Chore/bump deps

.github/workflows/build.yaml

@@ -9,7 +9,7 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
           cache: true

Dockerfile

@@ -1,8 +1,8 @@
-ARG ALPINE_VERSION=3.17
-ARG GO_VERSION=1.19.6
+ARG ALPINE_VERSION=3.21
+ARG GO_VERSION=1.23.4
 
 # build image
-FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} as build
+FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS build
 
 ARG DOCKERCLI_VERSION=20.10.23
 ARG DOCKERCLI_CHANNEL=stable
@@ -30,7 +30,7 @@ RUN make BUILDTIME=$BUILDTIME COMMIT=$COMMIT TAG=$TAG bin/cnab-to-oci &&\
   make BUILDTIME=$BUILDTIME COMMIT=$COMMIT TAG=$TAG build-e2e-test
 
 # e2e image
-FROM alpine:${ALPINE_VERSION} as e2e
+FROM alpine:${ALPINE_VERSION} AS e2e
 
 # copy all the elements needed for e2e tests from build image
 COPY --from=build /go/docker/docker /usr/bin/docker

Makefile

@@ -48,7 +48,7 @@ check_go_env:
 
 get-tools:
 	go install golang.org/x/tools/cmd/goimports@latest
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.51.2
+	go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.63.4
 
 # Default build
 build: bin/cnab-to-oci

cmd/cnab-to-oci/fixup.go

@@ -8,8 +8,8 @@ import (
 	"github.com/cnabio/cnab-go/bundle"
 	"github.com/cnabio/cnab-to-oci/remotes"
 	containerdRemotes "github.com/containerd/containerd/remotes"
+	"github.com/distribution/reference"
 	"github.com/docker/cli/cli/config"
-	"github.com/docker/distribution/reference"
 	"github.com/spf13/cobra"
 )
 
@@ -29,7 +29,7 @@ func fixupCmd() *cobra.Command {
 		Short: "Fixes the digest of an image",
 		Long:  "The fixup command resolves all the digest references from a registry and patches the bundle.json with them.",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			opts.input = args[0]
 			return runFixup(opts)
 		},

cmd/cnab-to-oci/main.go

@@ -12,7 +12,7 @@ func main() {
 	cmd := &cobra.Command{
 		Use:          "cnab-to-oci <subcommand> [options]",
 		SilenceUsage: true,
-		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+		PersistentPreRunE: func(_ *cobra.Command, _ []string) error {
 			level, err := logrus.ParseLevel(logLevel)
 			if err != nil {
 				return err

cmd/cnab-to-oci/pull.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/cnabio/cnab-to-oci/remotes"
 	"github.com/cyberphone/json-canonicalization/go/src/webpki.org/jsoncanonicalizer"
-	"github.com/docker/distribution/reference"
+	"github.com/distribution/reference"
 	"github.com/spf13/cobra"
 )
 
@@ -25,7 +25,7 @@ func pullCmd() *cobra.Command {
 		Use:   "pull <ref> [options]",
 		Short: "Pulls an image reference",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			opts.targetRef = args[0]
 			return runPull(opts)
 		},

cmd/cnab-to-oci/push.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/cnabio/cnab-go/bundle"
 	"github.com/cnabio/cnab-to-oci/remotes"
-	"github.com/docker/distribution/reference"
+	"github.com/distribution/reference"
 	"github.com/docker/docker/client"
 	"github.com/spf13/cobra"
 )
@@ -31,7 +31,7 @@ func pushCmd() *cobra.Command {
 		Use:   "push <bundle file> [options]",
 		Short: "Fixes and pushes the bundle to an registry",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			opts.input = args[0]
 			if opts.targetRef == "" {
 				return errors.New("--target flag must be set with a namespace ")

cmd/cnab-to-oci/version.go

@@ -11,7 +11,7 @@ func versionCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "version",
 		Short: "Shows the version of cnab-to-oci",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			fmt.Println(internal.FullVersion())
 			return nil
 		},

converter/convert.go

@@ -10,7 +10,7 @@ import (
 	"github.com/cnabio/cnab-go/bundle"
 	"github.com/cnabio/cnab-to-oci/relocation"
 	"github.com/containerd/containerd/images"
-	"github.com/docker/distribution/reference"
+	"github.com/distribution/reference"
 	ocischema "github.com/opencontainers/image-spec/specs-go"
 	ocischemav1 "github.com/opencontainers/image-spec/specs-go/v1"
 )

converter/convert_test.go

@@ -4,8 +4,8 @@ import (
 	"testing"
 
 	"github.com/cnabio/cnab-to-oci/tests"
-	"github.com/docker/distribution/manifest/schema2"
-	"github.com/docker/distribution/reference"
+	"github.com/distribution/distribution/manifest/schema2"
+	"github.com/distribution/reference"
 	ocischemav1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"gotest.tools/v3/assert"
 )
@@ -80,7 +80,7 @@ func TestConvertFromFixedUpBundleToOCI(t *testing.T) {
 	badRelocationMap["my.registry/namespace/my-app-invoc"] = "Some/iNvalid/Ref"
 	_, err = ConvertBundleToOCIIndex(src, named, bundleConfigDescriptor, badRelocationMap)
 	assert.ErrorContains(t, err, "invalid invocation image: "+
-		"image \"Some/iNvalid/Ref\" is not a valid image reference: invalid reference format: repository name must be lowercase")
+		"image \"Some/iNvalid/Ref\" is not a valid image reference: invalid reference format: repository name (iNvalid/Ref) must be lowercase")
 
 	// Invalid size
 	src = tests.MakeTestBundle()

converter/types.go

@@ -4,8 +4,8 @@ import (
 	"encoding/json"
 
 	"github.com/cnabio/cnab-go/bundle"
+	"github.com/distribution/distribution/manifest/schema2"
 	"github.com/docker/distribution"
-	"github.com/docker/distribution/manifest/schema2"
 	"github.com/opencontainers/go-digest"
 	ocischema "github.com/opencontainers/image-spec/specs-go"
 	ocischemav1 "github.com/opencontainers/image-spec/specs-go/v1"

e2e/e2e_test.go

@@ -36,14 +36,13 @@ func TestPushAndPullCNAB(t *testing.T) {
 
 	// Fetch service images
 	runCmd(t, icmd.Command("docker", "pull", "hashicorp/http-echo"))
-	// We are using whalesay because it has duplicate layers in the image
-	runCmd(t, icmd.Command("docker", "pull", "docker/whalesay"))
+	runCmd(t, icmd.Command("docker", "pull", "docker/compose"))
 	runCmd(t, icmd.Command("docker", "tag", "hashicorp/http-echo", serviceImageName))
-	runCmd(t, icmd.Command("docker", "tag", "docker/whalesay", whalesayImageName))
+	runCmd(t, icmd.Command("docker", "tag", "docker/compose", whalesayImageName))
 
 	// Tidy up my room
 	defer func() {
-		runCmd(t, icmd.Command("docker", "image", "rm", "-f", invocationImageName, "hashicorp/http-echo", serviceImageName, "docker/whalesay", whalesayImageName))
+		runCmd(t, icmd.Command("docker", "image", "rm", "-f", invocationImageName, "hashicorp/http-echo", serviceImageName, "docker/compose", whalesayImageName))
 	}()
 
 	// Push the images to the registry

e2e/helper_test.go

@@ -38,5 +38,6 @@ func (c *Container) Stop(t *testing.T) {
 // GetAddress returns the host:port this container listens on
 func (c *Container) GetAddress(t *testing.T) string {
 	result := icmd.RunCommand("docker", "port", c.container, strconv.Itoa(c.privatePort)).Assert(t, icmd.Success)
-	return fmt.Sprintf("127.0.0.1:%v", strings.Trim(strings.Split(result.Stdout(), ":")[1], " \r\n"))
+	port := strings.Split(strings.Split(result.Stdout(), ":")[1], "\n")[0]
+	return fmt.Sprintf("127.0.0.1:%v", strings.Trim(port, " \r\n"))
 }

