From 3d80b86107396f59417794b0d4431aa907869757 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Fri, 28 Aug 2026 20:44:27 -0500
Subject: [PATCH 01/13] test: fix git version annotation test

The test used to verify that stacker annotates OCIs with a git_version
value of the repository in which the stacker.yaml file is from caused
no end of problems since the stacker code to extract a GitVersion value
differed from how our the stacker binary obtains it's own version from
git.  Many times this aligned, but most often once a tagged build was
pushed or a lightweight tag was pushed the values diverged.

Resolve this conflict by creating a dedicated test for this and in that
test create a git repository separate from stacker and commit a test
stacker.yaml to this respostory and tagging it with a known value. This
makes validating the annotated git_version value in the OCI matches the
git version of the stacker.yaml used to build the OCI.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 test/basic.bats | 38 ++++++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/test/basic.bats b/test/basic.bats
index 7853d80a..d68d8659 100644
--- a/test/basic.bats
+++ b/test/basic.bats
@@ -92,11 +92,6 @@ EOF
     config=$(cat oci/blobs/sha256/$manifest | jq -r .config.digest | cut -f2 -d:)
     [ "$(cat oci/blobs/sha256/$config | jq -r '.config.Entrypoint | join(" ")')" = "echo hello world" ]
 
-    publishedGitVersion=$(cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.git_version"')
-    echo "WARK1: publishedGitVersion=${publishedGitVersion}" >&3
-    echo "WARK1: VERSION_FULL=${VERSION_FULL}" >&3
-    [ "$publishedGitVersion" = "$VERSION_FULL" ]
-
     # need to trim the extra newline from jq
     cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.stacker_yaml"' | sed '$ d' > stacker_yaml_annotation
 
@@ -136,6 +131,34 @@ EOF
     [ ! -d dest/rootfs/stacker ]
 }
 
+@test "git version annotation matches stackerfile repository" {
+    local gitdir="$TEST_TMPDIR/stackerfile-git"
+    local gitTag="v0.0.1"
+
+    mkdir "$gitdir"
+    cat > "$gitdir/stacker.yaml" <<"EOF"
+busybox:
+    from:
+        type: oci
+        url: ${{BUSYBOX_OCI}}
+    run: |
+        touch /foo
+EOF
+    git -C "$gitdir" init -q
+    git -C "$gitdir" add stacker.yaml
+    git -C "$gitdir" -c user.name=stacker-test -c user.email=stacker@test commit -qm test
+    git -C "$gitdir" tag "$gitTag"
+    give_user_ownership "$gitdir"
+
+    stacker build -f "$gitdir/stacker.yaml" --substitute BUSYBOX_OCI=${BUSYBOX_OCI}
+
+    manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:)
+    publishedGitVersion=$(cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.git_version"')
+    echo "publishedGitVersion=${publishedGitVersion}" >&3
+    echo "repositoryGitTag   =${gitTag}" >&3
+    [ "$publishedGitVersion" = "$gitTag" ]
+}
+
 @test "stacker.yaml without imports can run" {
     cat > stacker.yaml <<"EOF"
 busybox:
@@ -257,11 +280,6 @@ EOF
     config=$(cat oci/blobs/sha256/$manifest | jq -r .config.digest | cut -f2 -d:)
     [ "$(cat oci/blobs/sha256/$config | jq -r '.config.Entrypoint | join(" ")')" = "echo hello world" ]
 
-    publishedGitVersion=$(cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.git_version"')
-    echo "WARK2: publishedGitVersion=${publishedGitVersion}" >&3
-    echo "WARK2: VERSION_FULL=${VERSION_FULL}" >&3
-    [ "$publishedGitVersion" = "$VERSION_FULL" ]
-
     # need to trim the extra newline from jq
     cat oci/blobs/sha256/$manifest | jq -r '.annotations."io.stackeroci.stacker.stacker_yaml"' | sed '$ d' > stacker_yaml_annotation
 

From 063c22f5ac45f5609f6f6d191e5edbf2de94d502 Mon Sep 17 00:00:00 2001
From: Ryan Harper <rharper@woxford.com>
Date: Wed, 26 Aug 2026 09:14:59 -0500
Subject: [PATCH 02/13] fix: fetch full history when checking out repo in gh
 actions

Fetch tags and the history leading to the checked-out commit so that
git describe can find the closest version tag.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 .github/workflows/build.yaml          | 3 +++
 .github/workflows/cloc.yml            | 3 +++
 .github/workflows/codeql-analysis.yml | 3 +++
 .github/workflows/commit-msg.yaml     | 3 +++
 .github/workflows/coverage.yaml       | 3 +++
 .github/workflows/dco.yml             | 3 +++
 .github/workflows/release.yaml        | 3 +++
 7 files changed, 21 insertions(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 29dcfe26..95adcc57 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -55,6 +55,9 @@ jobs:
     name: "Build platform ${{ matrix.platform }} golang ${{ matrix.go-version }} privilege ${{ matrix.privilege-level }}"
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - name: Clean disk space
         uses: ./.github/actions/clean-runner
       - uses: benjlevesque/short-sha@v4.0
diff --git a/.github/workflows/cloc.yml b/.github/workflows/cloc.yml
index 5786f210..b79fd18a 100644
--- a/.github/workflows/cloc.yml
+++ b/.github/workflows/cloc.yml
@@ -23,6 +23,9 @@ jobs:
           go-version: 1.25.12
       - name: Check out source code
         uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 0bf728df..7a08368a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -44,6 +44,9 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v7
+      with:
+        fetch-tags: true
+        fetch-depth: 0
 
     - name: Install go
       uses: actions/setup-go@v6
diff --git a/.github/workflows/commit-msg.yaml b/.github/workflows/commit-msg.yaml
index 3cc5ba30..f6500921 100644
--- a/.github/workflows/commit-msg.yaml
+++ b/.github/workflows/commit-msg.yaml
@@ -17,6 +17,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - name: Check Commit Type
         uses: gsactions/commit-message-checker@v2
         with:
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index be7dfa12..8521ae57 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -51,6 +51,9 @@ jobs:
     name: "golang ${{ matrix.go-version }} privilege ${{ matrix.privilege-level }}"
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - name: Clean disk space
         uses: ./.github/actions/clean-runner
       - uses: benjlevesque/short-sha@v4.0
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index dd515645..fcb10654 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -12,6 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
+      with:
+        fetch-tags: true
+        fetch-depth: 0
     - name: Set up Python 3.x
       uses: actions/setup-python@v6
       with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index edecaf27..a3aae325 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -12,6 +12,9 @@ jobs:
       build-id: ${{steps.build-id.outputs.build-id}}
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          fetch-depth: 0
       - uses: benjlevesque/short-sha@v4.0
         id: short-sha
       - id: build-id

From 60255a1ace99789ea4e45075ed6eea13a776b440 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Wed, 26 Aug 2026 15:49:51 -0500
Subject: [PATCH 03/13] fix: Adjust VERSION makefile variable to use all tag
 types

Now that the basic.bats test for stacker published git_version
annotation has been resolved we can disconnect how stacker builds its
own VERSION value from how we test that stacker uses a repo's git
version when annotating OCI images.

VERSION will describe the current tree using tags, lightweight (aka
from github release page) and annotated (via git tag --annotate) and
use the --long flag which also shows reasonable values when we push new
commits after a tagged release in the form of <tag>-N-g<hash>.
For example:

$ make debug
TOP_LEVEL=/home/ryaharpe.linux/stacker
BUILD_ID=ccd1bd8
VERSION=v1.2.1-1-gccd1bd8-dirty

or

$ make debug
TOP_LEVEL=/home/ryaharpe.linux/stacker
BUILD_ID=7957373
VERSION=v1.2.1-2-g7957373

