 @@ func LoadConfigTree(fp string) (*toml.Tree, error) {
 	defer f.Close()
 	t, err := toml.LoadReader(f)
 	if err != nil {
-		return t, errors.Wrap(err, "failed to parse buildkit config")
-	}
-	var bkcfg config.Config
-	if err = t.Unmarshal(&bkcfg); err != nil {
-		return t, errors.Wrap(err, "failed to parse buildkit config")
+		return t, errors.Wrap(err, "failed to parse config")
 	}
 	return t, nil
 }

util/dockerutil/progress.go

@@ -55,21 +55,19 @@ func fromReader(l progress.SubLogger, rc io.ReadCloser) error {
 				Started: &now,
 			}
 		}
+		timeDelta := time.Since(st.Timestamp)
+		if timeDelta < minTimeDelta {
+			continue
+		}
+		st.Timestamp = time.Now()
 		if jm.Status == "Loading layer" {
 			st.Current = jm.Progress.Current
 			st.Total = jm.Progress.Total
 		}
-		now := time.Now()
 		if jm.Error != nil {
+			now := time.Now()
 			st.Completed = &now
-		} else {
-			timeDelta := time.Since(st.Timestamp)
-			if timeDelta < minTimeDelta {
-				started[id] = st
-				continue
-			}
 		}
-		st.Timestamp = now
 		started[id] = st
 		l.SetStatus(&st)
 	}

util/imagetools/create.go

@@ -8,9 +8,9 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/containerd/containerd/v2/core/content"
-	"github.com/containerd/containerd/v2/core/images"
-	"github.com/containerd/containerd/v2/core/remotes"
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/remotes"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/platforms"
 	"github.com/distribution/reference"

util/imagetools/imagetools_helpers_test.go

@@ -8,7 +8,7 @@ import (
 	"io"
 	"strings"
 
-	"github.com/containerd/containerd/v2/core/remotes"
+	"github.com/containerd/containerd/remotes"
 	intoto "github.com/in-toto/in-toto-golang/in_toto"
 	slsa02 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
 	"github.com/opencontainers/go-digest"

util/imagetools/inspect.go

@@ -8,8 +8,8 @@ import (
 	"io"
 	"net/http"
 
-	"github.com/containerd/containerd/v2/core/remotes"
-	"github.com/containerd/containerd/v2/core/remotes/docker"
+	"github.com/containerd/containerd/remotes"
+	"github.com/containerd/containerd/remotes/docker"
 	"github.com/containerd/log"
 	"github.com/distribution/reference"
 	"github.com/docker/buildx/util/resolver"

util/imagetools/loader.go

@@ -11,9 +11,9 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/containerd/containerd/v2/core/content"
-	"github.com/containerd/containerd/v2/core/images"
-	"github.com/containerd/containerd/v2/core/remotes"
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/remotes"
 	"github.com/containerd/platforms"
 	"github.com/distribution/reference"
 	intoto "github.com/in-toto/in-toto-golang/in_toto"

util/imagetools/printers.go

@@ -10,7 +10,7 @@ import (
 	"text/tabwriter"
 	"text/template"
 
-	"github.com/containerd/containerd/v2/core/images"
+	"github.com/containerd/containerd/images"
 	"github.com/containerd/platforms"
 	"github.com/distribution/reference"
 	"github.com/opencontainers/go-digest"

util/resolver/resolver.go

@@ -8,7 +8,7 @@ import (
 	"runtime"
 	"time"
 
-	"github.com/containerd/containerd/v2/core/remotes/docker"
+	"github.com/containerd/containerd/remotes/docker"
 	"github.com/moby/buildkit/util/tracing"
 	"github.com/pkg/errors"
 )

vendor/github.com/AdaLogics/go-fuzz-headers/consumer.go

@@ -48,7 +48,6 @@ type ConsumeFuzzer struct {
 	NumberOfCalls        int
 	position             uint32
 	fuzzUnexportedFields bool
-	forceUTF8Strings     bool
 	curDepth             int
 	Funcs                map[reflect.Type]reflect.Value
 }
@@ -105,14 +104,6 @@ func (f *ConsumeFuzzer) DisallowUnexportedFields() {
 	f.fuzzUnexportedFields = false
 }
 
-func (f *ConsumeFuzzer) AllowNonUTF8Strings() {
-	f.forceUTF8Strings = false
-}
-
-func (f *ConsumeFuzzer) DisallowNonUTF8Strings() {
-	f.forceUTF8Strings = true
-}
-
 func (f *ConsumeFuzzer) GenerateStruct(targetStruct interface{}) error {
 	e := reflect.ValueOf(targetStruct).Elem()
 	return f.fuzzStruct(e, false)
@@ -233,14 +224,6 @@ func (f *ConsumeFuzzer) fuzzStruct(e reflect.Value, customFunctions bool) error
 		if e.CanSet() {
 			e.Set(uu)
 		}
-	case reflect.Uint:
-		newInt, err := f.GetUint()
-		if err != nil {
-			return err
-		}
-		if e.CanSet() {
-			e.SetUint(uint64(newInt))
-		}
 	case reflect.Uint16:
 		newInt, err := f.GetUint16()
 		if err != nil {
@@ -326,14 +309,6 @@ func (f *ConsumeFuzzer) fuzzStruct(e reflect.Value, customFunctions bool) error
 		if e.CanSet() {
 			e.SetUint(uint64(b))
 		}
-	case reflect.Bool:
-		b, err := f.GetBool()
-		if err != nil {
-			return err
-		}
-		if e.CanSet() {
-			e.SetBool(b)
-		}
 	}
 	return nil
 }
@@ -435,23 +410,6 @@ func (f *ConsumeFuzzer) GetUint64() (uint64, error) {
 	return binary.BigEndian.Uint64(u64), nil
 }
 
-func (f *ConsumeFuzzer) GetUint() (uint, error) {
-	var zero uint
-	size := int(unsafe.Sizeof(zero))
-	if size == 8 {
-		u64, err := f.GetUint64()
-		if err != nil {
-			return 0, err
-		}
-		return uint(u64), nil
-	}
-	u32, err := f.GetUint32()
-	if err != nil {
-		return 0, err
-	}
-	return uint(u32), nil
-}
-
 func (f *ConsumeFuzzer) GetBytes() ([]byte, error) {
 	var length uint32
 	var err error
@@ -503,11 +461,7 @@ func (f *ConsumeFuzzer) GetString() (string, error) {
 		return "nil", errors.New("numbers overflow")
 	}
 	f.position = byteBegin + length
-	s := string(f.data[byteBegin:f.position])
-	if f.forceUTF8Strings {
-		s = strings.ToValidUTF8(s, "")
-	}
-	return s, nil
+	return string(f.data[byteBegin:f.position]), nil
 }
 
 func (f *ConsumeFuzzer) GetBool() (bool, error) {

vendor/github.com/aws/aws-sdk-go-v2/aws/accountid_endpoint_mode.go

@@ -1,18 +0,0 @@
-package aws
-
-// AccountIDEndpointMode controls how a resolved AWS account ID is handled for endpoint routing.
-type AccountIDEndpointMode string
-
-const (
-	// AccountIDEndpointModeUnset indicates the AWS account ID will not be used for endpoint routing
-	AccountIDEndpointModeUnset AccountIDEndpointMode = ""
-
-	// AccountIDEndpointModePreferred indicates the AWS account ID will be used for endpoint routing if present
-	AccountIDEndpointModePreferred = "preferred"
-
-	// AccountIDEndpointModeRequired indicates an error will be returned if the AWS account ID is not resolved from identity
-	AccountIDEndpointModeRequired = "required"
-
-	// AccountIDEndpointModeDisabled indicates the AWS account ID will be ignored during endpoint routing
-	AccountIDEndpointModeDisabled = "disabled"
-)

vendor/github.com/aws/aws-sdk-go-v2/aws/config.go

@@ -162,9 +162,6 @@ type Config struct {
 	// This variable is sourced from environment variable AWS_REQUEST_MIN_COMPRESSION_SIZE_BYTES or
 	// the shared config profile attribute request_min_compression_size_bytes
 	RequestMinCompressSizeBytes int64
-
-	// Controls how a resolved AWS account ID is handled for endpoint routing.
-	AccountIDEndpointMode AccountIDEndpointMode
 }
 
