Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package falcosecurity-container-plugin for
openSUSE:Factory checked in at 2026-10-27 16:48:39
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/falcosecurity-container-plugin (Old)
and
/work/SRC/openSUSE:Factory/.falcosecurity-container-plugin.new.2252680 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "falcosecurity-container-plugin"
Tue Oct 27 16:48:39 2026 rev:5 rq:1392828 version:0.7.6
Changes:
--------
---
/work/SRC/openSUSE:Factory/falcosecurity-container-plugin/falcosecurity-container-plugin.changes
2026-09-24 23:00:19.744428031 +0200
+++
/work/SRC/openSUSE:Factory/.falcosecurity-container-plugin.new.2252680/falcosecurity-container-plugin.changes
2026-10-27 16:49:13.114131794 +0100
@@ -1,0 +2,14 @@
+Mon Oct 26 19:25:49 UTC 2026 - Martin Pluskal <[email protected]>
+
+- Update to version 0.7.6:
+ * Bound each steady-state container lookup with the engine
+ timeout, including retries and deferred lookups (0 disables)
+ * Retry lookups whose metadata enrichment hit the deadline,
+ keeping the deferred container identity
+ * Rebuild with the Go 1.26.10 release, including the
+ certificate-verification fix for the eMudhra CA issue
+ * Update containerd to 2.2.9 and Podman to 6.1.3
+- Raise the Go build floor to 1.26.10 as upstream now requires
+- Refresh vendor.tar.gz for the new go-worker dependencies
+
+-------------------------------------------------------------------
Old:
----
container-plugin-0.7.5.tar
New:
----
container-plugin-0.7.6.tar
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ falcosecurity-container-plugin.spec ++++++
--- /var/tmp/diff_new_pack.RmNojc/_old 2026-10-27 16:49:14.319182296 +0100
+++ /var/tmp/diff_new_pack.RmNojc/_new 2026-10-27 16:49:14.321182380 +0100
@@ -17,7 +17,7 @@
Name: falcosecurity-container-plugin
-Version: 0.7.5
+Version: 0.7.6
Release: 0
Summary: Falcosecurity plugin providing container metadata
# Legal-Review-Notice: MPL-2.0 from vendored Go modules statically
@@ -35,7 +35,7 @@
Patch0: container-plugin-use-system-deps.patch
BuildRequires: cmake
BuildRequires: gcc-c++
-BuildRequires: go >= 1.25
+BuildRequires: go >= 1.26.10
BuildRequires: libbtrfs-devel
BuildRequires: ninja
BuildRequires: pkgconfig
++++++ _service ++++++
--- /var/tmp/diff_new_pack.RmNojc/_old 2026-10-27 16:49:14.423186655 +0100
+++ /var/tmp/diff_new_pack.RmNojc/_new 2026-10-27 16:49:14.434187116 +0100
@@ -6,10 +6,10 @@
<service name="obs_scm" mode="manual">
<param name="url">https://github.com/falcosecurity/plugins.git</param>
<param name="scm">git</param>
- <param name="revision">refs/tags/plugins/container/v0.7.5</param>
+ <param name="revision">refs/tags/plugins/container/v0.7.6</param>
<param name="subdir">plugins/container</param>
<param name="filename">container-plugin</param>
- <param name="versionformat">0.7.5</param>
+ <param name="versionformat">0.7.6</param>
<param name="changesgenerate">enable</param>
</service>
<service name="tar" mode="manual"/>
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.RmNojc/_old 2026-10-27 16:49:14.482189128 +0100
+++ /var/tmp/diff_new_pack.RmNojc/_new 2026-10-27 16:49:14.489189421 +0100
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param
name="url">https://github.com/falcosecurity/plugins.git</param>
- <param
name="changesrevision">a246c88790db1180f8b15411a5fb20ce853f67a4</param></service></servicedata>
+ <param
name="changesrevision">f9711e2ac10bd243cb97fff7af20e87ceeaf931f</param></service></servicedata>
(No newline at EOF)
++++++ container-plugin-0.7.5.tar -> container-plugin-0.7.6.tar ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/container-plugin-0.7.5/CMakeLists.txt
new/container-plugin-0.7.6/CMakeLists.txt
--- old/container-plugin-0.7.5/CMakeLists.txt 2026-09-22 18:51:59.000000000
+0200
+++ new/container-plugin-0.7.6/CMakeLists.txt 2026-10-26 20:27:13.632196684
+0100
@@ -9,7 +9,7 @@
# project metadata
project(
container
- VERSION 0.7.5
+ VERSION 0.7.6
DESCRIPTION "Falco container metadata enrichment Plugin"
LANGUAGES CXX)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/container-plugin-0.7.5/README.md
new/container-plugin-0.7.6/README.md
--- old/container-plugin-0.7.5/README.md 2026-09-22 18:51:59.000000000
+0200
+++ new/container-plugin-0.7.6/README.md 2026-10-26 20:27:13.632196684
+0100
@@ -137,7 +137,7 @@
label_max_len: 100 # (optional, default: 100; container labels larger
than this won't be reported)
with_size: false # (optional, default: false; whether to enable
container size inspection, which is inherently slow)
hooks: ['create', 'start'] # (optional, default: 'create'. Some fields
might not be available in create hook, but we are guaranteed that it gets
triggered before first process gets started)
- engine_timeout: 10 # (optional, default: 10; seconds to wait for a
container engine to answer at startup, 0 disables the timeout)
+ engine_timeout: 10 # (optional, default: 10; seconds to wait for a
container engine to answer, at startup and for single-container lookups, 0
disables the timeout)
engines:
docker:
enabled: true
@@ -165,6 +165,8 @@
For containerd, this also includes namespaces whose container listing was
interrupted or had not started. Their listing is retried in the background
until it succeeds, without requiring a new process event. Each attempt uses
`engine_timeout` and stops when capture stops. Setting `engine_timeout` to `0`
disables the timeout: startup and background namespace listings then wait
indefinitely unless cancelled.
+The same timeout bounds every single-container lookup after startup too: the
lookups asked for by events, their retries, and the deferred startup lookups
each wait at most `engine_timeout` seconds for an engine to answer. A lookup
that expires is treated as failed: no partial metadata is published, and the
container is retried (keeping its deferred identity, if it had one) instead of
being considered resolved with incomplete data. With the timeout disabled, a
single lookup again waits indefinitely unless cancelled.
+
N.B. With podman the timeout can be exceeded by up to about 0.6 seconds, since
the podman client retries a failed request three times with fixed pauses in
between.
### Rules
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/container-plugin-0.7.5/go-worker/go.mod
new/container-plugin-0.7.6/go-worker/go.mod
--- old/container-plugin-0.7.5/go-worker/go.mod 2026-09-22 18:51:59.000000000
+0200
+++ new/container-plugin-0.7.6/go-worker/go.mod 2026-10-26 20:27:13.644198031
+0100
@@ -1,15 +1,15 @@
module github.com/falcosecurity/plugins/plugins/container/go-worker
-go 1.25.9
+go 1.26.10
require (
github.com/containerd/containerd/api v1.10.0
- github.com/containerd/containerd/v2 v2.2.8
+ github.com/containerd/containerd/v2 v2.2.9
github.com/containerd/typeurl/v2 v2.3.0
github.com/docker/docker v28.5.2+incompatible
github.com/falcosecurity/plugin-sdk-go v0.8.3
github.com/google/uuid v1.6.0
- github.com/moby/moby/api v1.54.2
+ github.com/moby/moby/api v1.55.0
github.com/opencontainers/runtime-spec v1.3.0
github.com/stretchr/testify v1.11.1
k8s.io/cri-api v0.35.0
@@ -17,23 +17,29 @@
)
require (
- cyphar.com/go-pathrs v0.2.4 // indirect
+ cyphar.com/go-pathrs v0.2.5 // indirect
+ github.com/ProtonMail/go-crypto v1.4.1 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
- github.com/fsouza/go-dockerclient v1.13.1 // indirect
+ github.com/cloudflare/circl v1.6.3 // indirect
+ github.com/fsouza/go-dockerclient v1.13.2 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/mistifyio/go-zfs/v4 v4.0.0 // indirect
- github.com/moby/buildkit v0.31.1 // indirect
+ github.com/moby/buildkit v0.31.2 // indirect
github.com/moby/go-archive v0.3.0 // indirect
- github.com/moby/moby/client v0.4.1 // indirect
+ github.com/moby/moby/client v0.5.1 // indirect
github.com/moby/patternmatcher v0.6.1 // indirect
github.com/moby/sys/devices v0.1.0 // indirect
github.com/openshift/imagebuilder v1.2.21 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
// indirect
github.com/spf13/cobra v1.10.2 // indirect
+ github.com/vbauerster/cupwriter v0.0.4 // indirect
+ github.com/vishvananda/netlink v1.3.1 // indirect
+ github.com/vishvananda/netns v0.0.5 // indirect
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
v0.69.0 // indirect
- go.podman.io/buildah v1.44.1 // indirect
- go.podman.io/common v0.68.1 // indirect
+ go.podman.io/buildah v1.45.1 // indirect
+ go.podman.io/common v0.69.2 // indirect
+ go.yaml.in/yaml/v3 v3.0.5 // indirect
)
require (
@@ -60,17 +66,17 @@
github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
github.com/containerd/ttrpc v1.2.8 // indirect
github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 //
indirect
- github.com/containers/ocicrypt v1.3.0 // indirect
+ github.com/containers/ocicrypt v1.3.2 // indirect
github.com/containers/psgo v1.10.0 // indirect
github.com/coreos/go-systemd/v22 v22.7.0 // indirect
github.com/cyberphone/json-canonicalization
v0.0.0-20241213102144-19d51d7fe467 // indirect
- github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+ github.com/cyphar/filepath-securejoin v0.7.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc //
indirect
github.com/disiqueira/gotree/v3 v3.0.2 // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker-credential-helpers v0.9.8 // indirect
- github.com/docker/go-connections v0.7.0 // indirect
+ github.com/docker/go-connections v0.8.1 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.10.1 // indirect
@@ -79,7 +85,6 @@
github.com/go-logr/stdr v1.2.2 // indirect
github.com/godbus/dbus/v5 v5.2.2 // indirect
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 //
indirect
- github.com/golang/protobuf v1.5.4 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/go-containerregistry v0.21.6 // indirect
github.com/google/go-intervals v0.0.2 // indirect
@@ -91,13 +96,13 @@
github.com/jinzhu/copier v0.4.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/kevinburke/ssh_config v1.5.0 // indirect
- github.com/klauspost/compress v1.18.7 // indirect
+ github.com/klauspost/compress v1.19.1 // indirect
github.com/klauspost/pgzip v1.2.6 // indirect
github.com/kr/fs v0.1.0 // indirect
github.com/manifoldco/promptui v0.9.0 // indirect
- github.com/mattn/go-runewidth v0.0.23 // indirect
- github.com/mattn/go-sqlite3 v1.14.45 // indirect
- github.com/miekg/pkcs11 v1.1.1 // indirect
+ github.com/mattn/go-runewidth v0.0.27 // indirect
+ github.com/mattn/go-sqlite3 v1.14.49 // indirect
+ github.com/miekg/pkcs11 v1.1.2 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/locker v1.0.1 // indirect
github.com/moby/sys/atomicwriter v0.1.0 // indirect
@@ -112,13 +117,13 @@
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee //
indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 //
indirect
github.com/nxadm/tail v1.4.11 // indirect
- github.com/opencontainers/cgroups v0.0.6 // indirect
+ github.com/opencontainers/cgroups v0.0.8 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.1 // indirect
github.com/opencontainers/runtime-tools
v0.9.1-0.20260316125833-8a4db579f5c8 // indirect
github.com/opencontainers/selinux v1.15.1 // indirect
github.com/pkg/errors v0.9.1 // indirect
- github.com/pkg/sftp v1.13.10 // indirect
+ github.com/pkg/sftp v1.13.11 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 //
indirect
github.com/proglottis/gpgme v0.1.6 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
@@ -126,19 +131,19 @@
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/procfs v0.20.1 // indirect
github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
- github.com/sigstore/fulcio v1.8.6 // indirect
+ github.com/sigstore/fulcio v1.8.7 // indirect
github.com/sigstore/protobuf-specs v0.5.1 // indirect
github.com/sigstore/sigstore v1.10.8 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/skeema/knownhosts v1.3.2 // indirect
- github.com/smallstep/pkcs7 v0.1.1 // indirect
+ github.com/smallstep/pkcs7 v0.2.1 // indirect
github.com/spf13/pflag v1.0.10 // indirect
github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6
// indirect
- github.com/sylabs/sif/v2 v2.24.0 // indirect
+ github.com/sylabs/sif/v2 v2.24.1 // indirect
github.com/tchap/go-patricia/v2 v2.3.3 // indirect
- github.com/ulikunitz/xz v0.5.15 // indirect
+ github.com/ulikunitz/xz v0.5.16 // indirect
github.com/vbatts/tar-split v0.12.3 // indirect
- github.com/vbauerster/mpb/v8 v8.12.1 // indirect
+ github.com/vbauerster/mpb/v8 v8.14.0 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
// indirect
@@ -149,11 +154,11 @@
go.opentelemetry.io/otel/sdk v1.45.0 // indirect
go.opentelemetry.io/otel/trace v1.45.0 // indirect
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
- go.podman.io/image/v5 v5.40.0 // indirect
- go.podman.io/podman/v6 v6.0.2
- go.podman.io/storage v1.63.0 // indirect
+ go.podman.io/image/v5 v5.41.2 // indirect
+ go.podman.io/podman/v6 v6.1.3
+ go.podman.io/storage v1.64.1 // indirect
go.yaml.in/yaml/v2 v2.4.4 // indirect
- golang.org/x/crypto v0.55.0 // indirect
+ golang.org/x/crypto v0.56.0 // indirect
golang.org/x/net v0.58.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sync v0.22.0 // indirect
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/container-plugin-0.7.5/go-worker/go.sum
new/container-plugin-0.7.6/go-worker/go.sum
--- old/container-plugin-0.7.5/go-worker/go.sum 2026-09-22 18:51:59.000000000
+0200
+++ new/container-plugin-0.7.6/go-worker/go.sum 2026-10-26 20:27:13.644198031
+0100
@@ -1,6 +1,6 @@
cloud.google.com/go v0.26.0/go.mod
h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cyphar.com/go-pathrs v0.2.4 h1:iD/mge36swa1UFKdINkr1Frkpp6wZsy3YYEildj9cLY=
-cyphar.com/go-pathrs v0.2.4/go.mod
h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
+cyphar.com/go-pathrs v0.2.5 h1:SnX9FBvnoyn3lUs1dkMgZ52bAETpirNu3FTRh5HlRik=
+cyphar.com/go-pathrs v0.2.5/go.mod
h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6
h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
@@ -10,12 +10,14 @@
github.com/BurntSushi/toml v0.3.1/go.mod
h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
github.com/BurntSushi/toml v1.6.0
h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
github.com/BurntSushi/toml v1.6.0/go.mod
h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/Masterminds/semver/v3 v3.4.0
h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod
h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.5.0
h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod
h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
github.com/Microsoft/go-winio v0.6.2
h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
github.com/Microsoft/go-winio v0.6.2/go.mod
h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
github.com/Microsoft/hcsshim v0.14.1
h1:CMuB3fqQVfPdhyXhUqYdUmPUIOhJkmghCx3dJet8Cqs=
github.com/Microsoft/hcsshim v0.14.1/go.mod
h1:VnzvPLyWUhxiPVsJ31P6XadxCcTogTguBFDy/1GR/OM=
+github.com/ProtonMail/go-crypto v1.4.1
h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod
h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
github.com/VividCortex/ewma v1.2.0
h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
github.com/VividCortex/ewma v1.2.0/go.mod
h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
@@ -41,13 +43,15 @@
github.com/client9/misspell v0.3.4/go.mod
h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
github.com/clipperhouse/uax29/v2 v2.7.0
h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
github.com/clipperhouse/uax29/v2 v2.7.0/go.mod
h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/cloudflare/circl v1.6.3
h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod
h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod
h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
github.com/containerd/cgroups/v3 v3.1.3
h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6dyLYXQ=
github.com/containerd/cgroups/v3 v3.1.3/go.mod
h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
github.com/containerd/containerd/api v1.10.0
h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o=
github.com/containerd/containerd/api v1.10.0/go.mod
h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM=
-github.com/containerd/containerd/v2 v2.2.8
h1:8nnNE5FqBmofd3lccku8GbWi6d1TO4rrcB2E/0o+HU0=
-github.com/containerd/containerd/v2 v2.2.8/go.mod
h1:lTw+wrjREio28N9+3umHS73C6Cs1mxrhczBcAliInuI=
+github.com/containerd/containerd/v2 v2.2.9
h1:ddw9THGOXhcKnHORjkKoXtazPjwtcPwmqk8AVyRpfZw=
+github.com/containerd/containerd/v2 v2.2.9/go.mod
h1:lTw+wrjREio28N9+3umHS73C6Cs1mxrhczBcAliInuI=
github.com/containerd/continuity v0.5.0
h1:7a85HZpCSs+1Zps0Ee3DPSuAWY+0SJM1JNM51nlEVDg=
github.com/containerd/continuity v0.5.0/go.mod
h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
github.com/containerd/errdefs v1.0.0
h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -70,8 +74,8 @@
github.com/containerd/typeurl/v2 v2.3.0/go.mod
h1:Qk+PAdUYArVj41TnGi6rJ+48RF0PkcTc4i/taoBcK0w=
github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01
h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01/go.mod
h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
-github.com/containers/ocicrypt v1.3.0
h1:ps3St6ZWNWhOQ/Kqld6K2wPHt01Mj3AqRTNCZLIWOfo=
-github.com/containers/ocicrypt v1.3.0/go.mod
h1:PmfuGFpBwnGLnbqBm+QIy2nc8noDJ1Wt6B19la7VBFo=
+github.com/containers/ocicrypt v1.3.2
h1:MuqHSfiPpGzoAQdgDSX85FgixSgIm9mSDXTLTgugY5E=
+github.com/containers/ocicrypt v1.3.2/go.mod
h1:ntBZabYG0rlvstB/1rK/ba2laaU5EHE0pD5ioHoPTq4=
github.com/containers/psgo v1.10.0
h1:r9cEzAMVRtC0sw4ayIPjbd9EgF9pPaTCqKgDHhS0D/8=
github.com/containers/psgo v1.10.0/go.mod
h1:e44fw+1A7eJH1y0eWAo3P7sjfftXDlfF4AY498h+svQ=
github.com/coreos/go-systemd/v22 v22.7.0
h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
@@ -81,8 +85,8 @@
github.com/creack/pty v1.1.24/go.mod
h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467
h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
github.com/cyberphone/json-canonicalization
v0.0.0-20241213102144-19d51d7fe467/go.mod
h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
-github.com/cyphar/filepath-securejoin v0.6.1
h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
-github.com/cyphar/filepath-securejoin v0.6.1/go.mod
h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
+github.com/cyphar/filepath-securejoin v0.7.0
h1:s0Y3ITPy6sQn5xt54DuYvTF8hu134ooYLUb58DX/HjE=
+github.com/cyphar/filepath-securejoin v0.7.0/go.mod
h1:ymLGms/u3BYaviIiuKFnUx8EkQEZeK6cInNoAPJA3o4=
github.com/davecgh/go-spew v1.1.0/go.mod
h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1/go.mod
h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -91,16 +95,16 @@
github.com/disiqueira/gotree/v3 v3.0.2/go.mod
h1:ZuyjE4+mUQZlbpkI24AmruZKhg3VHEgPLDY8Qk+uUu8=
github.com/distribution/reference v0.6.0
h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
github.com/distribution/reference v0.6.0/go.mod
h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v29.5.3+incompatible
h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs=
-github.com/docker/cli v29.5.3+incompatible/go.mod
h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.6.2+incompatible
h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw=
+github.com/docker/cli v29.6.2+incompatible/go.mod
h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/distribution v2.8.3+incompatible
h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
github.com/docker/distribution v2.8.3+incompatible/go.mod
h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
github.com/docker/docker v28.5.2+incompatible
h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
github.com/docker/docker v28.5.2+incompatible/go.mod
h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/docker-credential-helpers v0.9.8
h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
github.com/docker/docker-credential-helpers v0.9.8/go.mod
h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/go-connections v0.7.0
h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
-github.com/docker/go-connections v0.7.0/go.mod
h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-connections v0.8.1
h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
+github.com/docker/go-connections v0.8.1/go.mod
h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
github.com/docker/go-units v0.5.0
h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
github.com/docker/go-units v0.5.0/go.mod
h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
github.com/envoyproxy/go-control-plane v0.9.0/go.mod
h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -114,8 +118,8 @@
github.com/fsnotify/fsnotify v1.6.0/go.mod
h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
github.com/fsnotify/fsnotify v1.10.1
h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
github.com/fsnotify/fsnotify v1.10.1/go.mod
h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
-github.com/fsouza/go-dockerclient v1.13.1
h1:HbkJO8UPUhuQ1wHIgX+ho7AUucBmjtOfzSWYUgmWL/8=
-github.com/fsouza/go-dockerclient v1.13.1/go.mod
h1:0gx0SIFGV1F+79sM9p5K+UCc8enYKA8DBp7BlwlixpM=
+github.com/fsouza/go-dockerclient v1.13.2
h1:u+jAOuR9TZ3PAx2pdHA+ALt1ZZhS8Qx+A4d964IqXtw=
+github.com/fsouza/go-dockerclient v1.13.2/go.mod
h1:SJu2b0vfcF8sbsWs9VVG03iEjsogvo7JADvsi2wVYAI=
github.com/go-jose/go-jose/v4 v4.1.4
h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
github.com/go-jose/go-jose/v4 v4.1.4/go.mod
h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/go-logr/logr v1.2.2/go.mod
h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -182,8 +186,8 @@
github.com/json-iterator/go v1.1.12/go.mod
h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
github.com/kevinburke/ssh_config v1.5.0
h1:3cPZmE54xb5j3G5xQCjSvokqNwU2uW+3ry1+PRLSPpA=
github.com/kevinburke/ssh_config v1.5.0/go.mod
h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
-github.com/klauspost/compress v1.18.7
h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
-github.com/klauspost/compress v1.18.7/go.mod
h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.1
h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
+github.com/klauspost/compress v1.19.1/go.mod
h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
github.com/klauspost/pgzip v1.2.6
h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
github.com/klauspost/pgzip v1.2.6/go.mod
h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -196,26 +200,26 @@
github.com/kylelemons/godebug v1.1.0/go.mod
h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/manifoldco/promptui v0.9.0
h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
github.com/manifoldco/promptui v0.9.0/go.mod
h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg=
-github.com/mattn/go-runewidth v0.0.23
h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
-github.com/mattn/go-runewidth v0.0.23/go.mod
h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-sqlite3 v1.14.45
h1:6KA/spDguL3KV8rnybG7ezSaE4SeMR3KC9VbUoAQaIk=
-github.com/mattn/go-sqlite3 v1.14.45/go.mod
h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
-github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
-github.com/miekg/pkcs11 v1.1.1/go.mod
h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/mattn/go-runewidth v0.0.27
h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0=
+github.com/mattn/go-runewidth v0.0.27/go.mod
h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mattn/go-sqlite3 v1.14.49
h1:B8jBHC3xhxZgxztrgruTuLucebnULQnx4W7cF7SAE9w=
+github.com/mattn/go-sqlite3 v1.14.49/go.mod
h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
+github.com/miekg/pkcs11 v1.1.2 h1:/VxmeAX5qU6Q3EwafypogwWbYryHFmF2RpkJmw3m4MQ=
+github.com/miekg/pkcs11 v1.1.2/go.mod
h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
github.com/mistifyio/go-zfs/v4 v4.0.0
h1:sU0+5dX45tdDK5xNZ3HBi95nxUc48FS92qbIZEvpAg4=
github.com/mistifyio/go-zfs/v4 v4.0.0/go.mod
h1:weotFtXTHvBwhr9Mv96KYnDkTPBOHFUbm9cBmQpesL0=
-github.com/moby/buildkit v0.31.1
h1:j3p55abBl4kiXXPZgYX+6zWgB2aefqHXoPown12fIzU=
-github.com/moby/buildkit v0.31.1/go.mod
h1:YM5iNEbNCc6L1Zt3YWFB/aXNLufvf4Rcu0DPlc9HwQg=
+github.com/moby/buildkit v0.31.2
h1:UsaoSa0z45ycj+8DqWwmiXKnszDSNvv3wYPGLVtcEKE=
+github.com/moby/buildkit v0.31.2/go.mod
h1:q1QO35x5YryiXLONScL2IybwMIziz6Rq3FBznz8fmGc=
github.com/moby/docker-image-spec v1.3.1
h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
github.com/moby/docker-image-spec v1.3.1/go.mod
h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
github.com/moby/go-archive v0.3.0
h1:nos4BtzzUIqB406BgQnWGMI4qib9BZ8XUHU+ucv/n1c=
github.com/moby/go-archive v0.3.0/go.mod
h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE=
github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
github.com/moby/locker v1.0.1/go.mod
h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby/api v1.54.2