- Replace VERSION_FULL with VERSION everywhere.
- Replace github workflow use of github.sha/build-id as VERSION and
  instead set BUILD_ID. I believe that BUILD_ID is used to cache steps
  of the workflow.  We don't need to pass in the value for VERSION as
  the Makefile now will get the same version via git describe.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 .github/workflows/build.yaml    |  6 +++---
 .github/workflows/coverage.yaml |  2 +-
 Makefile                        | 26 +++++++++++++++++---------
 build.yaml                      |  2 +-
 4 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 95adcc57..4311e51d 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -92,13 +92,13 @@ jobs:
       - name: Build-level1
         run: |
           make show-info
-          make stacker-dynamic VERSION_FULL=${{ inputs.build-id }}
+          make stacker-dynamic BUILD_ID=${{ inputs.build-id }}
       - name: Lint
         run: |
           make lint
       - name: Build
         run: |
-          make stacker VERSION_FULL=${{ inputs.build-id }}
+          make stacker BUILD_ID=${{ inputs.build-id }}
         env:
           REGISTRY_SERVICE: ${{ inputs.registry-service }}
           REGISTRY_URL: localhost:5000
@@ -109,7 +109,7 @@ jobs:
         uses: ./.github/actions/show-disk-usage
       - name: Test
         run: |
-          make check VERSION_FULL=${{ inputs.build-id }} PRIVILEGE_LEVEL=${{ matrix.privilege-level }}
+          make check BUILD_ID=${{ inputs.build-id }} PRIVILEGE_LEVEL=${{ matrix.privilege-level }}
         env:
           REGISTRY_SERVICE: ${{ inputs.registry-service }}
           REGISTRY_URL: localhost:5000
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 8521ae57..86821214 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -89,7 +89,7 @@ jobs:
       - name: Build-level1
         run: |
           make show-info
-          make stacker-dynamic VERSION_FULL=${{ inputs.build-id }}
+          make stacker-dynamic BUILD_ID=${{ inputs.build-id }}
       - name: Show disk usage before running the tests
         if: always()
         uses: ./.github/actions/show-disk-usage
diff --git a/Makefile b/Makefile
index b1e2f7df..ace51e88 100644
--- a/Makefile
+++ b/Makefile
@@ -7,8 +7,9 @@ export GOCACHE ?= $(GOPATH)/gocache
 GO_SRC=$(shell find pkg cmd -name \*.go)
 GOARCH=$(shell go env GOARCH)
 GOOS=$(shell go env GOOS)
-VERSION?=$(shell git describe --tags || git rev-parse HEAD)
-VERSION_FULL?=$(if $(shell git status --porcelain --untracked-files=no),$(VERSION)-dirty,$(VERSION))
+# --tags includes both annotated and lightweight tags but must match our expected versioning
+VERSION?=$(shell git describe --tags --always --long --dirty --match 'v[0-9]*.[0-9]*.[0-9]*' 2>/dev/null || echo 'no-git')
+BUILD_ID?=$(shell git rev-parse --short HEAD || echo 'no-git')
 HASH = \#
 
 LXC_VERSION?=$(shell pkg-config --modversion lxc)
@@ -17,7 +18,7 @@ BUILD_TAGS = exclude_graphdriver_btrfs exclude_graphdriver_devicemapper containe
 
 STACKER_OPTS=--oci-dir=$(BUILD_D)/oci --roots-dir=$(BUILD_D)/roots --stacker-dir=$(BUILD_D)/stacker --storage-type=overlay
 
-VERSION_LDFLAGS=-X stackerbuild.io/stacker/pkg/lib.StackerVersion=$(VERSION_FULL) -X stackerbuild.io/stacker/pkg/lib.LXCVersion=$(LXC_VERSION)
+VERSION_LDFLAGS=-X stackerbuild.io/stacker/pkg/lib.StackerVersion=$(VERSION) -X stackerbuild.io/stacker/pkg/lib.LXCVersion=$(LXC_VERSION)
 build_stacker = go build $1 -tags "$(BUILD_TAGS) $2" -ldflags "$(VERSION_LDFLAGS) $3" -o $4 ./cmd/stacker
 
 # See doc/hacking.md for how to use a local oci or docker repository.
@@ -73,7 +74,7 @@ stacker: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper.c
 		--substitute STACKER_BUILD_BASE_IMAGE=$(STACKER_BUILD_BASE_IMAGE) \
 		--substitute LXC_CLONE_URL=$(LXC_CLONE_URL) \
 		--substitute LXC_BRANCH=$(LXC_BRANCH) \
-		--substitute VERSION_FULL=$(VERSION_FULL) \
+		--substitute VERSION=$(VERSION) \
 		--substitute WITH_COV=no
 
 stacker-cov: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper.c
@@ -83,7 +84,7 @@ stacker-cov: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapp
 		--substitute STACKER_BUILD_BASE_IMAGE=$(STACKER_BUILD_BASE_IMAGE) \
 		--substitute LXC_CLONE_URL=$(LXC_CLONE_URL) \
 		--substitute LXC_BRANCH=$(LXC_BRANCH) \
-		--substitute VERSION_FULL=$(VERSION_FULL) \
+		--substitute VERSION=$(VERSION) \
 		--substitute WITH_COV=yes
 
 .PHONY: publish-stacker-bin
@@ -94,7 +95,11 @@ $(STACKER_PUBLISH_BIN): stacker
 
 # On Ubuntu 24.04 the lxc package does not link against libsystemd so the pkg-config
 # below does list -lsystemd; we must add it to the list but only for stacker-dynamic
-ifeq ($(shell awk -F= '/VERSION_ID/ {print $$2}' /etc/os-release),"24.04")
+OS_VERSION_ID ?= "24.04"
+ifneq (,$(wildcard /etc/os-release))
+OS_VERSION_ID := $(shell awk -F= '/VERSION_ID/ {print $$2}' /etc/os-release)
+endif
+ifeq ($(OS_VERSION_ID),"24.04")
 ifeq (stacker-dynamic,$(firstword $(MAKECMDGOALS)))
 LXC_WRAPPER_LIBS=-lsystemd
 else
@@ -205,8 +210,8 @@ test: stacker download-tools lintbats
 		STACKER_BUILD_CENTOS_IMAGE=$(STACKER_BUILD_CENTOS_IMAGE) \
 		STACKER_BUILD_UBUNTU_IMAGE=$(STACKER_BUILD_UBUNTU_IMAGE) \
 		TOP_LEVEL=$(TOP_LEVEL) \
+		BUILD_ID=$(BUILD_ID) \
 		VERSION=$(VERSION) \
-		VERSION_FULL=$(VERSION_FULL) \
 		./test/main.py \
 		$(shell [ -z $(PRIVILEGE_LEVEL) ] || echo --privilege-level=$(PRIVILEGE_LEVEL)) \
 		$(patsubst %,test/%.bats,$(TEST))
@@ -230,8 +235,8 @@ test-cov: stacker-cov download-tools
 		STACKER_BUILD_CENTOS_IMAGE=$(STACKER_BUILD_CENTOS_IMAGE) \
 		STACKER_BUILD_UBUNTU_IMAGE=$(STACKER_BUILD_UBUNTU_IMAGE) \
 		TOP_LEVEL=$(TOP_LEVEL) \
+		BUILD_ID=$(BUILD_ID) \
 		VERSION=$(VERSION) \
-		VERSION_FULL=$(VERSION_FULL) \
 		./test/main.py \
 		$(shell [ -z $(PRIVILEGE_LEVEL) ] || echo --privilege-level=$(PRIVILEGE_LEVEL)) \
 		$(patsubst %,test/%.bats,$(TEST))
@@ -245,6 +250,9 @@ docker-clone: $(SKOPEO)
 .PHONY: show-info
 show-info:
 	@echo BUILD_D=$(BUILD_D)
+	@echo BUILD_ID=$(BUILD_ID)
+	@echo VERSION=$(VERSION)
+	@echo TOP_LEVEL=$(TOP_LEVEL)
 	@go env
 
 .PHONY: vendorup
@@ -255,8 +263,8 @@ vendorup:
 .PHONY: debug
 debug:
 	@echo TOP_LEVEL=$(TOP_LEVEL)
+	@echo BUILD_ID=$(BUILD_ID)
 	@echo VERSION=$(VERSION)
-	@echo VERSION_FULL=$(VERSION_FULL)
 
 .PHONY: clean
 clean:
diff --git a/build.yaml b/build.yaml
index c8f40daf..024ba4f3 100644
--- a/build.yaml
+++ b/build.yaml
@@ -88,7 +88,7 @@ build:
     # golang wants somewhere to put its garbage
     export HOME=/root
     export LXC_VERSION=$(git -C /lxc rev-parse HEAD)
-    export VERSION_FULL=${{VERSION_FULL}}
+    export VERSION=${{VERSION}}
 
     # apk go pkg doesn't seem to have the standard go.env which would set GOTOOLCHAIN=auto.
     # therefore it defaults to 'local', which ignores the `toolchain` line in go.mod

From 3a0865ec5fc696327de586b2e32656dac96ae668 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Thu, 27 Aug 2026 13:40:34 -0500
Subject: [PATCH 04/13] fix: optimize Makefile build dependencies

- Update the Makefile dependency graph to avoid rerunning build steps
  when their inputs have not changed.
- lint and go test now completes before attempting to compile any code
- Build host-specific and static lxc-wrapper artifacts separately. This
  keeps the nested static build from removing the wrapper used by the
  host dynamic build and avoids unrelated wrapper rebuilds during
  development and testing.
- Defer Makefile variable expansion where possible to prevent unnecessary
  go downloads or invocation of downloaded binaries, including during
  make clean.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 Makefile                           | 42 +++++++++++++++++++-----------
 build.yaml                         |  7 ++---
 cmd/stacker/lxc-wrapper/.gitignore |  2 +-
 cmd/stacker/lxc-wrapper/Makefile   |  8 +++++-
 cmd/stacker/main.go                |  1 +
 cmd/stacker/main_embed.go          |  5 ++--
 cmd/stacker/main_embed_static.go   | 11 ++++++++
 cmd/stacker/main_noembed.go        |  1 +
 pkg/container/container.go         |  2 +-
 pkg/container/userns.go            |  2 +-
 pkg/types/config.go                |  8 +++---
 11 files changed, 61 insertions(+), 28 deletions(-)
 create mode 100644 cmd/stacker/main_embed_static.go

diff --git a/Makefile b/Makefile
index ace51e88..3172bcb2 100644
--- a/Makefile
+++ b/Makefile
@@ -61,11 +61,17 @@ GOLANGCI_LINT_URL = https://github.com/golangci/golangci-lint/releases/download
 GOLANGCI_LINT = $(TOOLS_D)/bin/golangci-lint
 