 // NewConfig returns a new Config pointer that can be chained with builder

vendor/github.com/aws/aws-sdk-go-v2/aws/credentials.go

@@ -90,9 +90,6 @@ type Credentials struct {
 	// The time the credentials will expire at. Should be ignored if CanExpire
 	// is false.
 	Expires time.Time
-
-	// The ID of the account for the credentials.
-	AccountID string
 }
 
 // Expired returns if the credentials have expired.

vendor/github.com/aws/aws-sdk-go-v2/aws/endpoints.go

@@ -70,10 +70,6 @@ func GetUseFIPSEndpoint(options ...interface{}) (value FIPSEndpointState, found
 // The SDK will automatically resolve these endpoints per API client using an
 // internal endpoint resolvers. If you'd like to provide custom endpoint
 // resolving behavior you can implement the EndpointResolver interface.
-//
-// Deprecated: This structure was used with the global [EndpointResolver]
-// interface, which has been deprecated in favor of service-specific endpoint
-// resolution. See the deprecation docs on that interface for more information.
 type Endpoint struct {
 	// The base URL endpoint the SDK API clients will use to make API calls to.
 	// The SDK will suffix URI path and query elements to this endpoint.
@@ -128,8 +124,6 @@ type Endpoint struct {
 }
 
 // EndpointSource is the endpoint source type.
-//
-// Deprecated: The global [Endpoint] structure is deprecated.
 type EndpointSource int
 
 const (
@@ -167,25 +161,19 @@ func (e *EndpointNotFoundError) Unwrap() error {
 // API clients will fallback to attempting to resolve the endpoint using its
 // internal default endpoint resolver.
 //
-// Deprecated: The global endpoint resolution interface is deprecated. The API
-// for endpoint resolution is now unique to each service and is set via the
-// EndpointResolverV2 field on service client options. Setting a value for
-// EndpointResolver on aws.Config or service client options will prevent you
-// from using any endpoint-related service features released after the
-// introduction of EndpointResolverV2. You may also encounter broken or
-// unexpected behavior when using the old global interface with services that
-// use many endpoint-related customizations such as S3.
+// Deprecated: See EndpointResolverWithOptions
 type EndpointResolver interface {
 	ResolveEndpoint(service, region string) (Endpoint, error)
 }
 
 // EndpointResolverFunc wraps a function to satisfy the EndpointResolver interface.
 //
-// Deprecated: The global endpoint resolution interface is deprecated. See
-// deprecation docs on [EndpointResolver].
+// Deprecated: See EndpointResolverWithOptionsFunc
 type EndpointResolverFunc func(service, region string) (Endpoint, error)
 
 // ResolveEndpoint calls the wrapped function and returns the results.
+//
+// Deprecated: See EndpointResolverWithOptions.ResolveEndpoint
 func (e EndpointResolverFunc) ResolveEndpoint(service, region string) (Endpoint, error) {
 	return e(service, region)
 }
@@ -196,17 +184,11 @@ func (e EndpointResolverFunc) ResolveEndpoint(service, region string) (Endpoint,
 // available. If the EndpointResolverWithOptions returns an EndpointNotFoundError error,
 // API clients will fallback to attempting to resolve the endpoint using its
 // internal default endpoint resolver.
-//
-// Deprecated: The global endpoint resolution interface is deprecated. See
-// deprecation docs on [EndpointResolver].
 type EndpointResolverWithOptions interface {
 	ResolveEndpoint(service, region string, options ...interface{}) (Endpoint, error)
 }
 
 // EndpointResolverWithOptionsFunc wraps a function to satisfy the EndpointResolverWithOptions interface.
-//
-// Deprecated: The global endpoint resolution interface is deprecated. See
-// deprecation docs on [EndpointResolver].
 type EndpointResolverWithOptionsFunc func(service, region string, options ...interface{}) (Endpoint, error)
 
 // ResolveEndpoint calls the wrapped function and returns the results.

vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go

@@ -3,4 +3,4 @@
 package aws
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.30.3"
+const goModuleVersion = "1.24.1"

vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/middleware.go

@@ -139,16 +139,16 @@ func AddRecordResponseTiming(stack *middleware.Stack) error {
 // raw response within the response metadata.
 type rawResponseKey struct{}
 
-// AddRawResponse middleware adds raw response on to the metadata
-type AddRawResponse struct{}
+// addRawResponse middleware adds raw response on to the metadata
+type addRawResponse struct{}
 
 // ID the identifier for the ClientRequestID
-func (m *AddRawResponse) ID() string {
+func (m *addRawResponse) ID() string {
 	return "AddRawResponseToMetadata"
 }
 
 // HandleDeserialize adds raw response on the middleware metadata
-func (m AddRawResponse) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
+func (m addRawResponse) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
 	out middleware.DeserializeOutput, metadata middleware.Metadata, err error,
 ) {
 	out, metadata, err = next.HandleDeserialize(ctx, in)
@@ -159,7 +159,7 @@ func (m AddRawResponse) HandleDeserialize(ctx context.Context, in middleware.Des
 // AddRawResponseToMetadata adds middleware to the middleware stack that
 // store raw response on to the metadata.
 func AddRawResponseToMetadata(stack *middleware.Stack) error {
-	return stack.Deserialize.Add(&AddRawResponse{}, middleware.Before)
+	return stack.Deserialize.Add(&addRawResponse{}, middleware.Before)
 }
 
 // GetRawResponse returns raw response set on metadata

vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/private/metrics/metrics.go

@@ -112,8 +112,6 @@ type MetricData struct {
 	ResolveEndpointStartTime   time.Time
 	ResolveEndpointEndTime     time.Time
 	EndpointResolutionDuration time.Duration
-	GetIdentityStartTime       time.Time
-	GetIdentityEndTime         time.Time
 	InThroughput               float64
 	OutThroughput              float64
 	RetryCount                 int
@@ -124,7 +122,6 @@ type MetricData struct {
 	OperationName              string
 	PartitionID                string
 	Region                     string
-	UserAgent                  string
 	RequestContentLength       int64
 	Stream                     StreamMetrics
 	Attempts                   []AttemptMetrics
@@ -147,6 +144,8 @@ type AttemptMetrics struct {
 	ConnRequestedTime          time.Time
 	ConnObtainedTime           time.Time
 	ConcurrencyAcquireDuration time.Duration
+	CredentialFetchStartTime   time.Time
+	CredentialFetchEndTime     time.Time
 	SignStartTime              time.Time
 	SignEndTime                time.Time
 	SigningDuration            time.Duration

vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/request_id_retriever.go

@@ -11,22 +11,18 @@ import (
 func AddRequestIDRetrieverMiddleware(stack *middleware.Stack) error {
 	// add error wrapper middleware before operation deserializers so that it can wrap the error response
 	// returned by operation deserializers
-	return stack.Deserialize.Insert(&RequestIDRetriever{}, "OperationDeserializer", middleware.Before)
+	return stack.Deserialize.Insert(&requestIDRetriever{}, "OperationDeserializer", middleware.Before)
 }
 
-// RequestIDRetriever middleware captures the AWS service request ID from the
-// raw response.
-type RequestIDRetriever struct {
+type requestIDRetriever struct {
 }
 