h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod
h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.1
h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
-github.com/moby/moby/client v0.4.1/go.mod
h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/moby/api v1.55.0
h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
+github.com/moby/moby/api v1.55.0/go.mod
h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.5.1
h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=
+github.com/moby/moby/client v0.5.1/go.mod
h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
github.com/moby/patternmatcher v0.6.1
h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
github.com/moby/patternmatcher v0.6.1/go.mod
h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
github.com/moby/sys/atomicwriter v0.1.0
h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
@@ -248,12 +252,12 @@
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod
h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
github.com/nxadm/tail v1.4.11/go.mod
h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
-github.com/onsi/ginkgo/v2 v2.29.0
h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=
-github.com/onsi/ginkgo/v2 v2.29.0/go.mod
h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
-github.com/onsi/gomega v1.41.0/go.mod
h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
-github.com/opencontainers/cgroups v0.0.6
h1:tfZFWTIIGaUUFImTyuTg+Mr5x8XRiSdZESgEBW7UxuI=
-github.com/opencontainers/cgroups v0.0.6/go.mod
h1:oWVzJsKK0gG9SCRBfTpnn16WcGEqDI8PAcpMGbqWxcs=
+github.com/onsi/ginkgo/v2 v2.32.0
h1:Hw7s2pVrQo/8Yz5N77qdnpHaoc+c6cC9WIV1Jce+J6E=
+github.com/onsi/ginkgo/v2 v2.32.0/go.mod
h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod
h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/opencontainers/cgroups v0.0.8
h1:dQZyCsB73ggKJUzNl4FLbpvArrLv1tLOjMYPHswdUrI=
+github.com/opencontainers/cgroups v0.0.8/go.mod
h1:hPBRvnBhLZueEN0eJyozMeM3HeFGYlZW9KnO//px6G4=
github.com/opencontainers/go-digest v1.0.0
h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
github.com/opencontainers/go-digest v1.0.0/go.mod
h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.1.1
h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
@@ -268,8 +272,8 @@
github.com/openshift/imagebuilder v1.2.21/go.mod
h1:+L09sXUQ0RPdCU1tmzKrfBhqMlYvZtaA3MHb7aTjVU8=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod
h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.10 h1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=
-github.com/pkg/sftp v1.13.10/go.mod
h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1HbeGA=
+github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
+github.com/pkg/sftp v1.13.11/go.mod
h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod
h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
github.com/pmezard/go-difflib v1.0.0/go.mod
h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -297,8 +301,8 @@
github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod
h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q=
github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
github.com/sergi/go-diff v1.4.0/go.mod
h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/sigstore/fulcio v1.8.6
h1:vkvRpdhVAZjZHa0ltiJeLSILG9U8ADJoe5Z+RdZSLJk=
-github.com/sigstore/fulcio v1.8.6/go.mod
h1:7RwoGdMM0xpc9qc382sjSw7P9OLKbKIwQZXvYz4JPb4=
+github.com/sigstore/fulcio v1.8.7
h1:d7QJQxukgXarqPCT9uDNeyzt1Bbt/biw58/VfOnwI/o=
+github.com/sigstore/fulcio v1.8.7/go.mod
h1:7fX+QyigZxRGKTgHvTfOfxwwniCDxK02PVloHy5/vg4=
github.com/sigstore/protobuf-specs v0.5.1
h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah1/+7Px7U=
github.com/sigstore/protobuf-specs v0.5.1/go.mod
h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats=
github.com/sigstore/sigstore v1.10.8
h1:1Mgkxvkw4AXMfIP1DOjc6kw0GkUgA8pGVpveN/EfOq4=
@@ -307,8 +311,8 @@
github.com/sirupsen/logrus v1.9.4/go.mod
h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
github.com/skeema/knownhosts v1.3.2
h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
github.com/skeema/knownhosts v1.3.2/go.mod
h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow=
-github.com/smallstep/pkcs7 v0.1.1
h1:x+rPdt2W088V9Vkjho4KtoggyktZJlMduZAtRHm68LU=
-github.com/smallstep/pkcs7 v0.1.1/go.mod
h1:dL6j5AIz9GHjVEBTXtW+QliALcgM19RtXaTeyxI+AfA=
+github.com/smallstep/pkcs7 v0.2.1
h1:6Kfzr/QizdIuB6LSv8y1LJdZ3aPSfTNhTLqAx9CTLfA=
+github.com/smallstep/pkcs7 v0.2.1/go.mod
h1:RcXHsMfL+BzH8tRhmrF1NkkpebKpq3JEM66cOFxanf0=
github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
github.com/spf13/cobra v1.10.2/go.mod
h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
github.com/spf13/pflag v1.0.9/go.mod
h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -325,16 +329,22 @@
github.com/stretchr/testify v1.8.1/go.mod
h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.11.1
h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod
h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/sylabs/sif/v2 v2.24.0
h1:1wB5uMDUQYjk8AckTySaDcP9YnpMb1LyDRr1Jt9A10w=
-github.com/sylabs/sif/v2 v2.24.0/go.mod
h1:DbXWqWZ1hdLSU+K9ipdds5AmZeHWsyxCOj/oQakBa88=
+github.com/sylabs/sif/v2 v2.24.1
h1:OhTOfTwBaGXfbWYWXK9C6Pojma3A1bTaNJ6CEhyuKok=
+github.com/sylabs/sif/v2 v2.24.1/go.mod
h1:PRq9MoP0g+p0qE5ZRGrOhyVAUdHrPsAVmXHgoiW6VU0=
github.com/tchap/go-patricia/v2 v2.3.3
h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=
github.com/tchap/go-patricia/v2 v2.3.3/go.mod
h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
-github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
-github.com/ulikunitz/xz v0.5.15/go.mod
h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0=
+github.com/ulikunitz/xz v0.5.16/go.mod
h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
github.com/vbatts/tar-split v0.12.3
h1:Cd46rkGXI3Td4yrVNwU8ripbxFaQbmesqhjBUUYAJSw=
github.com/vbatts/tar-split v0.12.3/go.mod
h1:sQOc6OlqGCr7HkGx/IDBeKiTIvqhmj8KffNhEXG4Nq0=
-github.com/vbauerster/mpb/v8 v8.12.1
h1:pyj3yQ2ZGQJgUXm4h17QpR+eERaNz5OQ1ftPSEE/sMM=
-github.com/vbauerster/mpb/v8 v8.12.1/go.mod
h1:XLXRfStkw/6i5k0aQltijDHT1Z93fD1DVwmIdcFUp6k=
+github.com/vbauerster/cupwriter v0.0.4
h1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys=
+github.com/vbauerster/cupwriter v0.0.4/go.mod
h1:IFyzS6Xis5dnBH/rdAhrnuzg3c+KkUqEN6yE8lhJlDw=
+github.com/vbauerster/mpb/v8 v8.14.0
h1:55SR80dptMfASxIG/oCEkBXgBhxeSu4GrVsjl16oKmA=
+github.com/vbauerster/mpb/v8 v8.14.0/go.mod
h1:HgpQPKfcWe3kbuGGPmi+jatHreMase5C3Fp5dpdAy0Q=
+github.com/vishvananda/netlink v1.3.1
h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
+github.com/vishvananda/netlink v1.3.1/go.mod
h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
+github.com/vishvananda/netns v0.0.5
h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
+github.com/vishvananda/netns v0.0.5/go.mod
h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb
h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod
h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415
h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
@@ -370,31 +380,32 @@
go.opentelemetry.io/otel/trace v1.45.0/go.mod
h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
go.opentelemetry.io/proto/otlp v1.11.0
h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
go.opentelemetry.io/proto/otlp v1.11.0/go.mod
h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
-go.podman.io/buildah v1.44.1 h1:WQhr/LK3do8ENLHYTls+wUIx6XWZPghZ4VH232WbL0U=
-go.podman.io/buildah v1.44.1/go.mod
h1:hi+WSERjv19PU2CJ+AKbgwCO3IKuvtDXEUA8eXNkpqk=
-go.podman.io/common v0.68.1 h1:y8NoHLidghpgHtWtwB9+pN7cHhIDe33g1sB4RFCRvKI=
-go.podman.io/common v0.68.1/go.mod
h1:zVzufHkRpLueF6NW6N+fAs1C2METdzYcfD9zuw+oJKA=
-go.podman.io/image/v5 v5.40.0 h1:gNQvj343Eb4juCitUBkuDz1T82Zpp6nhgMEXzNfCges=
-go.podman.io/image/v5 v5.40.0/go.mod
h1:qgXf1abXJ+2l01pL8+CljaMKryeo6ahaHO7H51ooKIc=
-go.podman.io/podman/v6 v6.0.2 h1:T7p1IJytTb1JbWCMrNnt17O4+d2qMk8Wyw7Pezihr44=
-go.podman.io/podman/v6 v6.0.2/go.mod
h1:+WXAeC8vD6yCu7loCL20vDY4A3gWb6FN8vINPEQSo2Y=
-go.podman.io/storage v1.63.0 h1:bj/pAWFhChbuBmejzno0iQLhU7FevGVXepRXm5pFGeA=
-go.podman.io/storage v1.63.0/go.mod
h1:z4Z9K+7GhKjWL/Y1O17+4f8a1KGijVeC9hr3tymhSOs=
+go.podman.io/buildah v1.45.1 h1:QYJrpxBaTM9b5IraRwG53kcWxfrBAlSqBJAQIgrIuZY=
+go.podman.io/buildah v1.45.1/go.mod
h1:RwoZrDdgSYBQHHqBVPgnOIa1Ee7cLeTEgL8uhMGb/pA=
+go.podman.io/common v0.69.2 h1:5ZV7xkfFTOwgf21xaqNZSqjy9G9JVG7p2bF5Tj6IVjE=
+go.podman.io/common v0.69.2/go.mod
h1:cQ1+nD9QcwnUGiuJHMX61SoYK5MU90NDbl0lLWmDF2s=
+go.podman.io/image/v5 v5.41.2 h1:YnVaFrGLPWSBmipKfNvlOsGcBtk5bUxlPxQ+A6CS/uo=
+go.podman.io/image/v5 v5.41.2/go.mod
h1:T/bzxEFpdpAzyHabPmcq5K+my3wBsht22sFkFjJSKT4=
+go.podman.io/podman/v6 v6.1.3 h1:lGIii0b0SUHB2UOmJz5nH+RVB2k6quYoRrGNBSs/gng=
+go.podman.io/podman/v6 v6.1.3/go.mod
h1:ISrGqyTAEY4zMoUTLzpHuQ72uYrp9kgfg9OubMaJu0A=
+go.podman.io/storage v1.64.1 h1:DqbG8scW/bD3xHiSRzV7O5fzn46qVC+SwmUN6C6Fr5w=
+go.podman.io/storage v1.64.1/go.mod
h1:ft0DzCRMZs1yn0rszmLYXEEwgd7IIc66JRwSRPUDwwc=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
go.uber.org/goleak v1.3.0/go.mod
h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
go.yaml.in/yaml/v2 v2.4.4/go.mod
h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
go.yaml.in/yaml/v3 v3.0.4/go.mod
h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod
h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod
h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod
h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod
h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.13.0/go.mod
h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
golang.org/x/crypto v0.19.0/go.mod
h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
golang.org/x/crypto v0.23.0/go.mod
h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.30.0/go.mod
h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod
h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/crypto v0.33.0/go.mod
h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod
h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod
h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod
h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod
h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -433,7 +444,7 @@
golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0/go.mod
h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.11.0/go.mod
h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
golang.org/x/sync v0.22.0/go.mod
h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod
h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -448,12 +459,14 @@
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod
h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod
h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod
h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod
h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
@@ -464,7 +477,7 @@
golang.org/x/term v0.12.0/go.mod
h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
golang.org/x/term v0.17.0/go.mod
h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
golang.org/x/term v0.20.0/go.mod
h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.27.0/go.mod
h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.29.0/go.mod
h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
golang.org/x/term v0.45.0/go.mod
h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -475,7 +488,7 @@
golang.org/x/text v0.13.0/go.mod
h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/text v0.14.0/go.mod
h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/text v0.15.0/go.mod
h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0/go.mod
h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.22.0/go.mod
h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
golang.org/x/text v0.41.0/go.mod
h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/container-plugin-0.7.5/go-worker/pkg/container/fetcher.go
new/container-plugin-0.7.6/go-worker/pkg/container/fetcher.go
--- old/container-plugin-0.7.5/go-worker/pkg/container/fetcher.go
2026-09-22 18:51:59.000000000 +0200
+++ new/container-plugin-0.7.6/go-worker/pkg/container/fetcher.go
2026-10-26 20:27:13.648198480 +0100
@@ -395,14 +395,31 @@
// lookup uses the known runtime identity of a deferred container, or probes
// the engines for an unknown ID. Success publishes the event and releases
-// any deferred identity.