 STAGE1_STACKER ?= ./stacker-dynamic
-STACKER_PUBLISH_BIN := stacker-$(GOOS)-$(GOARCH)
+STACKER_PUBLISH_BIN = stacker-$(GOOS)-$(GOARCH)
+LXC_WRAPPER_DYNAMIC = cmd/stacker/lxc-wrapper/lxc-wrapper-host
+LXC_WRAPPER_STATIC = cmd/stacker/lxc-wrapper/lxc-wrapper-static
+LINT = $(BUILD_D)/lint
+GO_TEST = $(BUILD_D)/go-test
 
 STACKER_DEPS = $(GO_SRC) go.mod go.sum
+STACKER_DYNAMIC_DEPS = $(GO_TEST) $(STACKER_DEPS) $(LXC_WRAPPER_DYNAMIC)
+STACKER_STATIC_DEPS = $(STACKER_DEPS) $(LXC_WRAPPER_STATIC)
 
-stacker: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper.c
+stacker: $(STAGE1_STACKER) build.yaml
 	echo STACKER_DOCKER_BASE=$(STACKER_DOCKER_BASE)
 	echo STACKER_BUILD_BASE_IMAGE=$(STACKER_BUILD_BASE_IMAGE)
 	$(STAGE1_STACKER) --debug $(STACKER_OPTS) build \
@@ -77,7 +83,7 @@ stacker: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper.c
 		--substitute VERSION=$(VERSION) \
 		--substitute WITH_COV=no
 
-stacker-cov: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper.c
+stacker-cov: $(STAGE1_STACKER) build.yaml
 	$(STAGE1_STACKER) --debug $(STACKER_OPTS) build \
 		-f build.yaml \
 		--substitute BUILD_D=$(BUILD_D) \
@@ -107,38 +113,42 @@ LXC_WRAPPER_LIBS=
 endif
 endif
 
-stacker-static: $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper
+stacker-static: $(STACKER_STATIC_DEPS)
 	$(call build_stacker,,static_build,-extldflags '-static',stacker)
 
 # can't use a comma in func call args, so do this instead
 , := ,
-stacker-static-cov: $(GO_SRC) go.mod go.sum cmd/stacker/lxc-wrapper/lxc-wrapper
+stacker-static-cov: $(STACKER_STATIC_DEPS)
 	$(call build_stacker,-cover -coverpkg="./pkg/...$(,)./cmd/...",static_build,-extldflags '-static',stacker)
 
-# TODO: because we clean lxc-wrapper in the nested build, this always rebuilds.
-# Could find a better way to do this.
-stacker-dynamic: $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper
+stacker-dynamic: $(STACKER_DYNAMIC_DEPS)
 	$(call build_stacker,,,,stacker-dynamic)
 
-cmd/stacker/lxc-wrapper/lxc-wrapper: cmd/stacker/lxc-wrapper/lxc-wrapper.c
-	make -C cmd/stacker/lxc-wrapper LDFLAGS=-static LDLIBS="$(shell pkg-config --static --libs lxc) $(LXC_WRAPPER_LIBS) -lpthread -ldl" lxc-wrapper
+$(LXC_WRAPPER_DYNAMIC) $(LXC_WRAPPER_STATIC): cmd/stacker/lxc-wrapper/lxc-wrapper.c
+	make -C cmd/stacker/lxc-wrapper OUTPUT=$(notdir $@) LDFLAGS=-static LDLIBS="$(shell pkg-config --static --libs lxc) $(LXC_WRAPPER_LIBS) -lpthread -ldl"
 
 
 .PHONY: go-download
 go-download:
 	go mod download
 
-.PHONY: lint
-lint: $(GO_SRC) $(GOLANGCI_LINT)
+lint: $(LINT)
+
+$(LINT): $(GO_SRC) go.mod go.sum $(GOLANGCI_LINT)
 	go mod tidy
 	go fmt ./... && ([ -z $(CI) ] || git diff --exit-code)
 	bash test/static-analysis.sh
 	$(GOLANGCI_LINT) run --build-tags "$(BUILD_TAGS) skipembed"
+	@mkdir -p $(dir $@)
+	@touch $@
+
+go-test: $(GO_TEST)
 
-.PHONY: go-test
-go-test:
+$(GO_TEST): $(LINT) $(GO_SRC) go.mod go.sum
 	go test -v -trimpath -cover -coverprofile=coverage.txt -covermode=atomic -tags "exclude_graphdriver_btrfs exclude_graphdriver_devicemapper containers_image_openpgp osusergo netgo skipembed" ./pkg/... ./cmd/...
 	go tool cover -html coverage.txt  -o $(HACK_D)/coverage.html
+	@mkdir -p $(dir $@)
+	@touch $@
 
 .PHONY: download-tools
 download-tools: $(GOLANGCI_LINT) $(REGCLIENT) $(ZOT) $(BATS) $(UMOCI) $(SKOPEO)
@@ -200,7 +210,9 @@ PRIVILEGE_LEVEL ?= unpriv
 # make check TEST=basic will run only the basic test
 # make check PRIVILEGE_LEVEL=unpriv will run only unprivileged tests
 .PHONY: check
-check: lint test go-test
+check:
+	$(MAKE) go-test
+	$(MAKE) test
 
 .PHONY: test
 test: stacker download-tools lintbats
diff --git a/build.yaml b/build.yaml
index 024ba4f3..1a893410 100644
--- a/build.yaml
+++ b/build.yaml
@@ -97,9 +97,10 @@ build:
 
     cd /stacker-tree
     make BUILD_D=/build show-info
-    make BUILD_D=/build -C cmd/stacker/lxc-wrapper clean
+    # -B rebuilds the static wrapper for this build environment without
+    # cleaning the host wrapper used by stacker-dynamic.
     if [ x${{WITH_COV}} = x"yes" ]; then
-      make BUILD_D=/build stacker-static-cov
+      make -B BUILD_D=/build stacker-static-cov
     else
-      make -C /stacker-tree stacker-static
+      make -B -C /stacker-tree stacker-static
     fi
diff --git a/cmd/stacker/lxc-wrapper/.gitignore b/cmd/stacker/lxc-wrapper/.gitignore
index c4cb619f..d8548793 100644
--- a/cmd/stacker/lxc-wrapper/.gitignore
+++ b/cmd/stacker/lxc-wrapper/.gitignore
@@ -1 +1 @@
-lxc-wrapper
+lxc-wrapper*
diff --git a/cmd/stacker/lxc-wrapper/Makefile b/cmd/stacker/lxc-wrapper/Makefile
index 15fba8f0..e88c3946 100644
--- a/cmd/stacker/lxc-wrapper/Makefile
+++ b/cmd/stacker/lxc-wrapper/Makefile
@@ -1,2 +1,8 @@
+OUTPUT ?= lxc-wrapper
+
+$(OUTPUT): lxc-wrapper.c
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $< $(LDLIBS)
+
+.PHONY: clean
 clean:
-	-rm lxc-wrapper
+	-rm -f lxc-wrapper lxc-wrapper-host lxc-wrapper-static
diff --git a/cmd/stacker/main.go b/cmd/stacker/main.go
index 9d2a8a9d..454c3b06 100644
--- a/cmd/stacker/main.go
+++ b/cmd/stacker/main.go
@@ -257,6 +257,7 @@ func main() {
 		}
 
 		config.EmbeddedFS = embeddedFS
+		config.EmbeddedWrapperPath = embeddedWrapperPath
 
 		if config.WorkDir == "" || ctx.IsSet("work-dir") {
 			config.WorkDir = ctx.String("work-dir")
diff --git a/cmd/stacker/main_embed.go b/cmd/stacker/main_embed.go
index 8108c423..1e38ff45 100644
--- a/cmd/stacker/main_embed.go
+++ b/cmd/stacker/main_embed.go
@@ -1,10 +1,11 @@
-//go:build !skipembed
+//go:build !skipembed && !static_build
 
 package main
 
 import "embed"
 