 // ID returns the middleware identifier
-func (m *RequestIDRetriever) ID() string {
+func (m *requestIDRetriever) ID() string {
 	return "RequestIDRetriever"
 }
 
-// HandleDeserialize pulls the AWS request ID from the response, storing it in
-// operation metadata.
-func (m *RequestIDRetriever) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
+func (m *requestIDRetriever) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
 	out middleware.DeserializeOutput, metadata middleware.Metadata, err error,
 ) {
 	out, metadata, err = next.HandleDeserialize(ctx, in)

vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/user_agent.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"os"
 	"runtime"
-	"sort"
 	"strings"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
@@ -31,7 +30,6 @@ const (
 	FrameworkMetadata
 	AdditionalMetadata
 	ApplicationIdentifier
-	FeatureMetadata2
 )
 
 func (k SDKAgentKeyType) string() string {
@@ -52,8 +50,6 @@ func (k SDKAgentKeyType) string() string {
 		return "lib"
 	case ApplicationIdentifier:
 		return "app"
-	case FeatureMetadata2:
-		return "m"
 	case AdditionalMetadata:
 		fallthrough
 	default:
@@ -68,32 +64,12 @@ var validChars = map[rune]bool{
 	'-': true, '.': true, '^': true, '_': true, '`': true, '|': true, '~': true,
 }
 
-// UserAgentFeature enumerates tracked SDK features.
-type UserAgentFeature string
-
-// Enumerates UserAgentFeature.
-const (
-	UserAgentFeatureResourceModel          UserAgentFeature = "A" // n/a (we don't generate separate resource types)
-	UserAgentFeatureWaiter                                  = "B"
-	UserAgentFeaturePaginator                               = "C"
-	UserAgentFeatureRetryModeLegacy                         = "D" // n/a (equivalent to standard)
-	UserAgentFeatureRetryModeStandard                       = "E"
-	UserAgentFeatureRetryModeAdaptive                       = "F"
-	UserAgentFeatureS3Transfer                              = "G"
-	UserAgentFeatureS3CryptoV1N                             = "H" // n/a (crypto client is external)
-	UserAgentFeatureS3CryptoV2                              = "I" // n/a
-	UserAgentFeatureS3ExpressBucket                         = "J"
-	UserAgentFeatureS3AccessGrants                          = "K" // not yet implemented
-	UserAgentFeatureGZIPRequestCompression                  = "L"
-)
-
-// RequestUserAgent is a build middleware that set the User-Agent for the request.
-type RequestUserAgent struct {
+// requestUserAgent is a build middleware that set the User-Agent for the request.
+type requestUserAgent struct {
 	sdkAgent, userAgent *smithyhttp.UserAgentBuilder
-	features            map[UserAgentFeature]struct{}
 }
 
-// NewRequestUserAgent returns a new requestUserAgent which will set the User-Agent and X-Amz-User-Agent for the
+// newRequestUserAgent returns a new requestUserAgent which will set the User-Agent and X-Amz-User-Agent for the
 // request.
 //
 // User-Agent example:
@@ -103,15 +79,14 @@ type RequestUserAgent struct {
 // X-Amz-User-Agent example:
 //
 //	aws-sdk-go-v2/1.2.3 md/GOOS/linux md/GOARCH/amd64 lang/go/1.15
-func NewRequestUserAgent() *RequestUserAgent {
+func newRequestUserAgent() *requestUserAgent {
 	userAgent, sdkAgent := smithyhttp.NewUserAgentBuilder(), smithyhttp.NewUserAgentBuilder()
 	addProductName(userAgent)
 	addProductName(sdkAgent)
 
-	r := &RequestUserAgent{
+	r := &requestUserAgent{
 		sdkAgent:  sdkAgent,
 		userAgent: userAgent,
-		features:  map[UserAgentFeature]struct{}{},
 	}
 
 	addSDKMetadata(r)
@@ -119,7 +94,7 @@ func NewRequestUserAgent() *RequestUserAgent {
 	return r
 }
 
-func addSDKMetadata(r *RequestUserAgent) {
+func addSDKMetadata(r *requestUserAgent) {
 	r.AddSDKAgentKey(OperatingSystemMetadata, getNormalizedOSName())
 	r.AddSDKAgentKeyValue(LanguageMetadata, "go", languageVersion)
 	r.AddSDKAgentKeyValue(AdditionalMetadata, "GOOS", runtime.GOOS)
@@ -187,18 +162,18 @@ func AddRequestUserAgentMiddleware(stack *middleware.Stack) error {
 	return err
 }
 
-func getOrAddRequestUserAgent(stack *middleware.Stack) (*RequestUserAgent, error) {
-	id := (*RequestUserAgent)(nil).ID()
+func getOrAddRequestUserAgent(stack *middleware.Stack) (*requestUserAgent, error) {
+	id := (*requestUserAgent)(nil).ID()
 	bm, ok := stack.Build.Get(id)
 	if !ok {
-		bm = NewRequestUserAgent()
+		bm = newRequestUserAgent()
 		err := stack.Build.Add(bm, middleware.After)
 		if err != nil {
 			return nil, err
 		}
 	}
 
-	requestUserAgent, ok := bm.(*RequestUserAgent)
+	requestUserAgent, ok := bm.(*requestUserAgent)
 	if !ok {
 		return nil, fmt.Errorf("%T for %s middleware did not match expected type", bm, id)
 	}
@@ -207,40 +182,34 @@ func getOrAddRequestUserAgent(stack *middleware.Stack) (*RequestUserAgent, error
 }
 
 // AddUserAgentKey adds the component identified by name to the User-Agent string.
-func (u *RequestUserAgent) AddUserAgentKey(key string) {
+func (u *requestUserAgent) AddUserAgentKey(key string) {
 	u.userAgent.AddKey(strings.Map(rules, key))
 }
 
 // AddUserAgentKeyValue adds the key identified by the given name and value to the User-Agent string.
-func (u *RequestUserAgent) AddUserAgentKeyValue(key, value string) {
+func (u *requestUserAgent) AddUserAgentKeyValue(key, value string) {
 	u.userAgent.AddKeyValue(strings.Map(rules, key), strings.Map(rules, value))
 }
 
-// AddUserAgentFeature adds the feature ID to the tracking list to be emitted
-// in the final User-Agent string.
-func (u *RequestUserAgent) AddUserAgentFeature(feature UserAgentFeature) {
-	u.features[feature] = struct{}{}
-}
-
-// AddSDKAgentKey adds the component identified by name to the User-Agent string.
-func (u *RequestUserAgent) AddSDKAgentKey(keyType SDKAgentKeyType, key string) {
+// AddUserAgentKey adds the component identified by name to the User-Agent string.
+func (u *requestUserAgent) AddSDKAgentKey(keyType SDKAgentKeyType, key string) {
 	// TODO: should target sdkAgent
 	u.userAgent.AddKey(keyType.string() + "/" + strings.Map(rules, key))
 }
 
-// AddSDKAgentKeyValue adds the key identified by the given name and value to the User-Agent string.
-func (u *RequestUserAgent) AddSDKAgentKeyValue(keyType SDKAgentKeyType, key, value string) {
+// AddUserAgentKeyValue adds the key identified by the given name and value to the User-Agent string.
+func (u *requestUserAgent) AddSDKAgentKeyValue(keyType SDKAgentKeyType, key, value string) {
 	// TODO: should target sdkAgent
 	u.userAgent.AddKeyValue(keyType.string(), strings.Map(rules, key)+"#"+strings.Map(rules, value))
 }
 
 // ID the name of the middleware.
-func (u *RequestUserAgent) ID() string {
+func (u *requestUserAgent) ID() string {
 	return "UserAgent"
 }
 