+// any deferred identity. Each engine answers within the engine timeout, as
+// at bootstrap, so a socket that hangs after startup cannot block the
+// serving goroutine for good. A getter can also return an event whose
+// enrichment the deadline interrupted, so an expired lookup counts as a
+// miss: the container keeps its deferred identity and is retried, instead
+// of being resolved with partial metadata.
func (f *fetcher) lookup(ctx context.Context, containerId string, outCh chan<-
event.Event) bool {
var evt *event.Event
if d, ok := f.deferredLookups[containerId]; ok {
- evt, _ = d.get(f.ctx)
+ lctx, cancel := WithEngineTimeout(ctx)
+ evt, _ = d.get(lctx)
+ if lctx.Err() != nil {
+ evt = nil
+ }
+ cancel()
} else {
for _, e := range f.getters {
- evt, _ = e.get(f.ctx, containerId)
+ lctx, cancel := WithEngineTimeout(ctx)
+ evt, _ = e.get(lctx, containerId)
+ expired := lctx.Err() != nil
+ cancel()
+ if expired {
+ evt = nil
+ continue
+ }
if evt != nil {
break
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/container-plugin-0.7.5/go-worker/pkg/container/fetcher_lookup_timeout_test.go
new/container-plugin-0.7.6/go-worker/pkg/container/fetcher_lookup_timeout_test.go
---
old/container-plugin-0.7.5/go-worker/pkg/container/fetcher_lookup_timeout_test.go
1970-01-01 01:00:00.000000000 +0100
+++
new/container-plugin-0.7.6/go-worker/pkg/container/fetcher_lookup_timeout_test.go
2026-10-26 20:27:13.648198480 +0100
@@ -0,0 +1,223 @@
+package container
+
+import (
+ "context"
+ "sync"
+ "testing"
+ "time"
+
+ "github.com/stretchr/testify/assert"
+
+ "github.com/falcosecurity/plugins/plugins/container/go-worker/pkg/event"
+)
+
+// hangingGetter accepts a lookup and never answers it until its context is
+// done, like a runtime socket that hangs after startup. Every entry is
+// signalled on a per-ID channel, so tests can wait for a specific lookup to
+// reach the engine instead of inferring progress from a call count.
+type hangingGetter struct {
+ mu sync.Mutex
+ lookups int
+ signals map[string]chan struct{}
+}
+
+func newHangingGetter() *hangingGetter {
+ return &hangingGetter{signals: make(map[string]chan struct{})}
+}
+
+func (g *hangingGetter) get(ctx context.Context, containerId string)
(*event.Event, error) {
+ g.mu.Lock()
+ g.lookups++
+ signal, ok := g.signals[containerId]
+ if !ok {
+ signal = make(chan struct{}, 1)
+ g.signals[containerId] = signal
+ }
+ g.mu.Unlock()
+ select {
+ case signal <- struct{}{}:
+ default:
+ }
+ <-ctx.Done()
+ return nil, ctx.Err()
+}
+
+func (g *hangingGetter) count() int {
+ g.mu.Lock()
+ defer g.mu.Unlock()
+ return g.lookups
+}
+
+// entered returns a channel that receives once per lookup of containerId.
+// The entry is created on first use by either side, so the channel is
+// stable however the lookup and the test interleave.
+func (g *hangingGetter) entered(containerId string) <-chan struct{} {
+ g.mu.Lock()
+ defer g.mu.Unlock()
+ signal, ok := g.signals[containerId]
+ if !ok {
+ signal = make(chan struct{}, 1)
+ g.signals[containerId] = signal
+ }
+ return signal
+}
+
+// slowEnrichmentGetter answers its first lookup only once its context has
+// expired, and still returns an event with partial metadata, like Docker's
+// getter when ImageInspect times out mid-enrichment. Later lookups answer
+// with the full identity.
+type slowEnrichmentGetter struct {
+ mu sync.Mutex
+ lookups int
+}
+
+func (g *slowEnrichmentGetter) get(ctx context.Context, containerId string)
(*event.Event, error) {
+ g.mu.Lock()
+ g.lookups++
+ calls := g.lookups
+ g.mu.Unlock()
+ if calls == 1 {
+ <-ctx.Done()
+ // The engine answered past the deadline: an event whose
+ // enrichment was interrupted is not complete metadata.
+ return &event.Event{Info: event.Info{Container:
event.Container{ID: containerId}}, IsCreate: true}, nil
+ }
+ return &event.Event{
+ Info: event.Info{Container: event.Container{
+ ID: containerId,
+ FullID: containerId,
+ Image: "registry.example/" + containerId +
":latest",
+ ImageDigest: "sha256:0123456789abcdef",
+ }},
+ IsCreate: true,
+ }, nil
+}
+
+func (g *slowEnrichmentGetter) count() int {
+ g.mu.Lock()
+ defer g.mu.Unlock()
+ return g.lookups
+}
+
+// newTestFetcherGetters is newTestFetcher with an explicit getter list.
+func newTestFetcherGetters(getters []getter, fetchCh chan string, backoff
[]time.Duration, maxPending int, deferred []string) *fetcher {
+ f := &fetcher{
+ getters: getters,
+ ctx: context.Background(),
+ fetcherChan: fetchCh,
+ retryBackoff: backoff,
+ maxPending: maxPending,
+ deferred: append([]string(nil), deferred...),
+ deferredLookups: make(map[string]deferredFetch, len(deferred)),
+ }
+ for _, id := range deferred {
+ f.deferredLookups[id] = deferredFetch{engine: getters[0], ref:
ContainerRef{ID: id}, queued: true}
+ }
+ return f
+}
+
+// TestFetcherRequestLookupHonoursEngineTimeout feeds the fetcher a request
+// that a hanging engine never answers: the lookup must give way once the
+// engine timeout expires and consult the next engine with a fresh bound,
+// instead of blocking the fetcher goroutine for good.
+func TestFetcherRequestLookupHonoursEngineTimeout(t *testing.T) {
+ setEngineTimeout(t, 1)
+ hanging := newHangingGetter()
+ healthy := newCountingGetter(1)
+ fetchCh := make(chan string)
+ f := newTestFetcherGetters([]getter{hanging, healthy}, fetchCh,
fastBackoff, maxPendingFetches, nil)
+ outCh := runFetcher(t, f)
+
+ start := time.Now()
+ fetchCh <- "late"
+ evt := waitOnChannelOrTimeout(t, outCh)
+ assert.Equal(t, "late", evt.ID)
+ // The hanging engine burned its whole engine timeout before the healthy
+ // one answered, but no more.