-//go:embed lxc-wrapper/lxc-wrapper
+//go:embed lxc-wrapper/lxc-wrapper-host
 var embeddedFS embed.FS
 
 const hasEmbedded = true
+const embeddedWrapperPath = "lxc-wrapper/lxc-wrapper-host"
diff --git a/cmd/stacker/main_embed_static.go b/cmd/stacker/main_embed_static.go
new file mode 100644
index 00000000..37ab7e87
--- /dev/null
+++ b/cmd/stacker/main_embed_static.go
@@ -0,0 +1,11 @@
+//go:build !skipembed && static_build
+
+package main
+
+import "embed"
+
+//go:embed lxc-wrapper/lxc-wrapper-static
+var embeddedFS embed.FS
+
+const hasEmbedded = true
+const embeddedWrapperPath = "lxc-wrapper/lxc-wrapper-static"
diff --git a/cmd/stacker/main_noembed.go b/cmd/stacker/main_noembed.go
index 2790c3ea..4ad0621f 100644
--- a/cmd/stacker/main_noembed.go
+++ b/cmd/stacker/main_noembed.go
@@ -7,3 +7,4 @@ import "embed"
 var embeddedFS embed.FS
 
 const hasEmbedded = true
+const embeddedWrapperPath = ""
diff --git a/pkg/container/container.go b/pkg/container/container.go
index 25b924e2..347d8653 100644
--- a/pkg/container/container.go
+++ b/pkg/container/container.go
@@ -147,7 +147,7 @@ func (c *Container) Execute(args []string, stdin io.Reader) error {
 
 	cmd, cleanup, err := embed_exec.GetCommand(
 		c.sc.EmbeddedFS,
-		"lxc-wrapper/lxc-wrapper",
+		c.sc.EmbeddedWrapperPath,
 		append([]string{"spawn", c.c.Name(), c.sc.RootFSDir, f.Name()}, args...)...,
 	)
 	if err != nil {
diff --git a/pkg/container/userns.go b/pkg/container/userns.go
index 47a0eb18..94e1ad66 100644
--- a/pkg/container/userns.go
+++ b/pkg/container/userns.go
@@ -91,7 +91,7 @@ func MaybeRunInNamespace(config types.StackerConfig, userCmd []string) error {
 	log.Debugf("%s-ing %v", args[0], args[1:])
 	cmd, cleanup, err := embed_exec.GetCommand(
 		config.EmbeddedFS,
-		"lxc-wrapper/lxc-wrapper",
+		config.EmbeddedWrapperPath,
 		args...,
 	)
 	if err != nil {
diff --git a/pkg/types/config.go b/pkg/types/config.go
index 3e1f9835..7ca9ccb3 100644
--- a/pkg/types/config.go
+++ b/pkg/types/config.go
@@ -22,10 +22,10 @@ type StackerConfig struct {
 	// SOURCE_DATE_EPOCH environment variable.
 	SourceDateEpoch *time.Time `yaml:"-"`
 
-	// EmbeddedFS should contain a (statically linked) lxc-wrapper binary
-	// (built from cmd/lxc-wrapper/lxc-wrapper.c) at
-	// lxc-wrapper/lxc-wrapper.
-	EmbeddedFS embed.FS `yaml:"-"`
+	// EmbeddedFS should contain a statically linked lxc-wrapper binary built
+	// from cmd/lxc-wrapper/lxc-wrapper.c at EmbeddedWrapperPath.
+	EmbeddedFS          embed.FS `yaml:"-"`
+	EmbeddedWrapperPath string   `yaml:"-"`
 }
 
 // Substitutions - return an array of substitutions for StackerFiles

From 271a0b69967bd02ad48a93216eda35c7ff176089 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Thu, 27 Aug 2026 16:23:38 -0500
Subject: [PATCH 05/13] fix: bump bats version to one with --abort feature to
 fail fast

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 Makefile     | 8 ++++++--
 test/main.py | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 3172bcb2..f3205cd8 100644
--- a/Makefile
+++ b/Makefile
@@ -47,7 +47,8 @@ REGCLIENT_VERSION := v0.5.1
 SKOPEO = $(TOOLS_D)/bin/skopeo
 export SKOPEO_VERSION = 1.13.0
 BATS = $(TOOLS_D)/bin/bats
-BATS_VERSION := v1.10.0
+BATS_VERSION := v1.13.0
+BATS_VERSION_STAMP := $(TOOLS_D)/.bats-$(BATS_VERSION)
 # OCI registry
 ZOT := $(TOOLS_D)/bin/zot
 ZOT_VERSION := v2.1.8
@@ -185,7 +186,9 @@ $(SKOPEO):
 	cd $(TOP_LEVEL); \
 	rm -rf $$tmpdir;
 
-$(BATS):
+$(BATS): $(BATS_VERSION_STAMP)
+
+$(BATS_VERSION_STAMP):
 	mkdir -p $(TOOLS_D)/bin
 	rm -rf bats-core
 	git clone -b $(BATS_VERSION) https://github.com/bats-core/bats-core.git
@@ -195,6 +198,7 @@ $(BATS):
 	git clone --depth 1 https://github.com/bats-core/bats-support $(TOP_LEVEL)/test/test_helper/bats-support
 	git clone --depth 1 https://github.com/bats-core/bats-assert $(TOP_LEVEL)/test/test_helper/bats-assert
 	git clone --depth 1 https://github.com/bats-core/bats-file $(TOP_LEVEL)/test/test_helper/bats-file
+	touch $@
 
 
 $(UMOCI):
diff --git a/test/main.py b/test/main.py
index 144f70db..a3ae80de 100755
--- a/test/main.py
+++ b/test/main.py
@@ -48,6 +48,7 @@ def check_env(env_to_check):
         "./test/setup_suite.bash",
         "--jobs",
         str(options.jobs),
+        "--abort",
         "--tap",
         "--timing",
         "--verbose-run",

From a737128f37c7e207d7ee0073ca14a6e423782256 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Fri, 28 Aug 2026 17:40:07 -0500
Subject: [PATCH 06/13] fix: keep make clean self-contained

Defer the Go architecture lookup until publishing so make clean does not
download a toolchain. Remove all generated top-level build and test
artifacts from clean.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 Makefile | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/Makefile b/Makefile
index f3205cd8..851c784b 100644
--- a/Makefile
+++ b/Makefile
@@ -62,7 +62,6 @@ GOLANGCI_LINT_URL = https://github.com/golangci/golangci-lint/releases/download
 GOLANGCI_LINT = $(TOOLS_D)/bin/golangci-lint
 
 STAGE1_STACKER ?= ./stacker-dynamic
-STACKER_PUBLISH_BIN = stacker-$(GOOS)-$(GOARCH)
 LXC_WRAPPER_DYNAMIC = cmd/stacker/lxc-wrapper/lxc-wrapper-host
 LXC_WRAPPER_STATIC = cmd/stacker/lxc-wrapper/lxc-wrapper-static
 LINT = $(BUILD_D)/lint
@@ -95,10 +94,8 @@ stacker-cov: $(STAGE1_STACKER) build.yaml
 		--substitute WITH_COV=yes
 
 .PHONY: publish-stacker-bin
-publish-stacker-bin: $(STACKER_PUBLISH_BIN)
-
-$(STACKER_PUBLISH_BIN): stacker
-	cp -v $< $@
+publish-stacker-bin: stacker
+	cp -v $< stacker-$$(go env GOOS)-$$(go env GOARCH)
 
 # On Ubuntu 24.04 the lxc package does not link against libsystemd so the pkg-config
 # below does list -lsystemd; we must add it to the list but only for stacker-dynamic
@@ -284,7 +281,6 @@ debug:
 
 .PHONY: clean
 clean:
-	-unshare -Urm rm -rf stacker stacker-dynamic .build
+	-unshare -Urm rm -rf ./stacker ./stacker-dynamic ./stacker-*-* ./.build ./.stacker ./oci ./roots ./stackertest-* ./coverage.txt ./hack ./bats-core
 	-rm -rf ./test/centos ./test/ubuntu ./test/busybox ./test/alpine ./test/test_helper
 	-make -C cmd/stacker/lxc-wrapper clean
-	-rm -rf $(TOOLS_D)

From 45bbab06c1c64fafbfeea5c2d3fbe344f9deb556 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Fri, 28 Aug 2026 17:40:20 -0500
Subject: [PATCH 07/13] fix: improve Bats fail-fast diagnostics

Keep test cases parallel while reporting failures directly and preserving the
failed test logs. Stream live Bats test results and allow unprivileged tests
to traverse their temporary-directory parent.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 test/main.py | 82 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 81 insertions(+), 1 deletion(-)

diff --git a/test/main.py b/test/main.py
index a3ae80de..8de27c88 100755
--- a/test/main.py
+++ b/test/main.py
@@ -7,8 +7,12 @@
 import glob
 import multiprocessing
 import os
+from pathlib import Path
+import re
+import shutil
 import subprocess
 import sys
+import tempfile
 
 
 def check_env(env_to_check):
@@ -27,6 +31,71 @@ def check_env(env_to_check):
         raise RuntimeError(f"EnvCheckFailures: {errors}")
 