 // HandleBuild adds or appends the constructed user agent to the request.
-func (u *RequestUserAgent) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
+func (u *requestUserAgent) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
 	out middleware.BuildOutput, metadata middleware.Metadata, err error,
 ) {
 	switch req := in.Request.(type) {
@@ -255,15 +224,12 @@ func (u *RequestUserAgent) HandleBuild(ctx context.Context, in middleware.BuildI
 	return next.HandleBuild(ctx, in)
 }
 
-func (u *RequestUserAgent) addHTTPUserAgent(request *smithyhttp.Request) {
+func (u *requestUserAgent) addHTTPUserAgent(request *smithyhttp.Request) {
 	const userAgent = "User-Agent"
 	updateHTTPHeader(request, userAgent, u.userAgent.Build())
-	if len(u.features) > 0 {
-		updateHTTPHeader(request, userAgent, buildFeatureMetrics(u.features))
-	}
 }
 
-func (u *RequestUserAgent) addHTTPSDKAgent(request *smithyhttp.Request) {
+func (u *requestUserAgent) addHTTPSDKAgent(request *smithyhttp.Request) {
 	const sdkAgent = "X-Amz-User-Agent"
 	updateHTTPHeader(request, sdkAgent, u.sdkAgent.Build())
 }
@@ -293,13 +259,3 @@ func rules(r rune) rune {
 		return '-'
 	}
 }
-
-func buildFeatureMetrics(features map[UserAgentFeature]struct{}) string {
-	fs := make([]string, 0, len(features))
-	for f := range features {
-		fs = append(fs, string(f))
-	}
-
-	sort.Strings(fs)
-	return fmt.Sprintf("%s/%s", FeatureMetadata2.string(), strings.Join(fs, ","))
-}

vendor/github.com/aws/aws-sdk-go-v2/aws/ratelimit/none.go

@@ -1,20 +0,0 @@
-package ratelimit
-
-import "context"
-
-// None implements a no-op rate limiter which effectively disables client-side
-// rate limiting (also known as "retry quotas").
-//
-// GetToken does nothing and always returns a nil error. The returned
-// token-release function does nothing, and always returns a nil error.
-//
-// AddTokens does nothing and always returns a nil error.
-var None = &none{}
-
-type none struct{}
-
-func (*none) GetToken(ctx context.Context, cost uint) (func() error, error) {
-	return func() error { return nil }, nil
-}
-
-func (*none) AddTokens(v uint) error { return nil }

vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go

@@ -2,15 +2,12 @@ package retry
 
 import (
 	"context"
-	"errors"
 	"fmt"
+	"github.com/aws/aws-sdk-go-v2/aws/middleware/private/metrics"
 	"strconv"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go-v2/aws/middleware/private/metrics"
-	internalcontext "github.com/aws/aws-sdk-go-v2/internal/context"
-
 	"github.com/aws/aws-sdk-go-v2/aws"
 	awsmiddle "github.com/aws/aws-sdk-go-v2/aws/middleware"
 	"github.com/aws/aws-sdk-go-v2/internal/sdk"
@@ -42,10 +39,6 @@ type Attempt struct {
 	requestCloner RequestCloner
 }
 
-// define the threshold at which we will consider certain kind of errors to be probably
-// caused by clock skew
-const skewThreshold = 4 * time.Minute
-
 // NewAttemptMiddleware returns a new Attempt retry middleware.
 func NewAttemptMiddleware(retryer aws.Retryer, requestCloner RequestCloner, optFns ...func(*Attempt)) *Attempt {
 	m := &Attempt{
@@ -93,9 +86,6 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
 			AttemptClockSkew: attemptClockSkew,
 		})
 
-		// Setting clock skew to be used on other context (like signing)
-		ctx = internalcontext.SetAttemptSkewContext(ctx, attemptClockSkew)
-
 		var attemptResult AttemptResult
 		out, attemptResult, releaseRetryToken, err = r.handleAttempt(attemptCtx, attemptInput, releaseRetryToken, next)
 		attemptClockSkew, _ = awsmiddle.GetAttemptSkew(attemptResult.ResponseMetadata)
@@ -195,8 +185,6 @@ func (r *Attempt) handleAttempt(
 		return out, attemptResult, nopRelease, err
 	}
 
-	err = wrapAsClockSkew(ctx, err)
-
 	//------------------------------
 	// Is Retryable and Should Retry
 	//------------------------------
@@ -259,37 +247,6 @@ func (r *Attempt) handleAttempt(
 	return out, attemptResult, releaseRetryToken, err
 }
 
-// errors that, if detected when we know there's a clock skew,
-// can be retried and have a high chance of success
-var possibleSkewCodes = map[string]struct{}{
-	"InvalidSignatureException": {},
-	"SignatureDoesNotMatch":     {},
-	"AuthFailure":               {},
-}
-
-var definiteSkewCodes = map[string]struct{}{
-	"RequestExpired":       {},
-	"RequestInTheFuture":   {},
-	"RequestTimeTooSkewed": {},
-}
-
-// wrapAsClockSkew checks if this error could be related to a clock skew
-// error and if so, wrap the error.
-func wrapAsClockSkew(ctx context.Context, err error) error {
-	var v interface{ ErrorCode() string }
-	if !errors.As(err, &v) {
-		return err
-	}
-	if _, ok := definiteSkewCodes[v.ErrorCode()]; ok {
-		return &retryableClockSkewError{Err: err}
-	}
-	_, isPossibleSkewCode := possibleSkewCodes[v.ErrorCode()]
-	if skew := internalcontext.GetAttemptSkewContext(ctx); skew > skewThreshold && isPossibleSkewCode {
-		return &retryableClockSkewError{Err: err}
-	}
-	return err
-}
-
 // MetricsHeader attaches SDK request metric header for retries to the transport
 type MetricsHeader struct{}
 

vendor/github.com/aws/aws-sdk-go-v2/aws/retry/retryable_error.go

@@ -2,7 +2,6 @@ package retry
 
 import (
 	"errors"
-	"fmt"
 	"net"
 	"net/url"
 	"strings"
@@ -200,23 +199,3 @@ func (r RetryableErrorCode) IsErrorRetryable(err error) aws.Ternary {
 
 	return aws.TrueTernary
 }
-
-// retryableClockSkewError marks errors that can be caused by clock skew
-// (difference between server time and client time).
-// This is returned when there's certain confidence that adjusting the client time
-// could allow a retry to succeed
-type retryableClockSkewError struct{ Err error }
-
-func (e *retryableClockSkewError) Error() string {
-	return fmt.Sprintf("Probable clock skew error: %v", e.Err)
-}
-
-// Unwrap returns the wrapped error.
-func (e *retryableClockSkewError) Unwrap() error {
-	return e.Err
-}
-
-// RetryableError allows the retryer to retry this request
-func (e *retryableClockSkewError) RetryableError() bool {
-	return true
-}

vendor/github.com/aws/aws-sdk-go-v2/aws/retry/standard.go

@@ -123,17 +123,6 @@ type StandardOptions struct {
 
 	// Provides the rate limiting strategy for rate limiting attempt retries
 	// across all attempts the retryer is being used with.
-	//
-	// A RateLimiter operates as a token bucket with a set capacity, where
-	// attempt failures events consume tokens. A retry attempt that attempts to
-	// consume more tokens than what's available results in operation failure.
-	// The default implementation is parameterized as follows:
-	//   - a capacity of 500 (DefaultRetryRateTokens)
-	//   - a retry caused by a timeout costs 10 tokens (DefaultRetryCost)
-	//   - a retry caused by other errors costs 5 tokens (DefaultRetryTimeoutCost)
-	//   - an operation that succeeds on the 1st attempt adds 1 token (DefaultNoRetryIncrement)
-	//
-	// You can disable rate limiting by setting this field to ratelimit.None.
 	RateLimiter RateLimiter
 
