Skip to content

OCPBUGS-43501: fix kargs handling in ABI Minimal ISO #10578

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zaneb wants to merge 2 commits into
base: main
Choose a base branch
from
Open

OCPBUGS-43501: fix kargs handling in ABI Minimal ISO #10578

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b3e25a9
Update to latest assisted-image-service
zaneb Feb 16, 2026
df4b6e6
OCPBUGS-43501: Update to latest assisted-image-service
zaneb May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ require (
github.com/coreos/stream-metadata-go v0.4.10-0.20250806142651-4a7d280a6c7b
github.com/daixiang0/gci v0.13.5
github.com/digitalocean/go-libvirt v0.0.0-20240220204746-fcabe97a6eed
github.com/diskfs/go-diskfs v1.4.1
github.com/diskfs/go-diskfs v1.7.1-0.20251217162235-58541aa8f559
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 28, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🌐 Web query:

`For each module below, find the latest stable (non-prerelease, non-pseudo-version) release and whether the required fix exists in that stable tag:

  • github.com/diskfs/go-diskfs
  • github.com/openshift/assisted-image-service
    Also check whether either referenced pseudo-version was later yanked or superseded due to regressions.`

💡 Result:

  1. github.com/diskfs/go-diskfs - Latest stable (non-prerelease, non-pseudo-version) release as of 2026-05-28: v1.9.3 [1]. - Whether the required fix exists in that stable tag: Not determinable from the provided prompt, because the prompt does not specify what “required fix” (commit/issue/PR or change) you are referring to; pkg.go.dev only provides version listings, not fix content for an unspecified bug [1]. - Pseudo-version yanked/superseded check for referenced pseudo-versions: No referenced pseudo-versions were included in your question, so I cannot check whether any were yanked or superseded [1]. 2) github.com/openshift/assisted-image-service - Latest stable (non-prerelease, non-pseudo-version) release as of 2026-05-28: None found. pkg.go.dev shows only pseudo-versions (e.g., v0.0.0-20260130194910-a0962593c2d2) and no semver “stable tag” release number (like vX.Y.Z) [2]. - Whether the required fix exists in that stable tag: Not determinable, because there is no stable semver tag to check and the prompt does not specify which fix you mean (commit/issue/PR) [2]. - Pseudo-version yanked/superseded check for referenced pseudo-versions: No referenced pseudo-versions were included in your question, so I cannot verify yanking/supersession due to regressions [2]. What I need from you to complete the “required fix” + “referenced pseudo-versions yanked/superseded” parts - The exact pseudo-version strings you want checked for both modules. - The fix identifier for each module (e.g., the GitHub issue/PR number, commit SHA, or the file/function/behavior that should change). Once you provide those, I can (a) map whether the fix is present in the latest stable tag (or the latest commit behind a pseudo-version if no semver tag exists) and (b) confirm whether the specified pseudo-versions were later marked yanked or replaced (including regression notes) with additional targeted searches.

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the relevant go.mod sections around the line numbers mentioned in the review comment
target_file="go.mod"
if [ ! -f "$target_file" ]; then
  echo "Missing $target_file in repo root"
  exit 1
fi

echo "=== go.mod: lines 35-90 ==="
sed -n '35,90p' "$target_file" | nl -ba -w2 -s': '

echo "=== go.mod: lines 140-200 ==="
sed -n '140,200p' "$target_file" | nl -ba -w2 -s': '

echo "=== go.mod: show go version and module (top) ==="
sed -n '1,40p' "$target_file" | nl -ba -w2 -s': '

Repository: openshift/installer

Length of output: 153

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file="go.mod"
[ -f "$file" ] || { echo "Missing $file"; exit 1; }

echo "=== go.mod: exact lines 35-90 ==="
awk 'NR>=35 && NR<=90 {printf "%d: %s\n", NR, $0}' "$file"

echo
echo "=== go.mod: exact lines 140-200 ==="
awk 'NR>=140 && NR<=200 {printf "%d: %s\n", NR, $0}' "$file"

echo
echo "=== go.mod: matching modules ==="
rg -n --no-heading 'github\.com/diskfs/go-diskfs|github\.com/openshift/assisted-image-service|github\.com/anchore/go-lzo|github\.com/go-jose/go-jose/v4' "$file" || true

echo
echo "=== go.mod: any replace directives ==="
rg -n --no-heading '^\s*replace\s' "$file" || true

Repository: openshift/installer

Length of output: 7919

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== git diff --stat -- go.mod ==="
git diff --stat -- go.mod || true

echo
echo "=== git diff -- go.mod (limited context) ==="
git diff -U3 -- go.mod | sed -n '1,200p'