 
+def dump_log(log):
+    print(f"\n--- Bats log: {log} ---")
+    try:
+        print(log.read_text(errors="replace"), end="")
+    except OSError as err:
+        print(f"Unable to read {log}: {err}")
+
+
+def dump_bats_logs(tmpdir):
+    run_dirs = sorted(Path(tmpdir).glob("bats-run-*"))
+    failed_logs = []
+    for run_dir in run_dirs:
+        for stdout in (run_dir / "parallel_output").glob("*/stdout"):
+            try:
+                if "not ok " in stdout.read_text(errors="replace"):
+                    failed_logs.append(stdout)
+            except OSError:
+                continue
+
+    print(f"Bats failure logs retained in {tmpdir}")
+    if failed_logs:
+        for stdout in sorted(failed_logs, key=lambda log: int(log.parent.name)):
+            test_name = stdout.parents[2] / "test" / f"{stdout.parent.name}.name"
+            if test_name.is_file():
+                print(f"\nBats failed test: {test_name.read_text().strip()}")
+            dump_log(stdout)
+            stderr = stdout.with_name("stderr")
+            if stderr.is_file() and stderr.stat().st_size:
+                dump_log(stderr)
+        return
+
+    print("No failed test worker log was found; dumping suite-level diagnostics.")
+    for run_dir in run_dirs:
+        for log in (run_dir / "warnings.log", run_dir / "suite.out"):
+            if log.is_file() and log.stat().st_size:
+                dump_log(log)
+
+
+def run_bats(cmd, env):
+    abort_count_warning = re.compile(
+        r"# bats warning: Executed (\d+) instead of expected (\d+) tests"
+    )
+    run_tmpdir_notice = re.compile(r"BATS_RUN_TMPDIR: .+")
+    bats = subprocess.Popen(
+        cmd,
+        env=env,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+    )
+    for line in bats.stdout:
+        match = abort_count_warning.fullmatch(line.rstrip("\n"))
+        if match:
+            print(
+                "# Bats fail-fast: reported results for "
+                f"{match.group(1)} of {match.group(2)} planned tests before stopping.",
+                flush=True,
+            )
+        elif run_tmpdir_notice.fullmatch(line.rstrip("\n")):
+            continue
+        else:
+            print(line, end="", flush=True)
+    return bats.wait()
+
+
 priv_levels = ("priv", "unpriv")
 
 parser = argparse.ArgumentParser()
@@ -48,6 +117,9 @@ def check_env(env_to_check):
         "./test/setup_suite.bash",
         "--jobs",
         str(options.jobs),
+        # Keep test cases parallel, but let Bats report a failing file directly.
+        "--no-parallelize-across-files",
+        "--no-tempdir-cleanup",
         "--abort",
         "--tap",
         "--timing",
@@ -56,6 +128,10 @@ def check_env(env_to_check):
     cmd.extend(options.tests)
 
     env = os.environ.copy()
+    bats_tmpdir = tempfile.mkdtemp(prefix="stacker-bats-")
+    # Mode 0711 lets unprivileged tests traverse TMPDIR without listing retained logs.
+    os.chmod(bats_tmpdir, 0o711)
+    env["TMPDIR"] = bats_tmpdir
     env["PRIVILEGE_LEVEL"] = priv
     try:
         check_env
@@ -65,7 +141,11 @@ def check_env(env_to_check):
 
     print("running tests in modes:", priv)
     try:
-        subprocess.check_call(cmd, env=env)
+        if run_bats(cmd, env) != 0:
+            raise subprocess.CalledProcessError(1, cmd)
     except subprocess.CalledProcessError:
         print("tests in modes:", priv, "failed")
+        dump_bats_logs(bats_tmpdir)
         sys.exit(1)
+    else:
+        shutil.rmtree(bats_tmpdir)

From 39586ea1719392ae346676fc281f4375b2b218e4 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Fri, 28 Aug 2026 17:40:50 -0500
Subject: [PATCH 08/13] test: reap concurrent test background build

Reap the background build after intentionally killing it so Bash does not
print a misleading termination message during a successful test.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 test/concurrent.bats | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/concurrent.bats b/test/concurrent.bats
index 5e90aeba..482ef140 100644
--- a/test/concurrent.bats
+++ b/test/concurrent.bats
@@ -37,5 +37,7 @@ EOF
 EOF
 
     kill -9 $snoozpid
+    # Reap the intentionally killed build without printing Bash's "Killed" notice.
+    wait "$snoozpid" 2>/dev/null || true
 
 }

From 26ab6e0562ee3d99129fc1eaa040fbc97195083f Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Fri, 28 Aug 2026 17:41:04 -0500
Subject: [PATCH 09/13] test: improve image conversion test reporting

Name conversion tests after their work and report progress for long-running
clone, conversion, and build steps. Fetch only the history needed by the
upstream Dockerfile tests.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 test/convert.bats | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/test/convert.bats b/test/convert.bats
index a4728013..8926a7f1 100644
--- a/test/convert.bats
+++ b/test/convert.bats
@@ -46,6 +46,7 @@ EOF
   # build should now work
   ## docker build -t test
   mkdir -p /out
+  echo "# building converted Dockerfile; this may take several minutes" >&3
   stacker build -f stacker.yaml --substitute-file stacker-subs.yaml --substitute IMAGE=app
   if [ -z "${REGISTRY_URL}" ]; then
     skip "publish step of test because no registry found in REGISTRY_URL env variable"
@@ -55,12 +56,14 @@ EOF
   stacker clean
 }
 
-@test "alpine" {
+@test "alpine convert and build" {
   skip_slow_test
-  git clone https://github.com/alpinelinux/docker-alpine.git
+  echo "# cloning alpine Dockerfile repository; this may take some time" >&3
+  git clone --depth 1 https://github.com/alpinelinux/docker-alpine.git
   chmod -R a+rwx docker-alpine
   cd docker-alpine
   TEMPDIR=$(mktemp -d)
+  echo "# converting and building alpine; this may take several minutes" >&3
   stacker convert --docker-file Dockerfile --output-file stacker.yaml --substitute-file stacker-subs.yaml
   stacker build -f stacker.yaml --substitute-file stacker-subs.yaml --substitute IMAGE=alpine --substitute STACKER_VOL1="$TEMPDIR"
   if [ -nz "${REGISTRY_URL}" ]; then
@@ -70,11 +73,13 @@ EOF
   stacker clean
 }
 
-@test "elasticsearch" {
+@test "elasticsearch convert and build" {
   skip_slow_test
+  echo "# cloning elasticsearch Dockerfile repository; this may take some time" >&3
   git clone --branch v8.17.10 --depth 1 https://github.com/elastic/dockerfiles.git
   chmod -R a+rwx dockerfiles
   cd dockerfiles/elasticsearch
+  echo "# converting and building elasticsearch; this may take several minutes" >&3
   stacker convert --docker-file Dockerfile --output-file stacker.yaml --substitute-file stacker-subs.yaml
   stacker build -f stacker.yaml --substitute-file stacker-subs.yaml --substitute IMAGE=elasticsearch
   if [ -nz "${REGISTRY_URL}" ]; then
@@ -83,14 +88,18 @@ EOF
   rm -f stacker.yaml stacker-subs.yaml
   stacker clean
 }
-@test "python" {
+@test "python3 convert and build" {
   skip_slow_test
-  git clone https://github.com/docker-library/python.git
+  echo "# cloning python Dockerfile repository; this may take some time" >&3
+  git init -q python
   cd python
-  # pick a specific commit so we don't get broken by upstream changes:
-  git reset --hard aad39d215779f27b410b25f612b6680a75781edb
+  git remote add origin https://github.com/docker-library/python.git
+  # Fetch only the pinned commit so we do not need the repository's full history.
+  git fetch --depth 1 origin aad39d215779f27b410b25f612b6680a75781edb
+  git checkout --detach FETCH_HEAD
   cd 3.11/alpine3.22
   chmod -R a+rw .
+  echo "# converting and building python; this may take several minutes" >&3
   stacker convert --docker-file Dockerfile --output-file stacker.yaml --substitute-file stacker-subs.yaml
   stacker build -f stacker.yaml --substitute-file stacker-subs.yaml --substitute IMAGE=python
   if [ -nz "${REGISTRY_URL}" ]; then

From a8dd82aea7d46ffb055f2c886aa48a244f0d1feb Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Fri, 28 Aug 2026 17:41:13 -0500
Subject: [PATCH 10/13] test: isolate HTTP import test namespaces

Use a namespace name unique to each Bats test so parallel test teardown
cannot remove a namespace that another test is creating or using.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 test/import-http.bats | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/test/import-http.bats b/test/import-http.bats
index 236a7c1c..52be39f0 100644
--- a/test/import-http.bats
+++ b/test/import-http.bats
@@ -2,6 +2,7 @@ load helpers
 
 function setup() {
     stacker_setup
+    NETNS_NAME="stacker-test-${BATS_TEST_NUMBER}"
     mkdir -p reference
     mkdir -p dest
     rm -f nm_orig
@@ -35,7 +36,7 @@ function teardown() {
     rm -rf img || true
     rm -rf reference || true
     rm -rf dest || true
-    ip netns del stacker-test || true
+    ip netns del "$NETNS_NAME" 2>/dev/null || true
 }
 
 @test "importing from cache works for unreachable http urls" {
@@ -48,8 +49,9 @@ function teardown() {
     stacker build -f img/stacker2.yaml
     umoci ls --layout oci
     # Second execution reads from the cache, but cannot access the net
-    ip netns add stacker-test
-    run ip netns exec stacker-test "${ROOT_DIR}/stacker" build -f img/stacker2.yaml
+    ip netns del "$NETNS_NAME" 2>/dev/null || true
+    ip netns add "$NETNS_NAME"
+    run ip netns exec "$NETNS_NAME" "${ROOT_DIR}/stacker" build -f img/stacker2.yaml
     echo $output
     [ "$status" -eq 0 ]
     umoci ls --layout oci