 	// The cost to deduct from the RateLimiter's token bucket per retry.

vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/headers.go

@@ -38,6 +38,7 @@ var RequiredSignedHeaders = Rules{
 			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm": struct{}{},
 			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key":       struct{}{},
 			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-Md5":   struct{}{},
+			"X-Amz-Expected-Bucket-Owner":                                 struct{}{},
 			"X-Amz-Grant-Full-control":                                    struct{}{},
 			"X-Amz-Grant-Read":                                            struct{}{},
 			"X-Amz-Grant-Read-Acp":                                        struct{}{},

vendor/github.com/aws/aws-sdk-go-v2/aws/signer/v4/middleware.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
+	"github.com/aws/aws-sdk-go-v2/aws/middleware/private/metrics"
 	v4Internal "github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4"
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	"github.com/aws/aws-sdk-go-v2/internal/sdk"
@@ -84,12 +85,12 @@ func (m *dynamicPayloadSigningMiddleware) HandleFinalize(
 	}
 
 	if req.IsHTTPS() {
-		return (&UnsignedPayload{}).HandleFinalize(ctx, in, next)
+		return (&unsignedPayload{}).HandleFinalize(ctx, in, next)
 	}
-	return (&ComputePayloadSHA256{}).HandleFinalize(ctx, in, next)
+	return (&computePayloadSHA256{}).HandleFinalize(ctx, in, next)
 }
 
-// UnsignedPayload sets the SigV4 request payload hash to unsigned.
+// unsignedPayload sets the SigV4 request payload hash to unsigned.
 //
 // Will not set the Unsigned Payload magic SHA value, if a SHA has already been
 // stored in the context. (e.g. application pre-computed SHA256 before making
@@ -97,21 +98,21 @@ func (m *dynamicPayloadSigningMiddleware) HandleFinalize(
 //
 // This middleware does not check the X-Amz-Content-Sha256 header, if that
 // header is serialized a middleware must translate it into the context.
-type UnsignedPayload struct{}
+type unsignedPayload struct{}
 
 // AddUnsignedPayloadMiddleware adds unsignedPayload to the operation
 // middleware stack
 func AddUnsignedPayloadMiddleware(stack *middleware.Stack) error {
-	return stack.Finalize.Insert(&UnsignedPayload{}, "ResolveEndpointV2", middleware.After)
+	return stack.Finalize.Insert(&unsignedPayload{}, "ResolveEndpointV2", middleware.After)
 }
 
 // ID returns the unsignedPayload identifier
-func (m *UnsignedPayload) ID() string {
+func (m *unsignedPayload) ID() string {
 	return computePayloadHashMiddlewareID
 }
 
 // HandleFinalize sets the payload hash magic value to the unsigned sentinel.
-func (m *UnsignedPayload) HandleFinalize(
+func (m *unsignedPayload) HandleFinalize(
 	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
 ) (
 	out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
@@ -122,7 +123,7 @@ func (m *UnsignedPayload) HandleFinalize(
 	return next.HandleFinalize(ctx, in)
 }
 
-// ComputePayloadSHA256 computes SHA256 payload hash to sign.
+// computePayloadSHA256 computes SHA256 payload hash to sign.
 //
 // Will not set the Unsigned Payload magic SHA value, if a SHA has already been
 // stored in the context. (e.g. application pre-computed SHA256 before making
@@ -130,12 +131,12 @@ func (m *UnsignedPayload) HandleFinalize(
 //
 // This middleware does not check the X-Amz-Content-Sha256 header, if that
 // header is serialized a middleware must translate it into the context.
-type ComputePayloadSHA256 struct{}
+type computePayloadSHA256 struct{}
 
 // AddComputePayloadSHA256Middleware adds computePayloadSHA256 to the
 // operation middleware stack
 func AddComputePayloadSHA256Middleware(stack *middleware.Stack) error {
-	return stack.Finalize.Insert(&ComputePayloadSHA256{}, "ResolveEndpointV2", middleware.After)
+	return stack.Finalize.Insert(&computePayloadSHA256{}, "ResolveEndpointV2", middleware.After)
 }
 
 // RemoveComputePayloadSHA256Middleware removes computePayloadSHA256 from the
@@ -146,13 +147,13 @@ func RemoveComputePayloadSHA256Middleware(stack *middleware.Stack) error {
 }
 
 // ID is the middleware name
-func (m *ComputePayloadSHA256) ID() string {
+func (m *computePayloadSHA256) ID() string {
 	return computePayloadHashMiddlewareID
 }
 
 // HandleFinalize computes the payload hash for the request, storing it to the
 // context. This is a no-op if a caller has previously set that value.
-func (m *ComputePayloadSHA256) HandleFinalize(
+func (m *computePayloadSHA256) HandleFinalize(
 	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
 ) (
 	out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
@@ -195,35 +196,35 @@ func (m *ComputePayloadSHA256) HandleFinalize(
 // Use this to disable computing the Payload SHA256 checksum and instead use
 // UNSIGNED-PAYLOAD for the SHA256 value.
 func SwapComputePayloadSHA256ForUnsignedPayloadMiddleware(stack *middleware.Stack) error {
-	_, err := stack.Finalize.Swap(computePayloadHashMiddlewareID, &UnsignedPayload{})
+	_, err := stack.Finalize.Swap(computePayloadHashMiddlewareID, &unsignedPayload{})
 	return err
 }
 
-// ContentSHA256Header sets the X-Amz-Content-Sha256 header value to
+// contentSHA256Header sets the X-Amz-Content-Sha256 header value to
 // the Payload hash stored in the context.
-type ContentSHA256Header struct{}
+type contentSHA256Header struct{}
 
 // AddContentSHA256HeaderMiddleware adds ContentSHA256Header to the
 // operation middleware stack
 func AddContentSHA256HeaderMiddleware(stack *middleware.Stack) error {
-	return stack.Finalize.Insert(&ContentSHA256Header{}, computePayloadHashMiddlewareID, middleware.After)
+	return stack.Finalize.Insert(&contentSHA256Header{}, computePayloadHashMiddlewareID, middleware.After)
 }
 
 // RemoveContentSHA256HeaderMiddleware removes contentSHA256Header middleware
 // from the operation middleware stack
 func RemoveContentSHA256HeaderMiddleware(stack *middleware.Stack) error {
-	_, err := stack.Finalize.Remove((*ContentSHA256Header)(nil).ID())
+	_, err := stack.Finalize.Remove((*contentSHA256Header)(nil).ID())
 	return err
 }
 
 // ID returns the ContentSHA256HeaderMiddleware identifier
-func (m *ContentSHA256Header) ID() string {
+func (m *contentSHA256Header) ID() string {
 	return "SigV4ContentSHA256Header"
 }
 
 // HandleFinalize sets the X-Amz-Content-Sha256 header value to the Payload hash
 // stored in the context.
-func (m *ContentSHA256Header) HandleFinalize(
+func (m *contentSHA256Header) HandleFinalize(
 	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
 ) (
 	out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
@@ -300,7 +301,22 @@ func (s *SignHTTPRequestMiddleware) HandleFinalize(ctx context.Context, in middl
 		return out, metadata, &SigningError{Err: fmt.Errorf("computed payload hash missing from context")}
 	}
 
+	mctx := metrics.Context(ctx)
+
+	if mctx != nil {
+		if attempt, err := mctx.Data().LatestAttempt(); err == nil {
+			attempt.CredentialFetchStartTime = sdk.NowTime()
+		}
+	}
+
 	credentials, err := s.credentialsProvider.Retrieve(ctx)
+
+	if mctx != nil {
+		if attempt, err := mctx.Data().LatestAttempt(); err == nil {
+			attempt.CredentialFetchEndTime = sdk.NowTime()
+		}
+	}
+
 	if err != nil {
 		return out, metadata, &SigningError{Err: fmt.Errorf("failed to retrieve credentials: %w", err)}
 	}
@@ -321,7 +337,20 @@ func (s *SignHTTPRequestMiddleware) HandleFinalize(ctx context.Context, in middl
 		})
 	}
 