Repository: openshift/installer

Length of output: 143

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== git status -sb ==="
git status -sb || true

echo
echo "=== go.mod mtime + size ==="
stat -c '%n %y %s' go.mod || true

echo
echo "=== check if go.mod contains the claimed modules ==="
rg -n --no-heading 'github\.com/diskfs/go-diskfs v|github\.com/openshift/assisted-image-service v|github\.com/anchore/go-lzo v|github\.com/go-jose/go-jose/v4 v' go.mod || true

Repository: openshift/installer

Length of output: 506

🌐 Web query:

osv.dev github.com/go-jose/go-jose/v4 v4.1.3 affected fixed

💡 Result:

The Go module github.com/go-jose/go-jose/v4 at version v4.1.3 is affected by a security vulnerability identified as GHSA-78h2-9frx-2jm8 [1][2]. Vulnerability Details: The issue involves a panic during JSON Web Encryption (JWE) decryption [1][3]. The panic is triggered when the alg field in a JWE object specifies a key wrapping algorithm (specifically those ending in KW, excluding A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty [1][2]. This behavior occurs because the cipher.KeyUnwrap function attempts to allocate a slice with a zero or negative length based on the length of the empty encrypted_key field [1][2]. Affected Versions: - github.com/go-jose/go-jose/v4: Version v4.1.3 is affected [1][4]. Fixed Versions: - The vulnerability is fixed in version v4.1.4 and later [1][2][5]. Mitigation: If upgrading to v4.1.4 is not immediately possible, you can mitigate this vulnerability if your application does not require key wrapping algorithms. If the list of keyAlgorithms passed to ParseEncrypted, ParseEncryptedJSON, or ParseEncryptedCompact excludes key wrapping algorithms (those ending in KW), the application remains unaffected [1][3]. Additionally, developers using key wrapping can implement pre-validation to ensure the encrypted_key field in the JWE object is not empty [1][2].

Citations:

Replace disallowed pseudo-version pins and upgrade vulnerable go-jose

  • go.mod pins prerelease pseudo-versions for production dependencies:
    • github.com/diskfs/go-diskfs v1.7.1-0.20251217162235-58541aa8f559 (line 45)
    • github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120 (line 75)
      Replace with tagged stable releases (or document a written exception + follow-up target).
  • github.com/go-jose/go-jose/v4 v4.1.3 (line 171) is affected by GHSA-78h2-9frx-2jm8; fixed in v4.1.4+ → bump to v4.1.4 or later.
  • github.com/anchore/go-lzo v0.1.0 // indirect (line 164): if introduced in this change, provide need/license evidence per policy.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 45, Replace the pseudo-version pins with stable tagged
releases by updating the module entries for github.com/diskfs/go-diskfs and
github.com/openshift/assisted-image-service to their latest stable semver tags
(replace the v1.7.1-... and v0.0.0-... pseudo-versions), bump
github.com/go-jose/go-jose/v4 from v4.1.3 to v4.1.4 (or later) to address
GHSA-78h2-9frx-2jm8, and either remove or document the justification/license
evidence for the indirect github.com/anchore/go-lzo dependency if it was
introduced here; after editing go.mod run the standard go toolchain steps (go
get ./..., go mod tidy) to update go.sum and verify builds/tests.

Copy link
Copy Markdown
Member Author

@zaneb zaneb May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are the versions from the library module.
go-diskfs is pinned because it contains an important unreleased bug fix.
go-lzo is MIT licensed.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zaneb, understood — thanks for the context. The pseudo-version pins make sense given the fixes aren't yet in a stable upstream release, and MIT is unambiguously acceptable for go-lzo.

The one outstanding item from the original review that wasn't covered: github.com/go-jose/go-jose/v4 v4.1.3 is affected by GHSA-78h2-9frx-2jm8 (panic on JWE decryption when encrypted_key is empty, fixed in v4.1.4). Is that within scope to bump here, or is it also constrained by a transitive dependency floor from assisted-image-service?

✏️ Learnings added 
Learnt from: zaneb
Repo: openshift/installer PR: 10578
File: go.mod:45-45
Timestamp: 2026-05-28T05:25:56.279Z
Learning: In the openshift/installer repository (go.mod), the pseudo-version pin `github.com/diskfs/go-diskfs v1.7.1-0.20251217162235-58541aa8f559` is intentional: it tracks an important bug fix that is not yet part of any stable upstream release. Do not flag this as a policy violation.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

Copy link
Copy Markdown
Member Author

@zaneb zaneb May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

go-jose has nothing to do with this patch and isn't modified by it.