From 90ad9bf83ab4b5cd2b20389cb8ead2af88b2284e Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Fri, 28 Aug 2026 17:41:22 -0500
Subject: [PATCH 11/13] test: avoid command substitution in import test names

Use literal --require-hash text in test descriptions so Bats does not
interpret the old backticks as command substitutions.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 test/import.bats | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/import.bats b/test/import.bats
index 8beee20b..ec17f832 100644
--- a/test/import.bats
+++ b/test/import.bats
@@ -205,7 +205,7 @@ EOF
     echo $output | grep 'hash does not match'
 }
 
-@test "`require hash` flag allows build when hash is provided" {
+@test "--require-hash allows build when hash is provided" {
     touch test_file
     test_file_sha=$(sha test_file) || { stderr "failed sha $test_file"; return 1; }
     wget https://google.com/favicon.ico -O google_fav
@@ -229,7 +229,7 @@ EOF
     stacker build --require-hash
 }
 
-@test "`require hash` flag fails build when http import hash is not provided" {
+@test "--require-hash fails build when http import hash is not provided" {
     touch test_file
     test_file_sha=$(sha test_file) || { stderr "failed sha $test_file"; return 1; }
     wget https://google.com/favicon.ico -O google_fav
@@ -249,7 +249,7 @@ EOF
     bad_stacker build --require-hash
 }
 
-@test "`require hash` flag allows build even when local hash is not provided" {
+@test "--require-hash allows build even when local hash is not provided" {
     touch test_file
     wget https://google.com/favicon.ico -O google_fav
     google_sha=$(sha google_fav) || { stderr "failed sha $google_fav"; return 1; }

From 708a96f9073288609bcdefa149b4ddddafa70932 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryaharpe@cisco.com>
Date: Sat, 29 Aug 2026 16:01:30 -0500
Subject: [PATCH 12/13] test: avoid atomfs/erofs device-mapper block name race
 in parallel tests

Use a unique top layer for the deliberately invalid verity device rather
than the common base image layer. This prevents concurrently running
atomfs/erofs tests from creating or mounting the same device-mapper name.

Signed-off-by: Ryan Harper <ryaharpe@cisco.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 test/atomfs-erofs.bats    | 9 +++++++--
 test/atomfs-squashfs.bats | 9 +++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/test/atomfs-erofs.bats b/test/atomfs-erofs.bats
index 2662faf6..f5b6c689 100644
--- a/test/atomfs-erofs.bats
+++ b/test/atomfs-erofs.bats
@@ -137,6 +137,8 @@ EOF
 
 @test "bad existing verity device is rejected" {
     require_privilege priv
+    # This test creates a host-global device-mapper name from the layer hash.
+    # Keep its layer distinct from the concurrently running mount test.
     cat > stacker.yaml <<"EOF"
 test:
     from:
@@ -144,12 +146,15 @@ test:
         url: ${{BUSYBOX_OCI}}
     run: |
         touch /hello
+        touch /bad-existing-verity-device-erofs
 EOF
     stacker build --layer-type=erofs --substitute BUSYBOX_OCI=${BUSYBOX_OCI}
 
     manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:)
-    first_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[0].digest | cut -f2 -d:)
-    devname="$first_layer_hash-verity"
+    # Use this test's unique top layer, not the common base image layer.
+    last_layer_num=$(($(cat oci/blobs/sha256/$manifest | jq -r '.layers | length')-1))
+    last_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[$last_layer_num].digest | cut -f2 -d:)
+    devname="$last_layer_hash-verity"
 
     # make an evil device and fake it as an existing verity device
     dd if=/dev/random of=mydev bs=50K count=1
diff --git a/test/atomfs-squashfs.bats b/test/atomfs-squashfs.bats
index dd5118d8..01e75147 100644
--- a/test/atomfs-squashfs.bats
+++ b/test/atomfs-squashfs.bats
@@ -137,6 +137,8 @@ EOF
 
 @test "bad existing verity device is rejected" {
     require_privilege priv
+    # This test creates a host-global device-mapper name from the layer hash.
+    # Keep its layer distinct from the concurrently running mount test.
     cat > stacker.yaml <<"EOF"
 test:
     from:
@@ -144,12 +146,15 @@ test:
         url: ${{BUSYBOX_OCI}}
     run: |
         touch /hello
+        touch /bad-existing-verity-device-squashfs
 EOF
     stacker build --layer-type=squashfs --substitute BUSYBOX_OCI=${BUSYBOX_OCI}
 
     manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:)
-    first_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[0].digest | cut -f2 -d:)
-    devname="$first_layer_hash-verity"
+    # Use this test's unique top layer, not the common base image layer.
+    last_layer_num=$(($(cat oci/blobs/sha256/$manifest | jq -r '.layers | length')-1))
+    last_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[$last_layer_num].digest | cut -f2 -d:)
+    devname="$last_layer_hash-verity"
 
     # make an evil device and fake it as an existing verity device
     dd if=/dev/random of=mydev bs=50K count=1

From 6d4bad50777ff5d692dfb92f33b89280958272f6 Mon Sep 17 00:00:00 2001
From: Ryan Harper <rharper@woxford.com>
Date: Thu, 3 Sep 2026 22:07:52 -0500
Subject: [PATCH 13/13] fix: bump go mods, go version and workflow actions

- bump to latest go 1.26
- build(deps): Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 dependencies go
  - closes #795
- build(deps): Bump github.com/cheggaaa/pb/v3 from 3.1.7 to 3.2.1 dependencies go
  - closes #794
- build(deps): Bump go.podman.io/image/v5 from 5.40.0 to 5.41.1 dependencies go
  - closes #793
- build(deps): Bump actions/setup-python from 6 to 7 dependencies github_actions
  - closes #792
- build(deps): Bump actions/setup-go from 6 to 7 dependencies github_actions
  - closes #791
- build(deps): Bump actions/stale from 10 to 11 dependencies github_actions
  - closes #790
- build(deps): Bump github.com/moby/buildkit from 0.31.1 to 0.32.2 dependencies go
  - closes #788
- build(deps): Bump github.com/lxc/incus/v7 from 7.2.0 to 7.3.0 dependencies go
  - closes #787

Signed-off-by: Ryan Harper <rharper@woxford.com>
---
 .github/workflows/build.yaml          |   4 +-
 .github/workflows/cloc.yml            |   4 +-
 .github/workflows/codeql-analysis.yml |   4 +-
 .github/workflows/coverage.yaml       |   4 +-
 .github/workflows/dco.yml             |   2 +-
 Makefile                              |   2 +-
 go.mod                                |  83 ++++++++--------
 go.sum                                | 134 ++++++++++++++------------
 8 files changed, 121 insertions(+), 116 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4311e51d..615e9583 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -9,7 +9,7 @@ on:
         type: string
         description: 'Stringified JSON object listing go versions'
         default: >-
-          ["1.25.12"]
+          ["1.26.8"]
       privilege-level:
         required: false
         type: string
@@ -63,7 +63,7 @@ jobs:
       - uses: benjlevesque/short-sha@v4.0
         id: short-sha
       - name: Set up golang ${{ matrix.go-version }}
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go-version }}
       - name: Setup Environment
diff --git a/.github/workflows/cloc.yml b/.github/workflows/cloc.yml
index b79fd18a..07e5d107 100644
--- a/.github/workflows/cloc.yml
+++ b/.github/workflows/cloc.yml
@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: 1.25.12
+          go-version: 1.26.8
       - name: Check out source code
         uses: actions/checkout@v7
         with:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 7a08368a..dd921444 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,9 +49,9 @@ jobs:
         fetch-depth: 0
 
     - name: Install go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v7
       with:
-        go-version: 1.25.12
+        go-version: 1.26.8
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 86821214..15d153ff 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -9,7 +9,7 @@ on:
         type: string
         description: 'Stringified JSON object listing go versions'
         default: >-
-          ["1.25.12"]
+          ["1.26.8"]
       privilege-level:
         required: false
         type: string
@@ -59,7 +59,7 @@ jobs:
       - uses: benjlevesque/short-sha@v4.0
         id: short-sha
       - name: Set up golang ${{ matrix.go-version }}
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go-version }}
       - name: Setup Environment
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index fcb10654..79443e69 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -16,7 +16,7 @@ jobs:
         fetch-tags: true
         fetch-depth: 0
     - name: Set up Python 3.x
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: '3.x'
     - name: Check DCO
diff --git a/Makefile b/Makefile
index 851c784b..f92d36b6 100644
--- a/Makefile
+++ b/Makefile
@@ -57,7 +57,7 @@ UMOCI_VERSION := main
 
 export PATH := $(TOOLS_D)/bin:$(PATH)
 
-GOLANGCI_LINT_VERSION = 2.7.2
+GOLANGCI_LINT_VERSION = 2.13.1
 GOLANGCI_LINT_URL = https://github.com/golangci/golangci-lint/releases/download
 GOLANGCI_LINT = $(TOOLS_D)/bin/golangci-lint
 
diff --git a/go.mod b/go.mod
index eaedd2d8..7aa008dd 100644
--- a/go.mod
+++ b/go.mod
@@ -1,33 +1,33 @@
 module stackerbuild.io/stacker
 