+	if mctx != nil {
+		if attempt, err := mctx.Data().LatestAttempt(); err == nil {
+			attempt.SignStartTime = sdk.NowTime()
+		}
+	}
+
 	err = s.signer.SignHTTP(ctx, credentials, req.Request, payloadHash, signingName, signingRegion, sdk.NowTime(), signerOptions...)
+
+	if mctx != nil {
+		if attempt, err := mctx.Data().LatestAttempt(); err == nil {
+			attempt.SignEndTime = sdk.NowTime()
+		}
+	}
+
 	if err != nil {
 		return out, metadata, &SigningError{Err: fmt.Errorf("failed to sign http request, %w", err)}
 	}
@@ -331,21 +360,18 @@ func (s *SignHTTPRequestMiddleware) HandleFinalize(ctx context.Context, in middl
 	return next.HandleFinalize(ctx, in)
 }
 
-// StreamingEventsPayload signs input event stream messages.
-type StreamingEventsPayload struct{}
+type streamingEventsPayload struct{}
 
 // AddStreamingEventsPayload adds the streamingEventsPayload middleware to the stack.
 func AddStreamingEventsPayload(stack *middleware.Stack) error {
-	return stack.Finalize.Add(&StreamingEventsPayload{}, middleware.Before)
+	return stack.Finalize.Add(&streamingEventsPayload{}, middleware.Before)
 }
 
-// ID identifies the middleware.
-func (s *StreamingEventsPayload) ID() string {
+func (s *streamingEventsPayload) ID() string {
 	return computePayloadHashMiddlewareID
 }
 
-// HandleFinalize marks the input stream to be signed with SigV4.
-func (s *StreamingEventsPayload) HandleFinalize(
+func (s *streamingEventsPayload) HandleFinalize(
 	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
 ) (
 	out middleware.FinalizeOutput, metadata middleware.Metadata, err error,

vendor/github.com/aws/aws-sdk-go-v2/aws/signer/v4/v4.go

@@ -1,41 +1,48 @@
-// Package v4 implements the AWS signature version 4 algorithm (commonly known
-// as SigV4).
+// Package v4 implements signing for AWS V4 signer
 //
-// For more information about SigV4, see [Signing AWS API requests] in the IAM
-// user guide.
+// Provides request signing for request that need to be signed with
+// AWS V4 Signatures.
 //
-// While this implementation CAN work in an external context, it is developed
-// primarily for SDK use and you may encounter fringe behaviors around header
-// canonicalization.
+// # Standalone Signer
 //
-// # Pre-escaping a request URI
+// Generally using the signer outside of the SDK should not require any additional
 //
-// AWS v4 signature validation requires that the canonical string's URI path
-// component must be the escaped form of the HTTP request's path.
+//	The signer does this by taking advantage of the URL.EscapedPath method. If your request URI requires
 //
-// The Go HTTP client will perform escaping automatically on the HTTP request.
-// This may cause signature validation errors because the request differs from
-// the URI path or query from which the signature was generated.
+// additional escaping you many need to use the URL.Opaque to define what the raw URI should be sent
+// to the service as.
 //
-// Because of this, we recommend that you explicitly escape the request when
-// using this signer outside of the SDK to prevent possible signature mismatch.
-// This can be done by setting URL.Opaque on the request. The signer will
-// prefer that value, falling back to the return of URL.EscapedPath if unset.
-//
-// When setting URL.Opaque you must do so in the form of:
+// The signer will first check the URL.Opaque field, and use its value if set.
+// The signer does require the URL.Opaque field to be set in the form of:
 //
 //	"//<hostname>/<path>"
 //
 //	// e.g.
 //	"//example.com/some/path"
 //
-// The leading "//" and hostname are required or the escaping will not work
-// correctly.
+// The leading "//" and hostname are required or the URL.Opaque escaping will
+// not work correctly.
 //
-// The TestStandaloneSign unit test provides a complete example of using the
-// signer outside of the SDK and pre-escaping the URI path.
+// If URL.Opaque is not set the signer will fallback to the URL.EscapedPath()
+// method and using the returned value.
 //
-// [Signing AWS API requests]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-signing.html
+// AWS v4 signature validation requires that the canonical string's URI path
+// element must be the URI escaped form of the HTTP request's path.
+// http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
+//
+// The Go HTTP client will perform escaping automatically on the request. Some
+// of these escaping may cause signature validation errors because the HTTP
+// request differs from the URI path or query that the signature was generated.
+// https://golang.org/pkg/net/url/#URL.EscapedPath
+//
+// Because of this, it is recommended that when using the signer outside of the
+// SDK that explicitly escaping the request prior to being signed is preferable,
+// and will help prevent signature validation errors. This can be done by setting
+// the URL.Opaque or URL.RawPath. The SDK will use URL.Opaque first and then
+// call URL.EscapedPath() if Opaque is not set.
+//
+// Test `TestStandaloneSign` provides a complete example of using the signer
+// outside of the SDK and pre-escaping the URI path.
 package v4
 
 import (
@@ -395,12 +402,6 @@ func buildQuery(r v4Internal.Rule, header http.Header) (url.Values, http.Header)
 	query := url.Values{}
 	unsignedHeaders := http.Header{}
 	for k, h := range header {
-		// literally just this header has this constraint for some stupid reason,
-		// see #2508
-		if k == "X-Amz-Expected-Bucket-Owner" {
-			k = "x-amz-expected-bucket-owner"
-		}
-
 		if r.IsValid(k) {
 			query[k] = h
 		} else {

vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/response_error_middleware.go

@@ -12,20 +12,18 @@ import (
 func AddResponseErrorMiddleware(stack *middleware.Stack) error {
 	// add error wrapper middleware before request id retriever middleware so that it can wrap the error response
 	// returned by operation deserializers
-	return stack.Deserialize.Insert(&ResponseErrorWrapper{}, "RequestIDRetriever", middleware.Before)
+	return stack.Deserialize.Insert(&responseErrorWrapper{}, "RequestIDRetriever", middleware.Before)
 }
 
-// ResponseErrorWrapper wraps operation errors with ResponseError.
-type ResponseErrorWrapper struct {
+type responseErrorWrapper struct {
 }
 
 // ID returns the middleware identifier
-func (m *ResponseErrorWrapper) ID() string {
+func (m *responseErrorWrapper) ID() string {
 	return "ResponseErrorWrapper"
 }
 
-// HandleDeserialize wraps the stack error with smithyhttp.ResponseError.
-func (m *ResponseErrorWrapper) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
+func (m *responseErrorWrapper) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
 	out middleware.DeserializeOutput, metadata middleware.Metadata, err error,
 ) {
 	out, metadata, err = next.HandleDeserialize(ctx, in)

vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md

@@ -1,118 +1,3 @@
-# v1.27.27 (2024-07-18)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.26 (2024-07-10.2)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.25 (2024-07-10)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.24 (2024-07-03)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.23 (2024-06-28)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.22 (2024-06-26)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.21 (2024-06-19)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.20 (2024-06-18)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.19 (2024-06-17)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.18 (2024-06-07)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.17 (2024-06-03)
-
-* **Documentation**: Add deprecation docs to global endpoint resolution interfaces. These APIs were previously deprecated with the introduction of service-specific endpoint resolution (EndpointResolverV2 and BaseEndpoint on service client options).
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.16 (2024-05-23)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.15 (2024-05-16)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.14 (2024-05-15)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.13 (2024-05-10)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.12 (2024-05-08)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.11 (2024-04-05)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.10 (2024-03-29)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.9 (2024-03-21)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.8 (2024-03-18)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.7 (2024-03-07)
-
-* **Bug Fix**: Remove dependency on go-cmp.
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.6 (2024-03-05)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.5 (2024-03-04)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.4 (2024-02-23)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.3 (2024-02-22)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.2 (2024-02-21)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.1 (2024-02-20)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.27.0 (2024-02-13)
-
-* **Feature**: Bump minimum Go version to 1.20 per our language support policy.
-* **Dependency Update**: Updated to the latest SDK module versions
-
 # v1.26.6 (2024-01-22)
 