+ elapsed := time.Since(start)
+ assert.GreaterOrEqual(t, elapsed, time.Second)
+ assert.Less(t, elapsed, 5*time.Second)
+}
+
+// TestFetcherDeferredLookupHonoursEngineTimeout defers a startup container
+// to a hanging engine, then asks for a live container: the deferred lookup
+// must return once the engine timeout expires so the request can be served,
+// instead of stalling the single fetcher goroutine. Waiting for the deferred
+// lookup to enter the engine makes the ordering explicit: the live request
+// cannot overtake the background lookup still hanging inside the getter.
+func TestFetcherDeferredLookupHonoursEngineTimeout(t *testing.T) {
+ setEngineTimeout(t, 1)
+ hanging := newHangingGetter()
+ healthy := newCountingGetter(1)
+ fetchCh := make(chan string)
+ f := newTestFetcherGetters([]getter{hanging, healthy}, fetchCh,
fastBackoff, maxPendingFetches, []string{"aabbccddeeff"})
+ outCh := runFetcher(t, f)
+
+ // The deferred startup lookup reaches the hanging engine before the
+ // live request is even sent.
+ select {
+ case <-hanging.entered("aabbccddeeff"):
+ case <-time.After(5 * time.Second):
+ t.Error("timed out waiting for the deferred lookup to enter the
engine")
+ }
+
+ start := time.Now()
+ fetchCh <- "late"
+ evt := waitOnChannelOrTimeout(t, outCh)
+ assert.Equal(t, "late", evt.ID)
+ elapsed := time.Since(start)
+ assert.GreaterOrEqual(t, elapsed, time.Second)
+ assert.Less(t, elapsed, 5*time.Second)
+ // The deferred startup lookup and the live request both consulted the
+ // hanging engine, each within the engine timeout.
+ assert.Eventually(t, func() bool { return hanging.count() >= 2 },
5*time.Second, 10*time.Millisecond)
+}
+
+// TestFetcherRequestLookupExpiredIsRetried serves a request whose first
+// lookup expires during metadata enrichment: the engine answers past the
+// deadline with an event whose enrichment was interrupted, and that partial
+// metadata must not be published. The fetcher retries, and the full identity
+// of the live request is served.
+func TestFetcherRequestLookupExpiredIsRetried(t *testing.T) {
+ setEngineTimeout(t, 1)
+ slow := &slowEnrichmentGetter{}
+ fetchCh := make(chan string)
+ f := newTestFetcherGetters([]getter{slow}, fetchCh, fastBackoff,
maxPendingFetches, nil)
+ outCh := runFetcher(t, f)
+
+ fetchCh <- "late"
+ evt := waitOnChannelOrTimeout(t, outCh)
+ // The expired attempt's partial event was dropped: the first published
+ // event carries the full identity of the retry.
+ assert.Equal(t, "late", evt.ID)
+ assert.Equal(t, "late", evt.FullID)
+ assert.Equal(t, "registry.example/late:latest", evt.Image)
+ assert.Equal(t, "sha256:0123456789abcdef", evt.ImageDigest)
+ // One expired attempt, one successful retry.
+ assert.Equal(t, 2, slow.count())
+}
+
+// TestFetcherDeferredLookupExpiredKeepsIdentityAndRetries defers a startup
+// container whose lookup expires during metadata enrichment: the engine
+// answers past the deadline with an event whose enrichment was interrupted,
+// and that partial metadata must not be published. The deferred identity is
+// preserved, so the retry completes it instead of the C++ cache considering
+// the container resolved.
+func TestFetcherDeferredLookupExpiredKeepsIdentityAndRetries(t *testing.T) {
+ setEngineTimeout(t, 1)
+ slow := &slowEnrichmentGetter{}
+ fetchCh := make(chan string)
+ f := newTestFetcherGetters([]getter{slow}, fetchCh, fastBackoff,
maxPendingFetches, []string{"aabbccddeeff"})
+ outCh := runFetcher(t, f)
+
+ // If the expired attempt's partial event were published, the first
+ // event would leak an empty image and digest: the assertions below
+ // fail on it. With it dropped, the first event is the complete retry.
+ evt := waitOnChannelOrTimeout(t, outCh)
+ assert.Equal(t, "aabbccddeeff", evt.ID)
+ assert.Equal(t, "aabbccddeeff", evt.FullID)
+ assert.Equal(t, "registry.example/aabbccddeeff:latest", evt.Image)
+ assert.Equal(t, "sha256:0123456789abcdef", evt.ImageDigest)
+ // One expired attempt, one successful retry.
+ assert.Equal(t, 2, slow.count())
+}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/container-plugin-0.7.5/src/plugin_config_schema.h
new/container-plugin-0.7.6/src/plugin_config_schema.h
--- old/container-plugin-0.7.5/src/plugin_config_schema.h 2026-09-22
18:51:59.000000000 +0200
+++ new/container-plugin-0.7.6/src/plugin_config_schema.h 2026-10-26
20:27:13.660199827 +0100
@@ -45,7 +45,7 @@
"type": "integer",
"minimum": 0,
"title": "Container engine timeout",
- "description": "Seconds to wait for a container engine to answer while
connecting to it and listing the pre-existing containers at startup. An engine
that does not answer in time is skipped, so that an unresponsive runtime socket
cannot block Falco's startup. 0 disables the timeout. Defaults to 10."
+ "description": "Seconds to wait for a container engine to answer while
connecting to it and listing the pre-existing containers at startup, and when
looking up a single container afterwards (live requests, retries and background
lookups). An engine that does not answer in time is skipped, so that an
unresponsive runtime socket cannot block Falco's startup nor its container
enrichment. 0 disables the timeout. Defaults to 10."
},
"engines": {
"$ref": "#/definitions/Engines",
++++++ container-plugin.obsinfo ++++++
--- /var/tmp/diff_new_pack.RmNojc/_old 2026-10-27 16:49:14.712198767 +0100
+++ /var/tmp/diff_new_pack.RmNojc/_new 2026-10-27 16:49:14.718199019 +0100
@@ -1,5 +1,5 @@
name: container-plugin
-version: 0.7.5
-mtime: 1790095919
-commit: a246c88790db1180f8b15411a5fb20ce853f67a4
+version: 0.7.6
+mtime: 1793025711
+commit: 9064e9d620538aebf32912fa00f6b9ef95d46a37
++++++ vendor.tar.gz ++++++
/work/SRC/openSUSE:Factory/falcosecurity-container-plugin/vendor.tar.gz
/work/SRC/openSUSE:Factory/.falcosecurity-container-plugin.new.2252680/vendor.tar.gz
differ: char 5, line 1