-go 1.25.12
+go 1.26.8
 
 require (
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/apex/log v1.9.0
 	github.com/apparentlymart/go-shquot v0.0.1
-	github.com/cheggaaa/pb/v3 v3.1.7
+	github.com/cheggaaa/pb/v3 v3.2.1
 	github.com/dustin/go-humanize v1.0.1
 	github.com/google/uuid v1.6.0
 	github.com/justincormack/go-memfd v0.0.0-20170219213707-6e4af0518993
 	github.com/klauspost/pgzip v1.2.6
 	github.com/lxc/go-lxc v0.0.0-20260316180011-3af4ce000ed7
-	github.com/lxc/incus/v7 v7.2.0
+	github.com/lxc/incus/v7 v7.4.0
 	github.com/minio/sha256-simd v1.0.1
 	github.com/mitchellh/hashstructure v1.1.0
-	github.com/moby/buildkit v0.31.1
+	github.com/moby/buildkit v0.32.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/umoci v0.6.1-0.20251213054154-70fc5ee1f4df
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/xattr v0.4.12
 	github.com/smartystreets/goconvey v1.8.1
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 	github.com/twmb/algoimpl v0.0.0-20170717182524-076353e90b94
 	github.com/udhos/equalfile v0.3.0
 	github.com/urfave/cli/v2 v2.27.7
 	github.com/vbatts/go-mtree v0.7.0
-	go.podman.io/image/v5 v5.40.0
+	go.podman.io/image/v5 v5.41.1
 	golang.org/x/sys v0.47.0
 	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v2 v2.4.0
@@ -37,102 +37,103 @@ require (
 require (
 	cyphar.com/go-pathrs v0.2.5 // indirect
 	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v1.0.0-rc.4 // indirect
+	github.com/containerd/platforms v1.0.0-rc.5 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/freddierice/go-losetup v0.0.0-20220711213114-2a14873012db // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6 // indirect
-	github.com/mattn/go-sqlite3 v1.14.47 // indirect
+	github.com/mattn/go-sqlite3 v1.14.50 // indirect
 	github.com/mistifyio/go-zfs/v4 v4.0.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/moby/api v1.54.2 // indirect
-	github.com/moby/moby/client v0.4.1 // indirect
+	github.com/moby/moby/api v1.55.0 // indirect
+	github.com/moby/moby/client v0.5.1 // indirect
 	github.com/moby/sys/capability v0.4.0 // indirect
 	github.com/moby/sys/user v0.4.1 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/sys/userns v0.2.0 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/sigstore/protobuf-specs v0.5.1 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
-	github.com/smallstep/pkcs7 v0.1.1 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
+	github.com/smallstep/pkcs7 v0.2.1 // indirect
 	github.com/smarty/assertions v1.15.0 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
-	github.com/vbauerster/mpb/v8 v8.12.0 // indirect
+	github.com/vbauerster/cupwriter v0.0.4 // indirect
+	github.com/vbauerster/mpb/v8 v8.14.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
-	go.opentelemetry.io/otel v1.44.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.opentelemetry.io/otel v1.46.0 // indirect
+	go.opentelemetry.io/otel/metric v1.46.0 // indirect
+	go.opentelemetry.io/otel/trace v1.46.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 )
 
 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/containerd/typeurl/v2 v2.3.0 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
-	github.com/containers/ocicrypt v1.3.0 // indirect
+	github.com/containers/ocicrypt v1.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.8 // indirect
-	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/go-connections v0.8.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/go-containerregistry v0.21.6 // indirect
+	github.com/google/go-containerregistry v0.21.7 // indirect
 	github.com/google/go-intervals v0.0.2 // indirect
 	github.com/gopherjs/gopherjs v1.17.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/jtolds/gls v4.20.0+incompatible // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.22 // indirect
-	github.com/mattn/go-runewidth v0.0.24 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/mattn/go-runewidth v0.0.28 // indirect
+	github.com/miekg/pkcs11 v1.1.2 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/opencontainers/runtime-spec v1.3.0 // indirect
 	github.com/opencontainers/selinux v1.15.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/proglottis/gpgme v0.1.6 // indirect
 	github.com/rootless-containers/proto/go-proto v0.0.0-20260207013450-f6ee952d53d9 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
-	github.com/sigstore/fulcio v1.8.5 // indirect
+	github.com/sigstore/fulcio v1.8.7 // indirect
 	github.com/sigstore/sigstore v1.10.8 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
+	github.com/ulikunitz/xz v0.5.16 // indirect
 	github.com/urfave/cli v1.22.17 // indirect
 	github.com/vbatts/tar-split v0.12.3 // indirect
 	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
-	go.podman.io/storage v1.63.0 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
-	google.golang.org/grpc v1.81.1 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	go.podman.io/storage v1.64.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	machinerun.io/atomfs v1.2.1
 )
 
@@ -153,5 +154,3 @@ replace golang.org/x/crypto => golang.org/x/crypto v0.52.0
 replace golang.org/x/net => golang.org/x/net v0.55.0
 