 * **Bug Fix**: Remove invalid escaping of shared config values. All values in the shared config file will now be interpreted literally, save for fully-quoted strings which are unwrapped for legacy reasons.

vendor/github.com/aws/aws-sdk-go-v2/config/config.go

@@ -80,9 +80,6 @@ var defaultAWSConfigResolvers = []awsConfigResolver{
 
 	// Sets the RequestMinCompressSizeBytes if present in env var or shared config profile
 	resolveRequestMinCompressSizeBytes,
-
-	// Sets the AccountIDEndpointMode if present in env var or shared config profile
-	resolveAccountIDEndpointMode,
 }
 
 // A Config represents a generic configuration value or set of values. This type

vendor/github.com/aws/aws-sdk-go-v2/config/env_config.go

@@ -80,9 +80,6 @@ const (
 	awsRequestMinCompressionSizeBytes = "AWS_REQUEST_MIN_COMPRESSION_SIZE_BYTES"
 
 	awsS3DisableExpressSessionAuthEnv = "AWS_S3_DISABLE_EXPRESS_SESSION_AUTH"
-
-	awsAccountIDEnv             = "AWS_ACCOUNT_ID"
-	awsAccountIDEndpointModeEnv = "AWS_ACCOUNT_ID_ENDPOINT_MODE"
 )
 
 var (
@@ -293,9 +290,6 @@ type EnvConfig struct {
 	// will only bypass the modified endpoint routing and signing behaviors
 	// associated with the feature.
 	S3DisableExpressAuth *bool
-
-	// Indicates whether account ID will be required/ignored in endpoint2.0 routing
-	AccountIDEndpointMode aws.AccountIDEndpointMode
 }
 
 // loadEnvConfig reads configuration values from the OS's environment variables.
@@ -315,7 +309,6 @@ func NewEnvConfig() (EnvConfig, error) {
 	setStringFromEnvVal(&creds.AccessKeyID, credAccessEnvKeys)
 	setStringFromEnvVal(&creds.SecretAccessKey, credSecretEnvKeys)
 	if creds.HasKeys() {
-		creds.AccountID = os.Getenv(awsAccountIDEnv)
 		creds.SessionToken = os.Getenv(awsSessionTokenEnvVar)
 		cfg.Credentials = creds
 	}
@@ -396,10 +389,6 @@ func NewEnvConfig() (EnvConfig, error) {
 		return cfg, err
 	}
 
-	if err := setAIDEndPointModeFromEnvVal(&cfg.AccountIDEndpointMode, []string{awsAccountIDEndpointModeEnv}); err != nil {
-		return cfg, err
-	}
-
 	return cfg, nil
 }
 
@@ -428,10 +417,6 @@ func (c EnvConfig) getRequestMinCompressSizeBytes(context.Context) (int64, bool,
 	return *c.RequestMinCompressSizeBytes, true, nil
 }
 
-func (c EnvConfig) getAccountIDEndpointMode(context.Context) (aws.AccountIDEndpointMode, bool, error) {
-	return c.AccountIDEndpointMode, len(c.AccountIDEndpointMode) > 0, nil
-}
-
 // GetRetryMaxAttempts returns the value of AWS_MAX_ATTEMPTS if was specified,
 // and not 0.
 func (c EnvConfig) GetRetryMaxAttempts(ctx context.Context) (int, bool, error) {
@@ -506,28 +491,6 @@ func setEC2IMDSEndpointMode(mode *imds.EndpointModeState, keys []string) error {
 	return nil
 }
 
-func setAIDEndPointModeFromEnvVal(m *aws.AccountIDEndpointMode, keys []string) error {
-	for _, k := range keys {
-		value := os.Getenv(k)
-		if len(value) == 0 {
-			continue
-		}
-
-		switch value {
-		case "preferred":
-			*m = aws.AccountIDEndpointModePreferred
-		case "required":
-			*m = aws.AccountIDEndpointModeRequired
-		case "disabled":
-			*m = aws.AccountIDEndpointModeDisabled
-		default:
-			return fmt.Errorf("invalid value for environment variable, %s=%s, must be preferred/required/disabled", k, value)
-		}
-		break
-	}
-	return nil
-}
-
 // GetRegion returns the AWS Region if set in the environment. Returns an empty
 // string if not set.
 func (c EnvConfig) getRegion(ctx context.Context) (string, bool, error) {

vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go

@@ -3,4 +3,4 @@
 package config
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.27.27"
+const goModuleVersion = "1.26.6"

vendor/github.com/aws/aws-sdk-go-v2/config/load_options.go

@@ -215,8 +215,6 @@ type LoadOptions struct {
 
 	// Whether S3 Express auth is disabled.
 	S3DisableExpressAuth *bool
-
-	AccountIDEndpointMode aws.AccountIDEndpointMode
 }
 
 func (o LoadOptions) getDefaultsMode(ctx context.Context) (aws.DefaultsMode, bool, error) {
@@ -280,10 +278,6 @@ func (o LoadOptions) getRequestMinCompressSizeBytes(ctx context.Context) (int64,
 	return *o.RequestMinCompressSizeBytes, true, nil
 }
 
-func (o LoadOptions) getAccountIDEndpointMode(ctx context.Context) (aws.AccountIDEndpointMode, bool, error) {
-	return o.AccountIDEndpointMode, len(o.AccountIDEndpointMode) > 0, nil
-}
-
 // WithRegion is a helper function to construct functional options
 // that sets Region on config's LoadOptions. Setting the region to
 // an empty string, will result in the region value being ignored.
@@ -329,17 +323,6 @@ func WithRequestMinCompressSizeBytes(RequestMinCompressSizeBytes *int64) LoadOpt
 	}
 }
 
-// WithAccountIDEndpointMode is a helper function to construct functional options
-// that sets AccountIDEndpointMode on config's LoadOptions
-func WithAccountIDEndpointMode(m aws.AccountIDEndpointMode) LoadOptionsFunc {
-	return func(o *LoadOptions) error {
-		if m != "" {
-			o.AccountIDEndpointMode = m
-		}
-		return nil
-	}
-}
-
 // getDefaultRegion returns DefaultRegion from config's LoadOptions
 func (o LoadOptions) getDefaultRegion(ctx context.Context) (string, bool, error) {
 	if len(o.DefaultRegion) == 0 {
@@ -841,14 +824,7 @@ func (o LoadOptions) getEndpointResolver(ctx context.Context) (aws.EndpointResol
 // the EndpointResolver value is ignored. If multiple WithEndpointResolver calls
 // are made, the last call overrides the previous call values.
 //
-// Deprecated: The global endpoint resolution interface is deprecated. The API
-// for endpoint resolution is now unique to each service and is set via the
-// EndpointResolverV2 field on service client options. Use of
-// WithEndpointResolver or WithEndpointResolverWithOptions will prevent you
-// from using any endpoint-related service features released after the
-// introduction of EndpointResolverV2. You may also encounter broken or
-// unexpected behavior when using the old global interface with services that
-// use many endpoint-related customizations such as S3.
+// Deprecated: See WithEndpointResolverWithOptions
 func WithEndpointResolver(v aws.EndpointResolver) LoadOptionsFunc {
 	return func(o *LoadOptions) error {
 		o.EndpointResolver = v
@@ -868,9 +844,6 @@ func (o LoadOptions) getEndpointResolverWithOptions(ctx context.Context) (aws.En
 // that sets the EndpointResolverWithOptions on LoadOptions. If the EndpointResolverWithOptions is set to nil,
 // the EndpointResolver value is ignored. If multiple WithEndpointResolver calls
 // are made, the last call overrides the previous call values.
-//
-// Deprecated: The global endpoint resolution interface is deprecated. See
-// deprecation docs on [WithEndpointResolver].
 func WithEndpointResolverWithOptions(v aws.EndpointResolverWithOptions) LoadOptionsFunc {
 	return func(o *LoadOptions) error {
 		o.EndpointResolverWithOptions = v

vendor/github.com/aws/aws-sdk-go-v2/config/provider.go

@@ -225,23 +225,6 @@ func getRequestMinCompressSizeBytes(ctx context.Context, configs configs) (value
 	return
 }
 