e2e/testdata/bundle.json.golden.template

@@ -1 +1 @@
-{"actions":{"io.cnab.status":{}},"description":"Hello, World!","images":{"hello":{"contentDigest":"sha256:61d5cb94d7e546518a7bbd5bee06bfad0ecea8f56a75b084522a43dccbbcd845","description":"hello","image":"{{ .ServiceImage }}","imageType":"docker","mediaType":"application/vnd.docker.distribution.manifest.v2+json","size":528},"whalesay":{"contentDigest":"sha256:df326a383b4a036fd5a33402248027d1c972954622924158a28744ed5f9fca1e","description":"whalesay","image":"{{ .WhalesayImage }}","imageType":"docker","mediaType":"application/vnd.docker.distribution.manifest.v2+json","size":2402}},"invocationImages":[{"contentDigest":"{{ .InvocationDigest }}","image":"{{ .InvocationImage }}","imageType":"docker","mediaType":"application/vnd.docker.distribution.manifest.v2+json","size":941}],"maintainers":[{"email":"[email protected]","name":"user"}],"name":"hello-world","parameters":{"fields":{"definition":"","destination":null}},"schemaVersion":"v1.0.0","version":"0.1.0"}
+{"actions":{"io.cnab.status":{}},"description":"Hello, World!","images":{"hello":{"contentDigest":"sha256:2c213d6c05a0f68adfe9c7fe1a78a314e5c4fee783e2ee8592d49f10d0c4513f","description":"hello","image":"127.0.0.1:32797/e2e/http-echo","imageType":"docker","mediaType":"application/vnd.docker.distribution.manifest.v2+json","size":2401},"whalesay":{"contentDigest":"sha256:b60a020c0f68047b353a4a747f27f5e5ddb17116b7b018762edfb6f7a6439a82","description":"whalesay","image":"127.0.0.1:32797/e2e/whalesay","imageType":"docker","mediaType":"application/vnd.docker.distribution.manifest.v2+json","size":1158}},"invocationImages":[{"contentDigest":"sha256:3079367dd5c4c6c4f99a7842112d062ce91ea35c934e6ea2d6677de11be0a23b","image":"127.0.0.1:32797/e2e/hello-world:0.1.0-invoc","imageType":"docker","mediaType":"application/vnd.docker.distribution.manifest.v2+json","size":941}],"maintainers":[{"email":"[email protected]","name":"user"}],"name":"hello-world","parameters":{"fields":{"definition":"","destination":null}},"schemaVersion":"v1.0.0","version":"0.1.0"}

go.mod

@@ -6,35 +6,33 @@ toolchain go1.23.3
 
 require (
 	github.com/cnabio/cnab-go v0.25.2
-	github.com/containerd/containerd v1.7.23
-	github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f
+	github.com/containerd/containerd v1.7.25
+	github.com/containerd/log v0.1.0
+	github.com/containerd/platforms v0.2.1
+	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467
+	github.com/distribution/distribution v2.8.3+incompatible
+	github.com/distribution/reference v0.6.1-0.20240718132515-8c942b0459df
+	github.com/docker/cli v27.4.1+incompatible
+	github.com/docker/distribution v2.8.3+incompatible
+	github.com/docker/docker v27.4.1+incompatible
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.8.1
-	golang.org/x/sync v0.9.0
+	golang.org/x/sync v0.10.0
 	gotest.tools/v3 v3.5.1
 )
 
-require (
-	github.com/docker/cli v27.3.1+incompatible
-	github.com/docker/distribution v2.8.2+incompatible
-	github.com/docker/docker v27.3.1+incompatible
-)
-
 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.12.9 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
-	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
@@ -50,28 +48,31 @@ require (
 	github.com/klauspost/compress v1.17.11 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/term v0.5.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_golang v1.20.5 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.60.1 // indirect
+	github.com/prometheus/common v0.61.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/qri-io/jsonpointer v0.1.1 // indirect
 	github.com/qri-io/jsonschema v0.2.2-0.20210831022256-780655b2ba0e // indirect
-	github.com/sergi/go-diff v1.1.0 // indirect
+	github.com/sergi/go-diff v1.3.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 // indirect
-	go.opentelemetry.io/otel v1.32.0 // indirect
-	go.opentelemetry.io/otel/metric v1.32.0 // indirect
-	go.opentelemetry.io/otel/trace v1.32.0 // indirect
-	golang.org/x/net v0.31.0 // indirect
-	golang.org/x/sys v0.27.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241113202542-65e8d215514f // indirect
-	google.golang.org/grpc v1.68.0 // indirect
-	google.golang.org/protobuf v1.35.1 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.33.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 // indirect
+	go.opentelemetry.io/otel/metric v1.33.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.32.0 // indirect
+	go.opentelemetry.io/otel/trace v1.33.0 // indirect
+	golang.org/x/net v0.34.0 // indirect
+	golang.org/x/sys v0.29.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
+	google.golang.org/grpc v1.69.2 // indirect
+	google.golang.org/protobuf v1.36.2 // indirect
 )