 replace golang.org/x/text => golang.org/x/text v0.39.0
-
-replace google.golang.org/grpc => google.golang.org/grpc v1.82.1
diff --git a/go.sum b/go.sum
index ac0c9c0f..930ed36a 100644
--- a/go.sum
+++ b/go.sum
@@ -9,8 +9,10 @@ github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
 github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 h1:0kQAzHq8vLs7Pptv+7TxjdETLf/nIqJpIB4oC6Ba4vY=
+github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29/go.mod h1:ZWa7ssZJT30CCDGJ7fk/2SBTq9BIQrrVjrcss0UW2s0=
+github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
 github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
@@ -30,26 +32,28 @@ github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cheggaaa/pb/v3 v3.1.7 h1:2FsIW307kt7A/rz/ZI2lvPO+v3wKazzE4K/0LtTWsOI=
-github.com/cheggaaa/pb/v3 v3.1.7/go.mod h1:/Ji89zfVPeC/u5j8ukD0MBPHt2bzTYp74lQ7KlgFWTQ=
+github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
+github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v1.0.0-rc.4 h1:M42JrUT4zfZTqtkUwkr0GzmUWbfyO5VO0Q5b3op97T4=
-github.com/containerd/platforms v1.0.0-rc.4/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
+github.com/containerd/platforms v1.0.0-rc.5 h1:vXd569rDrz8LeMXzAnBsy6LADV5YtsD8oyaRarxdmSU=
+github.com/containerd/platforms v1.0.0-rc.5/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
 github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
 github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
 github.com/containerd/typeurl/v2 v2.3.0 h1:HZHPhRWo5XMy3QGQoPrUzbW/2ckwjfweHmOwlkIrPAQ=
 github.com/containerd/typeurl/v2 v2.3.0/go.mod h1:Qk+PAdUYArVj41TnGi6rJ+48RF0PkcTc4i/taoBcK0w=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
-github.com/containers/ocicrypt v1.3.0 h1:ps3St6ZWNWhOQ/Kqld6K2wPHt01Mj3AqRTNCZLIWOfo=
-github.com/containers/ocicrypt v1.3.0/go.mod h1:PmfuGFpBwnGLnbqBm+QIy2nc8noDJ1Wt6B19la7VBFo=
+github.com/containers/ocicrypt v1.3.2 h1:MuqHSfiPpGzoAQdgDSX85FgixSgIm9mSDXTLTgugY5E=
+github.com/containers/ocicrypt v1.3.2/go.mod h1:ntBZabYG0rlvstB/1rK/ba2laaU5EHE0pD5ioHoPTq4=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
@@ -62,14 +66,14 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs=
-github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw=
+github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
 github.com/docker/docker-credential-helpers v0.9.8/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
-github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
+github.com/docker/go-connections v0.8.1/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@@ -86,8 +90,8 @@ github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -99,8 +103,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.6 h1:T+yqQIlJXKrM98Om4DlW3GoWQAmhZuLMwoDOvVrtiUM=
-github.com/google/go-containerregistry v0.21.6/go.mod h1:U7MMSBIJynke2MVQrQk19NP9k/uQsGz/h0amIFSHMbo=
+github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU=
+github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE=
 github.com/google/go-intervals v0.0.2 h1:FGrVEiUnTRKR8yE04qzXYaJMtnIYqobR5QbblK3ixcM=
 github.com/google/go-intervals v0.0.2/go.mod h1:MkaR3LNRfeKLPmqgJYs4E66z5InYjmCjbbr4TQlcT6Y=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -137,8 +141,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lxc/go-lxc v0.0.0-20260316180011-3af4ce000ed7 h1:MXZvjx5IYff3AacumHgmaJqWXyfROImWfJzmMP1ye4o=
 github.com/lxc/go-lxc v0.0.0-20260316180011-3af4ce000ed7/go.mod h1:3UTWXVcHfgxE7JM4ZUnsy6bDA8L1vuzwJbJRF6dlB90=
-github.com/lxc/incus/v7 v7.2.0 h1:LCJmJnn6drX6Igi0ZYLdoxV+PP2I62g06wA12UqT7jY=
-github.com/lxc/incus/v7 v7.2.0/go.mod h1:m78+++9iytP0GZLClbY5BLTXzptYkAKVcvleYRAcYOs=
+github.com/lxc/incus/v7 v7.4.0 h1:gZPEQvFVOeeSVhsnZVObcrSCLVfnowBP3VM8Fr5QaAQ=
+github.com/lxc/incus/v7 v7.4.0/go.mod h1:drJHddxdr1men9MS1VYrdjDWBeiI92yL//Aq4oAIPCY=
 github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6 h1:YDjLk3wsL5ZLhLC4TIwIvT2NkSCAdAV6pzzZaRfj4jk=
 github.com/martinjungblut/go-cryptsetup v0.0.0-20220520180014-fd0874fd07a6/go.mod h1:gZoZ0+POlM1ge/VUxWpMmZVNPzzMJ7l436CgkQ5+qzU=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
@@ -147,37 +151,37 @@ github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
-github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
-github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
-github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-sqlite3 v1.14.47 h1:jOBI62gS7nKeZv+as1oGEy0+1qISgXwH/QBlR6KbfIo=
-github.com/mattn/go-sqlite3 v1.14.47/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU=
+github.com/mattn/go-runewidth v0.0.28/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mattn/go-sqlite3 v1.14.50 h1:dmdFvo1XG4MPzA4IkAmE9upVz/Nj31uRoM5+jC8hYbY=
+github.com/mattn/go-sqlite3 v1.14.50/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
-github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/miekg/pkcs11 v1.1.2 h1:/VxmeAX5qU6Q3EwafypogwWbYryHFmF2RpkJmw3m4MQ=
+github.com/miekg/pkcs11 v1.1.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/mistifyio/go-zfs/v4 v4.0.0 h1:sU0+5dX45tdDK5xNZ3HBi95nxUc48FS92qbIZEvpAg4=
 github.com/mistifyio/go-zfs/v4 v4.0.0/go.mod h1:weotFtXTHvBwhr9Mv96KYnDkTPBOHFUbm9cBmQpesL0=
 github.com/mitchellh/hashstructure v1.1.0 h1:P6P1hdjqAAknpY/M1CGipelZgp+4y9ja9kmUZPXP+H0=
 github.com/mitchellh/hashstructure v1.1.0/go.mod h1:xUDAozZz0Wmdiufv0uyhnHkUTN6/6d8ulp4AwfLKrmA=
-github.com/moby/buildkit v0.31.1 h1:j3p55abBl4kiXXPZgYX+6zWgB2aefqHXoPown12fIzU=
-github.com/moby/buildkit v0.31.1/go.mod h1:YM5iNEbNCc6L1Zt3YWFB/aXNLufvf4Rcu0DPlc9HwQg=
+github.com/moby/buildkit v0.32.2 h1:Sfy7+u6dUv/2yuBc9KCoK70Re8atuV8aPZ5UOC068Vc=
+github.com/moby/buildkit v0.32.2/go.mod h1:0GB/EJ1d+4VIVqIAgy3asaoGkVXy7IrDfVy7mPhOvg8=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
-github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
+github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=
+github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
 github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
-github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
-github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
+github.com/moby/sys/userns v0.2.0 h1:nEtDtp7NCV/6dutSklNe8FrENPwFdc4mXnZqC/JWgXM=
+github.com/moby/sys/userns v0.2.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -206,8 +210,6 @@ github.com/pkg/xattr v0.4.12/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6k
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/proglottis/gpgme v0.1.6 h1:8WpQ8VWggLdxkuTnW+sZ1r1t92XBNd8GZNDhQ4Rz+98=
 github.com/proglottis/gpgme v0.1.6/go.mod h1:5LoXMgpE4bttgwwdv9bLs/vwqv3qV7F4glEEZ7mRKrM=
 github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
@@ -228,10 +230,10 @@ github.com/sigstore/protobuf-specs v0.5.1 h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah
 github.com/sigstore/protobuf-specs v0.5.1/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats=
 github.com/sigstore/sigstore v1.10.4 h1:ytOmxMgLdcUed3w1SbbZOgcxqwMG61lh1TmZLN+WeZE=
 github.com/sigstore/sigstore v1.10.4/go.mod h1:tDiyrdOref3q6qJxm2G+JHghqfmvifB7hw+EReAfnbI=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
-github.com/smallstep/pkcs7 v0.1.1 h1:x+rPdt2W088V9Vkjho4KtoggyktZJlMduZAtRHm68LU=
-github.com/smallstep/pkcs7 v0.1.1/go.mod h1:dL6j5AIz9GHjVEBTXtW+QliALcgM19RtXaTeyxI+AfA=
+github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
+github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
+github.com/smallstep/pkcs7 v0.2.1 h1:6Kfzr/QizdIuB6LSv8y1LJdZ3aPSfTNhTLqAx9CTLfA=
+github.com/smallstep/pkcs7 v0.2.1/go.mod h1:RcXHsMfL+BzH8tRhmrF1NkkpebKpq3JEM66cOFxanf0=
 github.com/smarty/assertions v1.15.0 h1:cR//PqUBUiQRakZWqBiFFQ9wb8emQGDb0HeGdqGByCY=
 github.com/smarty/assertions v1.15.0/go.mod h1:yABtdzeQs6l1brC900WlRNwj6ZR55d7B+E8C6HtKdec=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
@@ -251,8 +253,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=
 github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
 github.com/tj/assert v0.0.0-20171129193455-018094318fb0/go.mod h1:mZ9/Rh9oLWpLLDRpvE+3b7gP/C2YyLFYxNmcLnPTMe0=
@@ -276,8 +278,10 @@ github.com/vbatts/go-mtree v0.5.4 h1:OMAb8jaCyiFA7zXj0Zc/oARcxBDBoeu2LizjB8BVJl0
 github.com/vbatts/go-mtree v0.5.4/go.mod h1:5GqJbVhm9BBiCc4K5uc/c42FPgXulHaQs4sFUEfIWMo=
 github.com/vbatts/tar-split v0.12.3 h1:Cd46rkGXI3Td4yrVNwU8ripbxFaQbmesqhjBUUYAJSw=
 github.com/vbatts/tar-split v0.12.3/go.mod h1:sQOc6OlqGCr7HkGx/IDBeKiTIvqhmj8KffNhEXG4Nq0=
-github.com/vbauerster/mpb/v8 v8.12.0 h1:+gneY3ifzc88tKDzOtfG8k8gfngCx615S2ZmFM4liWg=
-github.com/vbauerster/mpb/v8 v8.12.0/go.mod h1:V02YIuMVo301Y1VE9VtZlD8s84OMsk+EKN6mwvf/588=
+github.com/vbauerster/cupwriter v0.0.4 h1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys=
+github.com/vbauerster/cupwriter v0.0.4/go.mod h1:IFyzS6Xis5dnBH/rdAhrnuzg3c+KkUqEN6yE8lhJlDw=
+github.com/vbauerster/mpb/v8 v8.14.0 h1:55SR80dptMfASxIG/oCEkBXgBhxeSu4GrVsjl16oKmA=
+github.com/vbauerster/mpb/v8 v8.14.0/go.mod h1:HgpQPKfcWe3kbuGGPmi+jatHreMase5C3Fp5dpdAy0Q=
 github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg=
 github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
@@ -285,24 +289,26 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
 go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
 go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
 go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
 go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
-go.podman.io/image/v5 v5.40.0 h1:gNQvj343Eb4juCitUBkuDz1T82Zpp6nhgMEXzNfCges=
-go.podman.io/image/v5 v5.40.0/go.mod h1:qgXf1abXJ+2l01pL8+CljaMKryeo6ahaHO7H51ooKIc=
-go.podman.io/storage v1.63.0 h1:bj/pAWFhChbuBmejzno0iQLhU7FevGVXepRXm5pFGeA=
-go.podman.io/storage v1.63.0/go.mod h1:z4Z9K+7GhKjWL/Y1O17+4f8a1KGijVeC9hr3tymhSOs=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
+go.podman.io/image/v5 v5.41.1 h1:iPrhIt7/aNfRBMuzoxbMUVpQmR7Q75ahnrzkIC4JWLQ=
+go.podman.io/image/v5 v5.41.1/go.mod h1:wfgAlfczPK4ZZw/wn/Av2iJfb3z9Vv+RKWgjHNShzZk=
+go.podman.io/storage v1.64.0 h1:ryHCZO+Zl0ZG7OTHF+Qc4C0zLNuoe9W35zgE7mh2pYw=
+go.podman.io/storage v1.64.0/go.mod h1:ft0DzCRMZs1yn0rszmLYXEEwgd7IIc66JRwSRPUDwwc=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
 golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -334,8 +340,9 @@ golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -398,14 +405,14 @@ gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
 google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d h1:mpAgMyM9vQHxycBlDq50y1VHpfSfVwzXvrQKtYbXuUY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 h1:1VUiZAXyC+zmiFYi+WLtBzr68Cj8wOofHjjrA/kkizc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -418,7 +425,6 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=