-// accountIDEndpointModeProvider provides access to the AccountIDEndpointMode
-type accountIDEndpointModeProvider interface {
-	getAccountIDEndpointMode(context.Context) (aws.AccountIDEndpointMode, bool, error)
-}
-
-func getAccountIDEndpointMode(ctx context.Context, configs configs) (value aws.AccountIDEndpointMode, found bool, err error) {
-	for _, cfg := range configs {
-		if p, ok := cfg.(accountIDEndpointModeProvider); ok {
-			value, found, err = p.getAccountIDEndpointMode(ctx)
-			if err != nil || found {
-				break
-			}
-		}
-	}
-	return
-}
-
 // ec2IMDSRegionProvider provides access to the ec2 imds region
 // configuration value
 type ec2IMDSRegionProvider interface {

vendor/github.com/aws/aws-sdk-go-v2/config/resolve.go

@@ -166,22 +166,6 @@ func resolveRequestMinCompressSizeBytes(ctx context.Context, cfg *aws.Config, co
 	return nil
 }
 
-// resolveAccountIDEndpointMode extracts the AccountIDEndpointMode from the configs slice's
-// SharedConfig or EnvConfig
-func resolveAccountIDEndpointMode(ctx context.Context, cfg *aws.Config, configs configs) error {
-	m, found, err := getAccountIDEndpointMode(ctx, configs)
-	if err != nil {
-		return err
-	}
-
-	if !found {
-		m = aws.AccountIDEndpointModePreferred
-	}
-
-	cfg.AccountIDEndpointMode = m
-	return nil
-}
-
 // resolveDefaultRegion extracts the first instance of a default region and sets `aws.Config.Region` to the default
 // region if region had not been resolved from other sources.
 func resolveDefaultRegion(ctx context.Context, cfg *aws.Config, configs configs) error {

vendor/github.com/aws/aws-sdk-go-v2/config/shared_config.go

@@ -115,9 +115,6 @@ const (
 	requestMinCompressionSizeBytes = "request_min_compression_size_bytes"
 
 	s3DisableExpressSessionAuthKey = "s3_disable_express_session_auth"
-
-	accountIDKey          = "aws_account_id"
-	accountIDEndpointMode = "account_id_endpoint_mode"
 )
 
 // defaultSharedConfigProfile allows for swapping the default profile for testing
@@ -344,8 +341,6 @@ type SharedConfig struct {
 	// will only bypass the modified endpoint routing and signing behaviors
 	// associated with the feature.
 	S3DisableExpressAuth *bool
-
-	AccountIDEndpointMode aws.AccountIDEndpointMode
 }
 
 func (c SharedConfig) getDefaultsMode(ctx context.Context) (value aws.DefaultsMode, ok bool, err error) {
@@ -1129,17 +1124,12 @@ func (c *SharedConfig) setFromIniSection(profile string, section ini.Section) er
 		return fmt.Errorf("failed to load %s from shared config, %w", requestMinCompressionSizeBytes, err)
 	}
 
-	if err := updateAIDEndpointMode(&c.AccountIDEndpointMode, section, accountIDEndpointMode); err != nil {
-		return fmt.Errorf("failed to load %s from shared config, %w", accountIDEndpointMode, err)
-	}
-
 	// Shared Credentials
 	creds := aws.Credentials{
 		AccessKeyID:     section.String(accessKeyIDKey),
 		SecretAccessKey: section.String(secretAccessKey),
 		SessionToken:    section.String(sessionTokenKey),
 		Source:          fmt.Sprintf("SharedConfigCredentials: %s", section.SourceFile[accessKeyIDKey]),
-		AccountID:       section.String(accountIDKey),
 	}
 
 	if creds.HasKeys() {
@@ -1187,26 +1177,6 @@ func updateDisableRequestCompression(disable **bool, sec ini.Section, key string
 	return nil
 }
 
-func updateAIDEndpointMode(m *aws.AccountIDEndpointMode, sec ini.Section, key string) error {
-	if !sec.Has(key) {
-		return nil
-	}
-
-	v := sec.String(key)
-	switch v {
-	case "preferred":
-		*m = aws.AccountIDEndpointModePreferred
-	case "required":
-		*m = aws.AccountIDEndpointModeRequired
-	case "disabled":
-		*m = aws.AccountIDEndpointModeDisabled
-	default:
-		return fmt.Errorf("invalid value for shared config profile field, %s=%s, must be preferred/required/disabled", key, v)
-	}
-
-	return nil
-}
-
 func (c SharedConfig) getRequestMinCompressSizeBytes(ctx context.Context) (int64, bool, error) {
 	if c.RequestMinCompressSizeBytes == nil {
 		return 0, false, nil
@@ -1221,10 +1191,6 @@ func (c SharedConfig) getDisableRequestCompression(ctx context.Context) (bool, b
 	return *c.DisableRequestCompression, true, nil
 }
 
-func (c SharedConfig) getAccountIDEndpointMode(ctx context.Context) (aws.AccountIDEndpointMode, bool, error) {
-	return c.AccountIDEndpointMode, len(c.AccountIDEndpointMode) > 0, nil
-}
-
 func updateDefaultsMode(mode *aws.DefaultsMode, section ini.Section, key string) error {
 	if !section.Has(key) {
 		return nil

vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md

@@ -1,117 +1,3 @@
-# v1.17.27 (2024-07-18)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.26 (2024-07-10.2)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.25 (2024-07-10)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.24 (2024-07-03)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.23 (2024-06-28)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.22 (2024-06-26)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.21 (2024-06-19)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.20 (2024-06-18)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.19 (2024-06-17)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.18 (2024-06-07)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.17 (2024-06-03)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.16 (2024-05-23)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.15 (2024-05-16)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.14 (2024-05-15)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.13 (2024-05-10)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.12 (2024-05-08)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.11 (2024-04-05)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.10 (2024-03-29)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.9 (2024-03-21)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.8 (2024-03-18)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.7 (2024-03-07)
-
-* **Bug Fix**: Remove dependency on go-cmp.
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.6 (2024-03-05)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.5 (2024-03-04)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.4 (2024-02-23)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.3 (2024-02-22)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.2 (2024-02-21)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.1 (2024-02-20)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.17.0 (2024-02-13)
-
-* **Feature**: Bump minimum Go version to 1.20 per our language support policy.
-* **Dependency Update**: Updated to the latest SDK module versions
-
 # v1.16.16 (2024-01-18)
 
 * **Dependency Update**: Updated to the latest SDK module versions

vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/client.go

@@ -128,7 +128,6 @@ type GetCredentialsOutput struct {
 	AccessKeyID     string
 	SecretAccessKey string
 	Token           string
-	AccountID       string
 }
 
 // EndpointError is an error returned from the endpoint service