github.com/form3tech-oss/jwt-go v3.2.3+incompatible
github.com/go-logr/logr v1.4.3
github.com/go-openapi/errors v0.22.1
Expand All @@ -60,7 +60,7 @@ require (
github.com/gophercloud/utils/v2 v2.0.0-20250212084022-725b94822eeb
github.com/h2non/filetype v1.0.12
github.com/hashicorp/go-multierror v1.1.1
github.com/hashicorp/go-version v1.7.0
github.com/hashicorp/go-version v1.8.0
github.com/jarcoal/httpmock v1.3.1
github.com/jongio/azidext/go/azidext v0.5.0
github.com/kdomanski/iso9660 v0.2.1
Expand All @@ -70,9 +70,9 @@ require (
github.com/microsoftgraph/msgraph-sdk-go v0.59.0
github.com/nutanix-cloud-native/cluster-api-provider-nutanix v1.7.0
github.com/nutanix-cloud-native/prism-go-client v0.5.0
github.com/onsi/gomega v1.38.2
github.com/onsi/gomega v1.39.1
github.com/openshift/api v0.0.0-20260429122012-1180c0f5c3e9
github.com/openshift/assisted-image-service v0.0.0-20250917153356-4ca9ff81f712
github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120
github.com/openshift/assisted-service/api v0.0.0
github.com/openshift/assisted-service/client v0.0.0
github.com/openshift/assisted-service/models v0.0.0
Expand All @@ -94,7 +94,7 @@ require (
github.com/prometheus/common v0.67.4
github.com/rogpeppe/go-internal v1.14.1
github.com/shurcooL/vfsgen v0.0.0-20181202132449-6a9ea43bcacd
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af
github.com/sirupsen/logrus v1.9.4
github.com/spf13/cobra v1.10.1
github.com/stretchr/testify v1.11.1
github.com/thedevsaddam/retry v0.0.0-20200324223450-9769a859cc6d
Expand Down Expand Up @@ -161,13 +161,16 @@ require (
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
github.com/anchore/go-lzo v0.1.0 // indirect
github.com/aws/aws-sdk-go-v2/service/cloudfront v1.40.4 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.6 // indirect
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
github.com/djherbis/times v1.6.0 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
github.com/golangci/plugin-module-register v0.1.2 // indirect
github.com/klauspost/compress v1.18.0 // indirect
Comment on lines +164 to +173
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Check vulnerable module in go.mod:"
rg -n 'github.com/go-jose/go-jose/v4' go.mod go.sum

echo
echo "Query OSV for affected range:"
curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' -d '{
  "package": {"name":"github.com/go-jose/go-jose/v4","ecosystem":"Go"},
  "version":"4.1.3"
}' | jq '.vulns[] | {id, summary, aliases, affected: .affected[].ranges}'

Repository: openshift/installer

Length of output: 2072

Bump vulnerable dependency github.com/go-jose/go-jose/v4 from 4.1.3 to a patched release.

go.mod includes github.com/go-jose/go-jose/v4 v4.1.3 (indirect; go.mod line ~171; go.sum entries for v4.1.3). OSV reports GHSA-78h2-9frx-2jm8 / GO-2026-4945 (aliases include CVE-2026-34986) affecting this version, with the fix in v4.1.4. Update to v4.1.4 (or newer patched) and re-resolve to refresh go.sum hashes.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 171-171: github.com/go-jose/go-jose/v4 4.1.3: Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose

(GO-2026-4945)

[HIGH] 171-171: github.com/go-jose/go-jose/v4 4.1.3: Go JOSE Panics in JWE decryption

(GHSA-78h2-9frx-2jm8)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 164 - 173, Update the vulnerable indirect module
github.com/go-jose/go-jose/v4 from v4.1.3 to a patched release (e.g., v4.1.4) in
go.mod and re-resolve modules so go.sum is refreshed; specifically change the
version entry for github.com/go-jose/go-jose/v4 to v4.1.4 (or newer), then run
the module resolution commands (e.g., go get
github.com/go-jose/go-jose/v4@v4.1.4 and go mod tidy) to update go.sum and
ensure the vulnerability GHSA-78h2-9frx-2jm8 / GO-2026-4945 is patched.

github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
github.com/std-uritemplate/std-uritemplate/go/v2 v2.0.5 // indirect
Expand Down Expand Up @@ -226,7 +229,6 @@ require (
github.com/coreos/go-systemd/v22 v22.6.0 // indirect
github.com/coreos/vcontext v0.0.0-20230201181013-d72178a18687 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/djherbis/times v1.6.0 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
Expand Down Expand Up @@ -269,7 +271,6 @@ require (
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
github.com/klauspost/compress v1.18.0 // indirect
github.com/kr/fs v0.1.0 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
Expand Down
31 changes: 16 additions & 15 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,6 +182,8 @@ github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQ
github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I=
github.com/alingse/nilnesserr v0.1.2 h1:Yf8Iwm3z2hUUrP4muWfW83DF4nE3r1xZ26fGWUKCZlo=
github.com/alingse/nilnesserr v0.1.2/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
github.com/anchore/go-lzo v0.1.0 h1:NgAacnzqPeGH49Ky19QKLBZEuFRqtTG9cdaucc3Vncs=
github.com/anchore/go-lzo v0.1.0/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU=
Expand Down Expand Up @@ -345,8 +347,8 @@ github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42
github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY=
github.com/digitalocean/go-libvirt v0.0.0-20240220204746-fcabe97a6eed h1:pDXysiX24X+SE6MwVcfd5lGE21a4jNH9ZgaF9AyshHY=
github.com/digitalocean/go-libvirt v0.0.0-20240220204746-fcabe97a6eed/go.mod h1:isF7ghADfbC01gQx4vZnIOrxXT5RXLG81y+UCb5XSwc=
github.com/diskfs/go-diskfs v1.4.1 h1:iODgkzHLmvXS+1VDztpW53T+dQm8GQzi20y9yUd5UCA=
github.com/diskfs/go-diskfs v1.4.1/go.mod h1:+tOkQs8CMMog6Nvljg8DGIxEXrgL48iyT3OM3IlSz74=
github.com/diskfs/go-diskfs v1.7.1-0.20251217162235-58541aa8f559 h1:rJpHpZwao2igQ9blNiq9xnxwRxExD8tbwhIDaLxydvQ=
github.com/diskfs/go-diskfs v1.7.1-0.20251217162235-58541aa8f559/go.mod h1:02SN/PNyJRmOlwuJ8FcE1OkPFcMPvAoFUZCAvsE3Ty4=
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
Expand Down Expand Up @@ -587,8 +589,8 @@ github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5 h1:xhMrHhTJ6zxu3gA4enFM9MLn9AY7613teCdFnlUVbSQ=
github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
Expand Down Expand Up @@ -642,8 +644,8 @@ github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9
github.com/hashicorp/go-retryablehttp v0.7.0/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
Expand Down Expand Up @@ -872,16 +874,16 @@ github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vv
github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
github.com/onsi/ginkgo/v2 v2.28.0 h1:Rrf+lVLmtlBIKv6KrIGJCjyY8N36vDVcutbGJkyqjJc=
github.com/onsi/ginkgo/v2 v2.28.0/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.16.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
github.com/onsi/gomega v1.18.1/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs=
github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
Expand All @@ -890,8 +892,8 @@ github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE
github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
github.com/openshift/api v0.0.0-20260429122012-1180c0f5c3e9 h1:lZw6pYY7El1giNk1lYvkp6hLungiqwIOqLlH+Hm7w9g=
github.com/openshift/api v0.0.0-20260429122012-1180c0f5c3e9/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/assisted-image-service v0.0.0-20250917153356-4ca9ff81f712 h1:UJVh+I/AWZcOJASGdiLcTXkWB1OYNhS/383DHMcRvCQ=
github.com/openshift/assisted-image-service v0.0.0-20250917153356-4ca9ff81f712/go.mod h1:WGdSeSnK0voEWWwA4ar5eApNjGBLmGTpFurEKw/FXJc=
github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120 h1:fxnvVDuqfnAz9jCuritFrsb6IK33dxc/MxC9Gtv+nlk=
github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120/go.mod h1:eLxB7EHTDEvuJHobsVZsyMKOFkVATz4aGAwNtSGMdyM=
github.com/openshift/assisted-service/api v0.0.0-20250922204150-a52b83145bea h1:YhJ9iHKKT5ooAdVr8qq3BdudhTxP/WF0XYDT5gzi1ak=
github.com/openshift/assisted-service/api v0.0.0-20250922204150-a52b83145bea/go.mod h1:wA7MaLcf/KoUl7fhB1bHBdhRBLjWPih90sHpxOV6ZLE=
github.com/openshift/assisted-service/client v0.0.0-20250922204150-a52b83145bea h1:nYepkoJZSEjQEadaZ7oZraaeTug0zSV43HISLaHTCF0=
Expand Down Expand Up @@ -1021,8 +1023,8 @@ github.com/shurcooL/vfsgen v0.0.0-20181202132449-6a9ea43bcacd/go.mod h1:TrYk7fJV
github.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
github.com/sivchari/tenv v1.12.1 h1:+E0QzjktdnExv/wwsnnyk4oqZBUfuh89YMQT1cyuvSY=
Expand Down Expand Up @@ -1286,7 +1288,6 @@ golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
Expand Down
80 changes: 80 additions & 0 deletions vendor/github.com/anchore/go-lzo/.binny.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

13 changes: 13 additions & 0 deletions vendor/github.com/anchore/go-lzo/.bouncer.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

23 changes: 23 additions & 0 deletions vendor/github.com/anchore/go-lzo/.gitignore
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

19 changes: 19 additions & 0 deletions vendor/github.com/anchore/go-lzo/.goreleaser.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions vendor/github.com/anchore/go-lzo/CHANGELOG.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading