Allow digests in docker images

For the nextcloud update we need to be able to indicate the
digest of the docker image, as the docker tag is the same
for the vulnerable and the fixed docker image.
This avoids 'abra update' to re-install with a warning an
old image if the connection to docker hub fails.

.drone.yml

@@ -3,17 +3,22 @@ kind: pipeline
 name: coopcloud.tech/abra
 steps:
   - name: make check
-    image: golang:1.26
+    image: golang:1.27
     commands:
       - make check
 
   - name: xgettext-go
-    image: git.coopcloud.tech/toolshed/drone-xgettext-go:latest
-    settings:
-      keyword: i18n.G
-      keyword_ctx: i18n.GC
-      out: pkg/i18n/locales/abra.pot
-      comments_tag: translators
+    image: golang:1.27
+    environment:
+      GOPRIVATE: coopcloud.tech
+    commands:
+      - go run git.coopcloud.tech/toolshed/xgettext-go@latest
+        -o pkg/i18n/locales/abra.pot
+        --keyword=i18n.G
+        --keyword-ctx=i18n.GC
+        --sort-output
+        --add-comments-tag="translators"
+        $(find . -name "*.go" -not -path "*vendor*" | sort)
     depends_on:
       - make check
     when:
@@ -38,7 +43,7 @@ steps:
           - tag
 
   - name: make test
-    image: golang:1.26
+    image: golang:1.27
     environment:
       ABRA_DIR: /root/.abra_test
     commands:

.gitattributes

@@ -0,0 +1 @@
+vendor/** linguist-generated=true

Dockerfile

@@ -1,5 +1,5 @@
 # Build image
-FROM golang:1.26-alpine AS build
+FROM golang:1.27-alpine AS build
 
 ENV GOPRIVATE=coopcloud.tech
 
@@ -15,7 +15,7 @@ WORKDIR /app
 
 RUN CGO_ENABLED=0 make build
 
-FROM alpine:3.22
+FROM alpine:3.24
 
 RUN apk add --no-cache \
   ca-certificates \

Makefile

@@ -1,5 +1,5 @@
 ABRA         := ./cmd/abra
-XGETTEXT     := ./bin/xgettext-go
+XGETTEXT     := go run git.coopcloud.tech/toolshed/xgettext-go@latest
 COMMIT       := $(shell git rev-list -1 HEAD)
 GOPATH       := $(shell go env GOPATH)
 GOVERSION    := 1.26
@@ -62,8 +62,8 @@ update-po:
 	done
 
 .PHONY: update-pot
-update-pot: $(XGETTEXT)
-	@${XGETTEXT} \
+update-pot:
+	@$(XGETTEXT) \
 		-o pkg/i18n/locales/$(DOMAIN).pot \
 		--keyword=i18n.G \
 		--keyword-ctx=i18n.GC \
@@ -71,11 +71,6 @@ update-pot: $(XGETTEXT)
 		--add-comments-tag="translators" \
 		$$(find . -name "*.go" -not -path "*vendor*" | sort)
 
-${XGETTEXT}:
-	@mkdir -p ./bin && \
-	wget -O ./bin/xgettext-go https://git.coopcloud.tech/toolshed/xgettext-go/raw/branch/main/xgettext-go && \
-	chmod +x ./bin/xgettext-go
-
 .PHONY: update-pot-po-metadata
 update-pot-po-metadata:
 	@sed -i "s/charset=CHARSET/charset=UTF-8/g" pkg/i18n/locales/*.po pkg/i18n/locales/*.pot

cli/app/deploy.go

@@ -151,11 +151,12 @@ checkout as-is. Recipe commit hashes are also supported as values for
 
 		stackName := app.StackName()
 		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    stackName,
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
+			Composefiles:     composeFiles,
+			Namespace:        stackName,
+			Prune:            false,
+			ResolveImage:     stack.ResolveImageAlways,
+			Detach:           false,
+			SendRegistryAuth: true,
 		}
 		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
 		if err != nil {

cli/app/new.go

@@ -112,7 +112,11 @@ var AppNewCommand = &cobra.Command{
 				}
 			}
 
-			if len(recipeVersions) > 0 {
+			if recipeVersion != "" {
+				if _, err := recipe.EnsureVersion(recipeVersion); err != nil {
+					log.Fatal(err)
+				}
+			} else if len(recipeVersions) > 0 {
 				latest := recipeVersions[len(recipeVersions)-1]
 				for tag := range latest {
 					recipeVersion = tag

cli/app/rollback.go

@@ -166,11 +166,12 @@ beforehand. See "abra app backup" for more.`),
 
 		stackName := app.StackName()
 		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    stackName,
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
+			Composefiles:     composeFiles,
+			Namespace:        stackName,
+			Prune:            false,
+			ResolveImage:     stack.ResolveImageAlways,
+			Detach:           false,
+			SendRegistryAuth: true,
 		}
 
 		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)

cli/app/upgrade.go

@@ -178,11 +178,12 @@ beforehand. See "abra app backup" for more.`),
 
 		stackName := app.StackName()
 		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    stackName,
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
+			Composefiles:     composeFiles,
+			Namespace:        stackName,
+			Prune:            false,
+			ResolveImage:     stack.ResolveImageAlways,
+			Detach:           false,
+			SendRegistryAuth: true,
 		}
 
 		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)

cli/recipe/upgrade.go

@@ -129,6 +129,9 @@ interface.`),
 			log.Fatal(err)
 		}
 
+		// digest pinned images shared between services are only checked once
+		digestChecked := make(map[string]bool)
+
 		for _, service := range config.Services {
 			img, err := reference.ParseNormalizedNamed(service.Image)
 			if err != nil {
@@ -178,6 +181,13 @@ interface.`),
 
 			sort.Sort(tagcmp.ByTagDesc(compatible))
 
+			if canonical, ok := img.(reference.Canonical); ok && !digestChecked[service.Image] {
+				digestChecked[service.Image] = true
+				if err := refreshDigest(recipe, img, image, canonical.Digest().String()); err != nil {
+					log.Fatal(err)
+				}
+			}
+
 			if len(compatible) == 0 && !allTags {
 				log.Info(i18n.G("no new versions available for %s, assuming %s is the latest (use -a/--all-tags to see all anyway)", image, tag))
 				continue // skip on to the next tag and don't update any compose files
@@ -364,6 +374,47 @@ interface.`),
 	},
 }
 
+// refreshDigest checks whether the current tag of a digest pinned image was
+// re-published upstream with a new digest and offers to update the pin.
+func refreshDigest(recipe recipePkg.Recipe, img reference.Named, image, digest string) error {
+	tag := img.(reference.NamedTagged).Tag()
+
+	registryDigest, err := client.GetRegistryDigest(img, tag)
+	if err != nil {
+		return err
+	}
+
+	if registryDigest == digest {
+		log.Debug(i18n.G("digest of %s:%s is up to date", image, tag))
+		return nil
+	}
+
+	log.Warn(i18n.G("%s:%s was re-published upstream (digest %s → %s)", image, tag, digest, registryDigest))
+
+	update := false
+	if !internal.NoInput {
+		prompt := &survey.Confirm{
+			Message: i18n.G("update digest of %s:%s?", image, tag),
+			Default: true,
+		}
+		if err := survey.AskOne(prompt, &update); err != nil {
+			return err
+		}
+	}
+
+	if !update {
+		return nil
+	}
+
+	if _, err := recipe.UpdateTag(image, tag); err != nil {
+		return err
+	}
+
+	log.Info(i18n.G("digest updated for %s:%s", image, tag))
+
+	return nil
+}
+
 var (
 	allTags      bool
 	createCommit bool

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1778443072,
+        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,37 @@
+{
+  description = "The Co-op Cloud utility belt";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+    }:
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+      in
+      {
+        packages = rec {
+          abra = pkgs.callPackage ./package.nix { };
+          default = abra;
+        };
+        apps = rec {
+          abra = flake-utils.lib.mkApp { drv = self.packages.${system}.abra; };
+          default = abra;
+        };
+        devShells.default = pkgs.mkShell {
+          packages = with pkgs; [
+            go_1_26
+            gnumake
+          ];
+        };
+      }
+    );
+}

go.mod

@@ -1,26 +1,33 @@
 module coopcloud.tech/abra
 
-go 1.26.0
+go 1.27
 
 require (
-	coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca
+	coopcloud.tech/tagcmp v0.0.0-20260515102403-c26951b55977
 	git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c
 	github.com/AlecAivazis/survey/v2 v2.3.7
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/charmbracelet/log v1.0.0
+	github.com/containers/image v3.0.2+incompatible
+	github.com/decentral1se/passgen v1.0.1
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli v28.4.0+incompatible
 	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-units v0.5.0
-	github.com/go-git/go-git/v5 v5.17.2
+	github.com/go-git/go-git/v5 v5.19.3
 	github.com/google/go-cmp v0.7.0
-	github.com/leonelquinteros/gotext v1.7.2
+	github.com/hashicorp/go-retryablehttp v0.7.8
+	github.com/leonelquinteros/gotext v1.8.0
 	github.com/moby/sys/signal v0.7.1
 	github.com/moby/term v0.5.2
+	github.com/opencontainers/image-spec v1.1.1
 	github.com/pkg/errors v0.9.1
-	github.com/schollz/progressbar/v3 v3.19.0
-	golang.org/x/term v0.41.0
+	github.com/schollz/progressbar/v3 v3.19.1
+	github.com/spf13/cobra v1.10.1
+	github.com/stretchr/testify v1.12.1
+	golang.org/x/sys v0.49.0
+	golang.org/x/term v0.47.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
@@ -48,25 +55,29 @@ require (
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/containers/storage v1.38.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.8.0 // indirect
+	github.com/go-git/go-billy/v5 v5.9.2 // indirect
 	github.com/go-logfmt/logfmt v0.6.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -74,10 +85,9 @@ require (
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.21 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
@@ -85,7 +95,9 @@ require (
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/morikuni/aec v1.1.0 // indirect
@@ -96,17 +108,20 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/runc v1.1.13 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
-	github.com/pjbgf/sha1cd v0.5.0 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pjbgf/sha1cd v0.7.0 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
@@ -123,11 +138,11 @@ require (
 	go.opentelemetry.io/otel/trace v1.42.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.49.0 // indirect
-	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
-	golang.org/x/net v0.52.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.56.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
@@ -137,27 +152,6 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
 
-require (
-	github.com/containers/image v3.0.2+incompatible
-	github.com/containers/storage v1.38.2 // indirect
-	github.com/decentral1se/passgen v1.0.1
-	github.com/docker/docker-credential-helpers v0.9.5 // indirect
-	github.com/fvbommel/sortorder v1.1.0 // indirect
-	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.8
-	github.com/moby/patternmatcher v0.6.1 // indirect
-	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/sergi/go-diff v1.4.0 // indirect
-	github.com/spf13/cobra v1.10.1
-	github.com/stretchr/testify v1.11.1
-	github.com/theupdateframework/notary v0.7.0 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.42.0
-)
-
 replace github.com/docker/cli v28.4.0+incompatible => git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible
 
-replace github.com/spf13/cobra => github.com/decentral1se/cobra v1.10.2-i18n
+replace github.com/spf13/cobra => github.com/decentral1se/cobra v1.10.2

go.sum

@@ -22,8 +22,8 @@ cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIA
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca h1:gSD53tBAsbIGq4SnFfq+mEep6foekQ2a5ea7b38qkm0=
-coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
+coopcloud.tech/tagcmp v0.0.0-20260515102403-c26951b55977 h1:J7I0HFjwVAj/kkX6lwSTHmlXDRjQRsdIFNUUqu55ADY=
+coopcloud.tech/tagcmp v0.0.0-20260515102403-c26951b55977/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -306,10 +306,9 @@ github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW
 github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
 github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/decentral1se/cobra v1.10.2-i18n h1:XR+6AHHfnf4k5NM9f09oLMrEVwz3rkQIAIcqgL8R08g=
-github.com/decentral1se/cobra v1.10.2-i18n/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/decentral1se/cobra v1.10.2 h1:MZ8Ifi/jRels9sZrpSccDbUlK++3b2HlBODfv0Bh6x0=
+github.com/decentral1se/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/decentral1se/passgen v1.0.1 h1:j2AxK/kHKxDHWZZfkJj8Wgae9+O+DYEqR5sjKthIYKA=
 github.com/decentral1se/passgen v1.0.1/go.mod h1:530V+lNoPhKtkrX2fIVsIfLhkl47CuiOM7HRgi7C+SU=
 github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
@@ -389,12 +388,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
-github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
+github.com/go-git/go-billy/v5 v5.9.2 h1:OXFSRyz4g20upsGDJgQG9Bak1l/ZEv8GHVYB52O71sE=
+github.com/go-git/go-billy/v5 v5.9.2/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.17.2 h1:B+nkdlxdYrvyFK4GPXVU8w1U+YkbsgciIR7f2sZJ104=
-github.com/go-git/go-git/v5 v5.17.2/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
+github.com/go-git/go-git/v5 v5.19.3 h1:qHttbZ+Am7wEjdTpR1XMQ4rl42FK9SIXzZ4o9x7s6M4=
+github.com/go-git/go-git/v5 v5.19.3/go.mod h1:Ye4C8dVigkqrv9UsB4NMdSLV4yAIkLiIhW61gcOyhl4=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -586,8 +585,6 @@ github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdY
 github.com/klauspost/compress v1.14.2/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -605,8 +602,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/leonelquinteros/gotext v1.7.2 h1:bDPndU8nt+/kRo1m4l/1OXiiy2v7Z7dfPQ9+YP7G1Mc=
-github.com/leonelquinteros/gotext v1.7.2/go.mod h1:9/haCkm5P7Jay1sxKDGJ5WIg4zkz8oZKw4ekNpALob8=
+github.com/leonelquinteros/gotext v1.8.0 h1:wwpxINWmWq3JN3WFI9BoSupBFrvAqxZTtf3qppijYkU=
+github.com/leonelquinteros/gotext v1.8.0/go.mod h1:Wqke380+8unZq2F4oTmmqmbUY9zWQMzwImdC34XOAo8=
 github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
 github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
@@ -623,8 +620,8 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
@@ -753,14 +750,13 @@ github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuh
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pjbgf/sha1cd v0.5.0 h1:a+UkboSi1znleCDUNT3M5YxjOnN1fz2FhN48FlwCxs0=
-github.com/pjbgf/sha1cd v0.5.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
+github.com/pjbgf/sha1cd v0.7.0 h1:ZRNPKHj+gfkLBf0KJv/p1Hmz+7bqCT5o311YX0nq+DA=
+github.com/pjbgf/sha1cd v0.7.0/go.mod h1:pKR5Li+qTCo+ebqITZfwPlJGoCFCvSO00qxjbNtTUFQ=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
 github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
@@ -808,8 +804,8 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/schollz/progressbar/v3 v3.19.0 h1:Ea18xuIRQXLAUidVDox3AbwfUhD0/1IvohyTutOIFoc=
-github.com/schollz/progressbar/v3 v3.19.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
+github.com/schollz/progressbar/v3 v3.19.1 h1:iv8BgwOvdML/S3p84uBpy/IMigv4U9594vPZYa2EdrU=
+github.com/schollz/progressbar/v3 v3.19.1/go.mod h1:LFL7jqimKxfhero4K1eCkUr/6R39AgQeiPCJtlTWIW8=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
@@ -857,8 +853,8 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
@@ -946,8 +942,9 @@ go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -966,8 +963,8 @@ golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -978,8 +975,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1043,8 +1040,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1139,14 +1136,13 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1156,8 +1152,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

package.nix

@@ -0,0 +1,54 @@
+{
+  buildGo126Module,
+  fetchgit,
+  lib,
+  installShellFiles,
+}:
+
+buildGo126Module rec {
+  pname = "abra";
+  version = "0.13.0-beta";
+  rev = "06a57ded025a43c80f94d4e65299add8a31830dc";
+
+  src = fetchgit {
+    url = "https://git.coopcloud.tech/toolshed/abra.git";
+    tag = version;
+    hash = "sha256-rgoK0TY0WLSQ39lPvVM80zW/qJF40VFBSxYDOaKXZQo=";
+  };
+
+  vendorHash = null;
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  env.CGO_ENABLED = 0;
+  buildPhase = ''
+    runHook preBuild
+    go build -ldflags="-s -w -X 'main.Commit=${rev}' -X 'main.Version=${version}'" ./cmd/abra
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -D abra $out/bin/abra
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    export ABRA_DIR="$out"
+    $out/bin/abra autocomplete bash >abra.bash
+    $out/bin/abra autocomplete fish >abra.fish
+    $out/bin/abra autocomplete zsh >abra.zsh
+    installShellCompletion abra.{bash,fish,zsh}
+  '';
+
+  meta = with lib; {
+    description = "The Co-op Cloud utility belt";
+    homepage = "https://docs.coopcloud.tech/abra";
+    changelog = "https://git.coopcloud.tech/toolshed/abra/releases/tag/${version}";
+    mainProgram = "abra";
+    license = licenses.gpl3Plus;
+    maintainers = "devydave";
+  };
+}

pkg/client/registry.go

@@ -4,18 +4,35 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 
 	"coopcloud.tech/abra/pkg/i18n"
 	"github.com/containers/image/docker"
+	"github.com/containers/image/manifest"
 	"github.com/containers/image/types"
 	"github.com/distribution/reference"
+	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
+func init() {
+	// NOTE: containers/image does not request OCI image indexes by default.
+	// Many multi-arch images (e.g. on Docker Hub) are published as OCI indexes
+	// and the registry refuses to serve them without the matching Accept header.
+	if !slices.Contains(manifest.DefaultRequestedManifestMIMETypes, imgspecv1.MediaTypeImageIndex) {
+		manifest.DefaultRequestedManifestMIMETypes = append(
+			manifest.DefaultRequestedManifestMIMETypes,
+			imgspecv1.MediaTypeImageIndex,
+		)
+	}
+}
+
 // GetRegistryTags retrieves all tags of an image from a container registry.
 func GetRegistryTags(img reference.Named) ([]string, error) {
 	var tags []string
 
-	ref, err := docker.ParseReference(fmt.Sprintf("//%s", img))
+	// NOTE: strip tag and digest, containers/image refuses references
+	// which have both (e.g. nextcloud:34.0.5-fpm@sha256:...)
+	ref, err := docker.ParseReference(fmt.Sprintf("//%s", reference.TrimNamed(img)))
 	if err != nil {
 		return tags, errors.New(i18n.G("failed to parse image %s, saw: %s", img, err.Error()))
 	}
@@ -28,3 +45,37 @@ func GetRegistryTags(img reference.Named) ([]string, error) {
 
 	return tags, nil
 }
+
+// GetRegistryDigest retrieves the manifest digest of an image tag from a
+// container registry. For multi-arch images, this is the digest of the image
+// index, which is what Docker resolves "image:tag" to.
+func GetRegistryDigest(img reference.Named, tag string) (string, error) {
+	tagged, err := reference.WithTag(reference.TrimNamed(img), tag)
+	if err != nil {
+		return "", errors.New(i18n.G("failed to parse image %s, saw: %s", img, err.Error()))
+	}
+
+	ref, err := docker.ParseReference(fmt.Sprintf("//%s", tagged))
+	if err != nil {
+		return "", errors.New(i18n.G("failed to parse image %s, saw: %s", tagged, err.Error()))
+	}
+
+	ctx := context.Background()
+	src, err := ref.NewImageSource(ctx, &types.SystemContext{})
+	if err != nil {
+		return "", err
+	}
+	defer src.Close()
+
+	manifestBytes, _, err := src.GetManifest(ctx, nil)
+	if err != nil {
+		return "", err
+	}
+
+	digest, err := manifest.Digest(manifestBytes)
+	if err != nil {
+		return "", err
+	}
+
+	return digest.String(), nil
+}

pkg/git/clone.go

@@ -52,7 +52,6 @@ func Clone(dir, url string) error {
 				URL:           url,
 				Tags:          git.AllTags,
 				ReferenceName: plumbing.ReferenceName("refs/heads/main"),
-				SingleBranch:  true,
 			})
 
 			if err != nil && gitCloneIgnoreErr(err) {
@@ -71,7 +70,6 @@ func Clone(dir, url string) error {
 					URL:           url,
 					Tags:          git.AllTags,
 					ReferenceName: plumbing.ReferenceName("refs/heads/master"),
-					SingleBranch:  true,
 				})
 
 				if err != nil && gitCloneIgnoreErr(err) {

pkg/recipe/compose.go

@@ -6,8 +6,10 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 
+	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
@@ -110,7 +112,14 @@ func (r Recipe) GetVersionLabelLocal() (string, error) {
 	return label, nil
 }
 
+// getRegistryDigest is a variable so that it can be stubbed in tests.
+var getRegistryDigest = client.GetRegistryDigest
+
 // UpdateTag updates an image tag in-place on file system local compose files.
+// Images which are pinned to a digest (e.g. "nextcloud:34.0.5-fpm@sha256:...")
+// have their digest updated to the one of the new tag, as retrieved from the
+// container registry. Passing the current tag of a digest pinned image
+// refreshes the digest, e.g. when upstream re-published the same tag.
 func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 	fullPattern := fmt.Sprintf("%s/compose**yml", r.Dir)
 	image = formatter.StripTagMeta(image)
@@ -122,6 +131,11 @@ func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 
 	log.Debug(i18n.G("considering %s config(s) for tag update", strings.Join(composeFiles, ", ")))
 
+	var (
+		updated   bool
+		newDigest string
+	)
+
 	for _, composeFile := range composeFiles {
 		opts := stack.Deploy{Composefiles: []string{composeFile}}
 
@@ -140,7 +154,7 @@ func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 				continue // may be a compose.$optional.yml file
 			}
 
-			img, _ := reference.ParseNormalizedNamed(service.Image)
+			img, err := reference.ParseNormalizedNamed(service.Image)
 			if err != nil {
 				return false, err
 			}
@@ -154,30 +168,60 @@ func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 				continue
 			}
 
+			var composeDigest string
+			if canonical, ok := img.(reference.Canonical); ok {
+				composeDigest = canonical.Digest().String()
+			}
+
 			composeImage := formatter.StripTagMeta(reference.Path(img))
 
 			log.Debug(i18n.G("parsed %s from %s", composeTag, service.Image))
 
 			if image == composeImage {
-				bytes, err := ioutil.ReadFile(composeFile)
+				bytes, err := os.ReadFile(composeFile)
 				if err != nil {
 					return false, err
 				}
 
 				old := fmt.Sprintf("%s:%s", composeImage, composeTag)
 				new := fmt.Sprintf("%s:%s", composeImage, tag)
-				replacedBytes := strings.Replace(string(bytes), old, new, -1)
+
+				if composeDigest != "" {
+					if newDigest == "" {
+						newDigest, err = getRegistryDigest(img, tag)
+						if err != nil {
+							return false, errors.New(i18n.G("unable to retrieve digest for %s: %s", new, err))
+						}
+					}
+
+					old = fmt.Sprintf("%s@%s", old, composeDigest)
+					new = fmt.Sprintf("%s@%s", new, newDigest)
+				}
+
+				if old == new {
+					continue
+				}
+
+				// NOTE: only match the full image reference, so that "foo:1.2" does
+				// not match "foo:1.2.3" or the "foo:1.2" part of "foo:1.2@sha256:..."
+				pattern := regexp.MustCompile(regexp.QuoteMeta(old) + `([^@\w.\-]|$)`)
+				replaced := pattern.ReplaceAllString(string(bytes), new+"${1}")
+				if replaced == string(bytes) {
+					continue
+				}
 
 				log.Debug(i18n.G("updating %s to %s in %s", old, new, compose.Filename))
 
-				if err := os.WriteFile(compose.Filename, []byte(replacedBytes), 0o764); err != nil {
+				if err := os.WriteFile(compose.Filename, []byte(replaced), 0o764); err != nil {
 					return false, err
 				}
+
+				updated = true
 			}
 		}
 	}
 
-	return false, nil
+	return updated, nil
 }
 
 // UpdateLabel updates a label in-place on file system local compose files.

pkg/recipe/compose_test.go

@@ -0,0 +1,127 @@
+package recipe
+
+import (
+	"os"
+	"path"
+	"testing"
+
+	"github.com/distribution/reference"
+	"github.com/stretchr/testify/assert"
+)
+
+const (
+	oldDigest = "sha256:1111111111111111111111111111111111111111111111111111111111111111"
+	newDigest = "sha256:2222222222222222222222222222222222222222222222222222222222222222"
+)
+
+func setupUpdateTagRecipe(t *testing.T, compose string) (Recipe, string) {
+	t.Helper()
+
+	dir := t.TempDir()
+	composePath := path.Join(dir, "compose.yml")
+	envPath := path.Join(dir, ".env.sample")
+
+	assert.NoError(t, os.WriteFile(composePath, []byte(compose), 0o644))
+	assert.NoError(t, os.WriteFile(envPath, []byte("TYPE=foo\n"), 0o644))
+
+	return Recipe{
+		Name:          "foo",
+		Dir:           dir,
+		ComposePath:   composePath,
+		SampleEnvPath: envPath,
+	}, composePath
+}
+
+func stubRegistryDigest(t *testing.T, digest string) *[]string {
+	t.Helper()
+
+	var calls []string
+	orig := getRegistryDigest
+	getRegistryDigest = func(img reference.Named, tag string) (string, error) {
+		calls = append(calls, reference.Path(img)+":"+tag)
+		return digest, nil
+	}
+	t.Cleanup(func() { getRegistryDigest = orig })
+
+	return &calls
+}
+
+func TestUpdateTag(t *testing.T) {
+	testcases := []struct {
+		name     string
+		compose  string
+		image    string
+		tag      string
+		expected string
+		updated  bool
+		lookups  int
+	}{
+		{
+			name:     "plain tag",
+			compose:  "version: \"3.8\"\nservices:\n  app:\n    image: nginx:1.31.7\n",
+			image:    "nginx",
+			tag:      "1.31.8",
+			expected: "version: \"3.8\"\nservices:\n  app:\n    image: nginx:1.31.8\n",
+			updated:  true,
+		},
+		{
+			name:     "shorter tag does not mangle longer tag",
+			compose:  "version: \"3.8\"\nservices:\n  app:\n    image: nginx:1.31\n  web:\n    image: nginx:1.31.7\n",
+			image:    "nginx",
+			tag:      "1.32",
+			expected: "version: \"3.8\"\nservices:\n  app:\n    image: nginx:1.32\n  web:\n    image: nginx:1.32\n",
+			updated:  true,
+		},
+		{
+			name:     "digest is updated with tag",
+			compose:  "version: \"3.8\"\nservices:\n  app:\n    image: nextcloud:34.0.5-fpm@" + oldDigest + "\n",
+			image:    "nextcloud",
+			tag:      "34.0.6-fpm",
+			expected: "version: \"3.8\"\nservices:\n  app:\n    image: nextcloud:34.0.6-fpm@" + newDigest + "\n",
+			updated:  true,
+			lookups:  1,
+		},
+		{
+			name:     "digest is refreshed for same tag",
+			compose:  "version: \"3.8\"\nservices:\n  app:\n    image: \"nextcloud:34.0.5-fpm@" + oldDigest + "\"\n",
+			image:    "nextcloud",
+			tag:      "34.0.5-fpm",
+			expected: "version: \"3.8\"\nservices:\n  app:\n    image: \"nextcloud:34.0.5-fpm@" + newDigest + "\"\n",
+			updated:  true,
+			lookups:  1,
+		},
+		{
+			name:     "same tag without digest is a no-op",
+			compose:  "version: \"3.8\"\nservices:\n  app:\n    image: nextcloud:34.0.5-fpm\n",
+			image:    "nextcloud",
+			tag:      "34.0.5-fpm",
+			expected: "version: \"3.8\"\nservices:\n  app:\n    image: nextcloud:34.0.5-fpm\n",
+			updated:  false,
+		},
+		{
+			name:     "pinned and unpinned services sharing an image",
+			compose:  "version: \"3.8\"\nservices:\n  app:\n    image: nextcloud:34.0.5-fpm@" + oldDigest + "\n  cron:\n    image: nextcloud:34.0.5-fpm\n",
+			image:    "nextcloud",
+			tag:      "34.0.6-fpm",
+			expected: "version: \"3.8\"\nservices:\n  app:\n    image: nextcloud:34.0.6-fpm@" + newDigest + "\n  cron:\n    image: nextcloud:34.0.6-fpm\n",
+			updated:  true,
+			lookups:  1,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			r, composePath := setupUpdateTagRecipe(t, tc.compose)
+			calls := stubRegistryDigest(t, newDigest)
+
+			updated, err := r.UpdateTag(tc.image, tc.tag)
+			assert.NoError(t, err)
+			assert.Equal(t, tc.updated, updated)
+			assert.Len(t, *calls, tc.lookups)
+
+			content, err := os.ReadFile(composePath)
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expected, string(content))
+		})
+	}
+}

pkg/recipe/git.go

@@ -16,6 +16,7 @@ import (
 	"coopcloud.tech/tagcmp"
 	"github.com/distribution/reference"
 	"github.com/go-git/go-git/v5"
+	gitCfg "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 )
 
@@ -262,7 +263,12 @@ func (r Recipe) EnsureUpToDate() error {
 		return errors.New(i18n.G("unable to check out default branch in %s: %s", r.Dir, err))
 	}
 
-	fetchOpts := &git.FetchOptions{Tags: git.AllTags}
+	// the refspec is passed explicitly, because a repository cloned by an older abra has a
+	// single-branch refspec stored in its config and would otherwise never see other branches
+	fetchOpts := &git.FetchOptions{
+		Tags:     git.AllTags,
+		RefSpecs: []gitCfg.RefSpec{"+refs/heads/*:refs/remotes/origin/*"},
+	}
 	if err := repo.Fetch(fetchOpts); err != nil {
 		if !strings.Contains(err.Error(), "already up-to-date") {
 			return errors.New(i18n.G("unable to fetch tags in %s: %s", r.Dir, err))

pkg/recipe/recipe.go

@@ -592,15 +592,7 @@ func ReadReposMetadata(debug bool) (RepoCatalogue, error) {
 // sortRecipeVersions sorts the recipe semver versions
 func sortRecipeVersions(versions RecipeVersions) {
 	sort.Slice(versions, func(i, j int) bool {
-		version1, err := tagcmp.Parse(getVersionString(versions[i]))
-		if err != nil {
-			panic(err)
-		}
-		version2, err := tagcmp.Parse(getVersionString(versions[j]))
-		if err != nil {
-			panic(err)
-		}
-		return version1.IsLessThan(version2)
+		return safeCompareVersions(getVersionString(versions[i]), getVersionString(versions[j]))
 	})
 }
 
@@ -616,18 +608,23 @@ func getVersionString(versionMap map[string]map[string]ServiceMeta) string {
 // sortVersionStrings sorts a list of semver version strings
 func sortVersionStrings(versions []string) {
 	sort.Slice(versions, func(i, j int) bool {
-		version1, err := tagcmp.Parse(versions[i])
-		if err != nil {
-			panic(err)
-		}
-		version2, err := tagcmp.Parse(versions[j])
-		if err != nil {
-			panic(err)
-		}
-		return version1.IsLessThan(version2)
+		return safeCompareVersions(versions[i], versions[j])
 	})
 }
 
+// Invalid versions are sorted as less than valid ones.
+func safeCompareVersions(v1, v2 string) bool {
+	version1, err1 := tagcmp.Parse(v1)
+	if err1 != nil {
+		return true
+	}
+	version2, err2 := tagcmp.Parse(v2)
+	if err2 != nil {
+		return false
+	}
+	return version1.IsLessThan(version2)
+}
+
 // GetRecipeCatalogueVersions list the recipe versions listed in the recipe catalogue.
 func GetRecipeCatalogueVersions(recipeName string, catl RecipeCatalogue) ([]string, error) {
 	var versions []string

pkg/recipe/recipe_test.go

@@ -123,3 +123,41 @@ func TestGetVersionLabelLocalDoesNotUseTimeoutLabel(t *testing.T) {
 		assert.NotEqual(t, label, timeout)
 	}
 }
+
+// This is not a full test of comparison, as that occurs in the external
+// tagcmp package. This is a sunny-day integration test
+func TestSortRecipeVersionsSortsTwoValidStrings(t *testing.T) {
+	versions := RecipeVersions{
+		{"2.0.0": {}}, // Index 0
+		{"1.0.0": {}}, // Index 1
+	}
+
+	sortRecipeVersions(versions)
+
+	assert.Equal(t, "1.0.0", getVersionString(versions[0]), "Version 1.0.0 should be first")
+	assert.Equal(t, "2.0.0", getVersionString(versions[1]), "Version 2.0.0 should be second")
+}
+
+func TestSortRecipeVersionsSortsInvalidVersionStringToTheBottom(t *testing.T) {
+	versions := RecipeVersions{
+		{"2.0.0": {}},   // Index 0
+		{"invalid": {}}, // Index 1
+	}
+
+	sortRecipeVersions(versions)
+
+	assert.Equal(t, "invalid", getVersionString(versions[0]), "The invalid version should be first")
+	assert.Equal(t, "2.0.0", getVersionString(versions[1]), "Version 2.0.0 should be second")
+}
+
+func TestSortRecipeVersionsSortsInvalidVersionStringToTheBottomInReverse(t *testing.T) {
+	versions := RecipeVersions{
+		{"invalid": {}}, // Index 0
+		{"2.0.0": {}},   // Index 1
+	}
+
+	sortRecipeVersions(versions)
+
+	assert.Equal(t, "invalid", getVersionString(versions[0]), "The invalid version should be first")
+	assert.Equal(t, "2.0.0", getVersionString(versions[1]), "Version 2.0.0 should be second")
+}

pkg/secret/testdir/compose.yaml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.21.0
+    image: nginx:1.31.8
     secrets:
       - test_pass_one
       - test_pass_two

tests/integration/app_new.bats

@@ -61,6 +61,16 @@ teardown(){
   run grep -q "TYPE=$TEST_RECIPE:0.3.0+1.21.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
+
+  # 0.3.0-only
+  run grep -q "NETWORK_WITH_COMMENT=BAZ" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  # latest-only
+  run grep -q "TIMEOUT=120" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_failure
 }
 
 @test "ensure recipe is up-to-date" {
@@ -100,6 +110,49 @@ teardown(){
   run grep -q "TYPE=$TEST_RECIPE:${tagHash}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
+
+  # 0.3.0-only
+  run grep -q "NETWORK_WITH_COMMENT=BAZ" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  # latest-only
+  run grep -q "TIMEOUT=120" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_failure
+}
+
+@test "create new app with commit from another branch" {
+  branchHash=$(_get_other_branch_hash)
+  if [[ -z "$branchHash" ]]; then
+    skip "$TEST_RECIPE has no branch besides main"
+  fi
+
+  # re-clone the recipe the way an older abra did, with a single-branch refspec. --no-local
+  # forces a real transfer, a local clone would hardlink the whole object database and leave
+  # the commit reachable
+  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_success
+
+  run git clone -q --no-local --single-branch --branch main \
+    "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_success
+
+  # the commit has to be genuinely missing, otherwise this test passes for the wrong reason
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-parse --verify "$branchHash^{commit}"
+  assert_failure
+
+  run $ABRA app new "$TEST_RECIPE" "$branchHash" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  # the recipe names itself in TYPE, which differs per branch, so only the version is checked
+  run grep -q "TYPE=.*:${branchHash}$" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
 }
 
 @test "does not overwrite existing env files" {

tests/integration/helpers/git.bash

@@ -56,6 +56,13 @@ _get_tag_hash() {
   echo $(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-list -n 1 "$1")
 }
 
+_get_other_branch_hash() {
+  # asked from the origin mirror, not from the recipe checkout, so that the result does not
+  # depend on what has been fetched. empty when the recipe only has a default branch
+  echo $(git ls-remote "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" \
+    | grep 'refs/heads/' | grep -v 'refs/heads/main$' | head -1 | cut -f1)
+}
+
 _get_head_hash() {
   echo $(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show -s --format="%H" HEAD)
 }

tests/resources/test_recipe/compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.29.0
+    image: nginx:1.31.8
     networks:
       - proxy
     deploy:

vendor/coopcloud.tech/tagcmp/.drone.yml

@@ -3,16 +3,16 @@ kind: pipeline
 name: coopcloud.tech/tagcmp
 steps:
   - name: gofmt
-    image: golang:1.21
+    image: golang:1.27
     commands:
       - test -z "$(gofmt -l .)"
 
   - name: go build
-    image: golang:1.21
+    image: golang:1.27
     commands:
       - go build -v .
 
   - name: go test
-    image: golang:1.21
+    image: golang:1.27
     commands:
       - go test . -cover

vendor/coopcloud.tech/tagcmp/renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

vendor/github.com/go-git/go-billy/v5/README.md

@@ -5,6 +5,10 @@ Billy implements an interface based on the `os` standard library, allowing to de
 
 Billy was born as part of [go-git/go-git](https://github.com/go-git/go-git) project.
 
+## Version support
+
+go-billy v5 is in maintenance mode. Users should upgrade to [go-billy v6](https://pkg.go.dev/github.com/go-git/go-billy/v6) where possible.
+
 ## Installation
 
 ```go

vendor/github.com/go-git/go-billy/v5/helper/chroot/chroot.go

@@ -3,19 +3,25 @@ package chroot
 import (
 	"errors"
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
+	"syscall"
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-billy/v5/helper/polyfill"
 )
 
 // ChrootHelper is a helper to implement billy.Chroot.
+// It is not a security boundary, callers that need containment should use a
+// filesystem implementation that enforces paths at the OS boundary instead.
 type ChrootHelper struct {
 	underlying billy.Filesystem
 	base       string
 }
 
+const maxFollowedSymlinks = 8 // Aligns with POSIX_SYMLOOP_MAX
+
 // New creates a new filesystem wrapping up the given 'fs'.
 // The created filesystem has its base in the given ChrootHelperectory of the
 // underlying filesystem.
@@ -34,15 +40,184 @@ func (fs *ChrootHelper) underlyingPath(filename string) (string, error) {
 	return fs.Join(fs.Root(), filename), nil
 }
 
-func isCrossBoundaries(path string) bool {
-	path = filepath.ToSlash(path)
-	path = filepath.Clean(path)
+func (fs *ChrootHelper) followedPath(filename string, followFinal bool, op string) (string, error) {
+	fullpath, err := fs.underlyingPath(filename)
+	if err != nil {
+		return "", err
+	}
 
-	return strings.HasPrefix(path, ".."+string(filepath.Separator))
+	sl, ok := fs.underlying.(billy.Symlink)
+	if !ok {
+		return fullpath, nil
+	}
+
+	rel, err := fs.relativeToRoot(fullpath)
+	if err != nil {
+		return "", err
+	}
+
+	fullpath, err = fs.resolveFollowedPath(rel, followFinal, op, sl)
+	if errors.Is(err, billy.ErrNotSupported) {
+		return fs.underlyingPath(filename)
+	}
+
+	return fullpath, err
+}
+
+func (fs *ChrootHelper) resolveFollowedPath(rel string, followFinal bool, op string, sl billy.Symlink) (string, error) {
+	if rel == "" {
+		return fs.resolveFollowedRoot(followFinal, op, sl)
+	}
+
+	parts := splitRelativePath(rel)
+	resolved := ""
+	followed := 0
+
+	for len(parts) > 0 {
+		part := parts[0]
+		parts = parts[1:]
+
+		currentRel := joinRelativePath(resolved, part)
+		currentPath := fs.Join(fs.Root(), currentRel)
+		if len(parts) == 0 && !followFinal {
+			return currentPath, nil
+		}
+
+		fi, err := sl.Lstat(currentPath)
+		if err != nil {
+			if os.IsNotExist(err) {
+				return fs.Join(fs.Root(), joinRelativePath(append([]string{currentRel}, parts...)...)), nil
+			}
+			return "", err
+		}
+
+		if fi.Mode()&os.ModeSymlink == 0 {
+			resolved = currentRel
+			continue
+		}
+
+		followed++
+		if followed > maxFollowedSymlinks {
+			return "", symlinkLoopError(op, currentPath)
+		}
+
+		target, err := sl.Readlink(currentPath)
+		if err != nil {
+			return "", err
+		}
+
+		targetRel, err := fs.linkTargetRel(currentPath, target)
+		if err != nil {
+			return "", err
+		}
+		if targetRel == currentRel {
+			return "", symlinkLoopError(op, currentPath)
+		}
+
+		parts = append(splitRelativePath(targetRel), parts...)
+		resolved = ""
+	}
+
+	return fs.Join(fs.Root(), resolved), nil
+}
+
+func symlinkLoopError(op, path string) error {
+	return &os.PathError{Op: op, Path: path, Err: syscall.ELOOP}
+}
+
+func (fs *ChrootHelper) resolveFollowedRoot(followFinal bool, op string, sl billy.Symlink) (string, error) {
+	root := fs.Join(fs.Root(), "")
+	if !followFinal {
+		return root, nil
+	}
+
+	fi, err := sl.Lstat(root)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return root, nil
+		}
+		return "", err
+	}
+
+	if fi.Mode()&os.ModeSymlink == 0 {
+		return root, nil
+	}
+
+	target, err := sl.Readlink(root)
+	if err != nil {
+		return "", err
+	}
+
+	targetRel, err := fs.linkTargetRel(root, target)
+	if err != nil {
+		return root, err
+	}
+	if targetRel == "" {
+		return "", symlinkLoopError(op, root)
+	}
+
+	return fs.resolveFollowedPath(targetRel, followFinal, op, sl)
+}
+
+func (fs *ChrootHelper) relativeToRoot(filename string) (string, error) {
+	rel, err := filepath.Rel(filepath.Clean(fs.Root()), filepath.Clean(filename))
+	if err != nil || isCrossBoundaries(rel) {
+		return "", billy.ErrCrossedBoundary
+	}
+
+	if rel == "." {
+		return "", nil
+	}
+	return rel, nil
+}
+
+func (fs *ChrootHelper) linkTargetRel(linkPath, target string) (string, error) {
+	target = filepath.FromSlash(target)
+	if filepath.IsAbs(target) || strings.HasPrefix(target, string(filepath.Separator)) {
+		return fs.relativeToRoot(target)
+	}
+
+	return fs.relativeToRoot(fs.Join(filepath.Dir(linkPath), target))
+}
+
+func splitRelativePath(filename string) []string {
+	filename = filepath.Clean(filename)
+	if filename == "" || filename == "." {
+		return nil
+	}
+
+	return strings.Split(filepath.ToSlash(filename), "/")
+}
+
+func joinRelativePath(elem ...string) string {
+	parts := make([]string, 0, len(elem))
+	for _, part := range elem {
+		if part == "" || part == "." {
+			continue
+		}
+		parts = append(parts, part)
+	}
+
+	if len(parts) == 0 {
+		return ""
+	}
+	return filepath.Join(parts...)
+}
+
+func isCreateExclusive(flag int) bool {
+	return flag&os.O_CREATE != 0 && flag&os.O_EXCL != 0
+}
+
+func isCrossBoundaries(name string) bool {
+	name = filepath.ToSlash(name)
+	name = strings.TrimLeft(name, "/")
+	name = path.Clean(name)
+
+	return name == ".." || strings.HasPrefix(name, "../")
 }
 
 func (fs *ChrootHelper) Create(filename string) (billy.File, error) {
-	fullpath, err := fs.underlyingPath(filename)
+	fullpath, err := fs.followedPath(filename, true, "create")
 	if err != nil {
 		return nil, err
 	}
@@ -56,7 +231,7 @@ func (fs *ChrootHelper) Create(filename string) (billy.File, error) {
 }
 
 func (fs *ChrootHelper) Open(filename string) (billy.File, error) {
-	fullpath, err := fs.underlyingPath(filename)
+	fullpath, err := fs.followedPath(filename, true, "open")
 	if err != nil {
 		return nil, err
 	}
@@ -70,7 +245,7 @@ func (fs *ChrootHelper) Open(filename string) (billy.File, error) {
 }
 
 func (fs *ChrootHelper) OpenFile(filename string, flag int, mode os.FileMode) (billy.File, error) {
-	fullpath, err := fs.underlyingPath(filename)
+	fullpath, err := fs.followedPath(filename, !isCreateExclusive(flag), "open")
 	if err != nil {
 		return nil, err
 	}
@@ -84,12 +259,16 @@ func (fs *ChrootHelper) OpenFile(filename string, flag int, mode os.FileMode) (b
 }
 
 func (fs *ChrootHelper) Stat(filename string) (os.FileInfo, error) {
-	fullpath, err := fs.underlyingPath(filename)
+	fullpath, err := fs.followedPath(filename, true, "stat")
 	if err != nil {
 		return nil, err
 	}
 
-	return fs.underlying.Stat(fullpath)
+	fi, err := fs.underlying.Stat(fullpath)
+	if err != nil {
+		return nil, err
+	}
+	return fileInfo{FileInfo: fi, name: filepath.Base(filename)}, nil
 }
 
 func (fs *ChrootHelper) Rename(from, to string) error {
@@ -135,7 +314,7 @@ func (fs *ChrootHelper) TempFile(dir, prefix string) (billy.File, error) {
 }
 
 func (fs *ChrootHelper) ReadDir(path string) ([]os.FileInfo, error) {
-	fullpath, err := fs.underlyingPath(path)
+	fullpath, err := fs.followedPath(path, true, "readdir")
 	if err != nil {
 		return nil, err
 	}
@@ -241,6 +420,11 @@ type file struct {
 	name string
 }
 
+type fileInfo struct {
+	os.FileInfo
+	name string
+}
+
 func newFile(fs billy.Filesystem, f billy.File, filename string) billy.File {
 	filename = fs.Join(fs.Root(), filename)
 	filename, _ = filepath.Rel(fs.Root(), filename)
@@ -254,3 +438,7 @@ func newFile(fs billy.Filesystem, f billy.File, filename string) billy.File {
 func (f *file) Name() string {
 	return f.name
 }
+
+func (fi fileInfo) Name() string {
+	return fi.name
+}

vendor/github.com/go-git/go-billy/v5/osfs/os.go

@@ -24,6 +24,9 @@ var Default = &ChrootOS{}
 // New returns a new OS filesystem.
 // By default paths are deduplicated, but still enforced
 // under baseDir. For more info refer to WithDeduplicatePath.
+//
+// New returns ChrootOS by default for v5 compatibility. Users should prefer
+// New with WithBoundOS.
 func New(baseDir string, opts ...Option) billy.Filesystem {
 	o := &options{
 		deduplicatePath: true,
@@ -47,6 +50,8 @@ func WithBoundOS() Option {
 }
 
 // WithChrootOS returns the option of using a Chroot filesystem OS.
+//
+// Deprecated: use WithBoundOS instead.
 func WithChrootOS() Option {
 	return func(o *options) {
 		o.Type = ChrootOSFS

vendor/github.com/go-git/go-billy/v5/osfs/os_bound.go

@@ -20,6 +20,7 @@
 package osfs
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -29,6 +30,31 @@ import (
 	"github.com/go-git/go-billy/v5"
 )
 
+var (
+	// ErrBaseDirCannotBeRemoved is returned when removing the BoundOS base dir.
+	ErrBaseDirCannotBeRemoved = errors.New("base dir cannot be removed")
+
+	// ErrBaseDirCannotBeRenamed is returned when renaming the BoundOS base dir.
+	ErrBaseDirCannotBeRenamed = errors.New("base dir cannot be renamed")
+
+	dotPrefixes   = dotPathPrefixes()
+	dotSeparators = dotPathSeparators()
+)
+
+func dotPathPrefixes() []string {
+	if filepath.Separator == '\\' {
+		return []string{"./", ".\\"}
+	}
+	return []string{"./"}
+}
+
+func dotPathSeparators() string {
+	if filepath.Separator == '\\' {
+		return `/\`
+	}
+	return `/`
+}
+
 // BoundOS is a fs implementation based on the OS filesystem which is bound to
 // a base dir.
 // Prefer this fs implementation over ChrootOS.
@@ -54,6 +80,7 @@ func (fs *BoundOS) Create(filename string) (billy.File, error) {
 }
 
 func (fs *BoundOS) OpenFile(filename string, flag int, perm os.FileMode) (billy.File, error) {
+	filename = fs.expandDot(filename)
 	fn, err := fs.abs(filename)
 	if err != nil {
 		return nil, err
@@ -62,6 +89,7 @@ func (fs *BoundOS) OpenFile(filename string, flag int, perm os.FileMode) (billy.
 }
 
 func (fs *BoundOS) ReadDir(path string) ([]os.FileInfo, error) {
+	path = fs.expandDot(path)
 	dir, err := fs.abs(path)
 	if err != nil {
 		return nil, err
@@ -71,6 +99,12 @@ func (fs *BoundOS) ReadDir(path string) ([]os.FileInfo, error) {
 }
 
 func (fs *BoundOS) Rename(from, to string) error {
+	if fs.isBaseDir(from) {
+		return ErrBaseDirCannotBeRenamed
+	}
+	from = fs.expandDot(from)
+	to = fs.expandDot(to)
+
 	f, err := fs.abs(from)
 	if err != nil {
 		return err
@@ -89,6 +123,7 @@ func (fs *BoundOS) Rename(from, to string) error {
 }
 
 func (fs *BoundOS) MkdirAll(path string, perm os.FileMode) error {
+	path = fs.expandDot(path)
 	dir, err := fs.abs(path)
 	if err != nil {
 		return err
@@ -101,6 +136,7 @@ func (fs *BoundOS) Open(filename string) (billy.File, error) {
 }
 
 func (fs *BoundOS) Stat(filename string) (os.FileInfo, error) {
+	filename = fs.expandDot(filename)
 	filename, err := fs.abs(filename)
 	if err != nil {
 		return nil, err
@@ -109,6 +145,11 @@ func (fs *BoundOS) Stat(filename string) (os.FileInfo, error) {
 }
 
 func (fs *BoundOS) Remove(filename string) error {
+	if fs.isBaseDir(filename) {
+		return ErrBaseDirCannotBeRemoved
+	}
+	filename = fs.expandDot(filename)
+
 	fn, err := fs.abs(filename)
 	if err != nil {
 		return err
@@ -122,6 +163,7 @@ func (fs *BoundOS) Remove(filename string) error {
 func (fs *BoundOS) TempFile(dir, prefix string) (billy.File, error) {
 	if dir != "" {
 		var err error
+		dir = fs.expandDot(dir)
 		dir, err = fs.abs(dir)
 		if err != nil {
 			return nil, err
@@ -144,6 +186,11 @@ func (fs *BoundOS) Join(elem ...string) string {
 }
 
 func (fs *BoundOS) RemoveAll(path string) error {
+	if fs.isBaseDir(path) {
+		return ErrBaseDirCannotBeRemoved
+	}
+	path = fs.expandDot(path)
+
 	dir, err := fs.abs(path)
 	if err != nil {
 		return err
@@ -152,6 +199,7 @@ func (fs *BoundOS) RemoveAll(path string) error {
 }
 
 func (fs *BoundOS) Symlink(target, link string) error {
+	link = fs.expandDot(link)
 	ln, err := fs.abs(link)
 	if err != nil {
 		return err
@@ -164,6 +212,7 @@ func (fs *BoundOS) Symlink(target, link string) error {
 }
 
 func (fs *BoundOS) Lstat(filename string) (os.FileInfo, error) {
+	filename = fs.expandDot(filename)
 	filename = filepath.Clean(filename)
 	if !filepath.IsAbs(filename) {
 		filename = filepath.Join(fs.baseDir, filename)
@@ -175,6 +224,7 @@ func (fs *BoundOS) Lstat(filename string) (os.FileInfo, error) {
 }
 
 func (fs *BoundOS) Readlink(link string) (string, error) {
+	link = fs.expandDot(link)
 	if !filepath.IsAbs(link) {
 		link = filepath.Clean(filepath.Join(fs.baseDir, link))
 	}
@@ -185,6 +235,7 @@ func (fs *BoundOS) Readlink(link string) (string, error) {
 }
 
 func (fs *BoundOS) Chmod(path string, mode os.FileMode) error {
+	path = fs.expandDot(path)
 	abspath, err := fs.abs(path)
 	if err != nil {
 		return err
@@ -199,7 +250,7 @@ func (fs *BoundOS) Chroot(path string) (billy.Filesystem, error) {
 	if err != nil {
 		return nil, err
 	}
-	return New(joined), nil
+	return New(joined, WithBoundOS()), nil
 }
 
 // Root returns the current base dir of the billy.Filesystem.
@@ -220,6 +271,37 @@ func (fs *BoundOS) createDir(fullpath string) error {
 	return nil
 }
 
+func (fs *BoundOS) expandDot(path string) string {
+	if path == "." {
+		return fs.baseDir
+	}
+	for _, prefix := range dotPrefixes {
+		if strings.HasPrefix(path, prefix) {
+			path = strings.TrimLeft(strings.TrimPrefix(path, prefix), dotSeparators)
+			if path == "" {
+				return fs.baseDir
+			}
+			return path
+		}
+	}
+	return path
+}
+
+func (fs *BoundOS) isBaseDir(path string) bool {
+	if path == "" || filepath.Clean(path) == "." {
+		return true
+	}
+	path = fs.expandDot(path)
+	if filepath.Clean(path) == filepath.Clean(fs.baseDir) {
+		return true
+	}
+	abspath, err := fs.abs(path)
+	if err != nil {
+		return false
+	}
+	return filepath.Clean(abspath) == filepath.Clean(fs.baseDir)
+}
+
 // abs transforms filename to an absolute path, taking into account the base dir.
 // Relative paths won't be allowed to ascend the base dir, so `../file` will become
 // `/working-dir/file`.
@@ -233,7 +315,7 @@ func (fs *BoundOS) abs(filename string) (string, error) {
 
 	path, err := securejoin.SecureJoin(fs.baseDir, filename)
 	if err != nil {
-		return "", nil
+		return "", err
 	}
 
 	if fs.deduplicatePath {
@@ -246,24 +328,12 @@ func (fs *BoundOS) abs(filename string) (string, error) {
 	return path, nil
 }
 
-// insideBaseDir checks whether filename is located within
-// the fs.baseDir.
-func (fs *BoundOS) insideBaseDir(filename string) (bool, error) {
-	if filename == fs.baseDir {
-		return true, nil
-	}
-	if !strings.HasPrefix(filename, fs.baseDir+string(filepath.Separator)) {
-		return false, fmt.Errorf("path outside base dir")
-	}
-	return true, nil
-}
-
 // insideBaseDirEval checks whether filename is contained within
 // a dir that is within the fs.baseDir, by first evaluating any symlinks
 // that either filename or fs.baseDir may contain.
 func (fs *BoundOS) insideBaseDirEval(filename string) (bool, error) {
 	// "/" contains all others.
-	if fs.baseDir == "/" {
+	if fs.baseDir == "/" || fs.baseDir == filename {
 		return true, nil
 	}
 	dir, err := filepath.EvalSymlinks(filepath.Dir(filename))

vendor/github.com/go-git/go-billy/v5/osfs/os_chroot.go

@@ -14,6 +14,8 @@ import (
 // ChrootOS is a legacy filesystem based on a "soft chroot" of the os filesystem.
 // Although this is still the default os filesystem, consider using BoundOS instead.
 //
+// Deprecated: use New with WithBoundOS instead.
+//
 // Behaviours of note:
 //  1. A "soft chroot" translates the base dir to "/" for the purposes of the
 //     fs abstraction.
@@ -24,6 +26,14 @@ import (
 type ChrootOS struct{}
 
 func newChrootOS(baseDir string) billy.Filesystem {
+	if baseDir != "" {
+		resolved, err := filepath.EvalSymlinks(baseDir)
+		if err != nil {
+			return chroot.New(&ChrootOS{}, baseDir)
+		}
+		baseDir = resolved
+	}
+
 	return chroot.New(&ChrootOS{}, baseDir)
 }
 

vendor/github.com/go-git/go-billy/v5/util/util.go

@@ -16,8 +16,6 @@ import (
 // can but returns the first error it encounters. If the path does not exist,
 // RemoveAll returns nil (no error).
 func RemoveAll(fs billy.Basic, path string) error {
-	fs, path = getUnderlyingAndPath(fs, path)
-
 	if r, ok := fs.(removerAll); ok {
 		return r.RemoveAll(path)
 	}
@@ -39,7 +37,7 @@ func removeAll(fs billy.Basic, path string) error {
 	}
 
 	// Otherwise, is this a directory we need to recurse into?
-	dir, serr := fs.Stat(path)
+	dir, serr := lstat(fs, path)
 	if serr != nil {
 		if errors.Is(serr, os.ErrNotExist) {
 			return nil
@@ -48,8 +46,8 @@ func removeAll(fs billy.Basic, path string) error {
 		return serr
 	}
 
-	if !dir.IsDir() {
-		// Not a directory; return the error from Remove.
+	if dir.Mode()&os.ModeSymlink != 0 || !dir.IsDir() {
+		// Not a directory we should recurse into; return the error from Remove.
 		return err
 	}
 
@@ -62,7 +60,7 @@ func removeAll(fs billy.Basic, path string) error {
 	fis, err := dirfs.ReadDir(path)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			// Race. It was deleted between the Lstat and Open.
+			// Race. It was deleted between the Lstat and ReadDir.
 			// Return nil per RemoveAll's docs.
 			return nil
 		}
@@ -91,7 +89,18 @@ func removeAll(fs billy.Basic, path string) error {
 	}
 
 	return err
+}
 
+func lstat(filesystem billy.Basic, path string) (os.FileInfo, error) {
+	if sl, ok := filesystem.(billy.Symlink); ok {
+		// Avoid following a symlink substituted after the initial Remove fails.
+		fi, err := sl.Lstat(path)
+		if err == nil || !errors.Is(err, billy.ErrNotSupported) {
+			return fi, err
+		}
+	}
+
+	return filesystem.Stat(path)
 }
 
 // WriteFile writes data to a file named by filename in the given filesystem.
@@ -123,8 +132,10 @@ func WriteFile(fs billy.Basic, filename string, data []byte, perm os.FileMode) (
 // We generate random temporary file names so that there's a good
 // chance the file doesn't exist yet - keeps the number of tries in
 // TempFile to a minimum.
-var rand uint32
-var randmu sync.Mutex
+var (
+	rand   uint32
+	randmu sync.Mutex
+)
 
 func reseed() uint32 {
 	return uint32(time.Now().UnixNano() + int64(os.Getpid()))
@@ -220,22 +231,6 @@ func getTempDir(fs billy.Basic) string {
 	return ".tmp"
 }
 
-type underlying interface {
-	Underlying() billy.Basic
-}
-
-func getUnderlyingAndPath(fs billy.Basic, path string) (billy.Basic, string) {
-	u, ok := fs.(underlying)
-	if !ok {
-		return fs, path
-	}
-	if ch, ok := fs.(billy.Chroot); ok {
-		path = fs.Join(ch.Root(), path)
-	}
-
-	return u.Underlying(), path
-}
-
 // ReadFile reads the named file and returns the contents from the given filesystem.
 // A successful call returns err == nil, not err == EOF.
 // Because ReadFile reads the whole file, it does not treat an EOF from Read

vendor/github.com/go-git/go-git/v5/.gitignore

@@ -5,3 +5,4 @@ profile.out
 .tmp/
 .git-dist/
 .vscode
+build/tools/

vendor/github.com/go-git/go-git/v5/config/config.go

@@ -61,6 +61,16 @@ type Config struct {
 		CommentChar string
 		// RepositoryFormatVersion identifies the repository format and layout version.
 		RepositoryFormatVersion format.RepositoryFormatVersion
+		// ProtectNTFS controls whether NTFS-specific path protections are
+		// applied (e.g. rejecting .git trailing spaces/periods, alternate
+		// data streams, 8.3 short names). When unset, defaults to true on
+		// Windows.
+		ProtectNTFS OptBool
+		// ProtectHFS controls whether HFS+-specific path protections are
+		// applied (e.g. rejecting .git with Unicode zero-width or
+		// directional characters that HFS+ would normalize away).
+		// When unset, defaults to true on macOS.
+		ProtectHFS OptBool
 	}
 
 	User struct {
@@ -266,6 +276,8 @@ const (
 	repositoryFormatVersionKey = "repositoryformatversion"
 	objectFormat               = "objectformat"
 	mirrorKey                  = "mirror"
+	protectNTFSKey             = "protectNTFS"
+	protectHFSKey              = "protectHFS"
 
 	// DefaultPackWindow holds the number of previous objects used to
 	// generate deltas. The value 10 is the same used by git command.
@@ -309,6 +321,18 @@ func (c *Config) unmarshalCore() {
 
 	c.Core.Worktree = s.Options.Get(worktreeKey)
 	c.Core.CommentChar = s.Options.Get(commentCharKey)
+
+	if parsed := parseConfigBool(s.Options.Get(protectNTFSKey)); parsed.IsSet() {
+		c.Core.ProtectNTFS = parsed
+	}
+
+	if parsed := parseConfigBool(s.Options.Get(protectHFSKey)); parsed.IsSet() {
+		c.Core.ProtectHFS = parsed
+	}
+
+	if s.Options.Get(repositoryFormatVersionKey) == string(format.Version_1) {
+		c.Core.RepositoryFormatVersion = format.Version_1
+	}
 }
 
 func (c *Config) unmarshalUser() {
@@ -379,7 +403,8 @@ func unmarshalSubmodules(fc *format.Config, submodules map[string]*Submodule) {
 		m := &Submodule{}
 		m.unmarshal(sub)
 
-		if m.Validate() == ErrModuleBadPath {
+		if err := m.Validate(); errors.Is(err, ErrModuleBadPath) ||
+			errors.Is(err, ErrModuleBadName) {
 			continue
 		}
 
@@ -436,6 +461,14 @@ func (c *Config) marshalCore() {
 	if c.Core.Worktree != "" {
 		s.SetOption(worktreeKey, c.Core.Worktree)
 	}
+
+	if c.Core.ProtectNTFS.IsSet() {
+		s.SetOption(protectNTFSKey, c.Core.ProtectNTFS.FormatBool())
+	}
+
+	if c.Core.ProtectHFS.IsSet() {
+		s.SetOption(protectHFSKey, c.Core.ProtectHFS.FormatBool())
+	}
 }
 
 func (c *Config) marshalExtensions() {

vendor/github.com/go-git/go-git/v5/config/modules.go

@@ -3,8 +3,11 @@ package config
 import (
 	"bytes"
 	"errors"
+	"fmt"
 	"regexp"
+	"strings"
 
+	"github.com/go-git/go-git/v5/internal/pathutil"
 	format "github.com/go-git/go-git/v5/plumbing/format/config"
 )
 
@@ -12,6 +15,7 @@ var (
 	ErrModuleEmptyURL  = errors.New("module config: empty URL")
 	ErrModuleEmptyPath = errors.New("module config: empty path")
 	ErrModuleBadPath   = errors.New("submodule has an invalid path")
+	ErrModuleBadName   = errors.New("ignoring suspicious submodule name")
 )
 
 var (
@@ -94,6 +98,10 @@ type Submodule struct {
 
 // Validate validates the fields and sets the default values.
 func (m *Submodule) Validate() error {
+	if err := validSubmoduleName(m.Name); err != nil {
+		return fmt.Errorf("%w: %q", ErrModuleBadName, m.Name)
+	}
+
 	if m.Path == "" {
 		return ErrModuleEmptyPath
 	}
@@ -109,6 +117,50 @@ func (m *Submodule) Validate() error {
 	return nil
 }
 
+// validSubmoduleName mirrors canonical Git's check_submodule_name in
+// submodule-config.c [1]: reject empty names and any name with a ".."
+// path component, using both '/' and '\\' as separators so the rule
+// is consistent across platforms. The component check is delegated to
+// `pathutil.IsHFSDot` and `pathutil.IsNTFSDot` with `.` as the needle,
+// which both cover the bare ".." case and reject components that
+// resolve to ".." after HFS+ Unicode normalisation (ignored code
+// points, e.g. `.<U+200C>.`) or NTFS trailing-space/dot/ADS
+// canonicalisation (e.g. `.. `, `..::$INDEX_ALLOCATION`).
+// `.gitmodules` is attacker-controlled by definition, so both checks
+// run unconditionally regardless of host OS.
+//
+// The additional checks (bare ".", NUL byte, leading or trailing
+// separator, drive-letter prefix) close go-git-specific edge cases
+// the canonical loop does not exercise: canonical Git treats names
+// as opaque C strings, while Go strings carry NULs through and the
+// billy filesystem layer is path-aware in ways Git's working storage
+// is not.
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/submodule-config.c#L214-L237
+func validSubmoduleName(name string) error {
+	if name == "" || name == "." {
+		return ErrModuleBadName
+	}
+	for _, seg := range strings.FieldsFunc(name, isPathSep) {
+		if pathutil.IsHFSDot(seg, ".") || pathutil.IsNTFSDot(seg, ".", "") {
+			return ErrModuleBadName
+		}
+	}
+	// go-git-specific defensive checks beyond canonical Git.
+	if strings.ContainsRune(name, 0) {
+		return ErrModuleBadName
+	}
+	if isPathSep(rune(name[0])) || isPathSep(rune(name[len(name)-1])) {
+		return ErrModuleBadName
+	}
+	if len(name) >= 2 && name[1] == ':' {
+		return ErrModuleBadName
+	}
+	return nil
+}
+
+func isPathSep(r rune) bool { return r == '/' || r == '\\' }
+
 func (m *Submodule) unmarshal(s *format.Subsection) {
 	m.raw = s
 

vendor/github.com/go-git/go-git/v5/config/optbool.go

@@ -0,0 +1,82 @@
+package config
+
+import (
+	"strconv"
+	"strings"
+)
+
+// OptBool is a tri-state boolean: unset, explicitly false, or explicitly true.
+// Its zero value (OptBoolUnset) means the setting was not specified, which
+// allows merge logic based on reflect.Value.IsZero to skip unset fields while
+// still letting an explicit "false" override a previously set "true".
+type OptBool byte
+
+const (
+	// OptBoolUnset indicates the setting was not specified.
+	OptBoolUnset OptBool = iota
+	// OptBoolFalse indicates the setting was explicitly set to false.
+	OptBoolFalse
+	// OptBoolTrue indicates the setting was explicitly set to true.
+	OptBoolTrue
+)
+
+// NewOptBool converts a plain bool into an OptBool.
+func NewOptBool(v bool) OptBool {
+	if v {
+		return OptBoolTrue
+	}
+	return OptBoolFalse
+}
+
+// IsTrue returns whether the value is explicitly true.
+func (o OptBool) IsTrue() bool { return o == OptBoolTrue }
+
+// IsSet returns whether the value was explicitly specified (true or false).
+func (o OptBool) IsSet() bool { return o != OptBoolUnset }
+
+func (o OptBool) String() string {
+	switch o {
+	case OptBoolTrue:
+		return "true"
+	case OptBoolFalse:
+		return "false"
+	default:
+		return "unset"
+	}
+}
+
+// FormatBool returns the strconv-formatted value. Only meaningful when IsSet.
+func (o OptBool) FormatBool() string {
+	return strconv.FormatBool(o.IsTrue())
+}
+
+// parseConfigBool mirrors upstream Git's git_parse_maybe_bool: it
+// accepts true/yes/on (→ OptBoolTrue) and false/no/off (→
+// OptBoolFalse) case-insensitively, plus any decimal integer (zero
+// → OptBoolFalse, non-zero → OptBoolTrue). Empty or otherwise
+// unrecognised values return OptBoolUnset, leaving the caller's
+// platform default in place. The empty-string handling is the only
+// intentional divergence from upstream, which returns false for
+// empty: in our unmarshalCore caller, an empty value means the key
+// is unset and the platform default should apply.
+//
+// Reference: upstream Git git_parse_maybe_bool_text at parse.c
+// L157-L173 and git_parse_maybe_bool at parse.c L174-L182 in tag
+// v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/parse.c#L157-L182
+func parseConfigBool(v string) OptBool {
+	switch strings.ToLower(v) {
+	case "true", "yes", "on":
+		return OptBoolTrue
+	case "false", "no", "off":
+		return OptBoolFalse
+	}
+	if i, err := strconv.Atoi(v); err == nil {
+		if i != 0 {
+			return OptBoolTrue
+		}
+		return OptBoolFalse
+	}
+	return OptBoolUnset
+}

vendor/github.com/go-git/go-git/v5/internal/pathutil/dotgit.go

@@ -0,0 +1,21 @@
+package pathutil
+
+import "strings"
+
+// IsDotGitName reports whether name is `.git` or its 8.3 NTFS short
+// alias `git~1`, case-insensitively. Both are forbidden as path
+// components (and as submodule names) because they refer to the
+// repository's own metadata directory.
+//
+// File names that do not conform to the 8.3 format (up to eight
+// characters for the basename, three for the file extension) are
+// associated with a so-called "short name" on NTFS — at least on
+// the `C:` drive by default — which means that `git~1/` is a valid
+// way to refer to `.git/`.
+func IsDotGitName(name string) bool {
+	switch strings.ToLower(name) {
+	case ".git", "git~1":
+		return true
+	}
+	return false
+}

vendor/github.com/go-git/go-git/v5/internal/pathutil/hfs.go

@@ -0,0 +1,99 @@
+package pathutil
+
+import "unicode"
+
+// hfsIgnoredCodepoints contains Unicode code points that HFS+ ignores
+// during path normalization. A path component containing these
+// characters between the bytes of ".git" (or ".gitmodules", etc.)
+// will be treated as that name by HFS+, so they have to be filtered
+// out before comparison.
+//
+// See upstream Git utf8.c next_hfs_char in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/utf8.c#L703-L740
+var hfsIgnoredCodepoints = map[rune]struct{}{
+	0x200c: {}, // ZERO WIDTH NON-JOINER
+	0x200d: {}, // ZERO WIDTH JOINER
+	0x200e: {}, // LEFT-TO-RIGHT MARK
+	0x200f: {}, // RIGHT-TO-LEFT MARK
+	0x202a: {}, // LEFT-TO-RIGHT EMBEDDING
+	0x202b: {}, // RIGHT-TO-LEFT EMBEDDING
+	0x202c: {}, // POP DIRECTIONAL FORMATTING
+	0x202d: {}, // LEFT-TO-RIGHT OVERRIDE
+	0x202e: {}, // RIGHT-TO-LEFT OVERRIDE
+	0x206a: {}, // INHIBIT SYMMETRIC SWAPPING
+	0x206b: {}, // ACTIVATE SYMMETRIC SWAPPING
+	0x206c: {}, // INHIBIT ARABIC FORM SHAPING
+	0x206d: {}, // ACTIVATE ARABIC FORM SHAPING
+	0x206e: {}, // NATIONAL DIGIT SHAPES
+	0x206f: {}, // NOMINAL DIGIT SHAPES
+	0xfeff: {}, // ZERO WIDTH NO-BREAK SPACE
+}
+
+// IsHFSDot reports whether part would be treated as ".<needle>" on an
+// HFS+ filesystem after stripping ignored Unicode code points and
+// folding ASCII to lower case. The needle is the lowercase ASCII
+// suffix without the leading dot (e.g. "git", "gitmodules"). It
+// mirrors upstream Git's is_hfs_dot_generic and is the building
+// block of IsHFSDotGit / IsHFSDotGitmodules.
+//
+// Reference: upstream Git utf8.c is_hfs_dot_generic at L741-L774 and
+// the dotgit family at L784-L809 in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/utf8.c#L741-L809
+func IsHFSDot(part, needle string) bool {
+	runes := []rune(part)
+	i := 0
+
+	// skip ignored code points, then expect '.'
+	for i < len(runes) {
+		if _, ok := hfsIgnoredCodepoints[runes[i]]; !ok {
+			break
+		}
+		i++
+	}
+	if i >= len(runes) || runes[i] != '.' {
+		return false
+	}
+	i++
+
+	// match needle case-insensitively, skipping ignored code points
+	for _, expected := range needle {
+		for i < len(runes) {
+			if _, ok := hfsIgnoredCodepoints[runes[i]]; !ok {
+				break
+			}
+			i++
+		}
+		if i >= len(runes) {
+			return false
+		}
+		r := runes[i]
+		if r > 127 {
+			return false
+		}
+		if unicode.ToLower(r) != expected {
+			return false
+		}
+		i++
+	}
+
+	// skip trailing ignored code points
+	for i < len(runes) {
+		if _, ok := hfsIgnoredCodepoints[runes[i]]; !ok {
+			break
+		}
+		i++
+	}
+
+	// must be at end of component
+	return i == len(runes)
+}
+
+// IsHFSDotGit reports whether part is an HFS+ equivalent of ".git".
+func IsHFSDotGit(part string) bool { return IsHFSDot(part, "git") }
+
+// IsHFSDotGitmodules reports whether part is an HFS+ equivalent of
+// ".gitmodules", catching attempts to plant the file via Unicode
+// code points that HFS+ would strip during normalisation.
+func IsHFSDotGitmodules(part string) bool { return IsHFSDot(part, "gitmodules") }

vendor/github.com/go-git/go-git/v5/internal/pathutil/ntfs.go

@@ -0,0 +1,187 @@
+package pathutil
+
+import "strings"
+
+// IsNTFSDotGit ports upstream Git's is_ntfs_dotgit. It detects path
+// components that NTFS would resolve to ".git": the canonical name
+// itself and its 8.3 short-name alias "git~1", each followed by any
+// number of trailing spaces or periods (which NTFS silently trims)
+// and an optional Alternate Data Stream suffix (":<stream>"). The
+// bare strings ".git" and "git~1" also match, mirroring upstream.
+//
+// Reference: upstream Git path.c is_ntfs_dotgit at L1415-L1449
+// in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/path.c#L1415-L1449
+func IsNTFSDotGit(part string) bool {
+	var i int
+	switch {
+	case len(part) >= 4 && part[0] == '.' &&
+		asciiToLower(part[1]) == 'g' &&
+		asciiToLower(part[2]) == 'i' &&
+		asciiToLower(part[3]) == 't':
+		i = 4
+	case len(part) >= 5 &&
+		asciiToLower(part[0]) == 'g' &&
+		asciiToLower(part[1]) == 'i' &&
+		asciiToLower(part[2]) == 't' &&
+		part[3] == '~' && part[4] == '1':
+		i = 5
+	default:
+		return false
+	}
+
+	for ; i < len(part); i++ {
+		c := part[i]
+		if c == ':' {
+			return true
+		}
+		if c != '.' && c != ' ' {
+			return false
+		}
+	}
+	return true
+}
+
+// WindowsValidPath reports whether part is a valid Windows / NTFS
+// path component for the worktree filesystem abstraction. It rejects
+// NTFS-disguised variants of `.git` and `git~1` (trailing spaces,
+// periods, Alternate Data Streams) and Windows reserved device
+// names. Bare `.git` and `git~1` are allowed at this layer; the
+// caller decides whether they are permissible at the current path
+// position.
+func WindowsValidPath(part string) bool {
+	if IsNTFSDotGit(part) && !IsDotGitName(part) {
+		return false
+	}
+	return !isWindowsReservedName(part)
+}
+
+// windowsReservedNames lists the Windows reserved device names.
+// A path component is reserved if its base name (ignoring trailing
+// spaces, extensions, and NTFS Alternate Data Streams) matches one of
+// these case-insensitively.
+//
+// See upstream Git compat/mingw.c is_valid_win32_path().
+var windowsReservedNames = []string{
+	"CON", "PRN", "AUX", "NUL",
+	"COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
+	"LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
+	"CONIN$", "CONOUT$",
+}
+
+func isWindowsReservedName(part string) bool {
+	for _, name := range windowsReservedNames {
+		if len(part) < len(name) {
+			continue
+		}
+		if !strings.EqualFold(part[:len(name)], name) {
+			continue
+		}
+		// Exact match or followed by space, dot, colon (ADS), or separator.
+		if len(part) == len(name) {
+			return true
+		}
+		switch part[len(name)] {
+		case ' ', '.', ':':
+			return true
+		}
+	}
+	return false
+}
+
+// IsNTFSDot ports upstream Git's is_ntfs_dot_generic. It detects NTFS
+// path-component variants of a dotfile name that attackers can use to
+// bypass case-insensitive comparisons against the canonical name on
+// Windows. The dotgit parameter is the lowercase name without the
+// leading dot (e.g. "gitmodules"); shortnamePrefix is the canonical
+// 6-character NTFS short-name prefix used as a fall-back match
+// (e.g. "gi7eba" for ".gitmodules").
+//
+// Reference: upstream Git path.c is_ntfs_dot_generic at L1451-L1507
+// in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/path.c#L1451-L1507
+func IsNTFSDot(name, dotgit, shortnamePrefix string) bool {
+	// onlySpacesAndPeriods returns true when the suffix from start
+	// onwards consists only of trailing spaces and periods, possibly
+	// terminated by a NTFS Alternate Data Stream colon. Mirrors the
+	// only_spaces_and_periods label in upstream's is_ntfs_dot_generic.
+	onlySpacesAndPeriods := func(start int) bool {
+		for i := start; i < len(name); i++ {
+			c := name[i]
+			if c == ':' {
+				return true
+			}
+			if c != ' ' && c != '.' {
+				return false
+			}
+		}
+		return true
+	}
+
+	// Pattern 1: ".<dotgit>" prefix + trailing spaces / periods / ADS.
+	if len(name) >= len(dotgit)+1 && name[0] == '.' &&
+		strings.EqualFold(name[1:1+len(dotgit)], dotgit) {
+		if onlySpacesAndPeriods(len(dotgit) + 1) {
+			return true
+		}
+	}
+
+	// Pattern 2: standard NTFS short name <dotgit[:6]>~[1-4].
+	if len(dotgit) >= 6 && len(name) >= 8 &&
+		strings.EqualFold(name[:6], dotgit[:6]) &&
+		name[6] == '~' && name[7] >= '1' && name[7] <= '4' {
+		if onlySpacesAndPeriods(8) {
+			return true
+		}
+	}
+
+	// Pattern 3: fall-back NTFS short name keyed by shortnamePrefix.
+	if len(shortnamePrefix) < 6 || len(name) < 8 {
+		return false
+	}
+	sawTilde := false
+	i := 0
+	for i < 8 {
+		c := name[i]
+		switch {
+		case sawTilde:
+			if c < '0' || c > '9' {
+				return false
+			}
+		case c == '~':
+			i++
+			if i >= len(name) || name[i] < '1' || name[i] > '9' {
+				return false
+			}
+			sawTilde = true
+		case i >= 6:
+			return false
+		case c&0x80 != 0:
+			return false
+		default:
+			if asciiToLower(c) != shortnamePrefix[i] {
+				return false
+			}
+		}
+		i++
+	}
+	return onlySpacesAndPeriods(8)
+}
+
+// IsNTFSDotGitmodules reports whether part is an NTFS-equivalent of
+// ".gitmodules" — the file name (or any of its variants that NTFS
+// would resolve to it) that attackers can use to plant submodule
+// configuration disguised as a symlink. The 6-character canonical
+// short-name prefix "gi7eba" mirrors upstream Git's is_ntfs_dotgitmodules.
+func IsNTFSDotGitmodules(part string) bool {
+	return IsNTFSDot(part, "gitmodules", "gi7eba")
+}
+
+func asciiToLower(c byte) byte {
+	if c >= 'A' && c <= 'Z' {
+		return c + ('a' - 'A')
+	}
+	return c
+}

vendor/github.com/go-git/go-git/v5/internal/pathutil/tree.go

@@ -0,0 +1,66 @@
+package pathutil
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+)
+
+// ErrInvalidPath is returned by ValidTreePath when its argument is
+// not a safe path to materialise into the worktree.
+var ErrInvalidPath = fmt.Errorf("invalid path")
+
+// ValidTreePath rejects path strings that, if materialised into a
+// worktree, would let an attacker-controlled tree entry escape the
+// worktree or rewrite repository metadata. It rejects:
+//
+//   - control characters (< 0x20, 0x7f);
+//   - empty paths and "." / ".." components;
+//   - Windows volume name prefixes (e.g. C:);
+//   - .git, its 8.3 NTFS short-name git~1, plus their HFS+ and NTFS
+//     variants — at every position, not just the root.
+//
+// HFS+/NTFS variants of `.git` are always rejected at this layer
+// regardless of runtime config: tree paths are canonical UTF-8 with
+// no zero-width characters or NTFS short-name forms, so an entry
+// that looks like a disguised `.git` is suspicious anywhere. Windows
+// reserved device names (CON, NUL, etc.) are not policed here — they
+// are legitimate filenames on non-Windows filesystems and upstream
+// Git accepts them. The wrapper layer (validPath in package git)
+// rejects them at materialisation time when core.protectNTFS is on.
+//
+// Mirrors upstream Git's verify_path_internal at read-cache.c#L987
+// in tag v2.54.0[1] with protect_hfs / protect_ntfs treated as
+// always-on for `.git`-disguise detection (tree paths are not
+// application-supplied) and is_valid_win32_path left to the wrapper.
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/read-cache.c#L987
+func ValidTreePath(p string) error {
+	for i := 0; i < len(p); i++ {
+		if p[i] < 0x20 || p[i] == 0x7f {
+			return fmt.Errorf("%w %q: contains control character", ErrInvalidPath, p)
+		}
+	}
+
+	parts := strings.FieldsFunc(p, func(r rune) bool { return r == '\\' || r == '/' })
+	if len(parts) == 0 {
+		return fmt.Errorf("%w: %q", ErrInvalidPath, p)
+	}
+
+	// Volume names are not supported, in both formats: \\ and <DRIVE_LETTER>:.
+	if vol := filepath.VolumeName(p); vol != "" {
+		return fmt.Errorf("%w: %q", ErrInvalidPath, p)
+	}
+
+	for _, part := range parts {
+		if part == "." || part == ".." {
+			return fmt.Errorf("%w %q: cannot use %q", ErrInvalidPath, p, part)
+		}
+
+		if IsDotGitName(part) || IsHFSDotGit(part) || IsNTFSDotGit(part) {
+			return fmt.Errorf("%w component: %q", ErrInvalidPath, p)
+		}
+	}
+
+	return nil
+}

vendor/github.com/go-git/go-git/v5/internal/url/url.go

@@ -2,12 +2,14 @@ package url
 
 import (
 	"regexp"
+	"runtime"
+	"strings"
 )
 
 var (
 	isSchemeRegExp = regexp.MustCompile(`^[^:]+://`)
 
-	// Ref: https://github.com/git/git/blob/master/Documentation/urls.txt#L37
+	// Ref: https://github.com/git/git/blob/v2.54.0/Documentation/urls.adoc#L41-L48
 	scpLikeUrlRegExp = regexp.MustCompile(`^(?:(?P<user>[^@]+)@)?(?P<host>[^:\s]+):(?:(?P<port>[0-9]{1,5}):)?(?P<path>[^\\].*)$`)
 )
 
@@ -20,7 +22,38 @@ func MatchesScheme(url string) bool {
 // MatchesScpLike returns true if the given string matches an SCP-like
 // format scheme.
 func MatchesScpLike(url string) bool {
-	return scpLikeUrlRegExp.MatchString(url)
+	if !scpLikeUrlRegExp.MatchString(url) {
+		return false
+	}
+	// Mirror canonical Git's url_is_local_not_ssh in connect.c[1] for
+	// the cases the regex above cannot disambiguate by itself: a URL
+	// is treated as a local path (not SCP-style SSH) when a `/`
+	// precedes the first `:` (e.g. `./relative:path`,
+	// `/abs/with:colon/file`), or — on Windows only — when it has a
+	// DOS drive prefix like `C:foo` where the host is a single
+	// ASCII letter.
+	//
+	// [1]: https://github.com/git/git/blob/v2.54.0/connect.c#L710-L716
+	if before, _, _ := strings.Cut(url, ":"); strings.Contains(before, "/") {
+		return false
+	}
+	if runtime.GOOS == "windows" && hasDosDrivePrefix(url) {
+		return false
+	}
+	return true
+}
+
+// hasDosDrivePrefix reports whether s begins with `<letter>:` (a
+// Windows drive prefix such as `C:` or `c:`). Mirrors canonical Git's
+// win32_has_dos_drive_prefix[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/compat/win32/path-utils.c#L20-L29
+func hasDosDrivePrefix(s string) bool {
+	if len(s) < 2 || s[1] != ':' {
+		return false
+	}
+	c := s[0]
+	return ('A' <= c && c <= 'Z') || ('a' <= c && c <= 'z')
 }
 
 // FindScpLikeComponents returns the user, host, port and path of the

vendor/github.com/go-git/go-git/v5/plumbing/format/idxfile/decoder.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 
 	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/utils/binary"
@@ -25,35 +26,88 @@ const (
 	objectIDLength = hash.Size
 )
 
+// Byte sizes of the idx v2 layout elements, used by the size formula
+// in [validateIdxV2Size]. See [gitformat-pack] for the canonical
+// layout.
+//
+// [gitformat-pack]: https://git-scm.com/docs/gitformat-pack
+const (
+	headerLen     = 8          // magic + version
+	fanoutLen     = fanout * 4 // uint32 per bucket
+	crc32Len      = 4          // CRC32 per object
+	offset32Len   = 4          // 32-bit offset per object
+	offset64Len   = 8          // 64-bit overflow offset
+	trailerHashes = 2          // pack checksum + idx checksum, each hashsz
+)
+
+// statInput is the optional shape the [Decoder] probes for at the
+// start of [Decoder.Decode] to learn the on-disk length of the idx
+// blob, which it uses to validate the canonical-Git size formula
+// before any allocations driven by the fanout table. Callers that
+// pass an [*os.File] or a `billy.File` backed by an `*os.File`
+// (the production call sites in `storage/filesystem`) satisfy it
+// directly; arbitrary [io.Reader]s do not, and decode for them
+// retains the pre-existing behaviour of erroring out at the
+// truncated-payload boundary instead.
+//
+// The interface is intentionally unexported so the public
+// [NewDecoder] signature stays compatible with v5.
+type statInput interface {
+	Stat() (fs.FileInfo, error)
+}
+
 // Decoder reads and decodes idx files from an input stream.
 type Decoder struct {
 	io.Reader
-	h hash.Hash
+	src io.Reader
+	h   hash.Hash
 }
 
 // NewDecoder builds a new idx stream decoder, that reads from r.
 func NewDecoder(r io.Reader) *Decoder {
 	h := hash.New(crypto.SHA1)
 	tr := io.TeeReader(r, h)
-	return &Decoder{tr, h}
+	return &Decoder{tr, r, h}
 }
 
 // Decode reads from the stream and decode the content into the MemoryIndex struct.
 func (d *Decoder) Decode(idx *MemoryIndex) error {
+	idxSize := int64(-1)
+	if in, ok := d.src.(statInput); ok {
+		fi, err := in.Stat()
+		if err != nil {
+			return fmt.Errorf("%w: stat input: %w", ErrMalformedIdxFile, err)
+		}
+		idxSize = fi.Size()
+	}
+
 	if err := validateHeader(d); err != nil {
 		return err
 	}
 
-	flow := []func(*MemoryIndex, io.Reader) error{
+	headerFlow := []func(*MemoryIndex, io.Reader) error{
 		readVersion,
 		readFanout,
+	}
+	for _, f := range headerFlow {
+		if err := f(idx, d); err != nil {
+			return err
+		}
+	}
+
+	if idxSize >= 0 {
+		if err := validateIdxV2Size(idx, idxSize); err != nil {
+			return err
+		}
+	}
+
+	bodyFlow := []func(*MemoryIndex, io.Reader) error{
 		readObjectNames,
 		readCRC32,
 		readOffsets,
 		readPackChecksum,
 	}
-
-	for _, f := range flow {
+	for _, f := range bodyFlow {
 		if err := f(idx, d); err != nil {
 			return err
 		}
@@ -199,3 +253,103 @@ func readIdxChecksum(idx *MemoryIndex, r io.Reader) error {
 
 	return nil
 }
+
+// validateIdxV2Size enforces the size formula used by canonical Git
+// load_idx for idx v2 files: the on-disk length must lie within
+// [minSize, maxSize] where
+//
+//	perObject = hashsz + crc32Len + offset32Len
+//	minSize   = headerLen + fanoutLen + trailerHashes*hashsz + nr*perObject
+//	maxSize   = minSize + (nr-1)*offset64Len     when nr > 0
+//
+// with nr taken from the last fanout entry and hashsz fixed at
+// [objectIDLength] (SHA-1 in v5). Multiplications use a self-checking
+// overflow guard so inputs whose claimed object count overflows the
+// formula are rejected rather than wrapping into a smaller value.
+func validateIdxV2Size(idx *MemoryIndex, idxSize int64) error {
+	nr := int64(idx.Fanout[fanout-1])
+	hashsz := int64(objectIDLength)
+
+	minSize := minIdxV2Size(nr, hashsz)
+	maxSize := maxIdxV2Size(nr, hashsz)
+	if minSize < 0 || maxSize < 0 {
+		return fmt.Errorf("%w: object count %d is inconsistent with file size", ErrMalformedIdxFile, nr)
+	}
+
+	if idxSize < minSize || idxSize > maxSize {
+		return fmt.Errorf("%w: file size %d is inconsistent with object count %d", ErrMalformedIdxFile, idxSize, nr)
+	}
+	return nil
+}
+
+// minIdxV2Size returns the minimum on-disk size of an idx v2 file
+// holding nr objects with the given hash size, mirroring the
+// computation in canonical Git load_idx. Returns -1 when any
+// intermediate multiplication or addition would overflow int64.
+func minIdxV2Size(nr, hashsz int64) int64 {
+	perObject := hashsz + crc32Len + offset32Len
+	fixed := int64(headerLen+fanoutLen) + trailerHashes*hashsz
+
+	objects, ok := mulInt64(nr, perObject)
+	if !ok {
+		return -1
+	}
+	sum, ok := addInt64(fixed, objects)
+	if !ok {
+		return -1
+	}
+	return sum
+}
+
+// maxIdxV2Size returns the maximum on-disk size of an idx v2 file
+// holding nr objects with the given hash size, mirroring the
+// computation in canonical Git load_idx. Returns -1 on overflow.
+func maxIdxV2Size(nr, hashsz int64) int64 {
+	minSize := minIdxV2Size(nr, hashsz)
+	if minSize < 0 {
+		return -1
+	}
+	if nr == 0 {
+		return minSize
+	}
+	overflow, ok := mulInt64(nr-1, offset64Len)
+	if !ok {
+		return -1
+	}
+	sum, ok := addInt64(minSize, overflow)
+	if !ok {
+		return -1
+	}
+	return sum
+}
+
+// mulInt64 returns a*b and whether the result fits in an int64 without
+// overflow. Negative operands or overflow yield ok=false. The overflow
+// check uses the standard self-inverse identity: a*b/b == a only when
+// the multiplication did not wrap.
+func mulInt64(a, b int64) (int64, bool) {
+	if a < 0 || b < 0 {
+		return 0, false
+	}
+	if a == 0 || b == 0 {
+		return 0, true
+	}
+	c := a * b
+	if c/b != a {
+		return 0, false
+	}
+	return c, true
+}
+
+// addInt64 returns a+b and whether the result fits in an int64 without
+// overflow. Negative operands or overflow yield ok=false.
+func addInt64(a, b int64) (int64, bool) {
+	if a < 0 || b < 0 {
+		return 0, false
+	}
+	c := a + b
+	if c < a {
+		return 0, false
+	}
+	return c, true
+}

vendor/github.com/go-git/go-git/v5/plumbing/format/idxfile/idxfile.go

@@ -2,6 +2,7 @@ package idxfile
 
 import (
 	"bytes"
+	"fmt"
 	"io"
 	"sort"
 	"sync"
@@ -126,7 +127,10 @@ func (idx *MemoryIndex) FindOffset(h plumbing.Hash) (int64, error) {
 		return 0, plumbing.ErrObjectNotFound
 	}
 
-	offset := idx.getOffset(k, i)
+	offset, err := idx.getOffset(k, i)
+	if err != nil {
+		return 0, err
+	}
 
 	// Save the offset for reverse lookup
 	idx.mu.Lock()
@@ -141,17 +145,19 @@ func (idx *MemoryIndex) FindOffset(h plumbing.Hash) (int64, error) {
 
 const isO64Mask = uint64(1) << 31
 
-func (idx *MemoryIndex) getOffset(firstLevel, secondLevel int) uint64 {
+func (idx *MemoryIndex) getOffset(firstLevel, secondLevel int) (uint64, error) {
 	offset := secondLevel << 2
 	ofs := encbin.BigEndian.Uint32(idx.Offset32[firstLevel][offset : offset+4])
 
 	if (uint64(ofs) & isO64Mask) != 0 {
 		offset := 8 * (uint64(ofs) & ^isO64Mask)
-		n := encbin.BigEndian.Uint64(idx.Offset64[offset : offset+8])
-		return n
+		if l := uint64(len(idx.Offset64)); l < 8 || offset > l-8 {
+			return 0, fmt.Errorf("%w: offset64 index out of range", ErrMalformedIdxFile)
+		}
+		return encbin.BigEndian.Uint64(idx.Offset64[offset : offset+8]), nil
 	}
 
-	return uint64(ofs)
+	return uint64(ofs), nil
 }
 
 // FindCRC32 implements the Index interface.
@@ -209,8 +215,11 @@ func (idx *MemoryIndex) genOffsetHash() error {
 		mappedFirstLevel := idx.FanoutMapping[firstLevel]
 		for secondLevel := uint32(0); i < fanoutValue; i++ {
 			copy(hash[:], idx.Names[mappedFirstLevel][secondLevel*objectIDLength:])
-			offset := int64(idx.getOffset(mappedFirstLevel, int(secondLevel)))
-			offsetHash[offset] = hash
+			off, err := idx.getOffset(mappedFirstLevel, int(secondLevel))
+			if err != nil {
+				return err
+			}
+			offsetHash[int64(off)] = hash
 			secondLevel++
 		}
 	}
@@ -291,7 +300,11 @@ func (i *idxfileEntryIter) Next() (*Entry, error) {
 		mappedFirstLevel := i.idx.FanoutMapping[i.firstLevel]
 		entry := new(Entry)
 		copy(entry.Hash[:], i.idx.Names[mappedFirstLevel][i.secondLevel*objectIDLength:])
-		entry.Offset = i.idx.getOffset(mappedFirstLevel, i.secondLevel)
+		var err error
+		entry.Offset, err = i.idx.getOffset(mappedFirstLevel, i.secondLevel)
+		if err != nil {
+			return nil, err
+		}
 		entry.CRC32 = i.idx.getCRC32(mappedFirstLevel, i.secondLevel)
 
 		i.secondLevel++

vendor/github.com/go-git/go-git/v5/plumbing/format/objfile/reader.go

@@ -11,9 +11,10 @@ import (
 )
 
 var (
-	ErrClosed       = errors.New("objfile: already closed")
-	ErrHeader       = errors.New("objfile: invalid header")
-	ErrNegativeSize = errors.New("objfile: negative object size")
+	ErrClosed        = errors.New("objfile: already closed")
+	ErrHeader        = errors.New("objfile: invalid header")
+	ErrHeaderNotRead = errors.New("objfile: Header must be called before Read")
+	ErrNegativeSize  = errors.New("objfile: negative object size")
 )
 
 // Reader reads and decodes compressed objfile data from a provided io.Reader.
@@ -100,12 +101,23 @@ func (r *Reader) prepareForRead(t plumbing.ObjectType, size int64) {
 //
 // If Read encounters the end of the data stream it will return err == io.EOF,
 // either in the current call if n > 0 or in a subsequent call.
+//
+// Read returns ErrHeaderNotRead if Header has not been called successfully.
 func (r *Reader) Read(p []byte) (n int, err error) {
+	if r.multi == nil {
+		return 0, ErrHeaderNotRead
+	}
 	return r.multi.Read(p)
 }
 
 // Hash returns the hash of the object data stream that has been read so far.
+// It returns the zero plumbing.Hash if Header has not been called
+// successfully — guarding against the nil hasher that prepareForRead has
+// not yet allocated.
 func (r *Reader) Hash() plumbing.Hash {
+	if r.multi == nil {
+		return plumbing.ZeroHash
+	}
 	return r.hasher.Sum()
 }
 

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/delta_selector.go

@@ -139,8 +139,12 @@ func (dw *deltaSelector) fixAndBreakChains(objectsToPack []*ObjectToPack) error
 		m[otp.Hash()] = otp
 	}
 
+	// visiting holds the objects on the current resolution path, so that a
+	// delta chain looping back on itself can be detected and broken.
+	visiting := make(map[plumbing.Hash]bool)
+
 	for _, otp := range objectsToPack {
-		if err := dw.fixAndBreakChainsOne(m, otp); err != nil {
+		if err := dw.fixAndBreakChainsOne(m, otp, visiting); err != nil {
 			return err
 		}
 	}
@@ -148,7 +152,11 @@ func (dw *deltaSelector) fixAndBreakChains(objectsToPack []*ObjectToPack) error
 	return nil
 }
 
-func (dw *deltaSelector) fixAndBreakChainsOne(objectsToPack map[plumbing.Hash]*ObjectToPack, otp *ObjectToPack) error {
+func (dw *deltaSelector) fixAndBreakChainsOne(
+	objectsToPack map[plumbing.Hash]*ObjectToPack,
+	otp *ObjectToPack,
+	visiting map[plumbing.Hash]bool,
+) error {
 	if !otp.Object.Type().IsDelta() {
 		return nil
 	}
@@ -174,7 +182,21 @@ func (dw *deltaSelector) fixAndBreakChainsOne(objectsToPack map[plumbing.Hash]*O
 		return dw.undeltify(otp)
 	}
 
-	if err := dw.fixAndBreakChainsOne(objectsToPack, base); err != nil {
+	// Mark this object as being resolved before looking at its base, so that
+	// a delta based on itself is caught by the check below.
+	h := otp.Hash()
+	visiting[h] = true
+	defer delete(visiting, h)
+
+	// A delta chain that loops back onto an object we are already resolving
+	// cannot be written: every delta needs its base written first. Break the
+	// chain here instead of following the cycle, which would recurse until
+	// the goroutine stack is exhausted.
+	if visiting[do.BaseHash()] {
+		return dw.undeltify(otp)
+	}
+
+	if err := dw.fixAndBreakChainsOne(objectsToPack, base, visiting); err != nil {
 		return err
 	}
 

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/diff_delta.go

@@ -19,9 +19,6 @@ const (
 	// https://github.com/git/git/blob/f7466e94375b3be27f229c78873f0acf8301c0a5/diff-delta.c#L428
 	// Max size of a copy operation (64KB).
 	maxCopySize = 64 * 1024
-
-	// Min size of a copy operation.
-	minCopySize = 4
 )
 
 // GetDelta returns an EncodedObject of type OFSDeltaObject. Base and Target object,

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/fsobject.go

@@ -78,7 +78,13 @@ func (o *FSObject) Reader() (io.ReadCloser, error) {
 			_ = f.Close()
 			return nil, err
 		}
-		return ioutil.NewReadCloserWithCloser(r, f.Close), nil
+		// Cap the lazy stream at the resolved object size: well-formed
+		// content reaches EOF inside the bound, an inflated stream that
+		// runs past surfaces ErrInflatedSizeMismatch on the byte just
+		// past the limit. For delta-resolved objects o.size is the
+		// expanded size, which is what the caller is reading here.
+		bounded := newBoundedReadCloser(r, o.size)
+		return ioutil.NewReadCloserWithCloser(bounded, f.Close), nil
 	}
 	r, err := p.getObjectContent(o.offset)
 	if err != nil {

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/packfile.go

@@ -126,11 +126,17 @@ func (p *Packfile) nextObjectHeader() (*ObjectHeader, error) {
 	return h, err
 }
 
-func (p *Packfile) getDeltaObjectSize(buf *bytes.Buffer) int64 {
+func (p *Packfile) getDeltaObjectSize(buf *bytes.Buffer) (int64, error) {
 	delta := buf.Bytes()
-	_, delta = decodeLEB128(delta) // skip src size
-	sz, _ := decodeLEB128(delta)
-	return int64(sz)
+	_, delta, err := decodeLEB128(delta) // skip src size
+	if err != nil {
+		return 0, err
+	}
+	sz, _, err := decodeLEB128(delta)
+	if err != nil {
+		return 0, err
+	}
+	return int64(sz), nil
 }
 
 func (p *Packfile) getObjectSize(h *ObjectHeader) (int64, error) {
@@ -145,7 +151,7 @@ func (p *Packfile) getObjectSize(h *ObjectHeader) (int64, error) {
 			return 0, err
 		}
 
-		return p.getDeltaObjectSize(buf), nil
+		return p.getDeltaObjectSize(buf)
 	default:
 		return 0, ErrInvalidObject.AddDetails("type %q", h.Type)
 	}
@@ -233,7 +239,10 @@ func (p *Packfile) getNextObject(h *ObjectHeader, hash plumbing.Hash) (plumbing.
 			return nil, err
 		}
 
-		size = p.getDeltaObjectSize(buf)
+		size, err = p.getDeltaObjectSize(buf)
+		if err != nil {
+			return nil, err
+		}
 		if size <= smallObjectThreshold {
 			var obj = new(plumbing.MemoryObject)
 			obj.SetSize(size)

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/parser.go

@@ -26,6 +26,45 @@ var (
 	ErrDeltaNotCached = errors.New("delta could not be found in cache")
 )
 
+// maxObjectPreallocBytes caps the up-front size hint passed to
+// bytes.Buffer.Grow when staging an object's contents, so a malformed length
+// cannot trigger a huge or out-of-range allocation. The buffer still grows
+// dynamically as data is written; this is purely a hint cap.
+const maxObjectPreallocBytes = 1 << 30 // 1 GiB
+
+// maxObjectsPrealloc caps the up-front capacity reserved from the pack's
+// declared object count, so a header advertising an absurd quantity cannot
+// trigger a multi-gigabyte allocation. The slice and maps still grow
+// organically beyond this hint.
+const maxObjectsPrealloc = 1 << 16 // 64 Ki entries
+
+// Match upstream Git's pack depth ceiling: pack-objects.h OE_DEPTH_BITS,
+// enforced in builtin/pack-objects.c as (1 << OE_DEPTH_BITS) - 1.
+const maxDeltaChainDepth = 4095
+
+// growHint returns a non-negative int64 size, clamped to a sane upper bound,
+// suitable for passing to bytes.Buffer.Grow.
+func growHint(n int64) int {
+	switch {
+	case n <= 0:
+		return 0
+	case n > maxObjectPreallocBytes:
+		return maxObjectPreallocBytes
+	default:
+		return int(n)
+	}
+}
+
+// objectsHint returns a non-negative count, clamped to maxObjectsPrealloc,
+// suitable for passing to make() as the capacity hint for slices or maps
+// sized from a pack's declared object count.
+func objectsHint(n uint32) int {
+	if n > maxObjectsPrealloc {
+		return maxObjectsPrealloc
+	}
+	return int(n)
+}
+
 // Observer interface is implemented by index encoders.
 type Observer interface {
 	// OnHeader is called when a new packfile is opened.
@@ -166,9 +205,10 @@ func (p *Parser) init() error {
 	}
 
 	p.count = c
-	p.oiByHash = make(map[plumbing.Hash]*objectInfo, p.count)
-	p.oiByOffset = make(map[int64]*objectInfo, p.count)
-	p.oi = make([]*objectInfo, p.count)
+	hint := objectsHint(p.count)
+	p.oiByHash = make(map[plumbing.Hash]*objectInfo, hint)
+	p.oiByOffset = make(map[int64]*objectInfo, hint)
+	p.oi = make([]*objectInfo, 0, hint)
 
 	return nil
 }
@@ -261,7 +301,7 @@ func (p *Parser) indexObjects() error {
 		}
 		if delta && !p.scanner.IsSeekable {
 			buf.Reset()
-			buf.Grow(int(oh.Length))
+			buf.Grow(growHint(oh.Length))
 			writers = append(writers, buf)
 		}
 
@@ -306,7 +346,7 @@ func (p *Parser) indexObjects() error {
 		}
 
 		p.oiByOffset[oh.Offset] = ota
-		p.oi[i] = ota
+		p.oi = append(p.oi, ota)
 	}
 
 	return nil
@@ -317,8 +357,12 @@ func (p *Parser) resolveDeltas() error {
 	defer sync.PutBytesBuffer(buf)
 
 	for _, obj := range p.oi {
+		if err := checkDeltaChainDepth(obj); err != nil {
+			return err
+		}
+
 		buf.Reset()
-		buf.Grow(int(obj.Length))
+		buf.Grow(growHint(obj.Length))
 		err := p.get(obj, buf)
 		if err != nil {
 			return err
@@ -337,6 +381,9 @@ func (p *Parser) resolveDeltas() error {
 			// create it once and reuse across all children.
 			r := bytes.NewReader(buf.Bytes())
 			for _, child := range obj.Children {
+				if err := checkDeltaChainDepth(child); err != nil {
+					return err
+				}
 				// Even though we are discarding the output, we still need to read it to
 				// so that the scanner can advance to the next object, and the SHA1 can be
 				// calculated.
@@ -356,6 +403,17 @@ func (p *Parser) resolveDeltas() error {
 	return nil
 }
 
+func checkDeltaChainDepth(o *objectInfo) error {
+	var depth int
+	for current := o; current != nil && current.DiskType.IsDelta(); current = current.Parent {
+		depth++
+		if depth > maxDeltaChainDepth {
+			return fmt.Errorf("%w: delta chain depth exceeds %d", ErrMalformedPackFile, maxDeltaChainDepth)
+		}
+	}
+	return nil
+}
+
 func (p *Parser) resolveExternalRef(o *objectInfo) {
 	if ref, ok := p.oiByHash[o.SHA1]; ok && ref.ExternalRef {
 		p.oiByHash[o.SHA1] = o
@@ -405,7 +463,7 @@ func (p *Parser) get(o *objectInfo, buf *bytes.Buffer) (err error) {
 	if o.DiskType.IsDelta() {
 		b := sync.GetBytesBuffer()
 		defer sync.PutBytesBuffer(b)
-		buf.Grow(int(o.Length))
+		buf.Grow(growHint(o.Length))
 		err := p.get(o.Parent, b)
 		if err != nil {
 			return err

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/patch_delta.go

@@ -31,10 +31,15 @@ const (
 	// premptively made available for a patch operation.
 	maxPatchPreemptionSize uint = 65536
 
-	// minDeltaSize defines the smallest size for a delta.
-	minDeltaSize = 4
+	// minDeltaSize is the smallest valid delta: a 1-byte srcSz LEB128
+	// header followed by a 1-byte targetSz LEB128 header (the
+	// shortest case being targetSz=0 with no operations).
+	minDeltaSize = 2
 )
 
+// uintBits is the bit width of uint on the current platform (32 or 64).
+const uintBits = 32 << (^uint(0) >> 63)
+
 type offset struct {
 	mask  byte
 	shift uint
@@ -142,7 +147,7 @@ func ReaderFromDelta(base plumbing.EncodedObject, deltaRC io.Reader) (io.ReadClo
 		baseBuf := bufio.NewReader(baseRd)
 		basePos := uint(0)
 
-		for {
+		for remainingTargetSz > 0 {
 			cmd, err := deltaBuf.ReadByte()
 			if err == io.EOF {
 				_ = dstWr.CloseWithError(ErrInvalidDelta)
@@ -166,9 +171,9 @@ func ReaderFromDelta(base plumbing.EncodedObject, deltaRC io.Reader) (io.ReadClo
 					return
 				}
 
-				if invalidSize(sz, targetSz) ||
+				if invalidSize(sz, remainingTargetSz) ||
 					invalidOffsetSize(offset, sz, srcSz) {
-					_ = dstWr.Close()
+					_ = dstWr.CloseWithError(ErrInvalidDelta)
 					return
 				}
 
@@ -210,7 +215,7 @@ func ReaderFromDelta(base plumbing.EncodedObject, deltaRC io.Reader) (io.ReadClo
 
 			case isCopyFromDelta(cmd):
 				sz := uint(cmd) // cmd is the size itself
-				if invalidSize(sz, targetSz) {
+				if invalidSize(sz, remainingTargetSz) {
 					_ = dstWr.CloseWithError(ErrInvalidDelta)
 					return
 				}
@@ -225,40 +230,48 @@ func ReaderFromDelta(base plumbing.EncodedObject, deltaRC io.Reader) (io.ReadClo
 				_ = dstWr.CloseWithError(ErrDeltaCmd)
 				return
 			}
-
-			if remainingTargetSz <= 0 {
-				_ = dstWr.Close()
-				return
-			}
 		}
+
+		// Mirror upstream's `data != top` post-loop check: every byte
+		// of the delta payload must be consumed.
+		if _, err := deltaBuf.ReadByte(); err == nil {
+			_ = dstWr.CloseWithError(ErrInvalidDelta)
+			return
+		} else if err != io.EOF {
+			_ = dstWr.CloseWithError(err)
+			return
+		}
+
+		_ = dstWr.Close()
 	}()
 
 	return dstRd, nil
 }
 
 func patchDelta(dst *bytes.Buffer, src, delta []byte) error {
-	if len(delta) < minCopySize {
-		return ErrInvalidDelta
+	srcSz, delta, err := decodeLEB128(delta)
+	if err != nil {
+		return fmt.Errorf("%w: %w", ErrInvalidDelta, err)
 	}
-
-	srcSz, delta := decodeLEB128(delta)
 	if srcSz != uint(len(src)) {
 		return ErrInvalidDelta
 	}
 
-	targetSz, delta := decodeLEB128(delta)
+	targetSz, delta, err := decodeLEB128(delta)
+	if err != nil {
+		return fmt.Errorf("%w: %w", ErrInvalidDelta, err)
+	}
 	remainingTargetSz := targetSz
 
-	var cmd byte
-
 	growSz := min(targetSz, maxPatchPreemptionSize)
 	dst.Grow(int(growSz))
-	for {
+
+	for remainingTargetSz > 0 {
 		if len(delta) == 0 {
 			return ErrInvalidDelta
 		}
 
-		cmd = delta[0]
+		cmd := delta[0]
 		delta = delta[1:]
 
 		switch {
@@ -275,16 +288,16 @@ func patchDelta(dst *bytes.Buffer, src, delta []byte) error {
 				return err
 			}
 
-			if invalidSize(sz, targetSz) ||
+			if invalidSize(sz, remainingTargetSz) ||
 				invalidOffsetSize(offset, sz, srcSz) {
-				break
+				return ErrInvalidDelta
 			}
 			dst.Write(src[offset : offset+sz])
 			remainingTargetSz -= sz
 
 		case isCopyFromDelta(cmd):
 			sz := uint(cmd) // cmd is the size itself
-			if invalidSize(sz, targetSz) {
+			if invalidSize(sz, remainingTargetSz) {
 				return ErrInvalidDelta
 			}
 
@@ -299,10 +312,12 @@ func patchDelta(dst *bytes.Buffer, src, delta []byte) error {
 		default:
 			return ErrDeltaCmd
 		}
+	}
 
-		if remainingTargetSz <= 0 {
-			break
-		}
+	// Mirror upstream's `data != top` post-loop check: every byte of
+	// the delta payload must be consumed.
+	if len(delta) != 0 {
+		return ErrInvalidDelta
 	}
 
 	return nil
@@ -354,7 +369,7 @@ func patchDeltaWriter(dst io.Writer, base io.ReaderAt, delta io.Reader,
 	baselr := io.LimitReader(sr, 0).(*io.LimitedReader)
 	deltalr := io.LimitReader(deltaBuf, 0).(*io.LimitedReader)
 
-	for {
+	for remainingTargetSz > 0 {
 		buf := *bufp
 		cmd, err := deltaBuf.ReadByte()
 		if err == io.EOF {
@@ -374,9 +389,9 @@ func patchDeltaWriter(dst io.Writer, base io.ReaderAt, delta io.Reader,
 				return 0, plumbing.ZeroHash, err
 			}
 
-			if invalidSize(sz, targetSz) ||
+			if invalidSize(sz, remainingTargetSz) ||
 				invalidOffsetSize(offset, sz, srcSz) {
-				return 0, plumbing.ZeroHash, err
+				return 0, plumbing.ZeroHash, ErrInvalidDelta
 			}
 
 			if _, err := sr.Seek(int64(offset), io.SeekStart); err != nil {
@@ -389,7 +404,7 @@ func patchDeltaWriter(dst io.Writer, base io.ReaderAt, delta io.Reader,
 			remainingTargetSz -= sz
 		} else if isCopyFromDelta(cmd) {
 			sz := uint(cmd) // cmd is the size itself
-			if invalidSize(sz, targetSz) {
+			if invalidSize(sz, remainingTargetSz) {
 				return 0, plumbing.ZeroHash, ErrInvalidDelta
 			}
 			deltalr.N = int64(sz)
@@ -399,30 +414,41 @@ func patchDeltaWriter(dst io.Writer, base io.ReaderAt, delta io.Reader,
 
 			remainingTargetSz -= sz
 		} else {
-			return 0, plumbing.ZeroHash, err
-		}
-		if remainingTargetSz <= 0 {
-			break
+			return 0, plumbing.ZeroHash, ErrDeltaCmd
 		}
 	}
 
+	// Mirror upstream's `data != top` post-loop check: every byte of
+	// the delta payload must be consumed.
+	if _, err := deltaBuf.ReadByte(); err == nil {
+		return 0, plumbing.ZeroHash, ErrInvalidDelta
+	} else if err != io.EOF {
+		return 0, plumbing.ZeroHash, err
+	}
+
 	return targetSz, hasher.Sum(), nil
 }
 
 // Decodes a number encoded as an unsigned LEB128 at the start of some
-// binary data and returns the decoded number and the rest of the
-// stream.
+// binary data and returns the decoded number, the rest of the stream,
+// and an error if the encoded value does not fit in a uint.
 //
 // This must be called twice on the delta data buffer, first to get the
 // expected source buffer size, and again to get the target buffer size.
-func decodeLEB128(input []byte) (uint, []byte) {
+func decodeLEB128(input []byte) (uint, []byte, error) {
 	if len(input) == 0 {
-		return 0, input
+		return 0, input, nil
 	}
 
 	var num, sz uint
 	var b byte
 	for {
+		// A continuation byte at shift > uintBits-7 cannot contribute
+		// without overflowing the accumulator.
+		if sz*7 > uintBits-7 {
+			return 0, input, ErrLengthOverflow
+		}
+
 		b = input[sz]
 		num |= (uint(b) & payload) << (sz * 7) // concats 7 bits chunks
 		sz++
@@ -432,12 +458,16 @@ func decodeLEB128(input []byte) (uint, []byte) {
 		}
 	}
 
-	return num, input[sz:]
+	return num, input[sz:], nil
 }
 
 func decodeLEB128ByteReader(input io.ByteReader) (uint, error) {
 	var num, sz uint
 	for {
+		if sz*7 > uintBits-7 {
+			return 0, ErrLengthOverflow
+		}
+
 		b, err := input.ReadByte()
 		if err != nil {
 			return 0, err
@@ -529,8 +559,9 @@ func decodeSize(cmd byte, delta []byte) (uint, []byte, error) {
 	return sz, delta, nil
 }
 
-func invalidSize(sz, targetSz uint) bool {
-	return sz > targetSz
+// invalidSize reports whether sz exceeds the remaining target size.
+func invalidSize(sz, remaining uint) bool {
+	return sz > remaining
 }
 
 func invalidOffsetSize(offset, sz, srcSz uint) bool {

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/scanner.go

@@ -29,8 +29,100 @@ var (
 	ErrSeekNotSupported = NewError("not seek support")
 	// ErrMalformedPackFile is returned by the parser when the pack file is corrupted.
 	ErrMalformedPackFile = errors.New("malformed PACK file")
+	// ErrLengthOverflow is returned when a variable-length integer would not
+	// fit into its accumulator because the input declares more continuation
+	// bytes than the type can hold.
+	ErrLengthOverflow = errors.New("variable-length integer overflow")
+	// ErrInflatedSizeMismatch is returned when a packfile object inflates to
+	// more bytes than the size declared in its object header. A well-formed
+	// packfile never produces more data than the declared size; exceeding it
+	// indicates a structurally invalid entry.
+	ErrInflatedSizeMismatch = errors.New("packfile: inflated object exceeds declared size")
 )
 
+// boundedWriter passes writes through to w up to limit bytes total, then
+// returns ErrInflatedSizeMismatch. It is used to enforce that a packfile
+// object's inflated length does not exceed the size declared in its header.
+type boundedWriter struct {
+	w     io.Writer
+	limit int64
+	n     int64
+}
+
+// Write forwards p to the underlying writer while keeping the running total
+// at or below limit. On overrun it forwards the legal prefix and reports
+// the number of bytes actually consumed alongside ErrInflatedSizeMismatch,
+// matching the contract in io.Writer. A write error from the underlying
+// writer during overrun-handling is joined with ErrInflatedSizeMismatch so
+// it is not silently dropped.
+func (b *boundedWriter) Write(p []byte) (int, error) {
+	if b.n+int64(len(p)) > b.limit {
+		remain := int(b.limit - b.n)
+		err := error(ErrInflatedSizeMismatch)
+		if remain > 0 {
+			n, werr := b.w.Write(p[:remain])
+			b.n += int64(n)
+			if werr != nil {
+				err = errors.Join(ErrInflatedSizeMismatch, werr)
+			}
+			return n, err
+		}
+		return 0, err
+	}
+	n, err := b.w.Write(p)
+	b.n += int64(n)
+	return n, err
+}
+
+// boundedReadCloser wraps a ReadCloser and reports ErrInflatedSizeMismatch
+// once more than limit bytes have been read. It is used by the on-demand
+// object reader returned from FSObject.Reader so that a lazy Read of a
+// packfile object cannot stream past its declared inflated size.
+//
+// The implementation builds on io.LimitedReader with the standard
+// overrun-detection trick: request limit+1 bytes from the underlying so
+// that the moment the sentinel byte materializes (LimitedReader.N drops
+// to zero) we know the source produced more than limit bytes.
+type boundedReadCloser struct {
+	lr      io.LimitedReader
+	closer  io.Closer
+	overrun bool
+}
+
+// newBoundedReadCloser wraps rc so that the cumulative bytes returned from
+// Read never exceed limit. The first call that would have returned a byte
+// past limit instead returns ErrInflatedSizeMismatch; subsequent calls
+// keep returning the same error. A negative limit is treated as zero, so
+// the first byte produced by rc surfaces ErrInflatedSizeMismatch.
+func newBoundedReadCloser(rc io.ReadCloser, limit int64) *boundedReadCloser {
+	if limit < 0 {
+		limit = 0
+	}
+	return &boundedReadCloser{
+		lr:     io.LimitedReader{R: rc, N: limit + 1},
+		closer: rc,
+	}
+}
+
+// Read forwards Read up to the configured byte limit. When the underlying
+// stream produces the limit+1 sentinel byte, the legal prefix is returned
+// alongside ErrInflatedSizeMismatch; on subsequent calls only the error
+// is returned.
+func (b *boundedReadCloser) Read(p []byte) (int, error) {
+	if b.overrun {
+		return 0, ErrInflatedSizeMismatch
+	}
+	n, err := b.lr.Read(p)
+	if b.lr.N == 0 {
+		b.overrun = true
+		return n - 1, ErrInflatedSizeMismatch
+	}
+	return n, err
+}
+
+// Close closes the underlying ReadCloser.
+func (b *boundedReadCloser) Close() error { return b.closer.Close() }
+
 // ObjectHeader contains the information related to the object, this information
 // is collected from the previous bytes to the content of the object.
 type ObjectHeader struct {
@@ -220,6 +312,13 @@ func (s *Scanner) nextObjectHeader() (*ObjectHeader, error) {
 			return nil, err
 		}
 
+		// An OFS-delta references a base object that appears earlier
+		// in the pack; the negative offset must be strictly positive
+		// and not larger than the current object's offset.
+		if no <= 0 || no > h.Offset {
+			return nil, fmt.Errorf("%w: invalid OFS delta offset", ErrMalformedPackFile)
+		}
+
 		h.OffsetReference = h.Offset - no
 	case plumbing.REFDeltaObject:
 		var err error
@@ -303,6 +402,13 @@ func (s *Scanner) readLength(first byte) (int64, error) {
 	shift := firstLengthBits
 	var err error
 	for c&maskContinue > 0 {
+		// Mirrors unpack_object_header_buffer in canonical Git's
+		// packfile.c: a continuation byte at shift > 64-7 cannot
+		// contribute without overflowing an int64.
+		if shift > 64-lengthBits {
+			return 0, fmt.Errorf("%w: %w", ErrMalformedPackFile, ErrLengthOverflow)
+		}
+
 		if c, err = s.r.ReadByte(); err != nil {
 			return 0, err
 		}
@@ -315,10 +421,18 @@ func (s *Scanner) readLength(first byte) (int64, error) {
 }
 
 // NextObject writes the content of the next object into the reader, returns
-// the number of bytes written, the CRC32 of the content and an error, if any
+// the number of bytes written, the CRC32 of the content and an error, if any.
+//
+// When a prior NextObjectHeader has stashed the object header in
+// pendingObject, the inflated stream is bounded by the header's declared
+// length and surfaces ErrInflatedSizeMismatch on overrun.
 func (s *Scanner) NextObject(w io.Writer) (written int64, crc32 uint32, err error) {
+	declaredSize := int64(-1)
+	if s.pendingObject != nil {
+		declaredSize = s.pendingObject.Length
+	}
 	s.pendingObject = nil
-	written, err = s.copyObject(w)
+	written, err = s.copyObject(w, declaredSize)
 
 	s.r.Flush()
 	crc32 = s.crc.Sum32()
@@ -327,23 +441,39 @@ func (s *Scanner) NextObject(w io.Writer) (written int64, crc32 uint32, err erro
 	return
 }
 
-// ReadObject returns a reader for the object content and an error
+// ReadObject returns a reader for the object content and an error.
+//
+// When a prior NextObjectHeader has stashed the object header in
+// pendingObject, the returned reader is bounded by the header's declared
+// length so callers cannot stream past the declared inflated size; an
+// overrun surfaces ErrInflatedSizeMismatch on the byte just past the
+// limit.
 func (s *Scanner) ReadObject() (io.ReadCloser, error) {
+	declaredSize := int64(-1)
+	if s.pendingObject != nil {
+		declaredSize = s.pendingObject.Length
+	}
 	s.pendingObject = nil
 	zr, err := sync.GetZlibReader(s.r)
 	if err != nil {
 		return nil, fmt.Errorf("zlib reset error: %s", err)
 	}
 
-	return ioutil.NewReadCloserWithCloser(zr.Reader, func() error {
+	rc := ioutil.NewReadCloserWithCloser(zr.Reader, func() error {
 		sync.PutZlibReader(zr)
 		return nil
-	}), nil
+	})
+	if declaredSize >= 0 {
+		return newBoundedReadCloser(rc, declaredSize), nil
+	}
+	return rc, nil
 }
 
-// ReadRegularObject reads and write a non-deltified object
-// from it zlib stream in an object entry in the packfile.
-func (s *Scanner) copyObject(w io.Writer) (n int64, err error) {
+// copyObject inflates a non-deltified object's zlib stream into w. When
+// declaredSize is non-negative, the write sink is wrapped in a
+// boundedWriter so an overrun surfaces ErrInflatedSizeMismatch instead
+// of being silently appended.
+func (s *Scanner) copyObject(w io.Writer, declaredSize int64) (n int64, err error) {
 	zr, err := sync.GetZlibReader(s.r)
 	defer sync.PutZlibReader(zr)
 
@@ -352,8 +482,14 @@ func (s *Scanner) copyObject(w io.Writer) (n int64, err error) {
 	}
 
 	defer ioutil.CheckClose(zr.Reader, &err)
+
+	sink := w
+	if declaredSize >= 0 {
+		sink = &boundedWriter{w: w, limit: declaredSize}
+	}
+
 	buf := sync.GetByteSlice()
-	n, err = io.CopyBuffer(w, zr.Reader, *buf)
+	n, err = io.CopyBuffer(sink, zr.Reader, *buf)
 	sync.PutByteSlice(buf)
 	return
 }

vendor/github.com/go-git/go-git/v5/plumbing/object/commit.go

@@ -5,7 +5,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
+	"slices"
 	"strings"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
@@ -20,6 +20,7 @@ const (
 	beginpgp       string = "-----BEGIN PGP SIGNATURE-----"
 	endpgp         string = "-----END PGP SIGNATURE-----"
 	headerpgp      string = "gpgsig"
+	headerpgp256   string = "gpgsig-sha256"
 	headerencoding string = "encoding"
 
 	// https://github.com/git/git/blob/bcb6cae2966cc407ca1afc77413b3ef11103c175/Documentation/gitformat-signature.txt#L153
@@ -41,6 +42,11 @@ type MessageEncoding string
 // in time, such as a timestamp, the author of the changes since the last
 // commit, a pointer to the previous commit(s), etc.
 // http://shafiulazam.com/gitbook/1_the_git_object_model.html
+//
+// When a Commit is populated by Decode it retains a reference to the source
+// plumbing.EncodedObject so that EncodeWithoutSignature can reproduce the
+// exact bytes the signature was computed over. Refer to EncodeWithoutSignature
+// for more information.
 type Commit struct {
 	// Hash of the commit object.
 	Hash plumbing.Hash
@@ -66,6 +72,9 @@ type Commit struct {
 	ExtraHeaders []ExtraHeader
 
 	s storer.EncodedObjectStorer
+	// src holds the encoded object this Commit was decoded from, used by
+	// EncodeWithoutSignature to recover the canonical signed bytes.
+	src plumbing.EncodedObject
 }
 
 // ExtraHeader holds any non-standard header
@@ -98,8 +107,8 @@ func (h ExtraHeader) Format(f fmt.State, verb rune) {
 func parseExtraHeader(line []byte) (ExtraHeader, bool) {
 	split := bytes.SplitN(line, []byte{' '}, 2)
 
-	out := ExtraHeader {
-		Key: string(bytes.TrimRight(split[0], "\n")),
+	out := ExtraHeader{
+		Key:   string(bytes.TrimRight(split[0], "\n")),
 		Value: "",
 	}
 
@@ -181,6 +190,11 @@ func (c *Commit) NumParents() int {
 
 var ErrParentNotFound = errors.New("commit parent not found")
 
+// ErrMalformedCommit is returned when a commit object cannot be decoded
+// because its standard headers (tree, parent, author, committer) are missing,
+// duplicated, or out of order.
+var ErrMalformedCommit = errors.New("malformed commit")
+
 // Parent returns the ith parent of a commit.
 func (c *Commit) Parent(i int) (*Commit, error) {
 	if len(c.ParentHashes) == 0 || i > len(c.ParentHashes)-1 {
@@ -227,14 +241,23 @@ func (c *Commit) Type() plumbing.ObjectType {
 	return plumbing.CommitObject
 }
 
+func (c *Commit) reset() {
+	storer := c.s
+	*c = Commit{
+		Encoding: defaultUtf8CommitMessageEncoding,
+		s:        storer,
+	}
+}
+
 // Decode transforms a plumbing.EncodedObject into a Commit struct.
 func (c *Commit) Decode(o plumbing.EncodedObject) (err error) {
 	if o.Type() != plumbing.CommitObject {
 		return ErrUnsupportedObject
 	}
 
+	c.reset()
 	c.Hash = o.Hash()
-	c.Encoding = defaultUtf8CommitMessageEncoding
+	c.src = o
 
 	reader, err := o.Reader()
 	if err != nil {
@@ -245,97 +268,17 @@ func (c *Commit) Decode(o plumbing.EncodedObject) (err error) {
 	r := sync.GetBufioReader(reader)
 	defer sync.PutBufioReader(r)
 
-	var message bool
-	var mergetag bool
-	var pgpsig bool
-	var msgbuf bytes.Buffer
-	var extraheader *ExtraHeader = nil
-	for {
-		line, err := r.ReadBytes('\n')
-		if err != nil && err != io.EOF {
+	s := &commitScanner{r: r, c: c}
+	for state := scanTree; state != nil; {
+		state, err = state(s)
+		if err != nil {
 			return err
 		}
-
-		if mergetag {
-			if len(line) > 0 && line[0] == ' ' {
-				line = bytes.TrimLeft(line, " ")
-				c.MergeTag += string(line)
-				continue
-			} else {
-				mergetag = false
-			}
-		}
-
-		if pgpsig {
-			if len(line) > 0 && line[0] == ' ' {
-				line = bytes.TrimLeft(line, " ")
-				c.PGPSignature += string(line)
-				continue
-			} else {
-				pgpsig = false
-			}
-		}
-
-		if extraheader != nil {
-			if len(line) > 0 && line[0] == ' ' {
-				extraheader.Value += string(line[1:])
-				continue
-			} else {
-				extraheader.Value = strings.TrimRight(extraheader.Value, "\n")
-				c.ExtraHeaders = append(c.ExtraHeaders, *extraheader)
-				extraheader = nil
-			}
-		}
-
-		if !message {
-			original_line := line
-			line = bytes.TrimSpace(line)
-			if len(line) == 0 {
-				message = true
-				continue
-			}
-
-			split := bytes.SplitN(line, []byte{' '}, 2)
-
-			var data []byte
-			if len(split) == 2 {
-				data = split[1]
-			}
-
-			switch string(split[0]) {
-			case "tree":
-				c.TreeHash = plumbing.NewHash(string(data))
-			case "parent":
-				c.ParentHashes = append(c.ParentHashes, plumbing.NewHash(string(data)))
-			case "author":
-				c.Author.Decode(data)
-			case "committer":
-				c.Committer.Decode(data)
-			case headermergetag:
-				c.MergeTag += string(data) + "\n"
-				mergetag = true
-			case headerencoding:
-				c.Encoding = MessageEncoding(data)
-			case headerpgp:
-				c.PGPSignature += string(data) + "\n"
-				pgpsig = true
-			default:
-				h, maybecontinued := parseExtraHeader(original_line)
-				if maybecontinued {
-					extraheader = &h
-				} else {
-					c.ExtraHeaders = append(c.ExtraHeaders, h)
-				}
-			}
-		} else {
-			msgbuf.Write(line)
-		}
-
-		if err == io.EOF {
-			break
-		}
 	}
-	c.Message = msgbuf.String()
+	if !s.sawTree {
+		return fmt.Errorf("%w: missing tree header", ErrMalformedCommit)
+	}
+	c.Message = s.msgbuf.String()
 	return nil
 }
 
@@ -344,11 +287,73 @@ func (c *Commit) Encode(o plumbing.EncodedObject) error {
 	return c.encode(o, true)
 }
 
-// EncodeWithoutSignature export a Commit into a plumbing.EncodedObject without the signature (correspond to the payload of the PGP signature).
+// EncodeWithoutSignature exports a Commit into a plumbing.EncodedObject
+// without any signature headers, producing the payload that PGP/GPG
+// signatures are computed over.
+//
+// Behaviour depends on how the Commit was created:
+//
+//   - For Commits populated by Decode whose exported fields still match the
+//     source object, the payload is streamed from the raw source bytes with
+//     gpgsig and gpgsig-sha256 headers (and their continuation lines)
+//     stripped verbatim. This preserves the exact bytes the signature was
+//     computed over, regardless of any normalization performed by Decode.
+//
+//   - For Commits constructed in memory, or for decoded Commits whose
+//     exported fields have been mutated, the payload is derived from the
+//     current struct fields. Mutation is detected by re-decoding the source
+//     object and comparing exported fields; if any differ, the in-memory
+//     representation prevails.
 func (c *Commit) EncodeWithoutSignature(o plumbing.EncodedObject) error {
+	if c.matchesSource() {
+		return stripObjectSignatures(o, c.src, plumbing.CommitObject)
+	}
 	return c.encode(o, false)
 }
 
+// matchesSource reports whether c.src is set and re-decoding it produces a
+// Commit whose payload-affecting exported fields are identical to those of
+// c. It is the auto-detection used by EncodeWithoutSignature to decide
+// between the raw bytes and the struct-encoded payload.
+//
+// PGPSignature is intentionally excluded from the comparison: neither path
+// emits it, so mutating it must not trigger a switch to struct-encode (which
+// would change the byte layout the caller is trying to verify against).
+func (c *Commit) matchesSource() bool {
+	if c.src == nil {
+		return false
+	}
+	fresh := &Commit{}
+	if err := fresh.Decode(c.src); err != nil {
+		return false
+	}
+	return c.Hash == fresh.Hash &&
+		signatureEqual(c.Author, fresh.Author) &&
+		signatureEqual(c.Committer, fresh.Committer) &&
+		c.MergeTag == fresh.MergeTag &&
+		c.Message == fresh.Message &&
+		c.TreeHash == fresh.TreeHash &&
+		c.Encoding == fresh.Encoding &&
+		slices.Equal(c.ParentHashes, fresh.ParentHashes) &&
+		slices.Equal(c.ExtraHeaders, fresh.ExtraHeaders)
+}
+
+func signatureEqual(a, b Signature) bool {
+	return a.Name == b.Name &&
+		a.Email == b.Email &&
+		a.When.Unix() == b.When.Unix() &&
+		a.When.Format("-0700") == b.When.Format("-0700")
+}
+
+func isStandardHeader(key string) bool {
+	switch key {
+	case "tree", "parent", "author", "committer",
+		headerencoding, headermergetag, headerpgp, headerpgp256:
+		return true
+	}
+	return false
+}
+
 func (c *Commit) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	o.SetType(plumbing.CommitObject)
 	w, err := o.Writer()
@@ -407,7 +412,9 @@ func (c *Commit) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	}
 
 	for _, header := range c.ExtraHeaders {
-		
+		if isStandardHeader(header.Key) {
+			continue
+		}
 		if _, err = fmt.Fprintf(w, "\n%s", header); err != nil {
 			return err
 		}
@@ -478,9 +485,21 @@ func (c *Commit) String() string {
 	)
 }
 
+// ErrMultipleSignatures is returned by Verify when the commit carries more
+// than one armored signature block. Mirrors upstream's parse_gpg_output
+// rejection of GOODSIG/BADSIG status lines after the first
+// (gpg-interface.c:257-269): multi-signature commits are intentionally
+// unsupported because their provenance cannot be reduced to a single
+// authoritative signer.
+var ErrMultipleSignatures = errors.New("commit has multiple signatures")
+
 // Verify performs PGP verification of the commit with a provided armored
 // keyring and returns openpgp.Entity associated with verifying key on success.
 func (c *Commit) Verify(armoredKeyRing string) (*openpgp.Entity, error) {
+	if countSignatureBlocks([]byte(c.PGPSignature)) > 1 {
+		return nil, ErrMultipleSignatures
+	}
+
 	keyRingReader := strings.NewReader(armoredKeyRing)
 	keyring, err := openpgp.ReadArmoredKeyRing(keyRingReader)
 	if err != nil {

vendor/github.com/go-git/go-git/v5/plumbing/object/commit_scanner.go

@@ -0,0 +1,377 @@
+package object
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+// commitScanner holds the working state of the commit decoder driven by the
+// stateFn loop in (*Commit).Decode. Each commitState reads one or more lines
+// from r, updates the in-progress *Commit and the scanner's bookkeeping, and
+// returns the state that should run next (or nil to stop).
+type commitScanner struct {
+	r      *bufio.Reader
+	c      *Commit
+	msgbuf bytes.Buffer
+
+	// pending holds a line that was read but the current state decided to
+	// hand back to the next state, paired with the io.EOF flag that was
+	// returned when the line was originally read.
+	pending    []byte
+	pendingErr error
+
+	// First-occurrence tracking: once the corresponding field has been
+	// decoded, subsequent occurrences are silently dropped (matches
+	// upstream's find_commit_header / first-wins semantics).
+	//
+	// gpgsig is not tracked here: upstream's parse_buffer_signed_by_header
+	// (commit.c:1186) accumulates every occurrence into one signature buffer,
+	// so we do the same on the scanner side to keep verification payloads
+	// byte-aligned. gpgsig-sha256 is recognized and skipped without exposing a
+	// new field in v5.
+	sawTree, sawAuthor, sawCommitter bool
+	sawEncoding, sawMergetag         bool
+
+	// extra is the multi-line ExtraHeader currently being assembled.
+	extra *ExtraHeader
+}
+
+// commitState is one step of the decoder state machine. Each function reads
+// the lines it needs, mutates *Commit via s.c, and returns the next state to
+// run (or nil to terminate the loop).
+type commitState func(*commitScanner) (commitState, error)
+
+// readLine returns the next line from the buffer, transparently consuming any
+// line that was previously pushed back by a state that decided not to handle
+// it.
+func (s *commitScanner) readLine() ([]byte, error) {
+	if s.pending != nil {
+		line, err := s.pending, s.pendingErr
+		s.pending, s.pendingErr = nil, nil
+		return line, err
+	}
+	line, err := s.r.ReadBytes('\n')
+	if err != nil && err != io.EOF {
+		return line, err
+	}
+	return line, err
+}
+
+// pushBack stashes an unconsumed line so the next state's readLine call sees
+// it. Only one line can be pushed back at a time.
+func (s *commitScanner) pushBack(line []byte, err error) {
+	s.pending = line
+	s.pendingErr = err
+}
+
+// scanTree expects the first non-empty header to be `tree HASH`. Anything
+// else (or an empty buffer) is rejected with ErrMalformedCommit, matching
+// upstream's `bogus commit object` check.
+func scanTree(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 || isBlankLine(line) {
+		return nil, fmt.Errorf("%w: missing tree header", ErrMalformedCommit)
+	}
+
+	key, data := splitHeader(line)
+	if key != "tree" {
+		return nil, fmt.Errorf("%w: tree header must be first", ErrMalformedCommit)
+	}
+	h, herr := parseObjectIDHex(data, ErrMalformedCommit, "tree")
+	if herr != nil {
+		return nil, herr
+	}
+	s.c.TreeHash = h
+	s.sawTree = true
+	if err == io.EOF {
+		return nil, nil
+	}
+	return scanParents, nil
+}
+
+// scanParents consumes contiguous `parent HASH` lines. The first non-parent
+// line ends the parent block and is handed off to scanAuthor; any later
+// `parent` line is silently dropped (matches upstream's parse_commit_buffer
+// exiting its parent loop at the first non-parent line and
+// read_commit_extra_header_lines filtering `parent` out of extras).
+func scanParents(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanMessage, nil
+	}
+
+	key, data := splitHeader(line)
+	if key == "parent" {
+		h, herr := parseObjectIDHex(data, ErrMalformedCommit, "parent")
+		if herr != nil {
+			return nil, herr
+		}
+		s.c.ParentHashes = append(s.c.ParentHashes, h)
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanParents, nil
+	}
+	s.pushBack(line, err)
+	return scanAuthor, nil
+}
+
+// scanAuthor accepts an `author` line at its canonical position immediately
+// after the parent block. Any other header here is pushed back for
+// scanCommitter; an out-of-place author is therefore silently dropped.
+// Mirrors upstream's parse_commit_date func.
+func scanAuthor(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanMessage, nil
+	}
+
+	key, data := splitHeader(line)
+	if key == "author" {
+		s.c.Author.Decode(data)
+		s.sawAuthor = true
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanCommitter, nil
+	}
+	s.pushBack(line, err)
+	return scanCommitter, nil
+}
+
+// scanCommitter accepts a `committer` line at its canonical position
+// immediately after the author. Any other header is pushed back for
+// scanHeaders. Same upstream rationale as scanAuthor.
+func scanCommitter(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanMessage, nil
+	}
+
+	key, data := splitHeader(line)
+	if key == "committer" {
+		s.c.Committer.Decode(data)
+		s.sawCommitter = true
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanHeaders, nil
+	}
+	s.pushBack(line, err)
+	return scanHeaders, nil
+}
+
+// scanHeaders dispatches one header line. Continuation-bearing headers
+// (mergetag, gpgsig, gpgsig-sha256, and unknown extras whose value is
+// continued on subsequent lines) hand off to a dedicated continuation state
+// that handles the `<space>...` lines and then returns here.
+func scanHeaders(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanMessage, nil
+	}
+
+	originalLine := line
+	key, data := splitHeader(line)
+
+	var next commitState = scanHeaders
+	switch key {
+	case "tree", "parent", "author", "committer":
+		// Anything reaching scanHeaders with one of these keys is out of
+		// canonical position: duplicate tree, parent past the contiguous
+		// block, or author/committer not at their expected slot. Drop them
+		// the same way upstream's standard_header_field filter excludes
+		// them from the extras list (read_commit_extra_header_lines,
+		// commit.c:1520-1522).
+	case headerencoding:
+		if !s.sawEncoding {
+			s.c.Encoding = MessageEncoding(data)
+			s.sawEncoding = true
+		}
+	case headermergetag:
+		if s.sawMergetag {
+			next = scanSkipCont
+		} else {
+			s.c.MergeTag += string(data) + "\n"
+			s.sawMergetag = true
+			next = scanMergetagCont
+		}
+	case headerpgp:
+		s.c.PGPSignature += string(data) + "\n"
+		next = scanPgpCont
+	case headerpgp256:
+		next = scanSkipCont
+	default:
+		h, multiline := parseExtraHeader(originalLine)
+		if multiline {
+			s.extra = &h
+			next = scanExtraCont
+		} else {
+			s.c.ExtraHeaders = append(s.c.ExtraHeaders, h)
+		}
+	}
+
+	if err == io.EOF {
+		return nil, nil
+	}
+	return next, nil
+}
+
+// scanMergetagCont accumulates continuation lines for the first mergetag
+// header. Continuations strip exactly one leading space, mirroring upstream's
+// `line + 1` (commit.c:1509). The first non-continuation line is pushed back
+// so scanHeaders can dispatch it.
+func scanMergetagCont(s *commitScanner) (commitState, error) {
+	return continuationCont(s, &s.c.MergeTag, scanMergetagCont)
+}
+
+// scanPgpCont accumulates continuation lines for a signature header.
+// Continuations strip exactly one leading space, mirroring upstream's
+// `line + 1` (commit.c:1509). The first non-continuation line is pushed back
+// so scanHeaders can dispatch it. Repeat occurrences of the same signature
+// header land back here and concatenate, matching upstream's
+// parse_buffer_signed_by_header (commit.c:1186).
+func scanPgpCont(s *commitScanner) (commitState, error) {
+	return continuationCont(s, &s.c.PGPSignature, scanPgpCont)
+}
+
+func continuationCont(s *commitScanner, dst *string, self commitState) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) > 0 && line[0] == ' ' {
+		*dst += string(line[1:])
+		if err == io.EOF {
+			return nil, nil
+		}
+		return self, nil
+	}
+	if len(line) > 0 {
+		s.pushBack(line, err)
+	}
+	return scanHeaders, nil
+}
+
+// scanSkipCont discards continuation lines that belong to a header scanHeaders
+// chose to drop.
+func scanSkipCont(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) > 0 && line[0] == ' ' {
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanSkipCont, nil
+	}
+	if len(line) > 0 {
+		s.pushBack(line, err)
+	}
+	return scanHeaders, nil
+}
+
+// scanExtraCont accumulates continuation lines for an unknown ExtraHeader
+// whose value spans multiple lines, then finalises the entry once the
+// continuation block ends.
+func scanExtraCont(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) > 0 && line[0] == ' ' {
+		s.extra.Value += string(line[1:])
+		if err == io.EOF {
+			s.finaliseExtra()
+			return nil, nil
+		}
+		return scanExtraCont, nil
+	}
+	s.finaliseExtra()
+	if len(line) > 0 {
+		s.pushBack(line, err)
+	}
+	return scanHeaders, nil
+}
+
+func (s *commitScanner) finaliseExtra() {
+	s.extra.Value = strings.TrimRight(s.extra.Value, "\n")
+	s.c.ExtraHeaders = append(s.c.ExtraHeaders, *s.extra)
+	s.extra = nil
+}
+
+// scanMessage drains the remaining bytes into the message buffer.
+func scanMessage(s *commitScanner) (commitState, error) {
+	for {
+		line, err := s.readLine()
+		if err != nil && err != io.EOF {
+			return nil, err
+		}
+		if len(line) > 0 {
+			s.msgbuf.Write(line)
+		}
+		if err == io.EOF {
+			return nil, nil
+		}
+	}
+}
+
+// isBlankLine reports whether line is the canonical header/body separator:
+// a single newline. Mirrors upstream's `*line == '\n'` test in
+// read_commit_extra_header_lines (commit.c:1502).
+func isBlankLine(line []byte) bool {
+	return len(line) == 1 && line[0] == '\n'
+}
+
+// splitHeader returns the header keyword (everything before the first space)
+// and the value (everything after, with the trailing newline stripped). If
+// the header has no value the returned data is nil.
+func splitHeader(line []byte) (string, []byte) {
+	trimmed := bytes.TrimRight(line, "\n")
+	key, value, ok := bytes.Cut(trimmed, []byte{' '})
+	if !ok {
+		return string(trimmed), nil
+	}
+	return string(key), value
+}
+
+func parseObjectIDHex(data []byte, malformedErr error, header string) (plumbing.Hash, error) {
+	id := string(data)
+	if !plumbing.IsHash(id) {
+		return plumbing.ZeroHash, fmt.Errorf("%w: bad %s hash", malformedErr, header)
+	}
+	return plumbing.NewHash(id), nil
+}

vendor/github.com/go-git/go-git/v5/plumbing/object/signature.go

@@ -1,6 +1,13 @@
 package object
 
-import "bytes"
+import (
+	"bytes"
+	"io"
+
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
+)
 
 const (
 	signatureTypeUnknown signatureType = iota
@@ -100,3 +107,116 @@ func parseSignedBytes(b []byte) (int, signatureType) {
 	}
 	return match, t
 }
+
+// countSignatureBlocks reports how many distinct armored signature blocks
+// start at a line boundary in b. Used by verification paths to reject
+// multi-signature payloads, matching upstream's check in gpg-interface.c
+// where parse_gpg_output bails out the first time it sees a second
+// exclusive status line (a second GOODSIG/BADSIG/etc.).
+func countSignatureBlocks(b []byte) int {
+	n, count := 0, 0
+	for n < len(b) {
+		i := b[n:]
+		if typeForSignature(i) != signatureTypeUnknown {
+			count++
+		}
+		if eol := bytes.IndexByte(i, '\n'); eol >= 0 {
+			n += eol + 1
+			continue
+		}
+		break
+	}
+	return count
+}
+
+// isSignatureHeader reports whether line is a canonical "gpgsig "/
+// "gpgsig-sha256 " header line. Other "gpgsig"-prefixed extra headers
+// are intentionally not matched.
+func isSignatureHeader(line []byte) bool {
+	return bytes.HasPrefix(line, []byte(headerpgp+" ")) ||
+		bytes.HasPrefix(line, []byte(headerpgp256+" "))
+}
+
+// stripObjectSignatures streams src into dst, producing the byte sequence
+// over which a PGP/GPG signature is computed:
+//
+//   - Canonical "gpgsig" and "gpgsig-sha256" headers (and their
+//     continuation lines) are dropped, mirroring upstream's
+//     remove_signature in commit.c.
+//   - For tag objects, the inline trailing PGP signature is additionally
+//     truncated, mirroring upstream's parse_signature in gpg-interface.c
+//     used by gpg_verify_tag.
+//
+// The returned object's type is set to objType. Used by both
+// Commit.EncodeWithoutSignature and Tag.EncodeWithoutSignature to
+// reproduce the exact bytes the signature was computed over.
+func stripObjectSignatures(dst, src plumbing.EncodedObject, objType plumbing.ObjectType) (err error) {
+	dst.SetType(objType)
+
+	r, err := src.Reader()
+	if err != nil {
+		return err
+	}
+	defer ioutil.CheckClose(r, &err)
+
+	var input io.Reader = r
+	if objType == plumbing.TagObject {
+		raw, err := io.ReadAll(r)
+		if err != nil {
+			return err
+		}
+		if sm, _ := parseSignedBytes(raw); sm >= 0 {
+			raw = raw[:sm]
+		}
+		input = bytes.NewReader(raw)
+	}
+
+	w, err := dst.Writer()
+	if err != nil {
+		return err
+	}
+	defer ioutil.CheckClose(w, &err)
+
+	return stripHeaderSignatures(w, input)
+}
+
+// stripHeaderSignatures copies r to w, dropping canonical signature header
+// lines (gpgsig and gpgsig-sha256) and their continuation lines. Lines
+// past the blank line that closes the header block are copied verbatim.
+func stripHeaderSignatures(w io.Writer, r io.Reader) error {
+	br := sync.GetBufioReader(r)
+	defer sync.PutBufioReader(br)
+
+	var inBody, skipping bool
+	for {
+		line, rerr := br.ReadBytes('\n')
+		if rerr != nil && rerr != io.EOF {
+			return rerr
+		}
+
+		write := true
+		if !inBody {
+			switch {
+			case skipping && len(line) > 0 && line[0] == ' ':
+				write = false
+			case isSignatureHeader(line):
+				skipping = true
+				write = false
+			case len(line) == 1 && line[0] == '\n':
+				skipping = false
+				inBody = true
+			default:
+				skipping = false
+			}
+		}
+
+		if write && len(line) > 0 {
+			if _, werr := w.Write(line); werr != nil {
+				return werr
+			}
+		}
+		if rerr == io.EOF {
+			return nil
+		}
+	}
+}

vendor/github.com/go-git/go-git/v5/plumbing/object/tag.go

@@ -1,9 +1,8 @@
 package object
 
 import (
-	"bytes"
+	"errors"
 	"fmt"
-	"io"
 	"strings"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
@@ -13,6 +12,10 @@ import (
 	"github.com/go-git/go-git/v5/utils/sync"
 )
 
+// ErrMalformedTag is returned when a tag object cannot be decoded because
+// its required headers (object, type, tag) are missing or out of order.
+var ErrMalformedTag = errors.New("malformed tag")
+
 // Tag represents an annotated tag object. It points to a single git object of
 // any type, but tags typically are applied to commit or blob objects. It
 // provides a reference that associates the target with a tag name. It also
@@ -39,6 +42,9 @@ type Tag struct {
 	Target plumbing.Hash
 
 	s storer.EncodedObjectStorer
+	// src holds the encoded object this Tag was decoded from, used by
+	// EncodeWithoutSignature to recover the canonical signed bytes.
+	src plumbing.EncodedObject
 }
 
 // GetTag gets a tag from an object storer and decodes it.
@@ -77,13 +83,20 @@ func (t *Tag) Type() plumbing.ObjectType {
 	return plumbing.TagObject
 }
 
+func (t *Tag) reset() {
+	storer := t.s
+	*t = Tag{s: storer}
+}
+
 // Decode transforms a plumbing.EncodedObject into a Tag struct.
 func (t *Tag) Decode(o plumbing.EncodedObject) (err error) {
 	if o.Type() != plumbing.TagObject {
 		return ErrUnsupportedObject
 	}
 
+	t.reset()
 	t.Hash = o.Hash()
+	t.src = o
 
 	reader, err := o.Reader()
 	if err != nil {
@@ -94,42 +107,15 @@ func (t *Tag) Decode(o plumbing.EncodedObject) (err error) {
 	r := sync.GetBufioReader(reader)
 	defer sync.PutBufioReader(r)
 
-	for {
-		var line []byte
-		line, err = r.ReadBytes('\n')
-		if err != nil && err != io.EOF {
+	scanner := &tagScanner{r: r, t: t}
+	for state := scanTagObject; state != nil; {
+		state, err = state(scanner)
+		if err != nil {
 			return err
 		}
-
-		line = bytes.TrimSpace(line)
-		if len(line) == 0 {
-			break // Start of message
-		}
-
-		split := bytes.SplitN(line, []byte{' '}, 2)
-		switch string(split[0]) {
-		case "object":
-			t.Target = plumbing.NewHash(string(split[1]))
-		case "type":
-			t.TargetType, err = plumbing.ParseObjectType(string(split[1]))
-			if err != nil {
-				return err
-			}
-		case "tag":
-			t.Name = string(split[1])
-		case "tagger":
-			t.Tagger.Decode(split[1])
-		}
-
-		if err == io.EOF {
-			return nil
-		}
 	}
 
-	data, err := io.ReadAll(r)
-	if err != nil {
-		return err
-	}
+	data := scanner.msgbuf.Bytes()
 	if sm, _ := parseSignedBytes(data); sm >= 0 {
 		t.PGPSignature = string(data[sm:])
 		data = data[:sm]
@@ -144,11 +130,54 @@ func (t *Tag) Encode(o plumbing.EncodedObject) error {
 	return t.encode(o, true)
 }
 
-// EncodeWithoutSignature export a Tag into a plumbing.EncodedObject without the signature (correspond to the payload of the PGP signature).
+// EncodeWithoutSignature exports a Tag into a plumbing.EncodedObject without
+// any signature data, producing the payload that PGP/GPG signatures are
+// computed over.
+//
+// Behaviour mirrors Commit.EncodeWithoutSignature:
+//
+//   - For Tags populated by Decode whose exported fields still match the
+//     source object, the payload is streamed from the raw source bytes with
+//     the inline trailing signature truncated and gpgsig/gpgsig-sha256
+//     headers (and their continuation lines) stripped verbatim. This
+//     preserves the exact bytes the signature was computed over, regardless
+//     of any normalization performed by Decode.
+//
+//   - For Tags constructed in memory, or for decoded Tags whose exported
+//     fields have been mutated, the payload is derived from the current
+//     struct fields. Mutation is detected by re-decoding the source object
+//     and comparing exported fields; if any differ, the in-memory
+//     representation prevails.
 func (t *Tag) EncodeWithoutSignature(o plumbing.EncodedObject) error {
+	if t.matchesSource() {
+		return stripObjectSignatures(o, t.src, plumbing.TagObject)
+	}
 	return t.encode(o, false)
 }
 
+// matchesSource reports whether t.src is set and re-decoding it produces a
+// Tag whose payload-affecting exported fields are identical to those of t.
+//
+// PGPSignature is intentionally excluded from the comparison: neither path
+// emits it as part of the verification payload, so mutating it must not
+// trigger a switch to struct-encode (which would change the byte layout the
+// caller is trying to verify against).
+func (t *Tag) matchesSource() bool {
+	if t.src == nil {
+		return false
+	}
+	fresh := &Tag{}
+	if err := fresh.Decode(t.src); err != nil {
+		return false
+	}
+	return t.Hash == fresh.Hash &&
+		t.Name == fresh.Name &&
+		signatureEqual(t.Tagger, fresh.Tagger) &&
+		t.Message == fresh.Message &&
+		t.TargetType == fresh.TargetType &&
+		t.Target == fresh.Target
+}
+
 func (t *Tag) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	o.SetType(plumbing.TagObject)
 	w, err := o.Writer()
@@ -158,16 +187,26 @@ func (t *Tag) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	defer ioutil.CheckClose(w, &err)
 
 	if _, err = fmt.Fprintf(w,
-		"object %s\ntype %s\ntag %s\ntagger ",
+		"object %s\ntype %s\ntag %s\n",
 		t.Target.String(), t.TargetType.Bytes(), t.Name); err != nil {
 		return err
 	}
 
-	if err = t.Tagger.Encode(w); err != nil {
-		return err
+	if !isZeroSignature(t.Tagger) {
+		if _, err = fmt.Fprint(w, "tagger "); err != nil {
+			return err
+		}
+
+		if err = t.Tagger.Encode(w); err != nil {
+			return err
+		}
+
+		if _, err = fmt.Fprint(w, "\n"); err != nil {
+			return err
+		}
 	}
 
-	if _, err = fmt.Fprint(w, "\n\n"); err != nil {
+	if _, err = fmt.Fprint(w, "\n"); err != nil {
 		return err
 	}
 
@@ -175,11 +214,12 @@ func (t *Tag) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 		return err
 	}
 
-	// Note that this is highly sensitive to what it sent along in the message.
-	// Message *always* needs to end with a newline, or else the message and the
-	// signature will be concatenated into a corrupt object. Since this is a
-	// lower-level method, we assume you know what you are doing and have already
-	// done the needful on the message in the caller.
+	// Note that this is highly sensitive to what is sent along in the
+	// message. Message *always* needs to end with a newline, or else the
+	// message and the trailing signature will be concatenated into a
+	// corrupt object. Since this is a lower-level method, we assume you
+	// know what you are doing and have already done the needful on the
+	// message in the caller.
 	if includeSig {
 		if _, err = fmt.Fprint(w, t.PGPSignature); err != nil {
 			return err
@@ -189,6 +229,10 @@ func (t *Tag) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	return err
 }
 
+func isZeroSignature(s Signature) bool {
+	return s.Name == "" && s.Email == "" && s.When.IsZero()
+}
+
 // Commit returns the commit pointed to by the tag. If the tag points to a
 // different type of object ErrUnsupportedObject will be returned.
 func (t *Tag) Commit() (*Commit, error) {
@@ -256,7 +300,8 @@ func (t *Tag) String() string {
 }
 
 // Verify performs PGP verification of the tag with a provided armored
-// keyring and returns openpgp.Entity associated with verifying key on success.
+// keyring and returns openpgp.Entity associated with verifying key on
+// success.
 func (t *Tag) Verify(armoredKeyRing string) (*openpgp.Entity, error) {
 	keyRingReader := strings.NewReader(armoredKeyRing)
 	keyring, err := openpgp.ReadArmoredKeyRing(keyRingReader)

vendor/github.com/go-git/go-git/v5/plumbing/object/tag_scanner.go

@@ -0,0 +1,237 @@
+package object
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+// tagScanner holds the working state of the tag decoder driven by the
+// stateFn loop in (*Tag).Decode. Each tagState reads one or more lines
+// from r, updates the in-progress *Tag and the scanner's bookkeeping,
+// and returns the state that should run next (or nil to stop).
+type tagScanner struct {
+	r      *bufio.Reader
+	t      *Tag
+	msgbuf bytes.Buffer
+
+	// pending holds a line that was read but the current state decided to
+	// hand back to the next state, paired with the io.EOF flag returned
+	// when the line was originally read.
+	pending    []byte
+	pendingErr error
+
+	// First-occurrence tracking: once the corresponding canonical
+	// header has been decoded at its expected position, subsequent
+	// occurrences (or out-of-position lines) are silently dropped,
+	// matching the strict layout enforced by upstream's
+	// parse_tag_buffer (tag.c:130).
+	//
+	// gpgsig-sha256 is recognized and skipped without exposing a new field
+	// in v5.
+	sawObject, sawType, sawName, sawTagger bool
+}
+
+// tagState is one step of the decoder state machine. Each function reads
+// the lines it needs, mutates *Tag via s.t, and returns the next state
+// to run (or nil to terminate the loop).
+type tagState func(*tagScanner) (tagState, error)
+
+// readLine returns the next line from the buffer, transparently
+// consuming any line that was previously pushed back by a state that
+// decided not to handle it.
+func (s *tagScanner) readLine() ([]byte, error) {
+	if s.pending != nil {
+		line, err := s.pending, s.pendingErr
+		s.pending, s.pendingErr = nil, nil
+		return line, err
+	}
+	return s.r.ReadBytes('\n')
+}
+
+// pushBack stashes an unconsumed line so the next state's readLine call
+// sees it. Only one line can be pushed back at a time.
+func (s *tagScanner) pushBack(line []byte, err error) {
+	s.pending = line
+	s.pendingErr = err
+}
+
+// scanTagObject requires the first line to be `object HASH`, mirroring
+// upstream's strict parse_tag_buffer (tag.c:151-156). Anything else
+// returns ErrMalformedTag.
+func scanTagObject(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 || isBlankLine(line) {
+		return nil, fmt.Errorf("%w: missing object header", ErrMalformedTag)
+	}
+
+	key, data := splitHeader(line)
+	if key != "object" {
+		return nil, fmt.Errorf("%w: object header must be first", ErrMalformedTag)
+	}
+	h, herr := parseObjectIDHex(data, ErrMalformedTag, "object")
+	if herr != nil {
+		return nil, herr
+	}
+	s.t.Target = h
+	s.sawObject = true
+	if err == io.EOF {
+		return nil, nil
+	}
+	return scanTagType, nil
+}
+
+// scanTagType requires a `type` line immediately after the object header,
+// mirroring upstream's parse_tag_buffer (tag.c:158-166).
+func scanTagType(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 || isBlankLine(line) {
+		return nil, fmt.Errorf("%w: missing type header", ErrMalformedTag)
+	}
+
+	key, data := splitHeader(line)
+	if key != "type" {
+		return nil, fmt.Errorf("%w: type header must follow object", ErrMalformedTag)
+	}
+	ot, perr := plumbing.ParseObjectType(string(data))
+	if perr != nil {
+		return nil, perr
+	}
+	s.t.TargetType = ot
+	s.sawType = true
+	if err == io.EOF {
+		return nil, nil
+	}
+	return scanTagName, nil
+}
+
+// scanTagName requires a `tag` line immediately after the type header,
+// mirroring upstream's parse_tag_buffer (tag.c:186-194).
+func scanTagName(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 || isBlankLine(line) {
+		return nil, fmt.Errorf("%w: missing tag header", ErrMalformedTag)
+	}
+
+	key, data := splitHeader(line)
+	if key != "tag" {
+		return nil, fmt.Errorf("%w: tag header must follow type", ErrMalformedTag)
+	}
+	s.t.Name = string(data)
+	s.sawName = true
+	if err == io.EOF {
+		return nil, nil
+	}
+	return scanTagTagger, nil
+}
+
+// scanTagTagger accepts a `tagger` line at its canonical position. Any
+// other header is pushed back for scanTagHeaders.
+func scanTagTagger(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanTagMessage, nil
+	}
+
+	key, data := splitHeader(line)
+	if key == "tagger" {
+		s.t.Tagger.Decode(data)
+		s.sawTagger = true
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanTagHeaders, nil
+	}
+	s.pushBack(line, err)
+	return scanTagHeaders, nil
+}
+
+// scanTagHeaders dispatches one header line. gpgsig-sha256 hands off to
+// scanTagSkipCont so the continuation block can be consumed; out-of-position
+// canonical fields and unknown headers are silently dropped.
+func scanTagHeaders(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanTagMessage, nil
+	}
+
+	key, _ := splitHeader(line)
+	next := scanTagHeaders
+	switch key {
+	case "object", "type", "tag", "tagger":
+		// Out-of-canonical-position duplicates are dropped, mirroring the
+		// strict ordering of upstream's parse_tag_buffer.
+	case headerpgp256:
+		next = scanTagSkipCont
+	default:
+		// Unknown header: silently dropped (the Tag struct does not
+		// expose ExtraHeaders).
+	}
+
+	if err == io.EOF {
+		return nil, nil
+	}
+	return next, nil
+}
+
+// scanTagSkipCont discards continuation lines for a header scanTagHeaders chose
+// to drop. The first non-continuation line is pushed back so scanTagHeaders can
+// dispatch it.
+func scanTagSkipCont(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) > 0 && line[0] == ' ' {
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanTagSkipCont, nil
+	}
+	if len(line) > 0 {
+		s.pushBack(line, err)
+	}
+	return scanTagHeaders, nil
+}
+
+// scanTagMessage drains the remaining bytes into the message buffer.
+// (*Tag).Decode then runs parseSignedBytes over those bytes to peel off
+// the optional inline trailing PGP signature.
+func scanTagMessage(s *tagScanner) (tagState, error) {
+	for {
+		line, err := s.readLine()
+		if err != nil && err != io.EOF {
+			return nil, err
+		}
+		if len(line) > 0 {
+			s.msgbuf.Write(line)
+		}
+		if err == io.EOF {
+			return nil, nil
+		}
+	}
+}

vendor/github.com/go-git/go-git/v5/plumbing/object/tree.go

@@ -10,6 +10,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/go-git/go-git/v5/internal/pathutil"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/storer"
@@ -29,6 +30,7 @@ var (
 	ErrDirectoryNotFound = errors.New("directory not found")
 	ErrEntryNotFound     = errors.New("entry not found")
 	ErrEntriesNotSorted  = errors.New("entries in tree are not sorted")
+	ErrMalformedTree     = errors.New("malformed tree")
 )
 
 // Tree is basically like a directory - it references a bunch of other trees
@@ -37,9 +39,9 @@ type Tree struct {
 	Entries []TreeEntry
 	Hash    plumbing.Hash
 
-	s storer.EncodedObjectStorer
-	m map[string]*TreeEntry
-	t map[string]*Tree // tree path cache
+	s             storer.EncodedObjectStorer
+	t             map[string]*Tree // tree path cache
+	entriesSorted bool
 }
 
 // GetTree gets a tree from an object storer and decodes it.
@@ -117,7 +119,16 @@ func (t *Tree) Tree(path string) (*Tree, error) {
 }
 
 // TreeEntryFile returns the *File for a given *TreeEntry.
+//
+// The entry's name is validated against pathutil.ValidTreePath for
+// the same reason FindEntry validates: TreeEntryFile is a boundary
+// where attacker-controlled tree data leaves the trusted store as a
+// *File whose Name a caller can hand to filesystem ops.
 func (t *Tree) TreeEntryFile(e *TreeEntry) (*File, error) {
+	if err := pathutil.ValidTreePath(e.Name); err != nil {
+		return nil, err
+	}
+
 	blob, err := GetBlob(t.s, e.Hash)
 	if err != nil {
 		return nil, err
@@ -127,7 +138,16 @@ func (t *Tree) TreeEntryFile(e *TreeEntry) (*File, error) {
 }
 
 // FindEntry search a TreeEntry in this tree or any subtree.
+//
+// The lookup path is validated against pathutil.ValidTreePath to
+// prevent attacker-controlled tree contents from leaking past this
+// boundary as `.git`-shaped or path-traversal-shaped names. Callers
+// that legitimately need to look up unsafe paths should walk the
+// tree manually.
 func (t *Tree) FindEntry(path string) (*TreeEntry, error) {
+	if err := pathutil.ValidTreePath(path); err != nil {
+		return nil, err
+	}
 	if t.t == nil {
 		t.t = make(map[string]*Tree)
 	}
@@ -182,16 +202,43 @@ func (t *Tree) dir(baseName string) (*Tree, error) {
 }
 
 func (t *Tree) entry(baseName string) (*TreeEntry, error) {
-	if t.m == nil {
-		t.buildMap()
-	}
-
-	entry, ok := t.m[baseName]
-	if !ok {
+	if t.entriesSorted {
+		if entry := t.searchEntry(baseName); entry != nil {
+			return entry, nil
+		}
 		return nil, ErrEntryNotFound
 	}
 
-	return entry, nil
+	pastName := baseName + "/"
+	for i := range t.Entries {
+		entry := &t.Entries[i]
+		if entry.Name == baseName {
+			return entry, nil
+		}
+		if treeEntrySortName(entry) > pastName {
+			break
+		}
+	}
+
+	return nil, ErrEntryNotFound
+}
+
+func (t *Tree) searchEntry(baseName string) *TreeEntry {
+	if i := t.searchEntryIndex(baseName); i < len(t.Entries) && t.Entries[i].Name == baseName {
+		return &t.Entries[i]
+	}
+
+	if i := t.searchEntryIndex(baseName + "/"); i < len(t.Entries) && t.Entries[i].Name == baseName {
+		return &t.Entries[i]
+	}
+
+	return nil
+}
+
+func (t *Tree) searchEntryIndex(name string) int {
+	return sort.Search(len(t.Entries), func(i int) bool {
+		return treeEntrySortName(&t.Entries[i]) >= name
+	})
 }
 
 // Files returns a FileIter allowing to iterate over the Tree
@@ -212,20 +259,25 @@ func (t *Tree) Type() plumbing.ObjectType {
 	return plumbing.TreeObject
 }
 
+func (t *Tree) reset() {
+	storer := t.s
+	*t = Tree{s: storer}
+}
+
 // Decode transform an plumbing.EncodedObject into a Tree struct
 func (t *Tree) Decode(o plumbing.EncodedObject) (err error) {
 	if o.Type() != plumbing.TreeObject {
 		return ErrUnsupportedObject
 	}
 
+	t.reset()
 	t.Hash = o.Hash()
+	// assume tree is sorted as a valid tree should always be sorted.
+	t.entriesSorted = true
 	if o.Size() == 0 {
 		return nil
 	}
 
-	t.Entries = nil
-	t.m = nil
-
 	reader, err := o.Reader()
 	if err != nil {
 		return err
@@ -235,10 +287,14 @@ func (t *Tree) Decode(o plumbing.EncodedObject) (err error) {
 	r := sync.GetBufioReader(reader)
 	defer sync.PutBufioReader(r)
 
+	var prevSortName string
 	for {
 		str, err := r.ReadString(' ')
 		if err != nil {
 			if err == io.EOF {
+				if len(str) != 0 {
+					return fmt.Errorf("%w: missing mode terminator", ErrMalformedTree)
+				}
 				break
 			}
 
@@ -248,25 +304,41 @@ func (t *Tree) Decode(o plumbing.EncodedObject) (err error) {
 
 		mode, err := filemode.New(str)
 		if err != nil {
-			return err
+			return fmt.Errorf("%w: malformed mode", ErrMalformedTree)
 		}
+		mode = canonicalTreeMode(mode)
 
 		name, err := r.ReadString(0)
-		if err != nil && err != io.EOF {
+		if err != nil {
+			if err == io.EOF {
+				return fmt.Errorf("%w: missing filename terminator", ErrMalformedTree)
+			}
 			return err
 		}
+		if len(name) == 1 {
+			return fmt.Errorf("%w: empty filename", ErrMalformedTree)
+		}
 
 		var hash plumbing.Hash
 		if _, err = io.ReadFull(r, hash[:]); err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+				return fmt.Errorf("%w: truncated object id", ErrMalformedTree)
+			}
 			return err
 		}
 
 		baseName := name[:len(name)-1]
-		t.Entries = append(t.Entries, TreeEntry{
+		entry := TreeEntry{
 			Hash: hash,
 			Mode: mode,
 			Name: baseName,
-		})
+		}
+		sortName := treeEntrySortName(&entry)
+		if len(t.Entries) != 0 && prevSortName > sortName {
+			t.entriesSorted = false
+		}
+		prevSortName = sortName
+		t.Entries = append(t.Entries, entry)
 	}
 
 	return nil
@@ -279,21 +351,37 @@ func (s TreeEntrySorter) Len() int {
 }
 
 func (s TreeEntrySorter) Less(i, j int) bool {
-	name1 := s[i].Name
-	name2 := s[j].Name
-	if s[i].Mode == filemode.Dir {
-		name1 += "/"
-	}
-	if s[j].Mode == filemode.Dir {
-		name2 += "/"
-	}
-	return name1 < name2
+	return treeEntrySortName(&s[i]) < treeEntrySortName(&s[j])
 }
 
 func (s TreeEntrySorter) Swap(i, j int) {
 	s[i], s[j] = s[j], s[i]
 }
 
+// Git compares tree entries as if directory names had a trailing slash.
+func treeEntrySortName(e *TreeEntry) string {
+	if e.Mode == filemode.Dir {
+		return e.Name + "/"
+	}
+	return e.Name
+}
+
+func canonicalTreeMode(mode filemode.FileMode) filemode.FileMode {
+	switch mode & 0o170000 {
+	case 0o040000:
+		return filemode.Dir
+	case 0o100000:
+		if mode&0o111 != 0 {
+			return filemode.Executable
+		}
+		return filemode.Regular
+	case 0o120000:
+		return filemode.Symlink
+	default:
+		return filemode.Submodule
+	}
+}
+
 // Encode transforms a Tree into a plumbing.EncodedObject.
 // The tree entries must be sorted by name.
 func (t *Tree) Encode(o plumbing.EncodedObject) (err error) {
@@ -329,13 +417,6 @@ func (t *Tree) Encode(o plumbing.EncodedObject) (err error) {
 	return err
 }
 
-func (t *Tree) buildMap() {
-	t.m = make(map[string]*TreeEntry)
-	for i := 0; i < len(t.Entries); i++ {
-		t.m[t.Entries[i].Name] = &t.Entries[i]
-	}
-}
-
 // Diff returns a list of changes between this tree and the provided one
 func (t *Tree) Diff(to *Tree) (Changes, error) {
 	return t.DiffContext(context.Background(), to)
@@ -393,6 +474,14 @@ type TreeWalker struct {
 	recursive bool
 	seen      map[plumbing.Hash]bool
 
+	// skipPathValidation disables the pathutil.ValidTreePath check in Next.
+	// It is set by inspection-only callers (e.g. the revlist object walk)
+	// that never funnel entry names into the filesystem and must enumerate
+	// trees faithfully, including entries with names upstream Git accepts
+	// but that are unsafe to materialise (control characters, `.git`-shaped
+	// names).
+	skipPathValidation bool
+
 	s storer.EncodedObjectStorer
 	t *Tree
 }
@@ -415,10 +504,32 @@ func NewTreeWalker(t *Tree, recursive bool, seen map[plumbing.Hash]bool) *TreeWa
 	}
 }
 
+// SkipPathValidation disables the pathutil.ValidTreePath check performed by
+// Next, and must be called before the first Next.
+//
+// It is for inspection-only walks that never funnel an entry name into the
+// filesystem — enumerating which objects exist, rather than materialising
+// them — and that must therefore see the tree faithfully, including entries
+// whose names upstream Git accepts but that are unsafe to check out. Callers
+// that hand the returned name to filesystem or archive output must not use
+// it; path safety for those is enforced at the materialisation boundaries
+// (FindEntry, TreeEntryFile, archive, FileIter).
+func (w *TreeWalker) SkipPathValidation() {
+	w.skipPathValidation = true
+}
+
 // Next returns the next object from the tree. Objects are returned in order
 // and subtrees are included. After the last object has been returned further
 // calls to Next() will return io.EOF.
 //
+// Each entry's name is validated against pathutil.ValidTreePath as it
+// surfaces, so callers that funnel the returned name into filesystem
+// or archive output can trust it is free of `.git`-shaped components,
+// HFS+/NTFS variants, Windows reserved names, and traversal sequences.
+// A malformed entry stops the walk with the validator's error;
+// inspection-only callers that need to enumerate raw, unvalidated
+// names can read Tree.Entries directly or call SkipPathValidation.
+//
 // In the current implementation any objects which cannot be found in the
 // underlying repository will be skipped automatically. It is possible that this
 // may change in future versions.
@@ -455,6 +566,12 @@ func (w *TreeWalker) Next() (name string, entry TreeEntry, err error) {
 			continue
 		}
 
+		if !w.skipPathValidation {
+			if err := pathutil.ValidTreePath(entry.Name); err != nil {
+				return name, entry, err
+			}
+		}
+
 		if entry.Mode == filemode.Dir {
 			obj, err = GetTree(w.s, entry.Hash)
 		}

vendor/github.com/go-git/go-git/v5/plumbing/object/treenoder.go

@@ -106,6 +106,12 @@ func transformChildren(t *Tree) ([]noder.Noder, error) {
 	ret := make([]noder.Noder, 0, len(t.Entries))
 
 	walker := NewTreeWalker(t, false, nil) // don't recurse
+	// The diff walk is read-only and never materialises entry names into the
+	// filesystem, so it must enumerate the tree faithfully — including entries
+	// with names that are unsafe to check out but valid per upstream Git (e.g.
+	// control characters). Path safety is enforced at materialisation
+	// boundaries (FindEntry, TreeEntryFile, archive, FileIter), not here.
+	walker.SkipPathValidation()
 	// don't defer walker.Close() for efficiency reasons.
 	for {
 		_, e, err = walker.Next()

vendor/github.com/go-git/go-git/v5/plumbing/reference.go

@@ -110,6 +110,48 @@ func (r ReferenceName) IsTag() bool {
 	return strings.HasPrefix(string(r), refTagPrefix)
 }
 
+// IsSafe reports whether the reference name can be safely turned into a path
+// under the .git directory, mirroring Git's refname_is_safe (refs.c). A name
+// is safe when it is either:
+//
+//   - under "refs/", non-empty after the prefix, containing no backslash and
+//     no empty, "." or ".." path component (so it cannot escape the refs/
+//     sub-tree, or alias another name, once turned into a path); or
+//   - a one-level pseudo-ref whose spelling is restricted to [A-Z_]
+//     (e.g. HEAD, ORIG_HEAD, FETCH_HEAD).
+//
+// Everything else — a lowercase or mixed one-level name such as "config" or
+// "index", an absolute or drive-prefixed name, or a refs/ name that escapes —
+// is unsafe, because it could resolve onto unrelated repository metadata.
+func (r ReferenceName) IsSafe() bool {
+	s := string(r)
+	if s == "" {
+		return false
+	}
+
+	if rest, ok := strings.CutPrefix(s, refPrefix); ok {
+		// '\' is a path separator on Windows, so a refs/ name containing one
+		// could escape the sub-tree or alias another name once turned into a
+		// path; reject it outright (check_refname_format forbids '\' too).
+		if rest == "" || strings.Contains(rest, "\\") {
+			return false
+		}
+		for part := range strings.SplitSeq(rest, "/") {
+			if part == "" || part == "." || part == ".." {
+				return false
+			}
+		}
+		return true
+	}
+
+	for i := 0; i < len(s); i++ {
+		if (s[i] < 'A' || s[i] > 'Z') && s[i] != '_' {
+			return false
+		}
+	}
+	return true
+}
+
 func (r ReferenceName) String() string {
 	return string(r)
 }

vendor/github.com/go-git/go-git/v5/plumbing/revlist/revlist.go

@@ -187,6 +187,13 @@ func iterateCommitTrees(
 	cb(tree.Hash)
 
 	treeWalker := object.NewTreeWalker(tree, true, seen)
+	// This walk only enumerates which objects are reachable, to decide what
+	// to send; it never materialises an entry name into the filesystem. It
+	// must therefore enumerate the tree faithfully, including entries with
+	// names that are unsafe to check out but valid per upstream Git (e.g.
+	// control characters). Path safety is enforced at materialisation
+	// boundaries (FindEntry, TreeEntryFile, archive, FileIter), not here.
+	treeWalker.SkipPathValidation()
 
 	for {
 		_, e, err := treeWalker.Next()

vendor/github.com/go-git/go-git/v5/plumbing/transport/http/common.go

@@ -6,9 +6,12 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
+	"net/netip"
 	"net/url"
 	"reflect"
 	"strconv"
@@ -24,6 +27,33 @@ import (
 	"github.com/go-git/go-git/v5/utils/ioutil"
 )
 
+type contextKey int
+
+const initialRequestKey contextKey = iota
+
+// RedirectPolicy controls how the HTTP transport follows redirects.
+//
+// The values mirror Git's http.followRedirects config:
+// "true" follows redirects for all requests, "false" treats redirects as
+// errors, and "initial" follows redirects only for the initial
+// /info/refs discovery request. The zero value defaults to "initial".
+type RedirectPolicy string
+
+const (
+	FollowInitialRedirects RedirectPolicy = "initial"
+	FollowRedirects        RedirectPolicy = "true"
+	NoFollowRedirects      RedirectPolicy = "false"
+)
+
+func withInitialRequest(ctx context.Context) context.Context {
+	return context.WithValue(ctx, initialRequestKey, true)
+}
+
+func isInitialRequest(req *http.Request) bool {
+	v, _ := req.Context().Value(initialRequestKey).(bool)
+	return v
+}
+
 // it requires a bytes.Buffer, because we need to know the length
 func applyHeadersToRequest(req *http.Request, content *bytes.Buffer, host string, requestType string) {
 	req.Header.Add("User-Agent", capability.DefaultAgent())
@@ -47,19 +77,22 @@ func advertisedReferences(ctx context.Context, s *session, serviceName string) (
 		s.endpoint.String(), infoRefsPath, serviceName,
 	)
 
-	req, err := http.NewRequest(http.MethodGet, url, nil)
+	req, err := newRequest(http.MethodGet, url, nil)
 	if err != nil {
 		return nil, err
 	}
 
 	s.ApplyAuthToRequest(req)
 	applyHeadersToRequest(req, nil, s.endpoint.Host, serviceName)
-	res, err := s.client.Do(req.WithContext(ctx))
+	res, err := s.client.Do(req.WithContext(withInitialRequest(ctx)))
 	if err != nil {
 		return nil, err
 	}
 
-	s.ModifyEndpointIfRedirect(res)
+	if err := s.ModifyEndpointIfRedirect(res); err != nil {
+		_ = res.Body.Close()
+		return nil, err
+	}
 	defer ioutil.CheckClose(res.Body, &err)
 
 	if err = NewErr(res); err != nil {
@@ -96,6 +129,7 @@ type client struct {
 	client     *http.Client
 	transports *lru.Cache
 	mutex      sync.RWMutex
+	follow     RedirectPolicy
 }
 
 // ClientOptions holds user configurable options for the client.
@@ -106,6 +140,11 @@ type ClientOptions struct {
 	// size, will result in the least recently used transport getting deleted
 	// before the provided transport is added to the cache.
 	CacheMaxEntries int
+
+	// RedirectPolicy controls redirect handling. Supported values are
+	// "true", "false", and "initial". The zero value defaults to
+	// "initial", matching Git's http.followRedirects default.
+	RedirectPolicy RedirectPolicy
 }
 
 var (
@@ -142,6 +181,24 @@ func NewClient(c *http.Client) transport.Transport {
 // and other custom options specific to the client.
 // If the net/http client is nil or empty, it will use a net/http client configured
 // with http.DefaultTransport.
+//
+// Credentials this client adds where the transport cannot see them are not
+// subject to the redirect stripping described on AuthMethod: a RoundTripper
+// injects after the hop is decided, and Client.Jar is consulted after
+// CheckRedirect, so a domain cookie still follows a redirect to a subdomain
+// the transport counts as another origin. Apply them in an AuthMethod instead
+// if that is not wanted. A CheckRedirect hook set on this client runs
+// alongside the transport's own, but any header it adds when a redirect
+// leaves the repository's origin is discarded the same way.
+//
+// A RoundTripper is therefore also how to authenticate to a new origin a
+// redirect has moved the repository to: match on the request URL and inject
+// the credential only for that origin, so it is not sent anywhere else. The
+// transport keeps its own CheckRedirect on the copy it makes of this client,
+// so the policy and the origin checks still apply.
+//
+// None of this applies to a RoundTripper that follows redirects itself:
+// CheckRedirect is not consulted then, so no stripping happens at all.
 func NewClientWithOptions(c *http.Client, opts *ClientOptions) transport.Transport {
 	if c == nil {
 		c = &http.Client{
@@ -150,12 +207,16 @@ func NewClientWithOptions(c *http.Client, opts *ClientOptions) transport.Transpo
 	}
 	cl := &client{
 		client: c,
+		follow: FollowInitialRedirects,
 	}
 
 	if opts != nil {
 		if opts.CacheMaxEntries > 0 {
 			cl.transports = lru.New(opts.CacheMaxEntries)
 		}
+		if opts.RedirectPolicy != "" {
+			cl.follow = opts.RedirectPolicy
+		}
 	}
 	return cl
 }
@@ -289,14 +350,9 @@ func newSession(c *client, ep *transport.Endpoint, auth transport.AuthMethod) (*
 			}
 		}
 
-		httpClient = &http.Client{
-			Transport:     transport,
-			CheckRedirect: c.client.CheckRedirect,
-			Jar:           c.client.Jar,
-			Timeout:       c.client.Timeout,
-		}
+		httpClient = c.cloneHTTPClient(transport)
 	} else {
-		httpClient = c.client
+		httpClient = c.cloneHTTPClient(c.client.Transport)
 	}
 
 	s := &session{
@@ -324,30 +380,446 @@ func (s *session) ApplyAuthToRequest(req *http.Request) {
 	s.auth.SetAuth(req)
 }
 
-func (s *session) ModifyEndpointIfRedirect(res *http.Response) {
+func (s *session) ModifyEndpointIfRedirect(res *http.Response) error {
 	if res.Request == nil {
-		return
+		return nil
+	}
+	if s.endpoint == nil {
+		return fmt.Errorf("http redirect: nil endpoint")
 	}
 
 	r := res.Request
 	if !strings.HasSuffix(r.URL.Path, infoRefsPath) {
-		return
+		return fmt.Errorf("http redirect: target %q does not end with %s", r.URL.Path, infoRefsPath)
+	}
+	// A scheme is case-insensitive per RFC 3986, and checkRedirect folds case
+	// when it reads the same hop, so fold here too rather than reject a
+	// spelling that check let through. url.Parse and transport.NewEndpoint
+	// both lowercase what they parse, so only a hand-built URL or Endpoint
+	// arrives uppercased. The folded form is what gets stored below, so every
+	// later request built from the endpoint carries the canonical spelling.
+	scheme := strings.ToLower(r.URL.Scheme)
+	if scheme != "http" && scheme != "https" {
+		return fmt.Errorf("http redirect: unsupported scheme %q", r.URL.Scheme)
+	}
+	// schemeUpgrade rather than an inline comparison, so the one cross-scheme
+	// change go-git permits has a single definition shared with
+	// credentialsMayFollow.
+	if !strings.EqualFold(scheme, s.endpoint.Protocol) && !schemeUpgrade(s.endpoint.Protocol, scheme) {
+		return fmt.Errorf("http redirect: changes scheme from %q to %q", s.endpoint.Protocol, r.URL.Scheme)
 	}
 
-	h, p, err := net.SplitHostPort(r.URL.Host)
+	host := endpointHost(r.URL.Hostname())
+	port, err := endpointPort(r.URL.Port())
 	if err != nil {
-		h = r.URL.Host
+		return err
 	}
-	if p != "" {
-		port, err := strconv.Atoi(p)
-		if err == nil {
-			s.endpoint.Port = port
+
+	// The session stores the endpoint and re-applies its credentials on every
+	// later request, so clear them once the redirect has left the origin they
+	// were issued for. This uses the same predicate as stripCredentials, so
+	// both halves share one definition of an origin.
+	//
+	// The two are deliberately asymmetric in one respect: stripCredentials is
+	// sticky over the whole chain, so an origin -> evil -> origin redirect
+	// leaves the discovery GET's later hops unauthenticated even though the
+	// chain returned home. This compares the endpoint only against the final
+	// URL, so the same round trip leaves the session authenticated. That is
+	// not a leak - the final URL's origin is the original one - but it means
+	// such a chain can make the discovery GET anonymous while the session's
+	// POSTs are authenticated, which can surface as a confusing 401.
+	if !credentialsMayFollow(endpointURL(s.endpoint), r.URL) {
+		s.endpoint.User = ""
+		s.endpoint.Password = ""
+		s.auth = nil
+	}
+
+	s.endpoint.Host = host
+	s.endpoint.Port = port
+
+	s.endpoint.Protocol = scheme
+	s.endpoint.Path = r.URL.Path[:len(r.URL.Path)-len(infoRefsPath)]
+	return nil
+}
+
+func endpointHost(host string) string {
+	if strings.Contains(host, ":") {
+		return "[" + host + "]"
+	}
+
+	return host
+}
+
+func endpointPort(port string) (int, error) {
+	if port == "" {
+		return 0, nil
+	}
+
+	parsed, err := strconv.Atoi(port)
+	if err != nil {
+		return 0, fmt.Errorf("http redirect: invalid port %q", port)
+	}
+
+	return parsed, nil
+}
+
+// schemeUpgrade reports whether the scheme transition from one URL to another
+// is the one cross-scheme change go-git permits: a plain-http origin upgrading
+// to https. It strictly improves confidentiality and is how servers steer
+// clients off cleartext.
+//
+// Permitting it at all is a deliberate deviation: curl, git and the Fetch
+// standard all count scheme as part of host identity and drop credentials on
+// the upgrade. Auth is sent pre-emptively here, so an http origin has already
+// spent its credential in cleartext on the first request and refusing the
+// upgrade would break the clone without unspending it. The host is unchanged,
+// where an on-path attacker needs a valid certificate to receive anything.
+func schemeUpgrade(from, to string) bool {
+	return strings.EqualFold(from, "http") && strings.EqualFold(to, "https")
+}
+
+// canonicalHost returns u's hostname in the form origins are compared in.
+//
+// An address literal is normalised by netip, so the many spellings of one
+// address are one origin. Two literals are the same origin exactly when netip
+// parses them to the same Addr, which is also how the WHATWG URL Standard
+// compares hosts. An IPv4-mapped literal is deliberately not unmapped onto
+// the IPv4 it dials: reaching the same endpoint is not the same authority,
+// since net/http sends the literal as written in Host and a server may route
+// the two spellings to different virtual hosts.
+//
+// netip also keeps a scope zone verbatim, which is what origin comparison
+// needs: net resolves a zone to an interface by exact name, so folding %eth0
+// onto %ETH0 would call two hosts the same origin that net dials down
+// different interfaces.
+//
+// A registered name is ASCII-lowercased. That fold is the only liberty taken;
+// every other difference in spelling is a different origin.
+//
+// A trailing root dot is one such difference and is kept, for the same reason
+// as the IPv4-mapped literal: curl and the WHATWG URL Standard both hold
+// "example.com." and "example.com" to be distinct hosts, and although
+// crypto/tls and crypto/x509 fold the dot when they authenticate the peer,
+// net/http sends the name as written in Host.
+//
+// The fold is deliberately ASCII-only. strings.ToLower and strings.EqualFold
+// apply Unicode case mapping, which folds U+03C2 onto U+03C3 and so would
+// call two hosts the same origin when they resolve to different servers. An
+// ASCII-only fold cannot merge two names DNS keeps apart.
+//
+// No IDNA mapping is applied either, so a unicode hostname is a different
+// origin from the punycode encoding of it, and from another Unicode case of
+// itself, even though all three reach the same server. Mapping through
+// golang.org/x/net/idna would join them, but it can only widen this equality,
+// never narrow it, so leaving it out can cost a credential across such a
+// redirect and cannot forward one. Against that cost, go-git pins x/net while
+// net/http uses the copy vendored into the toolchain: the two are versioned
+// separately, so a release that moves the Unicode tables under one and not
+// the other would have this merge origins net/http still dials apart. That is
+// the failure this comparison exists to prevent, and comparing bytes has no
+// such mode.
+func canonicalHost(u *url.URL) string {
+	host := u.Hostname()
+	if addr, err := netip.ParseAddr(host); err == nil {
+		return addr.String()
+	}
+	b := []byte(host)
+	for i := range b {
+		if b[i] >= 'A' && b[i] <= 'Z' {
+			b[i] += 'a' - 'A'
 		}
 	}
-	s.endpoint.Host = h
+	return string(b)
+}
 
-	s.endpoint.Protocol = r.URL.Scheme
-	s.endpoint.Path = r.URL.Path[:len(r.URL.Path)-len(infoRefsPath)]
+// effectivePort returns u's port as the connection will use it: the scheme's
+// well-known port when the URL does not spell one out, and without leading
+// zeroes, so "https://x", "https://x:443" and "https://x:0443" all agree.
+func effectivePort(u *url.URL) string {
+	port := u.Port()
+	if port == "" {
+		switch strings.ToLower(u.Scheme) {
+		case "http":
+			return "80"
+		case "https":
+			return "443"
+		default:
+			return ""
+		}
+	}
+	if trimmed := strings.TrimLeft(port, "0"); trimmed != "" {
+		return trimmed
+	}
+	return "0"
+}
+
+// credentialsMayFollow reports whether credentials issued for one URL may be
+// sent to another.
+//
+// The relation is deliberately asymmetric: scheme, host and effective port
+// must all match, except that a plain http origin may upgrade to https on the
+// same host (see schemeUpgrade). That exception is confined to the two
+// default ports: 80 to 443 is the upgrade servers actually steer clients
+// through, whereas a non-default port carries no such convention, so
+// http://host:8080 to https://host:8443 is a move to another origin like any
+// other port change.
+//
+// Host matching is exact. Unlike Go's http.Client, which forwards credentials
+// from a host to any subdomain of it, a subdomain is a different origin here —
+// matching canonical git and libcurl.
+func credentialsMayFollow(from, to *url.URL) bool {
+	if canonicalHost(from) != canonicalHost(to) {
+		return false
+	}
+	if strings.EqualFold(from.Scheme, to.Scheme) {
+		return effectivePort(from) == effectivePort(to)
+	}
+	return schemeUpgrade(from.Scheme, to.Scheme) &&
+		effectivePort(from) == "80" && effectivePort(to) == "443"
+}
+
+// endpointURL renders an Endpoint's origin as a URL, so that the session's
+// credential clearing and the per-hop stripping share one definition of an
+// origin and cannot drift apart.
+func endpointURL(ep *transport.Endpoint) *url.URL {
+	host := strings.Trim(ep.Host, "[]")
+	if ep.Port != 0 {
+		host = net.JoinHostPort(host, strconv.Itoa(ep.Port))
+	} else if strings.Contains(host, ":") {
+		host = "[" + host + "]"
+	}
+	return &url.URL{Scheme: ep.Protocol, Host: host}
+}
+
+func (c *client) cloneHTTPClient(transport http.RoundTripper) *http.Client {
+	return &http.Client{
+		Transport:     transport,
+		CheckRedirect: wrapCheckRedirect(c.follow, c.client.CheckRedirect),
+		Jar:           c.client.Jar,
+		Timeout:       c.client.Timeout,
+	}
+}
+
+func wrapCheckRedirect(policy RedirectPolicy, next func(*http.Request, []*http.Request) error) func(*http.Request, []*http.Request) error {
+	return func(req *http.Request, via []*http.Request) error {
+		if err := checkRedirect(req, via, policy); err != nil {
+			return err
+		}
+		// Strip before the caller's hook so it observes what will actually
+		// be sent, and again afterwards so a hook of the common "preserve
+		// my headers across redirects" shape - which copies from via[0],
+		// the original unsanitized request - cannot reinstate them.
+		// Carrying credentials across an origin boundary is deliberately
+		// unsupported.
+		stripCredentials(req, via)
+		if next != nil {
+			if err := next(req, via); err != nil {
+				return err
+			}
+		}
+		stripCredentials(req, via)
+		return nil
+	}
+}
+
+// safeHeaders lists the headers go-git sets itself, none of which can carry a
+// caller credential. stripCredentials keeps only these when a redirect leaves
+// the credential's origin. Adding a name here makes it forwardable across an
+// origin boundary - do not add anything a caller can put a secret in.
+//
+// This narrows rather than eliminates the exposure: an AuthMethod that writes
+// a credential into one of these names directly - for example
+// Header.Set("User-Agent", "token "+secret) - still survives a cross-origin
+// redirect. Such a value is also sent to the origin and to any proxy in path,
+// so it should not be placed there whether or not a redirect follows.
+var safeHeaders = map[string]struct{}{
+	"User-Agent":     {},
+	"Host":           {},
+	"Accept":         {},
+	"Content-Type":   {},
+	"Content-Length": {},
+}
+
+func filterHeaders(h http.Header) http.Header {
+	filtered := make(http.Header)
+	for key, values := range h {
+		if _, ok := safeHeaders[http.CanonicalHeaderKey(key)]; ok {
+			filtered[key] = values
+		}
+	}
+	return filtered
+}
+
+// stripCredentials removes credentials from req once the redirect chain has
+// left the origin of the original, credential-bearing request.
+//
+// CheckRedirect is the only hook that runs while a redirected request's
+// headers are still mutable: http.Client.Do performs the entire chain
+// internally, so anything the transport does after Do returns - including
+// ModifyEndpointIfRedirect - is too late for the hops themselves.
+//
+// Two subtleties:
+//
+//   - net/http rebuilds every redirect request from the original request's
+//     headers before calling this, so a header removed at one hop reappears
+//     at the next. The decision is therefore recomputed per hop.
+//   - The decision is sticky: once the chain has left the origin, credentials
+//     stay gone even if a later hop returns to it. Stickiness is derived from
+//     via rather than stored, because this closure is shared across a
+//     session's requests.
+//
+// Stripping keeps only the headers go-git sets itself (safeHeaders). An
+// allowlist is used rather than a list of credential header names because
+// caller credentials arrive under names that cannot be enumerated -
+// PRIVATE-TOKEN, X-Api-Key, gateway headers - which is exactly what
+// net/http's fixed list of sensitive header names gets wrong. It is also
+// immune to header-name canonicalisation: an AuthMethod that writes a raw map
+// key is still removed.
+func stripCredentials(req *http.Request, via []*http.Request) {
+	if len(via) == 0 {
+		return
+	}
+	// net/http sets a URL on every request it builds, and req.URL is non-nil
+	// by construction: checkRedirect dereferences req.URL.Scheme on each path
+	// that returns nil, so it runs first or not at all. This nil check and
+	// the two in crossedOrigin are defensive, against a synthetic caller.
+	// Each treats a URL it cannot read as an origin crossing; removing one
+	// panics in canonicalHost rather than leaking.
+	if origin := via[0].URL; origin != nil && !crossedOrigin(origin, req, via) {
+		return
+	}
+	req.Header = filterHeaders(req.Header)
+	if req.URL != nil {
+		req.URL.User = nil
+	}
+}
+
+// crossedOrigin reports whether any hop so far, including the pending one, has
+// left origin.
+func crossedOrigin(origin *url.URL, req *http.Request, via []*http.Request) bool {
+	if req.URL == nil || !credentialsMayFollow(origin, req.URL) {
+		return true
+	}
+	for _, prev := range via[1:] {
+		if prev.URL == nil || !credentialsMayFollow(origin, prev.URL) {
+			return true
+		}
+	}
+	return false
+}
+
+// redactedURL returns the string form of u with the userinfo password
+// replaced, for use in error messages. (*url.URL).String() renders the
+// password verbatim, and request URLs are built from the endpoint, which
+// carries whatever credentials the caller put in the clone URL.
+func redactedURL(u *url.URL) string {
+	if u == nil {
+		return ""
+	}
+	if u.User == nil {
+		return u.String()
+	}
+	if _, hasPassword := u.User.Password(); !hasPassword {
+		return u.String()
+	}
+	redacted := *u
+	redacted.User = url.UserPassword(u.User.Username(), "REDACTED")
+	return redacted.String()
+}
+
+// redactedRawURL is redactedURL for a string that may not parse. Request URLs
+// are assembled from Endpoint.String(), which re-emits Endpoint.Path raw, so a
+// path holding a stray percent produces a string url.Parse rejects. url.Parse
+// reports the input verbatim and applies no redaction of its own; only
+// http.Client strips a password, and only from errors it raises itself.
+func redactedRawURL(raw string) string {
+	i := strings.Index(raw, "://")
+	if i < 0 {
+		return raw
+	}
+	authority := raw[i+3:]
+	if end := strings.IndexByte(authority, '/'); end >= 0 {
+		authority = authority[:end]
+	}
+	at := strings.LastIndexByte(authority, '@')
+	if at < 0 {
+		return raw
+	}
+	colon := strings.IndexByte(authority[:at], ':')
+	if colon < 0 {
+		// Username only, left alone, as redactedURL leaves it.
+		return raw
+	}
+	return raw[:i+3+colon+1] + "REDACTED" + raw[i+3+at:]
+}
+
+// newRequest wraps http.NewRequest so that a URL it cannot parse does not
+// reach the caller with the endpoint's credentials still in it.
+func newRequest(method, rawURL string, body io.Reader) (*http.Request, error) {
+	req, err := http.NewRequest(method, rawURL, body)
+	if err != nil {
+		var uerr *url.Error
+		if errors.As(err, &uerr) {
+			uerr.URL = redactedRawURL(uerr.URL)
+		}
+		return nil, err
+	}
+	return req, nil
+}
+
+func checkRedirect(req *http.Request, via []*http.Request, policy RedirectPolicy) error {
+	// CheckRedirect is the only hook that runs before the next hop leaves
+	// the client. ModifyEndpointIfRedirect inspects the chain after
+	// client.Do has followed all of it, so a hop rejected there has already
+	// carried the request headers to its server.
+	//
+	// The wording matches the message ModifyEndpointIfRedirect produces for
+	// the same hop, which this check reaches first.
+	if len(via) != 0 {
+		// A hop whose scheme cannot be read cannot be shown not to have been
+		// https, so it is assumed to have been, and a cleartext target is
+		// rejected. Skipping the comparison instead would let an
+		// undeterminable hop turn the check off, which is the wrong default
+		// for a credential control; crossedOrigin fails closed the same way.
+		// An empty scheme is as unreadable as a nil URL, so both take the
+		// assumed-https default.
+		//
+		// The comparisons fold case because a scheme is case-insensitive per
+		// RFC 3986. net/url lowercases what it parses, so only a hand-built
+		// URL reaches here uppercased - the same synthetic caller the nil
+		// checks guard against - and for that caller "HTTPS" to "http" is
+		// still a downgrade.
+		prevScheme := "https"
+		if prev := via[len(via)-1]; prev.URL != nil && prev.URL.Scheme != "" {
+			prevScheme = prev.URL.Scheme
+		}
+		if strings.EqualFold(prevScheme, "https") && strings.EqualFold(req.URL.Scheme, "http") {
+			return fmt.Errorf("http redirect: changes scheme from %q to %q: %s",
+				prevScheme, req.URL.Scheme, redactedURL(req.URL))
+		}
+	}
+
+	switch policy {
+	case FollowRedirects:
+	case NoFollowRedirects:
+		return fmt.Errorf("http redirect: redirects disabled to %s", redactedURL(req.URL))
+	case "", FollowInitialRedirects:
+		if !isInitialRequest(req) {
+			return fmt.Errorf("http redirect: redirect on non-initial request to %s", redactedURL(req.URL))
+		}
+	default:
+		return fmt.Errorf("http redirect: invalid redirect policy %q", policy)
+	}
+	// Folded for the same reason as the guard above: a scheme is
+	// case-insensitive per RFC 3986, so a spelling the downgrade check read
+	// as https must not be rejected here as a scheme go-git cannot speak.
+	if !strings.EqualFold(req.URL.Scheme, "http") && !strings.EqualFold(req.URL.Scheme, "https") {
+		return fmt.Errorf("http redirect: unsupported scheme %q", req.URL.Scheme)
+	}
+	if len(via) >= 10 {
+		return fmt.Errorf("http redirect: too many redirects")
+	}
+	return nil
 }
 
 func (*session) Close() error {
@@ -355,6 +827,17 @@ func (*session) Close() error {
 }
 
 // AuthMethod is concrete implementation of common.AuthMethod for HTTP services
+//
+// Headers SetAuth adds are dropped when a redirect leaves the repository's
+// origin: only the headers the transport sets itself survive that boundary.
+// This applies to non-credential headers too, so an implementation that adds a
+// trace or tenant header loses it on such a hop.
+//
+// That filter matches header names, not values. An implementation that writes
+// a credential into a name the transport also uses - User-Agent, Host, Accept,
+// Content-Type, Content-Length - has that value carried across the boundary
+// with the name. Such a credential is also sent to the origin and to any proxy
+// in path, so it should not be placed there whether or not a redirect follows.
 type AuthMethod interface {
 	transport.AuthMethod
 	SetAuth(r *http.Request)
@@ -472,6 +955,6 @@ func (e *Err) StatusCode() int {
 
 func (e *Err) Error() string {
 	return fmt.Sprintf("unexpected requesting %q status code: %d",
-		e.Response.Request.URL, e.Response.StatusCode,
+		redactedURL(e.Response.Request.URL), e.Response.StatusCode,
 	)
 }

vendor/github.com/go-git/go-git/v5/plumbing/transport/http/receive_pack.go

@@ -88,7 +88,7 @@ func (s *rpSession) doRequest(
 		body = content
 	}
 
-	req, err := http.NewRequest(method, url, body)
+	req, err := newRequest(method, url, body)
 	if err != nil {
 		return nil, plumbing.NewPermanentError(err)
 	}

vendor/github.com/go-git/go-git/v5/plumbing/transport/http/upload_pack.go

@@ -86,7 +86,7 @@ func (s *upSession) doRequest(
 		body = content
 	}
 
-	req, err := http.NewRequest(method, url, body)
+	req, err := newRequest(method, url, body)
 	if err != nil {
 		return nil, plumbing.NewPermanentError(err)
 	}

vendor/github.com/go-git/go-git/v5/plumbing/transport/ssh/common.go

@@ -252,7 +252,39 @@ func (c *command) setAuthFromEndpoint() error {
 }
 
 func endpointToCommand(cmd string, ep *transport.Endpoint) string {
-	return fmt.Sprintf("%s '%s'", cmd, ep.Path)
+	var b strings.Builder
+	b.WriteString(cmd)
+	b.WriteByte(' ')
+	writeShellQuote(&b, ep.Path)
+	return b.String()
+}
+
+// writeShellQuote writes s to b, wrapped in single quotes with
+// embedded single quotes and exclamation marks escaped using the
+// POSIX close-escape-reopen idiom:
+//
+//	' becomes '\''
+//	! becomes '\!'
+//
+// It is a direct port of canonical Git's sq_quote_buf (quote.c).
+// The bang escape keeps the result safe when re-evaluated under
+// csh-derived shells that perform history expansion. The output is
+// safe to pass as a single argument through any POSIX shell and
+// round-trips through git-shell's sq_dequote_to_argv.
+func writeShellQuote(b *strings.Builder, s string) {
+	b.Grow(len(s) + 2)
+	b.WriteByte('\'')
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		if c == '\'' || c == '!' {
+			b.WriteString(`'\`)
+			b.WriteByte(c)
+			b.WriteByte('\'')
+			continue
+		}
+		b.WriteByte(c)
+	}
+	b.WriteByte('\'')
 }
 
 func overrideConfig(overrides *ssh.ClientConfig, c *ssh.ClientConfig) {

vendor/github.com/go-git/go-git/v5/repository.go

@@ -433,6 +433,7 @@ func dotGitCommonDirectory(fs billy.Filesystem) (commonDir billy.Filesystem, err
 	if err != nil {
 		return nil, err
 	}
+	defer ioutil.CheckClose(f, &err)
 
 	b, err := io.ReadAll(f)
 	if err != nil {
@@ -1530,7 +1531,18 @@ func (r *Repository) Worktree() (*Worktree, error) {
 		return nil, ErrIsBareRepository
 	}
 
-	return &Worktree{r: r, Filesystem: r.wt}, nil
+	protectNTFS := defaultProtectNTFS()
+	protectHFS := defaultProtectHFS()
+	if cfg, err := r.Config(); err == nil {
+		if cfg.Core.ProtectNTFS.IsSet() {
+			protectNTFS = cfg.Core.ProtectNTFS.IsTrue()
+		}
+		if cfg.Core.ProtectHFS.IsSet() {
+			protectHFS = cfg.Core.ProtectHFS.IsTrue()
+		}
+	}
+
+	return &Worktree{r: r, Filesystem: newWorktreeFilesystem(r.wt, protectNTFS, protectHFS)}, nil
 }
 
 func expand_ref(s storer.ReferenceStorer, ref plumbing.ReferenceName) (*plumbing.Reference, error) {

vendor/github.com/go-git/go-git/v5/storage/filesystem/dotgit/dotgit.go

@@ -16,6 +16,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/go-git/go-git/v5/internal/pathutil"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/storage"
@@ -75,8 +76,56 @@ var (
 	// ErrEmptyRefFile is returned when a reference file is attempted to be read,
 	// but the file is empty
 	ErrEmptyRefFile = errors.New("ref file is empty")
+	// ErrModuleNameEscape is returned when a submodule name would
+	// resolve outside the modules/ subtree, mirroring canonical Git's
+	// "ignoring suspicious submodule name" defence.
+	ErrModuleNameEscape = errors.New("submodule name escapes modules/ directory")
+	// ErrReferenceNameEscape is returned when a reference name would
+	// resolve outside its reference sub-tree once turned into a path
+	// under the .git directory (e.g. a name with a ".." component).
+	ErrReferenceNameEscape = errors.New("reference name escapes the reference storage")
 )
 
+// isPathSep reports whether r is a path separator in reference names.
+// It treats both '/' and '\\' as separators to harden against cross-OS paths.
+func isPathSep(r rune) bool { return r == '/' || r == '\\' }
+
+// validReferenceName rejects reference names that cannot be safely turned into
+// a path under the .git directory. A loose reference is stored verbatim at
+// ".git/<name>", so a crafted name — for instance one advertised by a malicious
+// remote — could climb out of its reference sub-tree and read, overwrite, or
+// delete unrelated metadata such as .git/config.
+//
+// The storage-safety gate is plumbing.ReferenceName.IsSafe, mirroring Git's
+// refname_is_safe: a name must be under refs/ without escaping it, or be a
+// [A-Z_] pseudo-ref. This alone rejects absolute, drive-prefixed, escaping and
+// single-level metadata names. On top of it, this adds filesystem-specific
+// hardening that IsSafe's literal check does not cover: control characters, and
+// components a case-insensitive/NTFS/HFS+ filesystem would fold back to "." or
+// ".." (trailing dots/spaces, Alternate Data Streams, ignorable Unicode code
+// points), delegated to pathutil.IsHFSDot and pathutil.IsNTFSDot with "." as
+// the needle — as validSubmoduleName does — and run regardless of host OS.
+func validReferenceName(name plumbing.ReferenceName) error {
+	if !name.IsSafe() {
+		return fmt.Errorf("%w: %q is not under refs/ nor a valid pseudo-ref", ErrReferenceNameEscape, string(name))
+	}
+
+	s := string(name)
+	for i := 0; i < len(s); i++ {
+		if s[i] < 0x20 || s[i] == 0x7f {
+			return fmt.Errorf("%w: %q", ErrReferenceNameEscape, s)
+		}
+	}
+	for _, part := range strings.FieldsFunc(s, isPathSep) {
+		// IsNTFSDot/IsHFSDot with a "." needle match ".." and its disguises
+		// but not a bare ".", so reject that component explicitly too.
+		if part == "." || pathutil.IsHFSDot(part, ".") || pathutil.IsNTFSDot(part, ".", "") {
+			return fmt.Errorf("%w: %q", ErrReferenceNameEscape, s)
+		}
+	}
+	return nil
+}
+
 // Options holds configuration for the storage.
 type Options struct {
 	// ExclusiveAccess means that the filesystem is not modified externally
@@ -702,6 +751,10 @@ func (d *DotGit) checkReferenceAndTruncate(f billy.File, old *plumbing.Reference
 }
 
 func (d *DotGit) SetRef(r, old *plumbing.Reference) error {
+	if err := validReferenceName(r.Name()); err != nil {
+		return err
+	}
+
 	var content string
 	switch r.Type() {
 	case plumbing.SymbolicReference:
@@ -737,6 +790,10 @@ func (d *DotGit) Refs() ([]*plumbing.Reference, error) {
 
 // Ref returns the reference for a given reference name.
 func (d *DotGit) Ref(name plumbing.ReferenceName) (*plumbing.Reference, error) {
+	if err := validReferenceName(name); err != nil {
+		return nil, err
+	}
+
 	ref, err := d.readReferenceFile(".", name.String())
 	if err == nil {
 		return ref, nil
@@ -800,6 +857,10 @@ func (d *DotGit) packedRef(name plumbing.ReferenceName) (*plumbing.Reference, er
 
 // RemoveRef removes a reference by name.
 func (d *DotGit) RemoveRef(name plumbing.ReferenceName) error {
+	if err := validReferenceName(name); err != nil {
+		return err
+	}
+
 	path := d.fs.Join(".", name.String())
 	_, err := d.fs.Stat(path)
 	if err == nil {
@@ -1127,9 +1188,20 @@ func (d *DotGit) PackRefs() (err error) {
 	return nil
 }
 
-// Module return a billy.Filesystem pointing to the module folder
+// Module returns a billy.Filesystem pointing to the module folder.
+//
+// As a defence in depth against submodule name path traversal,
+// refuse names whose joined path leaves the modules/ subtree once
+// cleaned. The config-layer parser also validates submodule names,
+// but Module may be reached from any caller that constructs a
+// Submodule struct programmatically and so bypasses the parser.
 func (d *DotGit) Module(name string) (billy.Filesystem, error) {
-	return d.fs.Chroot(d.fs.Join(modulePath, name))
+	p := d.fs.Join(modulePath, name)
+	cleaned := path.Clean(filepath.ToSlash(p))
+	if cleaned != modulePath && !strings.HasPrefix(cleaned, modulePath+"/") {
+		return nil, ErrModuleNameEscape
+	}
+	return d.fs.Chroot(p)
 }
 
 func (d *DotGit) AddAlternate(remote string) error {

vendor/github.com/go-git/go-git/v5/submodule.go

@@ -6,9 +6,12 @@ import (
 	"errors"
 	"fmt"
 	"path"
+	"path/filepath"
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-git/v5/config"
+	"github.com/go-git/go-git/v5/internal/pathutil"
+	giturl "github.com/go-git/go-git/v5/internal/url"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/index"
 	"github.com/go-git/go-git/v5/plumbing/transport"
@@ -119,6 +122,16 @@ func (s *Submodule) Repository() (*Repository, error) {
 		exists = true
 	}
 
+	// s.c.Path is sourced from the worktree's .gitmodules and is
+	// therefore tree-controlled. Apply the strict tree-path validator
+	// before chroot — the wrapper's tolerant validPath would let a
+	// final-position .git component through (e.g. "submodule/.git"),
+	// which a malicious .gitmodules could use to chroot the submodule
+	// worktree into the repository's actual .git directory.
+	if err := pathutil.ValidTreePath(s.c.Path); err != nil {
+		return nil, err
+	}
+
 	var worktree billy.Filesystem
 	if worktree, err = s.w.Filesystem.Chroot(s.c.Path); err != nil {
 		return nil, err
@@ -138,18 +151,25 @@ func (s *Submodule) Repository() (*Repository, error) {
 		return nil, err
 	}
 
-	if !path.IsAbs(moduleEndpoint.Path) && moduleEndpoint.Protocol == "file" {
-		remotes, err := s.w.r.Remotes()
+	// A relative submodule URL such as "../X.git" must resolve against
+	// the parent repository's remote URL, not against the process CWD.
+	// Detect relativity from the raw configured URL because
+	// transport.NewEndpoint normalizes local paths to absolute form via
+	// filepath.Abs, which would otherwise mask the relative form here.
+	if giturl.IsLocalEndpoint(s.c.URL) &&
+		!path.IsAbs(s.c.URL) && !filepath.IsAbs(s.c.URL) {
+
+		base, err := defaultRemote(s.w.r)
+		if err != nil {
+			return nil, fmt.Errorf("resolving relative submodule URL: %w", err)
+		}
+
+		rootEndpoint, err := transport.NewEndpoint(base.URLs[0])
 		if err != nil {
 			return nil, err
 		}
 
-		rootEndpoint, err := transport.NewEndpoint(remotes[0].c.URLs[0])
-		if err != nil {
-			return nil, err
-		}
-
-		rootEndpoint.Path = path.Join(rootEndpoint.Path, moduleEndpoint.Path)
+		rootEndpoint.Path = path.Join(rootEndpoint.Path, s.c.URL)
 		*moduleEndpoint = *rootEndpoint
 	}
 
@@ -161,6 +181,52 @@ func (s *Submodule) Repository() (*Repository, error) {
 	return r, err
 }
 
+// defaultRemote returns the remote that relative submodule URLs are
+// resolved against, mirroring canonical Git's repo_default_remote
+// (remote.c) and resolve_relative_url (builtin/submodule--helper.c):
+//
+//  1. if HEAD is on a branch with branch.<name>.remote configured,
+//     use that remote;
+//  2. else if exactly one remote is configured, use it;
+//  3. otherwise fall back to DefaultRemoteName ("origin").
+//
+// Each rule falls through unconditionally: a branch lookup that
+// finds the branch but with an empty Remote does not short-circuit
+// rule (2). Returns an error when the chosen remote is not configured.
+func defaultRemote(r *Repository) (*config.RemoteConfig, error) {
+	cfg, err := r.Config()
+	if err != nil {
+		return nil, err
+	}
+
+	if ref, err := r.Reference(plumbing.HEAD, false); err == nil &&
+		ref.Type() == plumbing.SymbolicReference &&
+		ref.Target().IsBranch() {
+		if b, ok := cfg.Branches[ref.Target().Short()]; ok && b.Remote != "" {
+			return lookupRemote(cfg, b.Remote)
+		}
+	}
+
+	if len(cfg.Remotes) == 1 {
+		for name := range cfg.Remotes {
+			return lookupRemote(cfg, name)
+		}
+	}
+
+	return lookupRemote(cfg, DefaultRemoteName)
+}
+
+func lookupRemote(cfg *config.Config, name string) (*config.RemoteConfig, error) {
+	rc, ok := cfg.Remotes[name]
+	if !ok {
+		return nil, fmt.Errorf("remote %q not found", name)
+	}
+	if len(rc.URLs) == 0 {
+		return nil, fmt.Errorf("remote %q has no configured URL", name)
+	}
+	return rc, nil
+}
+
 // Update the registered submodule to match what the superproject expects, the
 // submodule should be initialized first calling the Init method or setting in
 // the options SubmoduleUpdateOptions.Init equals true

vendor/github.com/go-git/go-git/v5/utils/binary/read.go

@@ -5,11 +5,18 @@ package binary
 import (
 	"bufio"
 	"encoding/binary"
+	"errors"
 	"io"
+	"math"
 
 	"github.com/go-git/go-git/v5/plumbing"
 )
 
+// ErrIntegerOverflow is returned when a Git-format variable-width integer
+// would not fit into an int64 because the input declares more continuation
+// bytes than the type can hold.
+var ErrIntegerOverflow = errors.New("variable-width integer overflow")
+
 // Read reads structured binary data from r into data. Bytes are read and
 // decoded in BigEndian order
 // https://golang.org/pkg/encoding/binary/#Read
@@ -92,6 +99,14 @@ func ReadVariableWidthInt(r io.Reader) (int64, error) {
 
 	var v = int64(c & maskLength)
 	for c&maskContinue > 0 {
+		// Reject input that, after the v++ and shift below, would
+		// not fit in an int64. With v < (MaxInt64-127)>>7, the
+		// post-increment v is at most (MaxInt64-127)>>7 and the
+		// final (v << 7) + (c & 0x7F) stays within int64.
+		if v >= (math.MaxInt64-int64(maskLength))>>lengthBits {
+			return 0, ErrIntegerOverflow
+		}
+
 		v++
 		if err := Read(r, &c); err != nil {
 			return 0, err

vendor/github.com/go-git/go-git/v5/worktree.go

@@ -7,7 +7,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 
 	"github.com/go-git/go-billy/v5"
@@ -458,10 +457,6 @@ func (w *Worktree) resetWorktree(t *object.Tree, files []string) error {
 
 	filesMap := buildFilePathMap(files)
 	for _, ch := range changes {
-		if err := w.validChange(ch); err != nil {
-			return err
-		}
-
 		if len(files) > 0 {
 			file := ""
 			if ch.From != nil {
@@ -489,108 +484,6 @@ func (w *Worktree) resetWorktree(t *object.Tree, files []string) error {
 	return w.r.Storer.SetIndex(idx)
 }
 
-// worktreeDeny is a list of paths that are not allowed
-// to be used when resetting the worktree.
-var worktreeDeny = map[string]struct{}{
-	// .git
-	GitDirName: {},
-
-	// For other historical reasons, file names that do not conform to the 8.3
-	// format (up to eight characters for the basename, three for the file
-	// extension, certain characters not allowed such as `+`, etc) are associated
-	// with a so-called "short name", at least on the `C:` drive by default.
-	// Which means that `git~1/` is a valid way to refer to `.git/`.
-	"git~1": {},
-}
-
-// validPath checks whether paths are valid.
-// The rules around invalid paths could differ from upstream based on how
-// filesystems are managed within go-git, but they are largely the same.
-//
-// For upstream rules:
-// https://github.com/git/git/blob/564d0252ca632e0264ed670534a51d18a689ef5d/read-cache.c#L946
-// https://github.com/git/git/blob/564d0252ca632e0264ed670534a51d18a689ef5d/path.c#L1383
-func validPath(paths ...string) error {
-	for _, p := range paths {
-		parts := strings.FieldsFunc(p, func(r rune) bool { return (r == '\\' || r == '/') })
-		if len(parts) == 0 {
-			return fmt.Errorf("invalid path: %q", p)
-		}
-
-		if _, denied := worktreeDeny[strings.ToLower(parts[0])]; denied {
-			return fmt.Errorf("invalid path prefix: %q", p)
-		}
-
-		if runtime.GOOS == "windows" {
-			// Volume names are not supported, in both formats: \\ and <DRIVE_LETTER>:.
-			if vol := filepath.VolumeName(p); vol != "" {
-				return fmt.Errorf("invalid path: %q", p)
-			}
-
-			if !windowsValidPath(parts[0]) {
-				return fmt.Errorf("invalid path: %q", p)
-			}
-		}
-
-		for _, part := range parts {
-			if part == ".." {
-				return fmt.Errorf("invalid path %q: cannot use '..'", p)
-			}
-		}
-	}
-	return nil
-}
-
-// windowsPathReplacer defines the chars that need to be replaced
-// as part of windowsValidPath.
-var windowsPathReplacer *strings.Replacer
-
-func init() {
-	windowsPathReplacer = strings.NewReplacer(" ", "", ".", "")
-}
-
-func windowsValidPath(part string) bool {
-	if len(part) > 3 && strings.EqualFold(part[:4], GitDirName) {
-		// For historical reasons, file names that end in spaces or periods are
-		// automatically trimmed. Therefore, `.git . . ./` is a valid way to refer
-		// to `.git/`.
-		if windowsPathReplacer.Replace(part[4:]) == "" {
-			return false
-		}
-
-		// For yet other historical reasons, NTFS supports so-called "Alternate Data
-		// Streams", i.e. metadata associated with a given file, referred to via
-		// `<filename>:<stream-name>:<stream-type>`. There exists a default stream
-		// type for directories, allowing `.git/` to be accessed via
-		// `.git::$INDEX_ALLOCATION/`.
-		//
-		// For performance reasons, _all_ Alternate Data Streams of `.git/` are
-		// forbidden, not just `::$INDEX_ALLOCATION`.
-		if len(part) > 4 && part[4:5] == ":" {
-			return false
-		}
-	}
-	return true
-}
-
-func (w *Worktree) validChange(ch merkletrie.Change) error {
-	action, err := ch.Action()
-	if err != nil {
-		return nil
-	}
-
-	switch action {
-	case merkletrie.Delete:
-		return validPath(ch.From.String())
-	case merkletrie.Insert:
-		return validPath(ch.To.String())
-	case merkletrie.Modify:
-		return validPath(ch.From.String(), ch.To.String())
-	}
-
-	return nil
-}
-
 func (w *Worktree) checkoutChange(ch merkletrie.Change, t *object.Tree, idx *indexBuilder) error {
 	a, err := ch.Action()
 	if err != nil {
@@ -690,6 +583,10 @@ func (w *Worktree) checkoutChangeSubmodule(name string,
 			return err
 		}
 
+		if err := w.clearBlockingSymlinks(name); err != nil {
+			return err
+		}
+
 		if err := w.Filesystem.MkdirAll(name, mode); err != nil {
 			return err
 		}
@@ -733,7 +630,70 @@ func (w *Worktree) checkoutChangeRegularFile(name string,
 	return nil
 }
 
+// clearBlockingSymlinks removes a symlink that is in the way of
+// materialising name, so the checkout writes a real entry in its place
+// instead of following the link out of the worktree. Two cases:
+//
+//   - a leading directory component that is a symlink (e.g. "s" while
+//     writing "s/config", where "s" links to ".git"): OpenFile/MkdirAll
+//     would traverse it, so the write would land under the link's target.
+//   - the final component itself being a symlink (e.g. writing "s" while
+//     "s" links to ".git/config"): OpenFile with O_TRUNC, or Symlink,
+//     would follow/replace through it and clobber the target.
+//
+// A symlink can never be a legitimate parent of, or the destination for,
+// a tracked entry, so removing it is always correct. This mirrors upstream
+// Git's forced checkout, which unlinks a blocking symlink in the leading
+// path (create_directories) and unlinks an existing entry before
+// write_entry.
+// https://github.com/git/git/blob/v2.54.0/entry.c#L50
+func (w *Worktree) clearBlockingSymlinks(name string) error {
+	var dirs []string
+	for dir := filepath.Dir(name); dir != "." && dir != "" && dir != string(filepath.Separator); dir = filepath.Dir(dir) {
+		dirs = append(dirs, dir)
+	}
+	// Leading components, shallowest-first: removing the shallowest symlink
+	// invalidates every component beneath it, so a single removal is enough.
+	for i := len(dirs) - 1; i >= 0; i-- {
+		fi, err := w.Filesystem.Lstat(dirs[i])
+		if err != nil {
+			// A missing component is created as a real directory by the
+			// checkout. Any other error means we cannot tell whether it is
+			// a symlink, so surface it instead of leaving a blocking link in
+			// place and failing later in a harder-to-diagnose way.
+			if os.IsNotExist(err) {
+				continue
+			}
+			return err
+		}
+		if fi.Mode()&os.ModeSymlink != 0 {
+			return w.Filesystem.Remove(dirs[i])
+		}
+	}
+	// Final component: an existing symlink here would be followed by the
+	// subsequent OpenFile/Symlink/MkdirAll, so replace it.
+	fi, err := w.Filesystem.Lstat(name)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	if fi.Mode()&os.ModeSymlink != 0 {
+		return w.Filesystem.Remove(name)
+	}
+	return nil
+}
+
 func (w *Worktree) checkoutFile(f *object.File) (err error) {
+	// checkoutFile is the materialisation boundary for tracked entries.
+	// Remove any blocking symlink first so the subsequent OpenFile or
+	// Symlink call writes the entry itself instead of following a planted
+	// final-component link in the underlying filesystem.
+	if err := w.clearBlockingSymlinks(f.Name); err != nil {
+		return err
+	}
+
 	mode, err := f.Mode.ToOSFileMode()
 	if err != nil {
 		return
@@ -763,10 +723,10 @@ func (w *Worktree) checkoutFile(f *object.File) (err error) {
 }
 
 func (w *Worktree) checkoutFileSymlink(f *object.File) (err error) {
-	// https://github.com/git/git/commit/10ecfa76491e4923988337b2e2243b05376b40de
-	if strings.EqualFold(f.Name, gitmodulesFile) {
-		return ErrGitModulesSymlink
-	}
+	// .gitmodules symlink rejection (and its NTFS / HFS variants) is
+	// enforced by the worktreeFilesystem wrapper's Symlink method via
+	// validSymlinkName. See https://github.com/git/git/commit/10ecfa7
+	// for the upstream rationale.
 
 	from, err := f.Reader()
 	if err != nil {

vendor/github.com/go-git/go-git/v5/worktree_fs.go

@@ -0,0 +1,349 @@
+package git
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/go-git/go-billy/v5"
+
+	"github.com/go-git/go-git/v5/internal/pathutil"
+)
+
+// defaultProtectHFS returns the default value for core.protectHFS
+// when not explicitly configured. Matches upstream Git's
+// PROTECT_HFS_DEFAULT[1], which the Makefile sets to 1 on Darwin
+// and leaves at 0 on every other platform.
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/config.mak.uname#L146
+func defaultProtectHFS() bool {
+	return runtime.GOOS == "darwin"
+}
+
+// defaultProtectNTFS returns the default value for core.protectNTFS
+// when not explicitly configured. Matches upstream Git's
+// PROTECT_NTFS_DEFAULT, which has been 1 on every platform since
+// 9102f958ee5 (CVE-2019-1353)[1]: WSL allows Linux processes to
+// reach NTFS-mounted worktrees on Windows hosts, so the
+// is_ntfs_dotgit guard cannot safely be gated on the runtime OS.
+//
+// [1]: https://github.com/git/git/commit/9102f958ee5
+func defaultProtectNTFS() bool {
+	return true
+}
+
+// worktreeFilesystem wraps a billy.Filesystem and validates every path it
+// is handed, so worktree operations cannot use dangerous paths at the
+// boundary. Two layers apply:
+//
+//   - validPath rejects dangerous path *strings*: .git and its HFS+/NTFS
+//     variants, "..", control characters, volume names.
+//   - validNoLeadingSymlink rejects paths whose leading directories
+//     already exist on disk as symlinks, so a write or delete cannot
+//     follow a planted link out of the tree.
+//
+// Both layers run on every mutating operation (validWritePath) and every
+// read (validReadPath). Chroot additionally refuses a symlink as the final
+// component, so a sub-filesystem such as a submodule worktree cannot be
+// scoped to a redirected target.
+//
+// The wrapper intentionally stops at leading-component traversal. Callers
+// that need final-component no-follow semantics for materialisation
+// (checkoutFile) enforce that directly by removing the blocking symlink
+// before opening the destination path.
+type worktreeFilesystem struct {
+	billy.Filesystem
+	protectNTFS bool
+	protectHFS  bool
+}
+
+func newWorktreeFilesystem(fs billy.Filesystem, protectNTFS, protectHFS bool) *worktreeFilesystem {
+	return &worktreeFilesystem{Filesystem: fs, protectNTFS: protectNTFS, protectHFS: protectHFS}
+}
+
+func (sfs *worktreeFilesystem) Create(filename string) (billy.File, error) {
+	if err := sfs.validWritePath(filename); err != nil {
+		return nil, fmt.Errorf("create: %w", err)
+	}
+	return sfs.Filesystem.Create(filename)
+}
+
+func (sfs *worktreeFilesystem) Open(filename string) (billy.File, error) {
+	if err := sfs.validReadPath(filename); err != nil {
+		return nil, fmt.Errorf("open: %w", err)
+	}
+	return sfs.Filesystem.Open(filename)
+}
+
+func (sfs *worktreeFilesystem) OpenFile(filename string, flag int, perm os.FileMode) (billy.File, error) {
+	if err := sfs.validWritePath(filename); err != nil {
+		return nil, fmt.Errorf("openfile: %w", err)
+	}
+	return sfs.Filesystem.OpenFile(filename, flag, perm)
+}
+
+func (sfs *worktreeFilesystem) Stat(filename string) (os.FileInfo, error) {
+	if err := sfs.validReadPath(filename); err != nil {
+		return nil, fmt.Errorf("stat: %w", err)
+	}
+	return sfs.Filesystem.Stat(filename)
+}
+
+func (sfs *worktreeFilesystem) Remove(filename string) error {
+	if err := sfs.validWritePath(filename); err != nil {
+		return fmt.Errorf("remove: %w", err)
+	}
+	return sfs.Filesystem.Remove(filename)
+}
+
+func (sfs *worktreeFilesystem) Rename(from, to string) error {
+	if err := sfs.validWritePath(from, to); err != nil {
+		return fmt.Errorf("rename: %w", err)
+	}
+	return sfs.Filesystem.Rename(from, to)
+}
+
+func (sfs *worktreeFilesystem) ReadDir(path string) ([]os.FileInfo, error) {
+	if err := sfs.validReadPath(path); err != nil {
+		return nil, fmt.Errorf("readdir: %w", err)
+	}
+	return sfs.Filesystem.ReadDir(path)
+}
+
+func (sfs *worktreeFilesystem) Lstat(filename string) (os.FileInfo, error) {
+	if err := sfs.validReadPath(filename); err != nil {
+		return nil, fmt.Errorf("lstat: %w", err)
+	}
+	return sfs.Filesystem.Lstat(filename)
+}
+
+func (sfs *worktreeFilesystem) Symlink(target, link string) error {
+	if err := sfs.validWritePath(link); err != nil {
+		return fmt.Errorf("symlink: %w", err)
+	}
+	if err := sfs.validSymlinkName(link); err != nil {
+		return fmt.Errorf("symlink: %w", err)
+	}
+	return sfs.Filesystem.Symlink(target, link)
+}
+
+func (sfs *worktreeFilesystem) Readlink(link string) (string, error) {
+	if err := sfs.validReadPath(link); err != nil {
+		return "", fmt.Errorf("readlink: %w", err)
+	}
+	return sfs.Filesystem.Readlink(link)
+}
+
+func (sfs *worktreeFilesystem) MkdirAll(path string, perm os.FileMode) error {
+	// MkdirAll on the worktree root is a no-op: the root always exists,
+	// so there is nothing to materialise. Mirroring the tolerance that
+	// validReadPath gives to read-side operations avoids breaking callers
+	// that walk a directory tree and pass the relative-to-root prefix
+	// ("") through to the worktree FS.
+	if path == "" || path == "." || path == "/" {
+		return nil
+	}
+	if err := sfs.validWritePath(path); err != nil {
+		return fmt.Errorf("mkdirall: %w", err)
+	}
+	return sfs.Filesystem.MkdirAll(path, perm)
+}
+
+func (sfs *worktreeFilesystem) TempFile(_, _ string) (billy.File, error) {
+	return nil, fmt.Errorf("tempfile: %w", errUnsupportedOperation)
+}
+
+func (sfs *worktreeFilesystem) Chroot(path string) (billy.Filesystem, error) {
+	if err := sfs.validReadPath(path); err != nil {
+		return nil, fmt.Errorf("chroot: %w", err)
+	}
+	// Chroot scopes a sub-filesystem to path, so the final component must
+	// be a real directory too: a symlink there would silently redirect the
+	// scope (e.g. a submodule worktree) to a target outside the tree. This
+	// is the "valid path, wrong target" case that validNoLeadingSymlink,
+	// which only inspects leading components, does not cover.
+	//
+	// A non-existent target is fine: Chroot creates it as a real
+	// directory. Any other Lstat error means we cannot prove the target
+	// is not a symlink, so fail closed rather than scope through it.
+	if fi, err := sfs.Filesystem.Lstat(path); err != nil {
+		if !os.IsNotExist(err) {
+			return nil, fmt.Errorf("chroot: cannot stat %q: %w", path, err)
+		}
+	} else if fi.Mode()&os.ModeSymlink != 0 {
+		return nil, fmt.Errorf("chroot: invalid path %q: is a symlink", path)
+	}
+	return sfs.Filesystem.Chroot(path)
+}
+
+// validReadPath is like validWritePath but treats the empty string and "."
+// as valid references to the worktree root. Read-side operations on the
+// root (e.g. ReadDir(""), Lstat(".")) are legitimate. Mutating the root
+// itself is not, so write-side operations reject it via validPath. Reads
+// are still refused through a leading symlink, so the wrapper never
+// follows a planted link even on the read surface.
+func (sfs *worktreeFilesystem) validReadPath(p string) error {
+	if p == "" || p == "." || p == "/" {
+		return nil
+	}
+	if err := sfs.validPath(p); err != nil {
+		return err
+	}
+	return sfs.validNoLeadingSymlink(p)
+}
+
+var errUnsupportedOperation = errors.New("unsupported operation")
+
+// isDotGitVariant reports whether part is .git, git~1, or an HFS+
+// equivalent of .git (when protectHFS is true). NTFS variants of .git
+// (e.g. ".git " with trailing space, ".git::$INDEX_ALLOCATION") are
+// detected separately by pathutil.WindowsValidPath, which applies
+// regardless of position in the path. Both validators reuse this
+// helper.
+func isDotGitVariant(part string, protectHFS bool) bool {
+	if pathutil.IsDotGitName(part) {
+		return true
+	}
+	if protectHFS && pathutil.IsHFSDotGit(part) {
+		return true
+	}
+	return false
+}
+
+// validPath checks whether paths are valid for the worktree
+// filesystem abstraction. It is intentionally tolerant of .git as
+// the final path component of a multi-component path
+// (e.g. "submodule/.git"), so that legitimate gitlink pointer files
+// can still be Stat'd, Read, and Removed via the wrapper during
+// submodule cleanup. Attacker-controlled tree-entry paths are
+// validated separately by pathutil.ValidTreePath at the boundaries
+// where data leaves the trusted store (Tree.FindEntry, the explicit
+// callers in CherryPick and Submodule.Repository).
+//
+// For upstream rules:
+// https://github.com/git/git/blob/v2.54.0/read-cache.c#L987
+// https://github.com/git/git/blob/v2.54.0/path.c#L1419
+func (sfs *worktreeFilesystem) validPath(paths ...string) error {
+	for _, p := range paths {
+		for i := 0; i < len(p); i++ {
+			if p[i] < 0x20 || p[i] == 0x7f {
+				return fmt.Errorf("invalid path %q: contains control character", p)
+			}
+		}
+
+		parts := strings.FieldsFunc(p, func(r rune) bool { return (r == '\\' || r == '/') })
+		if len(parts) == 0 {
+			return fmt.Errorf("invalid path: %q", p)
+		}
+
+		if sfs.protectNTFS {
+			// Volume names are not supported, in both formats: \\ and <DRIVE_LETTER>:.
+			if vol := filepath.VolumeName(p); vol != "" {
+				return fmt.Errorf("invalid path: %q", p)
+			}
+		}
+
+		for i, part := range parts {
+			if part == "." || part == ".." {
+				return fmt.Errorf("invalid path %q: cannot use %q", p, part)
+			}
+
+			// Reject .git (and equivalents) as a path component when it is
+			// either the first component (root-level .git) or a non-final
+			// component (traversal into a .git directory, e.g. "a/.git/config").
+			// A final non-first .git component (e.g. "submodule/.git") is
+			// allowed because submodule worktrees contain a .git pointer file.
+			if isDotGitVariant(part, sfs.protectHFS) && (i == 0 || i < len(parts)-1) {
+				return fmt.Errorf("invalid path component: %q", p)
+			}
+
+			if sfs.protectNTFS && !pathutil.WindowsValidPath(part) {
+				return fmt.Errorf("invalid path: %q", p)
+			}
+		}
+	}
+	return nil
+}
+
+// validWritePath validates paths for mutating operations. It layers the
+// filesystem-state check validNoLeadingSymlink on top of the string-only
+// checks in validPath, so a write can neither name a dangerous path nor
+// reach one by traversing an existing symlink. Every mutating method on
+// the wrapper funnels through here, so the leading-symlink invariant holds
+// for all worktree writers without each call site having to remember it.
+func (sfs *worktreeFilesystem) validWritePath(paths ...string) error {
+	if err := sfs.validPath(paths...); err != nil {
+		return err
+	}
+	return sfs.validNoLeadingSymlink(paths...)
+}
+
+// validNoLeadingSymlink rejects paths whose leading directory components
+// resolve through a symlink that already exists on the underlying
+// filesystem. validPath guards the path string. This guards the on-disk
+// state, so a write or delete cannot reach outside the worktree by
+// traversing a symlink that a tree or an earlier step left in place.
+//
+// This is the fail-closed backstop for the whole class. Callers that want
+// upstream's replace-and-continue behaviour (checkout) remove the blocking
+// symlink first via clearBlockingSymlinks, so no symlink remains when the
+// write reaches the wrapper. Callers that do not get a safe error,
+// matching upstream Git refusing rather than following the link. See
+// has_symlink_leading_path (symlinks.c) and the check_leading_path guard
+// in unlink_entry (entry.c).
+func (sfs *worktreeFilesystem) validNoLeadingSymlink(paths ...string) error {
+	for _, p := range paths {
+		for dir := filepath.Dir(p); dir != "." && dir != "" && dir != string(filepath.Separator); dir = filepath.Dir(dir) {
+			fi, err := sfs.Filesystem.Lstat(dir)
+			if err != nil {
+				// A missing ancestor is materialised as a real directory,
+				// so it cannot be a symlink and is safe to skip. Any other
+				// error (permission, I/O) means we cannot prove the
+				// component is not a symlink, so fail closed rather than
+				// let the operation traverse an unverified component.
+				if os.IsNotExist(err) {
+					continue
+				}
+				return fmt.Errorf("invalid path %q: cannot stat leading component %q: %w", p, dir, err)
+			}
+			if fi.Mode()&os.ModeSymlink != 0 {
+				return fmt.Errorf("invalid path %q: leading component %q is a symlink", p, dir)
+			}
+		}
+	}
+	return nil
+}
+
+// validSymlinkName checks the per-component name of a symlink for
+// dotfile names that attackers can use to trick a checkout into
+// writing a dangerous symlink. Each path component is compared
+// against .gitmodules case-insensitively, against its NTFS variants
+// (e.g. ".gitmodules .", ".gitmodules::$INDEX_ALLOCATION", or 8.3
+// short-name forms) when protectNTFS is on, and against its HFS+
+// variants (Unicode ignored code points folded into ".gitmodules")
+// when protectHFS is on.
+//
+// Reference: upstream Git verify_path_internal at read-cache.c#L1004-L1024
+// in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/read-cache.c#L1004-L1024
+func (sfs *worktreeFilesystem) validSymlinkName(name string) error {
+	parts := strings.FieldsFunc(name, func(r rune) bool {
+		return r == '/' || r == '\\'
+	})
+	for _, part := range parts {
+		if strings.EqualFold(part, gitmodulesFile) {
+			return ErrGitModulesSymlink
+		}
+		if sfs.protectNTFS && pathutil.IsNTFSDotGitmodules(part) {
+			return ErrGitModulesSymlink
+		}
+		if sfs.protectHFS && pathutil.IsHFSDotGitmodules(part) {
+			return ErrGitModulesSymlink
+		}
+	}
+	return nil
+}

vendor/github.com/go-git/go-git/v5/worktree_status.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/go-git/go-billy/v5/util"
+	"github.com/go-git/go-git/v5/internal/pathutil"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
@@ -370,7 +371,7 @@ func (w *Worktree) doAdd(path string, ignorePattern []gitignore.Pattern, skipSta
 		}
 	}
 
-	path = filepath.Clean(path)
+	path = filepath.ToSlash(filepath.Clean(path))
 
 	if err != nil || !fi.IsDir() {
 		added, h, err = w.doAddFile(idx, s, path, ignorePattern)
@@ -545,6 +546,14 @@ func (w *Worktree) addOrUpdateFileToIndex(idx *index.Index, filename string, h p
 }
 
 func (w *Worktree) doAddFileToIndex(idx *index.Index, filename string, h plumbing.Hash) error {
+	// Mirror upstream's Index.Add gate at the v5 caller boundary: the
+	// index feeds future trees, so a name that the tree-side
+	// pathutil.ValidTreePath gate would reject must not enter the
+	// index in the first place. v5 keeps Index.Add's existing signature
+	// for API compatibility, so the validation happens here.
+	if err := pathutil.ValidTreePath(filename); err != nil {
+		return err
+	}
 	return w.doUpdateFileToIndex(idx.Add(filename), filename, h)
 }
 

vendor/github.com/klauspost/cpuid/v2/.gitignore

@@ -1,24 +0,0 @@
-# Compiled Object files, Static and Dynamic libs (Shared Objects)
-*.o
-*.a
-*.so
-
-# Folders
-_obj
-_test
-
-# Architecture specific extensions/prefixes
-*.[568vq]
-[568vq].out
-
-*.cgo1.go
-*.cgo2.c
-_cgo_defun.c
-_cgo_gotypes.go
-_cgo_export.*
-
-_testmain.go
-
-*.exe
-*.test
-*.prof

vendor/github.com/klauspost/cpuid/v2/.goreleaser.yml

@@ -1,57 +0,0 @@
-version: 2
-
-builds:
-  -
-    id: "cpuid"
-    binary: cpuid
-    main: ./cmd/cpuid/main.go
-    env:
-      - CGO_ENABLED=0
-    flags:
-      - -ldflags=-s -w
-    goos:
-      - aix
-      - linux
-      - freebsd
-      - netbsd
-      - windows
-      - darwin
-    goarch:
-      - 386
-      - amd64
-      - arm64
-    goarm:
-      - 7
-
-archives:
-  -
-    id: cpuid
-    name_template: "cpuid-{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
-    format_overrides:
-      - goos: windows
-        format: zip
-    files:
-      - LICENSE
-checksum:
-  name_template: 'checksums.txt'
-changelog:
-  sort: asc
-  filters:
-    exclude:
-    - '^doc:'
-    - '^docs:'
-    - '^test:'
-    - '^tests:'
-    - '^Update\sREADME.md'
-
-nfpms:
-  -
-    file_name_template: "cpuid_package_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
-    vendor: Klaus Post
-    homepage: https://github.com/klauspost/cpuid
-    maintainer: Klaus Post <klauspost@gmail.com>
-    description: CPUID Tool
-    license: BSD 3-Clause
-    formats:
-      - deb
-      - rpm

vendor/github.com/klauspost/cpuid/v2/CONTRIBUTING.txt

@@ -1,35 +0,0 @@
-Developer Certificate of Origin
-Version 1.1
-
-Copyright (C) 2015- Klaus Post & Contributors.
-Email: klauspost@gmail.com
-
-Everyone is permitted to copy and distribute verbatim copies of this
-license document, but changing it is not allowed.
-
-
-Developer's Certificate of Origin 1.1
-
-By making a contribution to this project, I certify that:
-
-(a) The contribution was created in whole or in part by me and I
-    have the right to submit it under the open source license
-    indicated in the file; or
-
-(b) The contribution is based upon previous work that, to the best
-    of my knowledge, is covered under an appropriate open source
-    license and I have the right under that license to submit that
-    work with modifications, whether created in whole or in part
-    by me, under the same open source license (unless I am
-    permitted to submit under a different license), as indicated
-    in the file; or
-
-(c) The contribution was provided directly to me by some other
-    person who certified (a), (b) or (c) and I have not modified
-    it.
-
-(d) I understand and agree that this project and the contribution
-    are public and that a record of the contribution (including all
-    personal information I submit with it, including my sign-off) is
-    maintained indefinitely and may be redistributed consistent with
-    this project or the open source license(s) involved.

vendor/github.com/klauspost/cpuid/v2/LICENSE

@@ -1,22 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2015 Klaus Post
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-

vendor/github.com/klauspost/cpuid/v2/README.md

@@ -1,512 +0,0 @@
-# cpuid
-Package cpuid provides information about the CPU running the current program.
-
-CPU features are detected on startup, and kept for fast access through the life of the application.
-Currently x86 / x64 (AMD64/i386) and ARM (ARM64) is supported, and no external C (cgo) code is used, which should make the library very easy to use.
-
-You can access the CPU information by accessing the shared CPU variable of the cpuid library.
-
-Package home: https://github.com/klauspost/cpuid
-
-[![PkgGoDev](https://pkg.go.dev/badge/github.com/klauspost/cpuid)](https://pkg.go.dev/github.com/klauspost/cpuid/v2)
-[![Go](https://github.com/klauspost/cpuid/actions/workflows/go.yml/badge.svg)](https://github.com/klauspost/cpuid/actions/workflows/go.yml)
-
-## installing
-
-`go get -u github.com/klauspost/cpuid/v2` using modules.
-Drop `v2` for others.
-
-Installing binary:
-
-`go install github.com/klauspost/cpuid/v2/cmd/cpuid@latest`
-
-Or download binaries from release page: https://github.com/klauspost/cpuid/releases
-
-### Homebrew
-
-For macOS/Linux users, you can install via [brew](https://brew.sh/)
-
-```sh
-$ brew install cpuid
-```
-
-## example
-
-```Go
-package main
-
-import (
-	"fmt"
-	"strings"
-
-	. "github.com/klauspost/cpuid/v2"
-)
-
-func main() {
-	// Print basic CPU information:
-	fmt.Println("Name:", CPU.BrandName)
-	fmt.Println("PhysicalCores:", CPU.PhysicalCores)
-	fmt.Println("ThreadsPerCore:", CPU.ThreadsPerCore)
-	fmt.Println("LogicalCores:", CPU.LogicalCores)
-	fmt.Println("Family", CPU.Family, "Model:", CPU.Model, "Vendor ID:", CPU.VendorID)
-	fmt.Println("Features:", strings.Join(CPU.FeatureSet(), ","))
-	fmt.Println("Cacheline bytes:", CPU.CacheLine)
-	fmt.Println("L1 Data Cache:", CPU.Cache.L1D, "bytes")
-	fmt.Println("L1 Instruction Cache:", CPU.Cache.L1I, "bytes")
-	fmt.Println("L2 Cache:", CPU.Cache.L2, "bytes")
-	fmt.Println("L3 Cache:", CPU.Cache.L3, "bytes")
-	fmt.Println("Frequency", CPU.Hz, "hz")
-
-	// Test if we have these specific features:
-	if CPU.Supports(SSE, SSE2) {
-		fmt.Println("We have Streaming SIMD 2 Extensions")
-	}
-}
-```
-
-Sample output:
-```
->go run main.go
-Name: AMD Ryzen 9 3950X 16-Core Processor
-PhysicalCores: 16
-ThreadsPerCore: 2
-LogicalCores: 32
-Family 23 Model: 113 Vendor ID: AMD
-Features: ADX,AESNI,AVX,AVX2,BMI1,BMI2,CLMUL,CMOV,CX16,F16C,FMA3,HTT,HYPERVISOR,LZCNT,MMX,MMXEXT,NX,POPCNT,RDRAND,RDSEED,RDTSCP,SHA,SSE,SSE2,SSE3,SSE4,SSE42,SSE4A,SSSE3
-Cacheline bytes: 64
-L1 Data Cache: 32768 bytes
-L1 Instruction Cache: 32768 bytes
-L2 Cache: 524288 bytes
-L3 Cache: 16777216 bytes
-Frequency 0 hz
-We have Streaming SIMD 2 Extensions
-```
-
-# usage
-
-The `cpuid.CPU` provides access to CPU features. Use `cpuid.CPU.Supports()` to check for CPU features.
-A faster `cpuid.CPU.Has()` is provided which will usually be inlined by the gc compiler.  
-
-To test a larger number of features, they can be combined using `f := CombineFeatures(CMOV, CMPXCHG8, X87, FXSR, MMX, SYSCALL, SSE, SSE2)`, etc.
-This can be using with `cpuid.CPU.HasAll(f)` to quickly test if all features are supported.
-
-Note that for some cpu/os combinations some features will not be detected.
-`amd64` has rather good support and should work reliably on all platforms.
-
-Note that hypervisors may not pass through all CPU features through to the guest OS,
-so even if your host supports a feature it may not be visible on guests.
-
-## arm64 feature detection
-
-Not all operating systems provide ARM features directly 
-and there is no safe way to do so for the rest.
-
-Currently `arm64/linux` and `arm64/freebsd` should be quite reliable. 
-`arm64/darwin` adds features expected from the M1 processor, but a lot remains undetected.
-
-A `DetectARM()` can be used if you are able to control your deployment,
-it will detect CPU features, but may crash if the OS doesn't intercept the calls.
-A `-cpu.arm` flag for detecting unsafe ARM features can be added. See below.
- 
-Note that currently only features are detected on ARM, 
-no additional information is currently available. 
-
-## flags
-
-It is possible to add flags that affects cpu detection.
-
-For this the `Flags()` command is provided.
-
-This must be called *before* `flag.Parse()` AND after the flags have been parsed `Detect()` must be called.
-
-This means that any detection used in `init()` functions will not contain these flags.
-
-Example:
-
-```Go
-package main
-
-import (
-	"flag"
-	"fmt"
-	"strings"
-
-	"github.com/klauspost/cpuid/v2"
-)
-
-func main() {
-	cpuid.Flags()
-	flag.Parse()
-	cpuid.Detect()
-
-	// Test if we have these specific features:
-	if cpuid.CPU.Supports(cpuid.SSE, cpuid.SSE2) {
-		fmt.Println("We have Streaming SIMD 2 Extensions")
-	}
-}
-```
-
-## commandline
-
-Download as binary from: https://github.com/klauspost/cpuid/releases
-
-Install from source:
-
-`go install github.com/klauspost/cpuid/v2/cmd/cpuid@latest`
-
-### Example
-
-```
-λ cpuid
-Name: AMD Ryzen 9 3950X 16-Core Processor
-Vendor String: AuthenticAMD
-Vendor ID: AMD
-PhysicalCores: 16
-Threads Per Core: 2
-Logical Cores: 32
-CPU Family 23 Model: 113
-Features: ADX,AESNI,AVX,AVX2,BMI1,BMI2,CLMUL,CLZERO,CMOV,CMPXCHG8,CPBOOST,CX16,F16C,FMA3,FXSR,FXSROPT,HTT,HYPERVISOR,LAHF,LZCNT,MCAOVERFLOW,MMX,MMXEXT,MOVBE,NX,OSXSAVE,POPCNT,RDRAND,RDSEED,RDTSCP,SCE,SHA,SSE,SSE2,SSE3,SSE4,SSE42,SSE4A,SSSE3,SUCCOR,X87,XSAVE
-Microarchitecture level: 3
-Cacheline bytes: 64
-L1 Instruction Cache: 32768 bytes
-L1 Data Cache: 32768 bytes
-L2 Cache: 524288 bytes
-L3 Cache: 16777216 bytes
-
-```
-### JSON Output:
-
-```
-λ cpuid --json
-{
-  "BrandName": "AMD Ryzen 9 3950X 16-Core Processor",
-  "VendorID": 2,
-  "VendorString": "AuthenticAMD",
-  "PhysicalCores": 16,
-  "ThreadsPerCore": 2,
-  "LogicalCores": 32,
-  "Family": 23,
-  "Model": 113,
-  "CacheLine": 64,
-  "Hz": 0,
-  "BoostFreq": 0,
-  "Cache": {
-    "L1I": 32768,
-    "L1D": 32768,
-    "L2": 524288,
-    "L3": 16777216
-  },
-  "SGX": {
-    "Available": false,
-    "LaunchControl": false,
-    "SGX1Supported": false,
-    "SGX2Supported": false,
-    "MaxEnclaveSizeNot64": 0,
-    "MaxEnclaveSize64": 0,
-    "EPCSections": null
-  },
-  "Features": [
-    "ADX",
-    "AESNI",
-    "AVX",
-    "AVX2",
-    "BMI1",
-    "BMI2",
-    "CLMUL",
-    "CLZERO",
-    "CMOV",
-    "CMPXCHG8",
-    "CPBOOST",
-    "CX16",
-    "F16C",
-    "FMA3",
-    "FXSR",
-    "FXSROPT",
-    "HTT",
-    "HYPERVISOR",
-    "LAHF",
-    "LZCNT",
-    "MCAOVERFLOW",
-    "MMX",
-    "MMXEXT",
-    "MOVBE",
-    "NX",
-    "OSXSAVE",
-    "POPCNT",
-    "RDRAND",
-    "RDSEED",
-    "RDTSCP",
-    "SCE",
-    "SHA",
-    "SSE",
-    "SSE2",
-    "SSE3",
-    "SSE4",
-    "SSE42",
-    "SSE4A",
-    "SSSE3",
-    "SUCCOR",
-    "X87",
-    "XSAVE"
-  ],
-  "X64Level": 3
-}
-```
-
-### Check CPU microarch level
-
-```
-λ cpuid --check-level=3
-2022/03/18 17:04:40 AMD Ryzen 9 3950X 16-Core Processor
-2022/03/18 17:04:40 Microarchitecture level 3 is supported. Max level is 3.
-Exit Code 0
-
-λ cpuid --check-level=4
-2022/03/18 17:06:18 AMD Ryzen 9 3950X 16-Core Processor
-2022/03/18 17:06:18 Microarchitecture level 4 not supported. Max level is 3.
-Exit Code 1
-```
-
-
-## Available flags
-
-### x86 & amd64 
-
-| Feature Flag       | Description                                                                                                                                                                        |
-|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| ADX                | Intel ADX (Multi-Precision Add-Carry Instruction Extensions)                                                                                                                       |
-| AESNI              | Advanced Encryption Standard New Instructions                                                                                                                                      |
-| AMD3DNOW           | AMD 3DNOW                                                                                                                                                                          |
-| AMD3DNOWEXT        | AMD 3DNowExt                                                                                                                                                                       |
-| AMXBF16            | Tile computational operations on BFLOAT16 numbers                                                                                                                                  |
-| AMXINT8            | Tile computational operations on 8-bit integers                                                                                                                                    |
-| AMXFP16            | Tile computational operations on FP16 numbers                                                                                                                                      |
-| AMXFP8             | Tile computational operations on FP8 numbers                                                                                                                                       |
-| AMXCOMPLEX         | Tile computational operations on complex numbers                                                                                                                                   |
-| AMXTILE            | Tile architecture                                                                                                                                                                  |
-| AMXTF32            | Matrix Multiplication of TF32 Tiles into Packed Single Precision Tile                                                                                                              |
-| AMXTRANSPOSE       | Tile multiply where the first operand is transposed                                                                                                                                |
-| APX_F              | Intel APX                                                                                                                                                                          |
-| AVX                | AVX functions                                                                                                                                                                      |
-| AVX10              | If set the Intel AVX10 Converged Vector ISA is supported                                                                                                                           |
-| AVX10_128          | If set indicates that AVX10 128-bit vector support is present                                                                                                                      |
-| AVX10_256          | If set indicates that AVX10 256-bit vector support is present                                                                                                                      |
-| AVX10_512          | If set indicates that AVX10 512-bit vector support is present                                                                                                                      |
-| AVX2               | AVX2 functions                                                                                                                                                                     |
-| AVX512BF16         | AVX-512 BFLOAT16 Instructions                                                                                                                                                      |
-| AVX512BITALG       | AVX-512 Bit Algorithms                                                                                                                                                             |
-| AVX512BW           | AVX-512 Byte and Word Instructions                                                                                                                                                 |
-| AVX512CD           | AVX-512 Conflict Detection Instructions                                                                                                                                            |
-| AVX512DQ           | AVX-512 Doubleword and Quadword Instructions                                                                                                                                       |
-| AVX512ER           | AVX-512 Exponential and Reciprocal Instructions                                                                                                                                    |
-| AVX512F            | AVX-512 Foundation                                                                                                                                                                 |
-| AVX512FP16         | AVX-512 FP16 Instructions                                                                                                                                                          |
-| AVX512IFMA         | AVX-512 Integer Fused Multiply-Add Instructions                                                                                                                                    |
-| AVX512PF           | AVX-512 Prefetch Instructions                                                                                                                                                      |
-| AVX512VBMI         | AVX-512 Vector Bit Manipulation Instructions                                                                                                                                       |
-| AVX512VBMI2        | AVX-512 Vector Bit Manipulation Instructions, Version 2                                                                                                                            |
-| AVX512VL           | AVX-512 Vector Length Extensions                                                                                                                                                   |
-| AVX512VNNI         | AVX-512 Vector Neural Network Instructions                                                                                                                                         |
-| AVX512VP2INTERSECT | AVX-512 Intersect for D/Q                                                                                                                                                          |
-| AVX512VPOPCNTDQ    | AVX-512 Vector Population Count Doubleword and Quadword                                                                                                                            |
-| AVXIFMA            | AVX-IFMA instructions                                                                                                                                                              |
-| AVXNECONVERT       | AVX-NE-CONVERT instructions                                                                                                                                                        |
-| AVXSLOW            | Indicates the CPU performs 2 128 bit operations instead of one                                                                                                                     |
-| AVXVNNI            | AVX (VEX encoded) VNNI neural network instructions                                                                                                                                 |
-| AVXVNNIINT8        | AVX-VNNI-INT8 instructions                                                                                                                                                         |
-| AVXVNNIINT16       | AVX-VNNI-INT16 instructions                                                                                                                                                        |
-| BHI_CTRL           | Branch History Injection and Intra-mode Branch Target Injection / CVE-2022-0001, CVE-2022-0002 / INTEL-SA-00598                                                                    |
-| BMI1               | Bit Manipulation Instruction Set 1                                                                                                                                                 |
-| BMI2               | Bit Manipulation Instruction Set 2                                                                                                                                                 |
-| CETIBT             | Intel CET Indirect Branch Tracking                                                                                                                                                 |
-| CETSS              | Intel CET Shadow Stack                                                                                                                                                             |
-| CLDEMOTE           | Cache Line Demote                                                                                                                                                                  |
-| CLMUL              | Carry-less Multiplication                                                                                                                                                          |
-| CLZERO             | CLZERO instruction supported                                                                                                                                                       |
-| CMOV               | i686 CMOV                                                                                                                                                                          |
-| CMPCCXADD          | CMPCCXADD instructions                                                                                                                                                             |
-| CMPSB_SCADBS_SHORT | Fast short CMPSB and SCASB                                                                                                                                                         |
-| CMPXCHG8           | CMPXCHG8 instruction                                                                                                                                                               |
-| CPBOOST            | Core Performance Boost                                                                                                                                                             |
-| CPPC               | AMD: Collaborative Processor Performance Control                                                                                                                                   |
-| CX16               | CMPXCHG16B Instruction                                                                                                                                                             |
-| EFER_LMSLE_UNS     | AMD: =Core::X86::Msr::EFER[LMSLE] is not supported, and MBZ                                                                                                                        |
-| ENQCMD             | Enqueue Command                                                                                                                                                                    |
-| ERMS               | Enhanced REP MOVSB/STOSB                                                                                                                                                           |
-| F16C               | Half-precision floating-point conversion                                                                                                                                           |
-| FLUSH_L1D          | Flush L1D cache                                                                                                                                                                    |
-| FMA3               | Intel FMA 3. Does not imply AVX.                                                                                                                                                   |
-| FMA4               | Bulldozer FMA4 functions                                                                                                                                                           |
-| FP128              | AMD: When set, the internal FP/SIMD execution datapath is 128-bits wide                                                                                                            |
-| FP256              | AMD: When set, the internal FP/SIMD execution datapath is 256-bits wide                                                                                                            |
-| FSRM               | Fast Short Rep Mov                                                                                                                                                                 |
-| FXSR               | FXSAVE, FXRESTOR instructions, CR4 bit 9                                                                                                                                           |
-| FXSROPT            | FXSAVE/FXRSTOR optimizations                                                                                                                                                       |
-| GFNI               | Galois Field New Instructions. May require other features (AVX, AVX512VL,AVX512F) based on usage.                                                                                  |
-| HLE                | Hardware Lock Elision                                                                                                                                                              |
-| HRESET             | If set CPU supports history reset and the IA32_HRESET_ENABLE MSR                                                                                                                   |
-| HTT                | Hyperthreading (enabled)                                                                                                                                                           |
-| HWA                | Hardware assert supported. Indicates support for MSRC001_10                                                                                                                        |
-| HYBRID_CPU         | This part has CPUs of more than one type.                                                                                                                                          |
-| HYPERVISOR         | This bit has been reserved by Intel & AMD for use by hypervisors                                                                                                                   |
-| IA32_ARCH_CAP      | IA32_ARCH_CAPABILITIES MSR (Intel)                                                                                                                                                 |
-| IA32_CORE_CAP      | IA32_CORE_CAPABILITIES MSR                                                                                                                                                         |
-| IBPB               | Indirect Branch Restricted Speculation (IBRS) and Indirect Branch Predictor Barrier (IBPB)                                                                                         |
-| IBRS               | AMD: Indirect Branch Restricted Speculation                                                                                                                                        |
-| IBRS_PREFERRED     | AMD: IBRS is preferred over software solution                                                                                                                                      |
-| IBRS_PROVIDES_SMP  | AMD: IBRS provides Same Mode Protection                                                                                                                                            |
-| IBS                | Instruction Based Sampling (AMD)                                                                                                                                                   |
-| IBSBRNTRGT         | Instruction Based Sampling Feature (AMD)                                                                                                                                           |
-| IBSFETCHSAM        | Instruction Based Sampling Feature (AMD)                                                                                                                                           |
-| IBSFFV             | Instruction Based Sampling Feature (AMD)                                                                                                                                           |
-| IBSOPCNT           | Instruction Based Sampling Feature (AMD)                                                                                                                                           |
-| IBSOPCNTEXT        | Instruction Based Sampling Feature (AMD)                                                                                                                                           |
-| IBSOPSAM           | Instruction Based Sampling Feature (AMD)                                                                                                                                           |
-| IBSRDWROPCNT       | Instruction Based Sampling Feature (AMD)                                                                                                                                           |
-| IBSRIPINVALIDCHK   | Instruction Based Sampling Feature (AMD)                                                                                                                                           |
-| IBS_FETCH_CTLX     | AMD: IBS fetch control extended MSR supported                                                                                                                                      |
-| IBS_OPDATA4        | AMD: IBS op data 4 MSR supported                                                                                                                                                   |
-| IBS_OPFUSE         | AMD: Indicates support for IbsOpFuse                                                                                                                                               |
-| IBS_PREVENTHOST    | Disallowing IBS use by the host supported                                                                                                                                          |
-| IBS_ZEN4           | Fetch and Op IBS support IBS extensions added with Zen4                                                                                                                            |
-| IDPRED_CTRL        | IPRED_DIS                                                                                                                                                                          |
-| INT_WBINVD         | WBINVD/WBNOINVD are interruptible.                                                                                                                                                 |
-| INVLPGB            | NVLPGB and TLBSYNC instruction supported                                                                                                                                           |
-| KEYLOCKER          | Key locker                                                                                                                                                                         |
-| KEYLOCKERW         | Key locker wide                                                                                                                                                                    |
-| LAHF               | LAHF/SAHF in long mode                                                                                                                                                             |
-| LAM                | If set, CPU supports Linear Address Masking                                                                                                                                        |
-| LBRVIRT            | LBR virtualization                                                                                                                                                                 |
-| LZCNT              | LZCNT instruction                                                                                                                                                                  |
-| MCAOVERFLOW        | MCA overflow recovery support.                                                                                                                                                     |
-| MCDT_NO            | Processor do not exhibit MXCSR Configuration Dependent Timing behavior and do not need to mitigate it.                                                                             |
-| MCOMMIT            | MCOMMIT instruction supported                                                                                                                                                      |
-| MD_CLEAR           | VERW clears CPU buffers                                                                                                                                                            |
-| MMX                | standard MMX                                                                                                                                                                       |
-| MMXEXT             | SSE integer functions or AMD MMX ext                                                                                                                                               |
-| MOVBE              | MOVBE instruction (big-endian)                                                                                                                                                     |
-| MOVDIR64B          | Move 64 Bytes as Direct Store                                                                                                                                                      |
-| MOVDIRI            | Move Doubleword as Direct Store                                                                                                                                                    |
-| MOVSB_ZL           | Fast Zero-Length MOVSB                                                                                                                                                             |
-| MPX                | Intel MPX (Memory Protection Extensions)                                                                                                                                           |
-| MOVU               | MOVU SSE instructions are more efficient and should be preferred to SSE	MOVL/MOVH. MOVUPS is more efficient than MOVLPS/MOVHPS. MOVUPD is more efficient than MOVLPD/MOVHPD        |
-| MSRIRC             | Instruction Retired Counter MSR available                                                                                                                                          |
-| MSRLIST            | Read/Write List of Model Specific Registers                                                                                                                                        |
-| MSR_PAGEFLUSH      | Page Flush MSR available                                                                                                                                                           |
-| NRIPS              | Indicates support for NRIP save on VMEXIT                                                                                                                                          |
-| NX                 | NX (No-Execute) bit                                                                                                                                                                |
-| OSXSAVE            | XSAVE enabled by OS                                                                                                                                                                |
-| PCONFIG            | PCONFIG for Intel Multi-Key Total Memory Encryption                                                                                                                                |
-| POPCNT             | POPCNT instruction                                                                                                                                                                 |
-| PPIN               | AMD: Protected Processor Inventory Number support. Indicates that Protected Processor Inventory Number (PPIN) capability can be enabled                                            |
-| PREFETCHI          | PREFETCHIT0/1 instructions                                                                                                                                                         |
-| PSFD               | Predictive Store Forward Disable                                                                                                                                                   |
-| RDPRU              | RDPRU instruction supported                                                                                                                                                        |
-| RDRAND             | RDRAND instruction is available                                                                                                                                                    |
-| RDSEED             | RDSEED instruction is available                                                                                                                                                    |
-| RDTSCP             | RDTSCP Instruction                                                                                                                                                                 |
-| RRSBA_CTRL         | Restricted RSB Alternate                                                                                                                                                           |
-| RTM                | Restricted Transactional Memory                                                                                                                                                    |
-| RTM_ALWAYS_ABORT   | Indicates that the loaded microcode is forcing RTM abort.                                                                                                                          |
-| SERIALIZE          | Serialize Instruction Execution                                                                                                                                                    |
-| SEV                | AMD Secure Encrypted Virtualization supported                                                                                                                                      |
-| SEV_64BIT          | AMD SEV guest execution only allowed from a 64-bit host                                                                                                                            |
-| SEV_ALTERNATIVE    | AMD SEV Alternate Injection supported                                                                                                                                              |
-| SEV_DEBUGSWAP      | Full debug state swap supported for SEV-ES guests                                                                                                                                  |
-| SEV_ES             | AMD SEV Encrypted State supported                                                                                                                                                  |
-| SEV_RESTRICTED     | AMD SEV Restricted Injection supported                                                                                                                                             |
-| SEV_SNP            | AMD SEV Secure Nested Paging supported                                                                                                                                             |
-| SGX                | Software Guard Extensions                                                                                                                                                          |
-| SGXLC              | Software Guard Extensions Launch Control                                                                                                                                           |
-| SGXPQC             | Software Guard Extensions 256-bit Encryption                                                                                                                                       |
-| SHA                | Intel SHA Extensions                                                                                                                                                               |
-| SME                | AMD Secure Memory Encryption supported                                                                                                                                             |
-| SME_COHERENT       | AMD Hardware cache coherency across encryption domains enforced                                                                                                                    |
-| SM3_X86            | SM3 instructions                                                                                                                                                                   |
-| SM4_X86            | SM4 instructions                                                                                                                                                                   |
-| SPEC_CTRL_SSBD     | Speculative Store Bypass Disable                                                                                                                                                   |
-| SRBDS_CTRL         | SRBDS mitigation MSR available                                                                                                                                                     |
-| SSE                | SSE functions                                                                                                                                                                      |
-| SSE2               | P4 SSE functions                                                                                                                                                                   |
-| SSE3               | Prescott SSE3 functions                                                                                                                                                            |
-| SSE4               | Penryn SSE4.1 functions                                                                                                                                                            |
-| SSE42              | Nehalem SSE4.2 functions                                                                                                                                                           |
-| SSE4A              | AMD Barcelona microarchitecture SSE4a instructions                                                                                                                                 |
-| SSSE3              | Conroe SSSE3 functions                                                                                                                                                             |
-| STIBP              | Single Thread Indirect Branch Predictors                                                                                                                                           |
-| STIBP_ALWAYSON     | AMD: Single Thread Indirect Branch Prediction Mode has Enhanced Performance and may be left Always On                                                                              |
-| STOSB_SHORT        | Fast short STOSB                                                                                                                                                                   |
-| SUCCOR             | Software uncorrectable error containment and recovery capability.                                                                                                                  |
-| SVM                | AMD Secure Virtual Machine                                                                                                                                                         |
-| SVMDA              | Indicates support for the SVM decode assists.                                                                                                                                      |
-| SVMFBASID          | SVM, Indicates that TLB flush events, including CR3 writes and CR4.PGE toggles, flush only the current ASID's TLB entries. Also indicates support for the extended VMCBTLB_Control |
-| SVML               | AMD SVM lock. Indicates support for SVM-Lock.                                                                                                                                      |
-| SVMNP              | AMD SVM nested paging                                                                                                                                                              |
-| SVMPF              | SVM pause intercept filter. Indicates support for the pause intercept filter                                                                                                       |
-| SVMPFT             | SVM PAUSE filter threshold. Indicates support for the PAUSE filter cycle count threshold                                                                                           |
-| SYSCALL            | System-Call Extension (SCE): SYSCALL and SYSRET instructions.                                                                                                                      |
-| SYSEE              | SYSENTER and SYSEXIT instructions                                                                                                                                                  |
-| TBM                | AMD Trailing Bit Manipulation                                                                                                                                                      |
-| TDX_GUEST          | Intel Trust Domain Extensions Guest                                                                                                                                                |
-| TLB_FLUSH_NESTED   | AMD: Flushing includes all the nested translations for guest translations                                                                                                          |
-| TME                | Intel Total Memory Encryption. The following MSRs are supported: IA32_TME_CAPABILITY, IA32_TME_ACTIVATE, IA32_TME_EXCLUDE_MASK, and IA32_TME_EXCLUDE_BASE.                         |
-| TOPEXT             | TopologyExtensions: topology extensions support. Indicates support for CPUID Fn8000_001D_EAX_x[N:0]-CPUID Fn8000_001E_EDX.                                                         |
-| TSA_L1_NO          | AMD only: Not vulnerable to TSA-L1                                                                                                                                                 |
-| TSA_SQ_NO          | AMD only: Not vulnerable to TSA-SQ                                                                                                                                                 |
-| TSA_VERW_CLEAR     | AMD: If set, the memory form of the VERW instruction may be used to help mitigate TSA                                                                                              |
-| TSCRATEMSR         | MSR based TSC rate control. Indicates support for MSR TSC ratio MSRC000_0104                                                                                                       |
-| TSXLDTRK           | Intel TSX Suspend Load Address Tracking                                                                                                                                            |
-| VAES               | Vector AES. AVX(512) versions requires additional checks.                                                                                                                          |
-| VMCBCLEAN          | VMCB clean bits. Indicates support for VMCB clean bits.                                                                                                                            |
-| VMPL               | AMD VM Permission Levels supported                                                                                                                                                 |
-| VMSA_REGPROT       | AMD VMSA Register Protection supported                                                                                                                                             |
-| VMX                | Virtual Machine Extensions                                                                                                                                                         |
-| VPCLMULQDQ         | Carry-Less Multiplication Quadword. Requires AVX for 3 register versions.                                                                                                          |
-| VTE                | AMD Virtual Transparent Encryption supported                                                                                                                                       |
-| WAITPKG            | TPAUSE, UMONITOR, UMWAIT                                                                                                                                                           |
-| WBNOINVD           | Write Back and Do Not Invalidate Cache                                                                                                                                             |
-| WRMSRNS            | Non-Serializing Write to Model Specific Register                                                                                                                                   |
-| X87                | FPU                                                                                                                                                                                |
-| XGETBV1            | Supports XGETBV with ECX = 1                                                                                                                                                       |
-| XOP                | Bulldozer XOP functions                                                                                                                                                            |
-| XSAVE              | XSAVE, XRESTOR, XSETBV, XGETBV                                                                                                                                                     |
-| XSAVEC             | Supports XSAVEC and the compacted form of XRSTOR.                                                                                                                                  |
-| XSAVEOPT           | XSAVEOPT available                                                                                                                                                                 |
-| XSAVES             | Supports XSAVES/XRSTORS and IA32_XSS                                                                                                                                               |
-
-# ARM features:
-
-| Feature Flag | Description                                                      |
-|--------------|------------------------------------------------------------------|
-| AESARM       | AES instructions                                                 |
-| ARMCPUID     | Some CPU ID registers readable at user-level                     |
-| ASIMD        | Advanced SIMD                                                    |
-| ASIMDDP      | SIMD Dot Product                                                 |
-| ASIMDHP      | Advanced SIMD half-precision floating point                      |
-| ASIMDRDM     | Rounding Double Multiply Accumulate/Subtract (SQRDMLAH/SQRDMLSH) |
-| ATOMICS      | Large System Extensions (LSE)                                    |
-| CRC32        | CRC32/CRC32C instructions                                        |
-| DCPOP        | Data cache clean to Point of Persistence (DC CVAP)               |
-| EVTSTRM      | Generic timer                                                    |
-| FCMA         | Floatin point complex number addition and multiplication         |
-| FHM          | FMLAL and FMLSL instructions                                     |
-| FP           | Single-precision and double-precision floating point             |
-| FPHP         | Half-precision floating point                                    |
-| GPA          | Generic Pointer Authentication                                   |
-| JSCVT        | Javascript-style double->int convert (FJCVTZS)                   |
-| LRCPC        | Weaker release consistency (LDAPR, etc)                          |
-| PMULL        | Polynomial Multiply instructions (PMULL/PMULL2)                  |
-| RNDR         | Random Number instructions                                       |
-| TLB          | Outer Shareable and TLB range maintenance instructions           |
-| TS           | Flag manipulation instructions                                   |
-| SHA1         | SHA-1 instructions (SHA1C, etc)                                  |
-| SHA2         | SHA-2 instructions (SHA256H, etc)                                |
-| SHA3         | SHA-3 instructions (EOR3, RAXI, XAR, BCAX)                       |
-| SHA512       | SHA512 instructions                                              |
-| SM3          | SM3 instructions                                                 |
-| SM4          | SM4 instructions                                                 |
-| SVE          | Scalable Vector Extension                                        |
-
-# license
-
-This code is published under an MIT license. See LICENSE file for more information.

vendor/github.com/klauspost/cpuid/v2/cpuid_386.s

@@ -1,47 +0,0 @@
-// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
-
-//+build 386,!gccgo,!noasm,!appengine
-
-// func asmCpuid(op uint32) (eax, ebx, ecx, edx uint32)
-TEXT ·asmCpuid(SB), 7, $0
-	XORL CX, CX
-	MOVL op+0(FP), AX
-	CPUID
-	MOVL AX, eax+4(FP)
-	MOVL BX, ebx+8(FP)
-	MOVL CX, ecx+12(FP)
-	MOVL DX, edx+16(FP)
-	RET
-
-// func asmCpuidex(op, op2 uint32) (eax, ebx, ecx, edx uint32)
-TEXT ·asmCpuidex(SB), 7, $0
-	MOVL op+0(FP), AX
-	MOVL op2+4(FP), CX
-	CPUID
-	MOVL AX, eax+8(FP)
-	MOVL BX, ebx+12(FP)
-	MOVL CX, ecx+16(FP)
-	MOVL DX, edx+20(FP)
-	RET
-
-// func xgetbv(index uint32) (eax, edx uint32)
-TEXT ·asmXgetbv(SB), 7, $0
-	MOVL index+0(FP), CX
-	BYTE $0x0f; BYTE $0x01; BYTE $0xd0 // XGETBV
-	MOVL AX, eax+4(FP)
-	MOVL DX, edx+8(FP)
-	RET
-
-// func asmRdtscpAsm() (eax, ebx, ecx, edx uint32)
-TEXT ·asmRdtscpAsm(SB), 7, $0
-	BYTE $0x0F; BYTE $0x01; BYTE $0xF9 // RDTSCP
-	MOVL AX, eax+0(FP)
-	MOVL BX, ebx+4(FP)
-	MOVL CX, ecx+8(FP)
-	MOVL DX, edx+12(FP)
-	RET
-
-// func asmDarwinHasAVX512() bool
-TEXT ·asmDarwinHasAVX512(SB), 7, $0
-	MOVL $0, eax+0(FP)
-	RET

vendor/github.com/klauspost/cpuid/v2/cpuid_amd64.s

@@ -1,72 +0,0 @@
-// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
-
-//+build amd64,!gccgo,!noasm,!appengine
-
-// func asmCpuid(op uint32) (eax, ebx, ecx, edx uint32)
-TEXT ·asmCpuid(SB), 7, $0
-	XORQ CX, CX
-	MOVL op+0(FP), AX
-	CPUID
-	MOVL AX, eax+8(FP)
-	MOVL BX, ebx+12(FP)
-	MOVL CX, ecx+16(FP)
-	MOVL DX, edx+20(FP)
-	RET
-
-// func asmCpuidex(op, op2 uint32) (eax, ebx, ecx, edx uint32)
-TEXT ·asmCpuidex(SB), 7, $0
-	MOVL op+0(FP), AX
-	MOVL op2+4(FP), CX
-	CPUID
-	MOVL AX, eax+8(FP)
-	MOVL BX, ebx+12(FP)
-	MOVL CX, ecx+16(FP)
-	MOVL DX, edx+20(FP)
-	RET
-
-// func asmXgetbv(index uint32) (eax, edx uint32)
-TEXT ·asmXgetbv(SB), 7, $0
-	MOVL index+0(FP), CX
-	BYTE $0x0f; BYTE $0x01; BYTE $0xd0 // XGETBV
-	MOVL AX, eax+8(FP)
-	MOVL DX, edx+12(FP)
-	RET
-
-// func asmRdtscpAsm() (eax, ebx, ecx, edx uint32)
-TEXT ·asmRdtscpAsm(SB), 7, $0
-	BYTE $0x0F; BYTE $0x01; BYTE $0xF9 // RDTSCP
-	MOVL AX, eax+0(FP)
-	MOVL BX, ebx+4(FP)
-	MOVL CX, ecx+8(FP)
-	MOVL DX, edx+12(FP)
-	RET
-
-// From https://go-review.googlesource.com/c/sys/+/285572/
-// func asmDarwinHasAVX512() bool
-TEXT ·asmDarwinHasAVX512(SB), 7, $0-1
-	MOVB $0, ret+0(FP) // default to false
-
-#ifdef GOOS_darwin // return if not darwin
-#ifdef GOARCH_amd64 // return if not amd64
-// These values from:
-// https://github.com/apple/darwin-xnu/blob/xnu-4570.1.46/osfmk/i386/cpu_capabilities.h
-#define commpage64_base_address         0x00007fffffe00000
-#define commpage64_cpu_capabilities64   (commpage64_base_address+0x010)
-#define commpage64_version              (commpage64_base_address+0x01E)
-#define hasAVX512F                      0x0000004000000000
-	MOVQ $commpage64_version, BX
-	MOVW (BX), AX
-	CMPW AX, $13                            // versions < 13 do not support AVX512
-	JL   no_avx512
-	MOVQ $commpage64_cpu_capabilities64, BX
-	MOVQ (BX), AX
-	MOVQ $hasAVX512F, CX
-	ANDQ CX, AX
-	JZ   no_avx512
-	MOVB $1, ret+0(FP)
-
-no_avx512:
-#endif
-#endif
-	RET
-

vendor/github.com/klauspost/cpuid/v2/cpuid_arm64.s

@@ -1,36 +0,0 @@
-// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
-
-//+build arm64,!gccgo,!noasm,!appengine
-
-// See https://www.kernel.org/doc/Documentation/arm64/cpu-feature-registers.txt
-
-// func getMidr
-TEXT ·getMidr(SB), 7, $0
-	WORD $0xd5380000    // mrs x0, midr_el1         /* Main ID Register */
-	MOVD R0, midr+0(FP)
-	RET
-
-// func getProcFeatures
-TEXT ·getProcFeatures(SB), 7, $0
-	WORD $0xd5380400            // mrs x0, id_aa64pfr0_el1  /* Processor Feature Register 0 */
-	MOVD R0, procFeatures+0(FP)
-	RET
-
-// func getInstAttributes
-TEXT ·getInstAttributes(SB), 7, $0
-	WORD $0xd5380600            // mrs x0, id_aa64isar0_el1 /* Instruction Set Attribute Register 0 */
-	WORD $0xd5380621            // mrs x1, id_aa64isar1_el1 /* Instruction Set Attribute Register 1 */
-	MOVD R0, instAttrReg0+0(FP)
-	MOVD R1, instAttrReg1+8(FP)
-	RET
-
-TEXT ·getVectorLength(SB), 7, $0
-	WORD $0xd2800002  // mov   x2, #0
-	WORD $0x04225022  // addvl x2, x2, #1
-	WORD $0xd37df042  // lsl   x2, x2, #3
-	WORD $0xd2800003  // mov   x3, #0
-	WORD $0x04635023  // addpl x3, x3, #1
-	WORD $0xd37df063  // lsl   x3, x3, #3
-	MOVD R2, vl+0(FP)
-	MOVD R3, pl+8(FP)
-	RET

vendor/github.com/klauspost/cpuid/v2/detect_arm64.go

@@ -1,250 +0,0 @@
-// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
-
-//go:build arm64 && !gccgo && !noasm && !appengine
-// +build arm64,!gccgo,!noasm,!appengine
-
-package cpuid
-
-import "runtime"
-
-func getMidr() (midr uint64)
-func getProcFeatures() (procFeatures uint64)
-func getInstAttributes() (instAttrReg0, instAttrReg1 uint64)
-func getVectorLength() (vl, pl uint64)
-
-func initCPU() {
-	cpuid = func(uint32) (a, b, c, d uint32) { return 0, 0, 0, 0 }
-	cpuidex = func(x, y uint32) (a, b, c, d uint32) { return 0, 0, 0, 0 }
-	xgetbv = func(uint32) (a, b uint32) { return 0, 0 }
-	rdtscpAsm = func() (a, b, c, d uint32) { return 0, 0, 0, 0 }
-}
-
-func addInfo(c *CPUInfo, safe bool) {
-	// Seems to be safe to assume on ARM64
-	c.CacheLine = 64
-	detectOS(c)
-
-	// ARM64 disabled since it may crash if interrupt is not intercepted by OS.
-	if safe && !c.Has(ARMCPUID) && runtime.GOOS != "freebsd" {
-		return
-	}
-	midr := getMidr()
-
-	// MIDR_EL1 - Main ID Register
-	// https://developer.arm.com/docs/ddi0595/h/aarch64-system-registers/midr_el1
-	//  x--------------------------------------------------x
-	//  | Name                         |  bits   | visible |
-	//  |--------------------------------------------------|
-	//  | Implementer                  | [31-24] |    y    |
-	//  |--------------------------------------------------|
-	//  | Variant                      | [23-20] |    y    |
-	//  |--------------------------------------------------|
-	//  | Architecture                 | [19-16] |    y    |
-	//  |--------------------------------------------------|
-	//  | PartNum                      | [15-4]  |    y    |
-	//  |--------------------------------------------------|
-	//  | Revision                     | [3-0]   |    y    |
-	//  x--------------------------------------------------x
-
-	switch (midr >> 24) & 0xff {
-	case 0xC0:
-		c.VendorString = "Ampere Computing"
-		c.VendorID = Ampere
-	case 0x41:
-		c.VendorString = "Arm Limited"
-		c.VendorID = ARM
-	case 0x42:
-		c.VendorString = "Broadcom Corporation"
-		c.VendorID = Broadcom
-	case 0x43:
-		c.VendorString = "Cavium Inc"
-		c.VendorID = Cavium
-	case 0x44:
-		c.VendorString = "Digital Equipment Corporation"
-		c.VendorID = DEC
-	case 0x46:
-		c.VendorString = "Fujitsu Ltd"
-		c.VendorID = Fujitsu
-	case 0x49:
-		c.VendorString = "Infineon Technologies AG"
-		c.VendorID = Infineon
-	case 0x4D:
-		c.VendorString = "Motorola or Freescale Semiconductor Inc"
-		c.VendorID = Motorola
-	case 0x4E:
-		c.VendorString = "NVIDIA Corporation"
-		c.VendorID = NVIDIA
-	case 0x50:
-		c.VendorString = "Applied Micro Circuits Corporation"
-		c.VendorID = AMCC
-	case 0x51:
-		c.VendorString = "Qualcomm Inc"
-		c.VendorID = Qualcomm
-	case 0x56:
-		c.VendorString = "Marvell International Ltd"
-		c.VendorID = Marvell
-	case 0x69:
-		c.VendorString = "Intel Corporation"
-		c.VendorID = Intel
-	}
-
-	// Lower 4 bits: Architecture
-	// Architecture	Meaning
-	// 0b0001		Armv4.
-	// 0b0010		Armv4T.
-	// 0b0011		Armv5 (obsolete).
-	// 0b0100		Armv5T.
-	// 0b0101		Armv5TE.
-	// 0b0110		Armv5TEJ.
-	// 0b0111		Armv6.
-	// 0b1111		Architectural features are individually identified in the ID_* registers, see 'ID registers'.
-	// Upper 4 bit: Variant
-	// An IMPLEMENTATION DEFINED variant number.
-	// Typically, this field is used to distinguish between different product variants, or major revisions of a product.
-	c.Family = int(midr>>16) & 0xff
-
-	// PartNum, bits [15:4]
-	// An IMPLEMENTATION DEFINED primary part number for the device.
-	// On processors implemented by Arm, if the top four bits of the primary
-	// part number are 0x0 or 0x7, the variant and architecture are encoded differently.
-	// Revision, bits [3:0]
-	// An IMPLEMENTATION DEFINED revision number for the device.
-	c.Model = int(midr) & 0xffff
-
-	procFeatures := getProcFeatures()
-
-	// ID_AA64PFR0_EL1 - Processor Feature Register 0
-	// x--------------------------------------------------x
-	// | Name                         |  bits   | visible |
-	// |--------------------------------------------------|
-	// | DIT                          | [51-48] |    y    |
-	// |--------------------------------------------------|
-	// | SVE                          | [35-32] |    y    |
-	// |--------------------------------------------------|
-	// | GIC                          | [27-24] |    n    |
-	// |--------------------------------------------------|
-	// | AdvSIMD                      | [23-20] |    y    |
-	// |--------------------------------------------------|
-	// | FP                           | [19-16] |    y    |
-	// |--------------------------------------------------|
-	// | EL3                          | [15-12] |    n    |
-	// |--------------------------------------------------|
-	// | EL2                          | [11-8]  |    n    |
-	// |--------------------------------------------------|
-	// | EL1                          | [7-4]   |    n    |
-	// |--------------------------------------------------|
-	// | EL0                          | [3-0]   |    n    |
-	// x--------------------------------------------------x
-
-	var f flagSet
-	// if procFeatures&(0xf<<48) != 0 {
-	// 	fmt.Println("DIT")
-	// }
-	f.setIf(procFeatures&(0xf<<32) != 0, SVE)
-	if procFeatures&(0xf<<20) != 15<<20 {
-		f.set(ASIMD)
-		// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64pfr0_el1
-		// 0b0001 --> As for 0b0000, and also includes support for half-precision floating-point arithmetic.
-		f.setIf(procFeatures&(0xf<<20) == 1<<20, FPHP, ASIMDHP)
-	}
-	f.setIf(procFeatures&(0xf<<16) != 0, FP)
-
-	instAttrReg0, instAttrReg1 := getInstAttributes()
-
-	// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64isar0_el1
-	//
-	// ID_AA64ISAR0_EL1 - Instruction Set Attribute Register 0
-	// x--------------------------------------------------x
-	// | Name                         |  bits   | visible |
-	// |--------------------------------------------------|
-	// | RNDR                         | [63-60] |    y    |
-	// |--------------------------------------------------|
-	// | TLB                          | [59-56] |    y    |
-	// |--------------------------------------------------|
-	// | TS                           | [55-52] |    y    |
-	// |--------------------------------------------------|
-	// | FHM                          | [51-48] |    y    |
-	// |--------------------------------------------------|
-	// | DP                           | [47-44] |    y    |
-	// |--------------------------------------------------|
-	// | SM4                          | [43-40] |    y    |
-	// |--------------------------------------------------|
-	// | SM3                          | [39-36] |    y    |
-	// |--------------------------------------------------|
-	// | SHA3                         | [35-32] |    y    |
-	// |--------------------------------------------------|
-	// | RDM                          | [31-28] |    y    |
-	// |--------------------------------------------------|
-	// | ATOMICS                      | [23-20] |    y    |
-	// |--------------------------------------------------|
-	// | CRC32                        | [19-16] |    y    |
-	// |--------------------------------------------------|
-	// | SHA2                         | [15-12] |    y    |
-	// |--------------------------------------------------|
-	// | SHA1                         | [11-8]  |    y    |
-	// |--------------------------------------------------|
-	// | AES                          | [7-4]   |    y    |
-	// x--------------------------------------------------x
-
-	f.setIf(instAttrReg0&(0xf<<60) != 0, RNDR)
-	f.setIf(instAttrReg0&(0xf<<56) != 0, TLB)
-	f.setIf(instAttrReg0&(0xf<<52) != 0, TS)
-	f.setIf(instAttrReg0&(0xf<<48) != 0, FHM)
-	f.setIf(instAttrReg0&(0xf<<44) != 0, ASIMDDP)
-	f.setIf(instAttrReg0&(0xf<<40) != 0, SM4)
-	f.setIf(instAttrReg0&(0xf<<36) != 0, SM3)
-	f.setIf(instAttrReg0&(0xf<<32) != 0, SHA3)
-	f.setIf(instAttrReg0&(0xf<<28) != 0, ASIMDRDM)
-	f.setIf(instAttrReg0&(0xf<<20) != 0, ATOMICS)
-	f.setIf(instAttrReg0&(0xf<<16) != 0, CRC32)
-	f.setIf(instAttrReg0&(0xf<<12) != 0, SHA2)
-	// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64isar0_el1
-	// 0b0010 --> As 0b0001, plus SHA512H, SHA512H2, SHA512SU0, and SHA512SU1 instructions implemented.
-	f.setIf(instAttrReg0&(0xf<<12) == 2<<12, SHA512)
-	f.setIf(instAttrReg0&(0xf<<8) != 0, SHA1)
-	f.setIf(instAttrReg0&(0xf<<4) != 0, AESARM)
-	// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64isar0_el1
-	// 0b0010 --> As for 0b0001, plus PMULL/PMULL2 instructions operating on 64-bit data quantities.
-	f.setIf(instAttrReg0&(0xf<<4) == 2<<4, PMULL)
-
-	// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64isar1_el1
-	//
-	// ID_AA64ISAR1_EL1 - Instruction set attribute register 1
-	// x--------------------------------------------------x
-	// | Name                         |  bits   | visible |
-	// |--------------------------------------------------|
-	// | GPI                          | [31-28] |    y    |
-	// |--------------------------------------------------|
-	// | GPA                          | [27-24] |    y    |
-	// |--------------------------------------------------|
-	// | LRCPC                        | [23-20] |    y    |
-	// |--------------------------------------------------|
-	// | FCMA                         | [19-16] |    y    |
-	// |--------------------------------------------------|
-	// | JSCVT                        | [15-12] |    y    |
-	// |--------------------------------------------------|
-	// | API                          | [11-8]  |    y    |
-	// |--------------------------------------------------|
-	// | APA                          | [7-4]   |    y    |
-	// |--------------------------------------------------|
-	// | DPB                          | [3-0]   |    y    |
-	// x--------------------------------------------------x
-
-	// if instAttrReg1&(0xf<<28) != 0 {
-	// 	fmt.Println("GPI")
-	// }
-	f.setIf(instAttrReg1&(0xf<<28) != 24, GPA)
-	f.setIf(instAttrReg1&(0xf<<20) != 0, LRCPC)
-	f.setIf(instAttrReg1&(0xf<<16) != 0, FCMA)
-	f.setIf(instAttrReg1&(0xf<<12) != 0, JSCVT)
-	// if instAttrReg1&(0xf<<8) != 0 {
-	// 	fmt.Println("API")
-	// }
-	// if instAttrReg1&(0xf<<4) != 0 {
-	// 	fmt.Println("APA")
-	// }
-	f.setIf(instAttrReg1&(0xf<<0) != 0, DCPOP)
-
-	// Store
-	c.featureSet.or(f)
-}

vendor/github.com/klauspost/cpuid/v2/detect_ref.go

@@ -1,17 +0,0 @@
-// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
-
-//go:build (!amd64 && !386 && !arm64) || gccgo || noasm || appengine
-// +build !amd64,!386,!arm64 gccgo noasm appengine
-
-package cpuid
-
-func initCPU() {
-	cpuid = func(uint32) (a, b, c, d uint32) { return 0, 0, 0, 0 }
-	cpuidex = func(x, y uint32) (a, b, c, d uint32) { return 0, 0, 0, 0 }
-	xgetbv = func(uint32) (a, b uint32) { return 0, 0 }
-	rdtscpAsm = func() (a, b, c, d uint32) { return 0, 0, 0, 0 }
-
-}
-
-func addInfo(info *CPUInfo, safe bool) {}
-func getVectorLength() (vl, pl uint64) { return 0, 0 }

vendor/github.com/klauspost/cpuid/v2/detect_x86.go

@@ -1,45 +0,0 @@
-// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
-
-//go:build (386 && !gccgo && !noasm && !appengine) || (amd64 && !gccgo && !noasm && !appengine)
-// +build 386,!gccgo,!noasm,!appengine amd64,!gccgo,!noasm,!appengine
-
-package cpuid
-
-func asmCpuid(op uint32) (eax, ebx, ecx, edx uint32)
-func asmCpuidex(op, op2 uint32) (eax, ebx, ecx, edx uint32)
-func asmXgetbv(index uint32) (eax, edx uint32)
-func asmRdtscpAsm() (eax, ebx, ecx, edx uint32)
-func asmDarwinHasAVX512() bool
-
-func initCPU() {
-	cpuid = asmCpuid
-	cpuidex = asmCpuidex
-	xgetbv = asmXgetbv
-	rdtscpAsm = asmRdtscpAsm
-	darwinHasAVX512 = asmDarwinHasAVX512
-}
-
-func addInfo(c *CPUInfo, safe bool) {
-	c.maxFunc = maxFunctionID()
-	c.maxExFunc = maxExtendedFunction()
-	c.BrandName = brandName()
-	c.CacheLine = cacheLine()
-	c.Family, c.Model, c.Stepping = familyModel()
-	c.featureSet = support()
-	c.SGX = hasSGX(c.featureSet.inSet(SGX), c.featureSet.inSet(SGXLC))
-	c.AMDMemEncryption = hasAMDMemEncryption(c.featureSet.inSet(SME) || c.featureSet.inSet(SEV))
-	c.ThreadsPerCore = threadsPerCore()
-	c.LogicalCores = logicalCores()
-	c.PhysicalCores = physicalCores()
-	c.VendorID, c.VendorString = vendorID()
-	c.HypervisorVendorID, c.HypervisorVendorString = hypervisorVendorID()
-	c.AVX10Level = c.supportAVX10()
-	c.cacheSize()
-	c.frequencies()
-	if c.maxFunc >= 0x0A {
-		eax, ebx, _, edx := cpuid(0x0A)
-		c.PMU = parseLeaf0AH(c, eax, ebx, edx)
-	}
-}
-
-func getVectorLength() (vl, pl uint64) { return 0, 0 }

vendor/github.com/klauspost/cpuid/v2/featureid_string.go

@@ -1,308 +0,0 @@
-// Code generated by "stringer -type=FeatureID,Vendor"; DO NOT EDIT.
-
-package cpuid
-
-import "strconv"
-
-func _() {
-	// An "invalid array index" compiler error signifies that the constant values have changed.
-	// Re-run the stringer command to generate them again.
-	var x [1]struct{}
-	_ = x[ADX-1]
-	_ = x[AESNI-2]
-	_ = x[AMD3DNOW-3]
-	_ = x[AMD3DNOWEXT-4]
-	_ = x[AMXBF16-5]
-	_ = x[AMXFP16-6]
-	_ = x[AMXINT8-7]
-	_ = x[AMXFP8-8]
-	_ = x[AMXTILE-9]
-	_ = x[AMXTF32-10]
-	_ = x[AMXCOMPLEX-11]
-	_ = x[AMXTRANSPOSE-12]
-	_ = x[APX_F-13]
-	_ = x[AVX-14]
-	_ = x[AVX10-15]
-	_ = x[AVX10_128-16]
-	_ = x[AVX10_256-17]
-	_ = x[AVX10_512-18]
-	_ = x[AVX2-19]
-	_ = x[AVX512BF16-20]
-	_ = x[AVX512BITALG-21]
-	_ = x[AVX512BW-22]
-	_ = x[AVX512CD-23]
-	_ = x[AVX512DQ-24]
-	_ = x[AVX512ER-25]
-	_ = x[AVX512F-26]
-	_ = x[AVX512FP16-27]
-	_ = x[AVX512IFMA-28]
-	_ = x[AVX512PF-29]
-	_ = x[AVX512VBMI-30]
-	_ = x[AVX512VBMI2-31]
-	_ = x[AVX512VL-32]
-	_ = x[AVX512VNNI-33]
-	_ = x[AVX512VP2INTERSECT-34]
-	_ = x[AVX512VPOPCNTDQ-35]
-	_ = x[AVXIFMA-36]
-	_ = x[AVXNECONVERT-37]
-	_ = x[AVXSLOW-38]
-	_ = x[AVXVNNI-39]
-	_ = x[AVXVNNIINT8-40]
-	_ = x[AVXVNNIINT16-41]
-	_ = x[BHI_CTRL-42]
-	_ = x[BMI1-43]
-	_ = x[BMI2-44]
-	_ = x[CETIBT-45]
-	_ = x[CETSS-46]
-	_ = x[CLDEMOTE-47]
-	_ = x[CLMUL-48]
-	_ = x[CLZERO-49]
-	_ = x[CMOV-50]
-	_ = x[CMPCCXADD-51]
-	_ = x[CMPSB_SCADBS_SHORT-52]
-	_ = x[CMPXCHG8-53]
-	_ = x[CPBOOST-54]
-	_ = x[CPPC-55]
-	_ = x[CX16-56]
-	_ = x[EFER_LMSLE_UNS-57]
-	_ = x[ENQCMD-58]
-	_ = x[ERMS-59]
-	_ = x[F16C-60]
-	_ = x[FLUSH_L1D-61]
-	_ = x[FMA3-62]
-	_ = x[FMA4-63]
-	_ = x[FP128-64]
-	_ = x[FP256-65]
-	_ = x[FSRM-66]
-	_ = x[FXSR-67]
-	_ = x[FXSROPT-68]
-	_ = x[GFNI-69]
-	_ = x[HLE-70]
-	_ = x[HRESET-71]
-	_ = x[HTT-72]
-	_ = x[HWA-73]
-	_ = x[HYBRID_CPU-74]
-	_ = x[HYPERVISOR-75]
-	_ = x[IA32_ARCH_CAP-76]
-	_ = x[IA32_CORE_CAP-77]
-	_ = x[IBPB-78]
-	_ = x[IBPB_BRTYPE-79]
-	_ = x[IBRS-80]
-	_ = x[IBRS_PREFERRED-81]
-	_ = x[IBRS_PROVIDES_SMP-82]
-	_ = x[IBS-83]
-	_ = x[IBSBRNTRGT-84]
-	_ = x[IBSFETCHSAM-85]
-	_ = x[IBSFFV-86]
-	_ = x[IBSOPCNT-87]
-	_ = x[IBSOPCNTEXT-88]
-	_ = x[IBSOPSAM-89]
-	_ = x[IBSRDWROPCNT-90]
-	_ = x[IBSRIPINVALIDCHK-91]
-	_ = x[IBS_FETCH_CTLX-92]
-	_ = x[IBS_OPDATA4-93]
-	_ = x[IBS_OPFUSE-94]
-	_ = x[IBS_PREVENTHOST-95]
-	_ = x[IBS_ZEN4-96]
-	_ = x[IDPRED_CTRL-97]
-	_ = x[INT_WBINVD-98]
-	_ = x[INVLPGB-99]
-	_ = x[KEYLOCKER-100]
-	_ = x[KEYLOCKERW-101]
-	_ = x[LAHF-102]
-	_ = x[LAM-103]
-	_ = x[LBRVIRT-104]
-	_ = x[LZCNT-105]
-	_ = x[MCAOVERFLOW-106]
-	_ = x[MCDT_NO-107]
-	_ = x[MCOMMIT-108]
-	_ = x[MD_CLEAR-109]
-	_ = x[MMX-110]
-	_ = x[MMXEXT-111]
-	_ = x[MOVBE-112]
-	_ = x[MOVDIR64B-113]
-	_ = x[MOVDIRI-114]
-	_ = x[MOVSB_ZL-115]
-	_ = x[MOVU-116]
-	_ = x[MPX-117]
-	_ = x[MSRIRC-118]
-	_ = x[MSRLIST-119]
-	_ = x[MSR_PAGEFLUSH-120]
-	_ = x[NRIPS-121]
-	_ = x[NX-122]
-	_ = x[OSXSAVE-123]
-	_ = x[PCONFIG-124]
-	_ = x[POPCNT-125]
-	_ = x[PPIN-126]
-	_ = x[PREFETCHI-127]
-	_ = x[PSFD-128]
-	_ = x[RDPRU-129]
-	_ = x[RDRAND-130]
-	_ = x[RDSEED-131]
-	_ = x[RDTSCP-132]
-	_ = x[RRSBA_CTRL-133]
-	_ = x[RTM-134]
-	_ = x[RTM_ALWAYS_ABORT-135]
-	_ = x[SBPB-136]
-	_ = x[SERIALIZE-137]
-	_ = x[SEV-138]
-	_ = x[SEV_64BIT-139]
-	_ = x[SEV_ALTERNATIVE-140]
-	_ = x[SEV_DEBUGSWAP-141]
-	_ = x[SEV_ES-142]
-	_ = x[SEV_RESTRICTED-143]
-	_ = x[SEV_SNP-144]
-	_ = x[SGX-145]
-	_ = x[SGXLC-146]
-	_ = x[SGXPQC-147]
-	_ = x[SHA-148]
-	_ = x[SME-149]
-	_ = x[SME_COHERENT-150]
-	_ = x[SM3_X86-151]
-	_ = x[SM4_X86-152]
-	_ = x[SPEC_CTRL_SSBD-153]
-	_ = x[SRBDS_CTRL-154]
-	_ = x[SRSO_MSR_FIX-155]
-	_ = x[SRSO_NO-156]
-	_ = x[SRSO_USER_KERNEL_NO-157]
-	_ = x[SSE-158]
-	_ = x[SSE2-159]
-	_ = x[SSE3-160]
-	_ = x[SSE4-161]
-	_ = x[SSE42-162]
-	_ = x[SSE4A-163]
-	_ = x[SSSE3-164]
-	_ = x[STIBP-165]
-	_ = x[STIBP_ALWAYSON-166]
-	_ = x[STOSB_SHORT-167]
-	_ = x[SUCCOR-168]
-	_ = x[SVM-169]
-	_ = x[SVMDA-170]
-	_ = x[SVMFBASID-171]
-	_ = x[SVML-172]
-	_ = x[SVMNP-173]
-	_ = x[SVMPF-174]
-	_ = x[SVMPFT-175]
-	_ = x[SYSCALL-176]
-	_ = x[SYSEE-177]
-	_ = x[TBM-178]
-	_ = x[TDX_GUEST-179]
-	_ = x[TLB_FLUSH_NESTED-180]
-	_ = x[TME-181]
-	_ = x[TOPEXT-182]
-	_ = x[TSA_L1_NO-183]
-	_ = x[TSA_SQ_NO-184]
-	_ = x[TSA_VERW_CLEAR-185]
-	_ = x[TSCRATEMSR-186]
-	_ = x[TSXLDTRK-187]
-	_ = x[VAES-188]
-	_ = x[VMCBCLEAN-189]
-	_ = x[VMPL-190]
-	_ = x[VMSA_REGPROT-191]
-	_ = x[VMX-192]
-	_ = x[VPCLMULQDQ-193]
-	_ = x[VTE-194]
-	_ = x[WAITPKG-195]
-	_ = x[WBNOINVD-196]
-	_ = x[WRMSRNS-197]
-	_ = x[X87-198]
-	_ = x[XGETBV1-199]
-	_ = x[XOP-200]
-	_ = x[XSAVE-201]
-	_ = x[XSAVEC-202]
-	_ = x[XSAVEOPT-203]
-	_ = x[XSAVES-204]
-	_ = x[AESARM-205]
-	_ = x[ARMCPUID-206]
-	_ = x[ASIMD-207]
-	_ = x[ASIMDDP-208]
-	_ = x[ASIMDHP-209]
-	_ = x[ASIMDRDM-210]
-	_ = x[ATOMICS-211]
-	_ = x[CRC32-212]
-	_ = x[DCPOP-213]
-	_ = x[EVTSTRM-214]
-	_ = x[FCMA-215]
-	_ = x[FHM-216]
-	_ = x[FP-217]
-	_ = x[FPHP-218]
-	_ = x[GPA-219]
-	_ = x[JSCVT-220]
-	_ = x[LRCPC-221]
-	_ = x[PMULL-222]
-	_ = x[RNDR-223]
-	_ = x[TLB-224]
-	_ = x[TS-225]
-	_ = x[SHA1-226]
-	_ = x[SHA2-227]
-	_ = x[SHA3-228]
-	_ = x[SHA512-229]
-	_ = x[SM3-230]
-	_ = x[SM4-231]
-	_ = x[SVE-232]
-	_ = x[PMU_FIXEDCOUNTER_CYCLES-233]
-	_ = x[PMU_FIXEDCOUNTER_REFCYCLES-234]
-	_ = x[PMU_FIXEDCOUNTER_INSTRUCTIONS-235]
-	_ = x[PMU_FIXEDCOUNTER_TOPDOWN_SLOTS-236]
-	_ = x[lastID-237]
-	_ = x[firstID-0]
-}
-
-const _FeatureID_name = "firstIDADXAESNIAMD3DNOWAMD3DNOWEXTAMXBF16AMXFP16AMXINT8AMXFP8AMXTILEAMXTF32AMXCOMPLEXAMXTRANSPOSEAPX_FAVXAVX10AVX10_128AVX10_256AVX10_512AVX2AVX512BF16AVX512BITALGAVX512BWAVX512CDAVX512DQAVX512ERAVX512FAVX512FP16AVX512IFMAAVX512PFAVX512VBMIAVX512VBMI2AVX512VLAVX512VNNIAVX512VP2INTERSECTAVX512VPOPCNTDQAVXIFMAAVXNECONVERTAVXSLOWAVXVNNIAVXVNNIINT8AVXVNNIINT16BHI_CTRLBMI1BMI2CETIBTCETSSCLDEMOTECLMULCLZEROCMOVCMPCCXADDCMPSB_SCADBS_SHORTCMPXCHG8CPBOOSTCPPCCX16EFER_LMSLE_UNSENQCMDERMSF16CFLUSH_L1DFMA3FMA4FP128FP256FSRMFXSRFXSROPTGFNIHLEHRESETHTTHWAHYBRID_CPUHYPERVISORIA32_ARCH_CAPIA32_CORE_CAPIBPBIBPB_BRTYPEIBRSIBRS_PREFERREDIBRS_PROVIDES_SMPIBSIBSBRNTRGTIBSFETCHSAMIBSFFVIBSOPCNTIBSOPCNTEXTIBSOPSAMIBSRDWROPCNTIBSRIPINVALIDCHKIBS_FETCH_CTLXIBS_OPDATA4IBS_OPFUSEIBS_PREVENTHOSTIBS_ZEN4IDPRED_CTRLINT_WBINVDINVLPGBKEYLOCKERKEYLOCKERWLAHFLAMLBRVIRTLZCNTMCAOVERFLOWMCDT_NOMCOMMITMD_CLEARMMXMMXEXTMOVBEMOVDIR64BMOVDIRIMOVSB_ZLMOVUMPXMSRIRCMSRLISTMSR_PAGEFLUSHNRIPSNXOSXSAVEPCONFIGPOPCNTPPINPREFETCHIPSFDRDPRURDRANDRDSEEDRDTSCPRRSBA_CTRLRTMRTM_ALWAYS_ABORTSBPBSERIALIZESEVSEV_64BITSEV_ALTERNATIVESEV_DEBUGSWAPSEV_ESSEV_RESTRICTEDSEV_SNPSGXSGXLCSGXPQCSHASMESME_COHERENTSM3_X86SM4_X86SPEC_CTRL_SSBDSRBDS_CTRLSRSO_MSR_FIXSRSO_NOSRSO_USER_KERNEL_NOSSESSE2SSE3SSE4SSE42SSE4ASSSE3STIBPSTIBP_ALWAYSONSTOSB_SHORTSUCCORSVMSVMDASVMFBASIDSVMLSVMNPSVMPFSVMPFTSYSCALLSYSEETBMTDX_GUESTTLB_FLUSH_NESTEDTMETOPEXTTSA_L1_NOTSA_SQ_NOTSA_VERW_CLEARTSCRATEMSRTSXLDTRKVAESVMCBCLEANVMPLVMSA_REGPROTVMXVPCLMULQDQVTEWAITPKGWBNOINVDWRMSRNSX87XGETBV1XOPXSAVEXSAVECXSAVEOPTXSAVESAESARMARMCPUIDASIMDASIMDDPASIMDHPASIMDRDMATOMICSCRC32DCPOPEVTSTRMFCMAFHMFPFPHPGPAJSCVTLRCPCPMULLRNDRTLBTSSHA1SHA2SHA3SHA512SM3SM4SVEPMU_FIXEDCOUNTER_CYCLESPMU_FIXEDCOUNTER_REFCYCLESPMU_FIXEDCOUNTER_INSTRUCTIONSPMU_FIXEDCOUNTER_TOPDOWN_SLOTSlastID"
-
-var _FeatureID_index = [...]uint16{0, 7, 10, 15, 23, 34, 41, 48, 55, 61, 68, 75, 85, 97, 102, 105, 110, 119, 128, 137, 141, 151, 163, 171, 179, 187, 195, 202, 212, 222, 230, 240, 251, 259, 269, 287, 302, 309, 321, 328, 335, 346, 358, 366, 370, 374, 380, 385, 393, 398, 404, 408, 417, 435, 443, 450, 454, 458, 472, 478, 482, 486, 495, 499, 503, 508, 513, 517, 521, 528, 532, 535, 541, 544, 547, 557, 567, 580, 593, 597, 608, 612, 626, 643, 646, 656, 667, 673, 681, 692, 700, 712, 728, 742, 753, 763, 778, 786, 797, 807, 814, 823, 833, 837, 840, 847, 852, 863, 870, 877, 885, 888, 894, 899, 908, 915, 923, 927, 930, 936, 943, 956, 961, 963, 970, 977, 983, 987, 996, 1000, 1005, 1011, 1017, 1023, 1033, 1036, 1052, 1056, 1065, 1068, 1077, 1092, 1105, 1111, 1125, 1132, 1135, 1140, 1146, 1149, 1152, 1164, 1171, 1178, 1192, 1202, 1214, 1221, 1240, 1243, 1247, 1251, 1255, 1260, 1265, 1270, 1275, 1289, 1300, 1306, 1309, 1314, 1323, 1327, 1332, 1337, 1343, 1350, 1355, 1358, 1367, 1383, 1386, 1392, 1401, 1410, 1424, 1434, 1442, 1446, 1455, 1459, 1471, 1474, 1484, 1487, 1494, 1502, 1509, 1512, 1519, 1522, 1527, 1533, 1541, 1547, 1553, 1561, 1566, 1573, 1580, 1588, 1595, 1600, 1605, 1612, 1616, 1619, 1621, 1625, 1628, 1633, 1638, 1643, 1647, 1650, 1652, 1656, 1660, 1664, 1670, 1673, 1676, 1679, 1702, 1728, 1757, 1787, 1793}
-
-func (i FeatureID) String() string {
-	if i < 0 || i >= FeatureID(len(_FeatureID_index)-1) {
-		return "FeatureID(" + strconv.FormatInt(int64(i), 10) + ")"
-	}
-	return _FeatureID_name[_FeatureID_index[i]:_FeatureID_index[i+1]]
-}
-func _() {
-	// An "invalid array index" compiler error signifies that the constant values have changed.
-	// Re-run the stringer command to generate them again.
-	var x [1]struct{}
-	_ = x[VendorUnknown-0]
-	_ = x[Intel-1]
-	_ = x[AMD-2]
-	_ = x[VIA-3]
-	_ = x[Transmeta-4]
-	_ = x[NSC-5]
-	_ = x[KVM-6]
-	_ = x[MSVM-7]
-	_ = x[VMware-8]
-	_ = x[XenHVM-9]
-	_ = x[Bhyve-10]
-	_ = x[Hygon-11]
-	_ = x[SiS-12]
-	_ = x[RDC-13]
-	_ = x[Ampere-14]
-	_ = x[ARM-15]
-	_ = x[Broadcom-16]
-	_ = x[Cavium-17]
-	_ = x[DEC-18]
-	_ = x[Fujitsu-19]
-	_ = x[Infineon-20]
-	_ = x[Motorola-21]
-	_ = x[NVIDIA-22]
-	_ = x[AMCC-23]
-	_ = x[Qualcomm-24]
-	_ = x[Marvell-25]
-	_ = x[QEMU-26]
-	_ = x[QNX-27]
-	_ = x[ACRN-28]
-	_ = x[SRE-29]
-	_ = x[Apple-30]
-	_ = x[lastVendor-31]
-}
-
-const _Vendor_name = "VendorUnknownIntelAMDVIATransmetaNSCKVMMSVMVMwareXenHVMBhyveHygonSiSRDCAmpereARMBroadcomCaviumDECFujitsuInfineonMotorolaNVIDIAAMCCQualcommMarvellQEMUQNXACRNSREApplelastVendor"
-
-var _Vendor_index = [...]uint8{0, 13, 18, 21, 24, 33, 36, 39, 43, 49, 55, 60, 65, 68, 71, 77, 80, 88, 94, 97, 104, 112, 120, 126, 130, 138, 145, 149, 152, 156, 159, 164, 174}
-
-func (i Vendor) String() string {
-	if i < 0 || i >= Vendor(len(_Vendor_index)-1) {
-		return "Vendor(" + strconv.FormatInt(int64(i), 10) + ")"
-	}
-	return _Vendor_name[_Vendor_index[i]:_Vendor_index[i+1]]
-}

vendor/github.com/klauspost/cpuid/v2/os_darwin_arm64.go

@@ -1,129 +0,0 @@
-// Copyright (c) 2020 Klaus Post, released under MIT License. See LICENSE file.
-
-package cpuid
-
-import (
-	"runtime"
-	"strings"
-
-	"golang.org/x/sys/unix"
-)
-
-func detectOS(c *CPUInfo) bool {
-	if runtime.GOOS != "ios" {
-		tryToFillCPUInfoFomSysctl(c)
-	}
-	// There are no hw.optional sysctl values for the below features on Mac OS 11.0
-	// to detect their supported state dynamically. Assume the CPU features that
-	// Apple Silicon M1 supports to be available as a minimal set of features
-	// to all Go programs running on darwin/arm64.
-	// TODO: Add more if we know them.
-	c.featureSet.setIf(runtime.GOOS != "ios", AESARM, PMULL, SHA1, SHA2)
-
-	return true
-}
-
-func sysctlGetBool(name string) bool {
-	value, err := unix.SysctlUint32(name)
-	if err != nil {
-		return false
-	}
-	return value != 0
-}
-
-func sysctlGetString(name string) string {
-	value, err := unix.Sysctl(name)
-	if err != nil {
-		return ""
-	}
-	return value
-}
-
-func sysctlGetInt(unknown int, names ...string) int {
-	for _, name := range names {
-		value, err := unix.SysctlUint32(name)
-		if err != nil {
-			continue
-		}
-		if value != 0 {
-			return int(value)
-		}
-	}
-	return unknown
-}
-
-func sysctlGetInt64(unknown int, names ...string) int {
-	for _, name := range names {
-		value64, err := unix.SysctlUint64(name)
-		if err != nil {
-			continue
-		}
-		if int(value64) != unknown {
-			return int(value64)
-		}
-	}
-	return unknown
-}
-
-func setFeature(c *CPUInfo, feature FeatureID, aliases ...string) {
-	for _, alias := range aliases {
-		set := sysctlGetBool(alias)
-		c.featureSet.setIf(set, feature)
-		if set {
-			break
-		}
-	}
-}
-
-func tryToFillCPUInfoFomSysctl(c *CPUInfo) {
-	c.BrandName = sysctlGetString("machdep.cpu.brand_string")
-
-	if len(c.BrandName) != 0 {
-		c.VendorString = strings.Fields(c.BrandName)[0]
-	}
-
-	c.PhysicalCores = sysctlGetInt(runtime.NumCPU(), "hw.physicalcpu")
-	c.ThreadsPerCore = sysctlGetInt(1, "machdep.cpu.thread_count", "kern.num_threads") /
-		sysctlGetInt(1, "hw.physicalcpu")
-	c.LogicalCores = sysctlGetInt(runtime.NumCPU(), "machdep.cpu.core_count")
-	c.Family = sysctlGetInt(0, "machdep.cpu.family", "hw.cpufamily")
-	c.Model = sysctlGetInt(0, "machdep.cpu.model")
-	c.CacheLine = sysctlGetInt64(0, "hw.cachelinesize")
-	c.Cache.L1I = sysctlGetInt64(-1, "hw.l1icachesize")
-	c.Cache.L1D = sysctlGetInt64(-1, "hw.l1dcachesize")
-	c.Cache.L2 = sysctlGetInt64(-1, "hw.l2cachesize")
-	c.Cache.L3 = sysctlGetInt64(-1, "hw.l3cachesize")
-
-	// ARM features:
-	//
-	// Note: On some Apple Silicon system, some feats have aliases. See:
-	// https://developer.apple.com/documentation/kernel/1387446-sysctlbyname/determining_instruction_set_characteristics
-	// When so, we look at all aliases and consider a feature available when at least one identifier matches.
-	setFeature(c, AESARM, "hw.optional.arm.FEAT_AES")                                   // AES instructions
-	setFeature(c, ASIMD, "hw.optional.arm.AdvSIMD", "hw.optional.neon")                 // Advanced SIMD
-	setFeature(c, ASIMDDP, "hw.optional.arm.FEAT_DotProd")                              // SIMD Dot Product
-	setFeature(c, ASIMDHP, "hw.optional.arm.AdvSIMD_HPFPCvt", "hw.optional.neon_hpfp")  // Advanced SIMD half-precision floating point
-	setFeature(c, ASIMDRDM, "hw.optional.arm.FEAT_RDM")                                 // Rounding Double Multiply Accumulate/Subtract
-	setFeature(c, ATOMICS, "hw.optional.arm.FEAT_LSE", "hw.optional.armv8_1_atomics")   // Large System Extensions (LSE)
-	setFeature(c, CRC32, "hw.optional.arm.FEAT_CRC32", "hw.optional.armv8_crc32")       // CRC32/CRC32C instructions
-	setFeature(c, DCPOP, "hw.optional.arm.FEAT_DPB")                                    // Data cache clean to Point of Persistence (DC CVAP)
-	setFeature(c, EVTSTRM, "hw.optional.arm.FEAT_ECV")                                  // Generic timer
-	setFeature(c, FCMA, "hw.optional.arm.FEAT_FCMA", "hw.optional.armv8_3_compnum")     // Floating point complex number addition and multiplication
-	setFeature(c, FHM, "hw.optional.armv8_2_fhm", "hw.optional.arm.FEAT_FHM")           // FMLAL and FMLSL instructions
-	setFeature(c, FP, "hw.optional.floatingpoint")                                      // Single-precision and double-precision floating point
-	setFeature(c, FPHP, "hw.optional.arm.FEAT_FP16", "hw.optional.neon_fp16")           // Half-precision floating point
-	setFeature(c, GPA, "hw.optional.arm.FEAT_PAuth")                                    // Generic Pointer Authentication
-	setFeature(c, JSCVT, "hw.optional.arm.FEAT_JSCVT")                                  // Javascript-style double->int convert (FJCVTZS)
-	setFeature(c, LRCPC, "hw.optional.arm.FEAT_LRCPC")                                  // Weaker release consistency (LDAPR, etc)
-	setFeature(c, PMULL, "hw.optional.arm.FEAT_PMULL")                                  // Polynomial Multiply instructions (PMULL/PMULL2)
-	setFeature(c, RNDR, "hw.optional.arm.FEAT_RNG")                                     // Random Number instructions
-	setFeature(c, TLB, "hw.optional.arm.FEAT_TLBIOS", "hw.optional.arm.FEAT_TLBIRANGE") // Outer Shareable and TLB range maintenance instructions
-	setFeature(c, TS, "hw.optional.arm.FEAT_FlagM", "hw.optional.arm.FEAT_FlagM2")      // Flag manipulation instructions
-	setFeature(c, SHA1, "hw.optional.arm.FEAT_SHA1")                                    // SHA-1 instructions (SHA1C, etc)
-	setFeature(c, SHA2, "hw.optional.arm.FEAT_SHA256")                                  // SHA-2 instructions (SHA256H, etc)
-	setFeature(c, SHA3, "hw.optional.arm.FEAT_SHA3")                                    // SHA-3 instructions (EOR3, RAXI, XAR, BCAX)
-	setFeature(c, SHA512, "hw.optional.arm.FEAT_SHA512")                                // SHA512 instructions
-	setFeature(c, SM3, "hw.optional.arm.FEAT_SM3")                                      // SM3 instructions
-	setFeature(c, SM4, "hw.optional.arm.FEAT_SM4")                                      // SM4 instructions
-	setFeature(c, SVE, "hw.optional.arm.FEAT_SVE")                                      // Scalable Vector Extension
-}

vendor/github.com/klauspost/cpuid/v2/os_linux_arm64.go

@@ -1,208 +0,0 @@
-// Copyright (c) 2020 Klaus Post, released under MIT License. See LICENSE file.
-
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file located
-// here https://github.com/golang/sys/blob/master/LICENSE
-
-package cpuid
-
-import (
-	"encoding/binary"
-	"io/ioutil"
-	"runtime"
-)
-
-// HWCAP bits.
-const (
-	hwcap_FP       = 1 << 0
-	hwcap_ASIMD    = 1 << 1
-	hwcap_EVTSTRM  = 1 << 2
-	hwcap_AES      = 1 << 3
-	hwcap_PMULL    = 1 << 4
-	hwcap_SHA1     = 1 << 5
-	hwcap_SHA2     = 1 << 6
-	hwcap_CRC32    = 1 << 7
-	hwcap_ATOMICS  = 1 << 8
-	hwcap_FPHP     = 1 << 9
-	hwcap_ASIMDHP  = 1 << 10
-	hwcap_CPUID    = 1 << 11
-	hwcap_ASIMDRDM = 1 << 12
-	hwcap_JSCVT    = 1 << 13
-	hwcap_FCMA     = 1 << 14
-	hwcap_LRCPC    = 1 << 15
-	hwcap_DCPOP    = 1 << 16
-	hwcap_SHA3     = 1 << 17
-	hwcap_SM3      = 1 << 18
-	hwcap_SM4      = 1 << 19
-	hwcap_ASIMDDP  = 1 << 20
-	hwcap_SHA512   = 1 << 21
-	hwcap_SVE      = 1 << 22
-	hwcap_ASIMDFHM = 1 << 23
-	hwcap_DIT      = 1 << 24
-	hwcap_USCAT    = 1 << 25
-	hwcap_ILRCPC   = 1 << 26
-	hwcap_FLAGM    = 1 << 27
-	hwcap_SSBS     = 1 << 28
-	hwcap_SB       = 1 << 29
-	hwcap_PACA     = 1 << 30
-	hwcap_PACG     = 1 << 31
-	hwcap_GCS      = 1 << 32
-
-	hwcap2_DCPODP      = 1 << 0
-	hwcap2_SVE2        = 1 << 1
-	hwcap2_SVEAES      = 1 << 2
-	hwcap2_SVEPMULL    = 1 << 3
-	hwcap2_SVEBITPERM  = 1 << 4
-	hwcap2_SVESHA3     = 1 << 5
-	hwcap2_SVESM4      = 1 << 6
-	hwcap2_FLAGM2      = 1 << 7
-	hwcap2_FRINT       = 1 << 8
-	hwcap2_SVEI8MM     = 1 << 9
-	hwcap2_SVEF32MM    = 1 << 10
-	hwcap2_SVEF64MM    = 1 << 11
-	hwcap2_SVEBF16     = 1 << 12
-	hwcap2_I8MM        = 1 << 13
-	hwcap2_BF16        = 1 << 14
-	hwcap2_DGH         = 1 << 15
-	hwcap2_RNG         = 1 << 16
-	hwcap2_BTI         = 1 << 17
-	hwcap2_MTE         = 1 << 18
-	hwcap2_ECV         = 1 << 19
-	hwcap2_AFP         = 1 << 20
-	hwcap2_RPRES       = 1 << 21
-	hwcap2_MTE3        = 1 << 22
-	hwcap2_SME         = 1 << 23
-	hwcap2_SME_I16I64  = 1 << 24
-	hwcap2_SME_F64F64  = 1 << 25
-	hwcap2_SME_I8I32   = 1 << 26
-	hwcap2_SME_F16F32  = 1 << 27
-	hwcap2_SME_B16F32  = 1 << 28
-	hwcap2_SME_F32F32  = 1 << 29
-	hwcap2_SME_FA64    = 1 << 30
-	hwcap2_WFXT        = 1 << 31
-	hwcap2_EBF16       = 1 << 32
-	hwcap2_SVE_EBF16   = 1 << 33
-	hwcap2_CSSC        = 1 << 34
-	hwcap2_RPRFM       = 1 << 35
-	hwcap2_SVE2P1      = 1 << 36
-	hwcap2_SME2        = 1 << 37
-	hwcap2_SME2P1      = 1 << 38
-	hwcap2_SME_I16I32  = 1 << 39
-	hwcap2_SME_BI32I32 = 1 << 40
-	hwcap2_SME_B16B16  = 1 << 41
-	hwcap2_SME_F16F16  = 1 << 42
-	hwcap2_MOPS        = 1 << 43
-	hwcap2_HBC         = 1 << 44
-	hwcap2_SVE_B16B16  = 1 << 45
-	hwcap2_LRCPC3      = 1 << 46
-	hwcap2_LSE128      = 1 << 47
-	hwcap2_FPMR        = 1 << 48
-	hwcap2_LUT         = 1 << 49
-	hwcap2_FAMINMAX    = 1 << 50
-	hwcap2_F8CVT       = 1 << 51
-	hwcap2_F8FMA       = 1 << 52
-	hwcap2_F8DP4       = 1 << 53
-	hwcap2_F8DP2       = 1 << 54
-	hwcap2_F8E4M3      = 1 << 55
-	hwcap2_F8E5M2      = 1 << 56
-	hwcap2_SME_LUTV2   = 1 << 57
-	hwcap2_SME_F8F16   = 1 << 58
-	hwcap2_SME_F8F32   = 1 << 59
-	hwcap2_SME_SF8FMA  = 1 << 60
-	hwcap2_SME_SF8DP4  = 1 << 61
-	hwcap2_SME_SF8DP2  = 1 << 62
-	hwcap2_POE         = 1 << 63
-)
-
-func detectOS(c *CPUInfo) bool {
-	// For now assuming no hyperthreading is reasonable.
-	c.LogicalCores = runtime.NumCPU()
-	c.PhysicalCores = c.LogicalCores
-	c.ThreadsPerCore = 1
-	if hwcap == 0 {
-		// We did not get values from the runtime.
-		// Try reading /proc/self/auxv
-
-		// From https://github.com/golang/sys
-		const (
-			_AT_HWCAP  = 16
-			_AT_HWCAP2 = 26
-
-			uintSize = int(32 << (^uint(0) >> 63))
-		)
-
-		buf, err := ioutil.ReadFile("/proc/self/auxv")
-		if err != nil {
-			// e.g. on android /proc/self/auxv is not accessible, so silently
-			// ignore the error and leave Initialized = false. On some
-			// architectures (e.g. arm64) doinit() implements a fallback
-			// readout and will set Initialized = true again.
-			return false
-		}
-		bo := binary.LittleEndian
-		for len(buf) >= 2*(uintSize/8) {
-			var tag, val uint
-			switch uintSize {
-			case 32:
-				tag = uint(bo.Uint32(buf[0:]))
-				val = uint(bo.Uint32(buf[4:]))
-				buf = buf[8:]
-			case 64:
-				tag = uint(bo.Uint64(buf[0:]))
-				val = uint(bo.Uint64(buf[8:]))
-				buf = buf[16:]
-			}
-			switch tag {
-			case _AT_HWCAP:
-				hwcap = val
-			case _AT_HWCAP2:
-				// Not used
-			}
-		}
-		if hwcap == 0 {
-			return false
-		}
-	}
-
-	// HWCap was populated by the runtime from the auxiliary vector.
-	// Use HWCap information since reading aarch64 system registers
-	// is not supported in user space on older linux kernels.
-	c.featureSet.setIf(isSet(hwcap, hwcap_AES), AESARM)
-	c.featureSet.setIf(isSet(hwcap, hwcap_ASIMD), ASIMD)
-	c.featureSet.setIf(isSet(hwcap, hwcap_ASIMDDP), ASIMDDP)
-	c.featureSet.setIf(isSet(hwcap, hwcap_ASIMDHP), ASIMDHP)
-	c.featureSet.setIf(isSet(hwcap, hwcap_ASIMDRDM), ASIMDRDM)
-	c.featureSet.setIf(isSet(hwcap, hwcap_CPUID), ARMCPUID)
-	c.featureSet.setIf(isSet(hwcap, hwcap_CRC32), CRC32)
-	c.featureSet.setIf(isSet(hwcap, hwcap_DCPOP), DCPOP)
-	c.featureSet.setIf(isSet(hwcap, hwcap_EVTSTRM), EVTSTRM)
-	c.featureSet.setIf(isSet(hwcap, hwcap_FCMA), FCMA)
-	c.featureSet.setIf(isSet(hwcap, hwcap_ASIMDFHM), FHM)
-	c.featureSet.setIf(isSet(hwcap, hwcap_FP), FP)
-	c.featureSet.setIf(isSet(hwcap, hwcap_FPHP), FPHP)
-	c.featureSet.setIf(isSet(hwcap, hwcap_JSCVT), JSCVT)
-	c.featureSet.setIf(isSet(hwcap, hwcap_LRCPC), LRCPC)
-	c.featureSet.setIf(isSet(hwcap, hwcap_PMULL), PMULL)
-	c.featureSet.setIf(isSet(hwcap, hwcap2_RNG), RNDR)
-	// c.featureSet.setIf(isSet(hwcap, hwcap_), TLB)
-	// c.featureSet.setIf(isSet(hwcap, hwcap_), TS)
-	c.featureSet.setIf(isSet(hwcap, hwcap_SHA1), SHA1)
-	c.featureSet.setIf(isSet(hwcap, hwcap_SHA2), SHA2)
-	c.featureSet.setIf(isSet(hwcap, hwcap_SHA3), SHA3)
-	c.featureSet.setIf(isSet(hwcap, hwcap_SHA512), SHA512)
-	c.featureSet.setIf(isSet(hwcap, hwcap_SM3), SM3)
-	c.featureSet.setIf(isSet(hwcap, hwcap_SM4), SM4)
-	c.featureSet.setIf(isSet(hwcap, hwcap_SVE), SVE)
-
-	// The Samsung S9+ kernel reports support for atomics, but not all cores
-	// actually support them, resulting in SIGILL. See issue #28431.
-	// TODO(elias.naur): Only disable the optimization on bad chipsets on android.
-	c.featureSet.setIf(isSet(hwcap, hwcap_ATOMICS) && runtime.GOOS != "android", ATOMICS)
-
-	return true
-}
-
-func isSet(hwc uint, value uint) bool {
-	return hwc&value != 0
-}

vendor/github.com/klauspost/cpuid/v2/os_other_arm64.go

@@ -1,16 +0,0 @@
-// Copyright (c) 2020 Klaus Post, released under MIT License. See LICENSE file.
-
-//go:build arm64 && !linux && !darwin
-// +build arm64,!linux,!darwin
-
-package cpuid
-
-import "runtime"
-
-func detectOS(c *CPUInfo) bool {
-	c.PhysicalCores = runtime.NumCPU()
-	// For now assuming 1 thread per core...
-	c.ThreadsPerCore = 1
-	c.LogicalCores = c.PhysicalCores
-	return false
-}

vendor/github.com/klauspost/cpuid/v2/os_safe_linux_arm64.go

@@ -1,8 +0,0 @@
-// Copyright (c) 2021 Klaus Post, released under MIT License. See LICENSE file.
-
-//go:build nounsafe
-// +build nounsafe
-
-package cpuid
-
-var hwcap uint

vendor/github.com/klauspost/cpuid/v2/os_unsafe_linux_arm64.go

@@ -1,11 +0,0 @@
-// Copyright (c) 2021 Klaus Post, released under MIT License. See LICENSE file.
-
-//go:build !nounsafe
-// +build !nounsafe
-
-package cpuid
-
-import _ "unsafe" // needed for go:linkname
-
-//go:linkname hwcap internal/cpu.HWCap
-var hwcap uint

vendor/github.com/klauspost/cpuid/v2/test-architectures.sh

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -e
-
-go tool dist list | while IFS=/ read os arch; do
-    echo "Checking $os/$arch..."
-    echo " normal"
-    GOARCH=$arch GOOS=$os go build -o /dev/null .
-    echo " noasm"
-    GOARCH=$arch GOOS=$os go build -tags noasm -o /dev/null .
-    echo " appengine"
-    GOARCH=$arch GOOS=$os go build -tags appengine -o /dev/null .
-    echo " noasm,appengine"
-    GOARCH=$arch GOOS=$os go build -tags 'appengine noasm' -o /dev/null .
-done

vendor/github.com/leonelquinteros/gotext/AGENTS.md

@@ -0,0 +1,64 @@
+# AGENTS.md - gotext Project Guidelines
+
+This document is the **source of truth** for the `gotext` project's architecture, conventions, and development workflows. All contributors — human or AI agent — must adhere to these guidelines.
+
+Agent-specific configuration files (e.g., `GEMINI.md`, `CLAUDE.md`) should reference this document rather than duplicating its content.
+
+## Project Overview
+
+`gotext` is a GNU Gettext implementation for Go (Golang). It provides a thread-safe, hierarchical translation system that supports PO/MO files, plural forms, and context-aware translations.
+
+## Core Architecture
+
+The project follows a hierarchical structure for managing translations:
+
+1. **Global Package API (`gotext.go`)**: Provides convenient, global functions (e.g., `Get`, `GetD`, `GetN`) that rely on a shared `globalConfig`.
+2. **Locales (`locale.go`)**: Represent a specific language (e.g., "en_US", "es_ES"). A `Locale` container manages multiple `Domains`.
+3. **Domains (`domain.go`)**: The core translation engine for a specific set of messages. It handles:
+    - Message retrieval (with support for plural forms and `msgctxt`).
+    - Header parsing (including plural-form rules).
+    - Thread-safety via `sync.RWMutex`.
+4. **Translators (`translator.go`)**: An interface for translation sources.
+    - **PO (`po.go`)**: Parsers for human-readable Gettext Portable Object files.
+    - **MO (`mo.go`)**: Parsers for binary Gettext Machine Object files.
+5. **Plural Forms (`plurals/`)**: A dedicated package for compiling and evaluating GNU Gettext plural form expressions.
+
+## CLI Tools
+
+- **xgotext (`cli/xgotext/`)**: A tool to scan Go source files, extract translatable strings (matching `Get`, `GetD`, etc.), and generate/update PO files.
+
+## Key Files & Symbols
+
+- `gotext.go`: `Configure`, `Get`, `GetD`, `GetN`.
+- `locale.go`: `Locale`, `NewLocale`, `AddDomain`.
+- `domain.go`: `Domain`, `Get`, `GetN`, `parseHeaders`.
+- `translator.go`: `Translator` interface.
+- `plurals/compiler.go`: `Compile` function for plural expressions.
+
+## Development Workflows
+
+### Branching & PRs
+
+- **Feature Branches**: All development MUST happen in dedicated feature branches (e.g., `feature/description-of-change`, `fix/bug-description`, `refactor/topic`).
+- **Target Branch**: All Pull Requests MUST be made against the `master` branch.
+- **Review Requirement**: No direct commits to `master` are allowed. All changes must be reviewed via a PR.
+- **GitHub Integration**: If the `gh` CLI tool is installed and authenticated, it should be used for managing Pull Requests, Issues, and Reviews. Otherwise, these tasks must be performed manually through the GitHub web interface.
+
+### Coding Standards
+
+- **Idiomatic Go**: Follow standard Go conventions (`gofmt`, `go vet`).
+- **Thread Safety**: Ensure all shared state (like in `Domain`) is protected by appropriate synchronization primitives.
+- **Testing**:
+    - Every new feature or bug fix must include corresponding tests.
+    - Use the `fixtures/` directory for sample PO/MO files.
+    - Run `go test ./...` to ensure no regressions.
+
+### Pre-Submit Checklist
+
+Before submitting a Pull Request, verify:
+
+1. All existing tests pass: `go test ./...`
+2. Code passes static analysis: `go vet ./...`
+3. Code is properly formatted: `gofmt`
+4. New features or bug fixes include corresponding tests.
+5. Commit messages are clear and descriptive.

vendor/github.com/leonelquinteros/gotext/CODE_OF_CONDUCT.md

@@ -1,46 +1,3 @@
-# Contributor Covenant Code of Conduct
+# CODE OF CONDUCT
 
-## Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to creating a positive environment include:
-
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-* The use of sexualized language or imagery and unwelcome sexual attention or advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or electronic address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a professional setting
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at leonel.quinteros@gmail.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
-
-[homepage]: http://contributor-covenant.org
-[version]: http://contributor-covenant.org/version/1/4/
+The canonical text of this project's Code of Conduct lives at [docs/CODE_OF_CONDUCT.md](docs/CODE_OF_CONDUCT.md).

vendor/github.com/leonelquinteros/gotext/CONTRIBUTING.md

@@ -1,19 +1,9 @@
 # CONTRIBUTING
 
-This open source project welcomes everybody that wants to contribute to it by implementing new features, fixing bugs, testing, creating documentation or simply talk about it. 
+Thank you for considering contributing to `gotext`! All kinds of contributions — features, bug fixes, tests, documentation, or discussions — are welcome.
 
-Most contributions will start by creating a new Issue to discuss what is the contribution about and to agree on the steps to move forward. 
+The canonical contribution guidelines live at [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md).
 
-## Issues
-
-All issues reports are welcome. Open a new Issue whenever you want to report a bug, request a change or make a proposal.
-
-This should be your start point of contribution. 
-
-
-## Pull Requests
-
-If you have any changes that can be merged, feel free to send a Pull Request. 
-
-Usually, you'd want to create a new Issue to discuss about the change you want to merge and why it's needed or what it solves. 
+Before contributing, please also read [AGENTS.md](AGENTS.md): it is the source of truth for project architecture, conventions, and development workflows (branching, PR process, coding standards, and the pre-submit checklist).
 
+Start point: open an [Issue](https://github.com/leonelquinteros/gotext/issues) to discuss your idea, then send a Pull Request against `master`.

vendor/github.com/leonelquinteros/gotext/GEMINI.md

@@ -0,0 +1,9 @@
+# GEMINI.md - Gemini CLI Instructions for gotext
+
+> **Important**: Read and follow [`AGENTS.md`](./AGENTS.md) first. It is the source of truth for project architecture, conventions, and development workflows. The instructions below are specific to Gemini CLI and supplement — not replace — those guidelines.
+
+## Gemini-Specific Instructions
+
+- Always work in a feature branch. Never commit directly to `master`.
+- Before submitting, verify changes with existing and new tests (`go test ./...`).
+- Propose a PR to `master` after confirmation, using the `gh` CLI when available.

vendor/github.com/leonelquinteros/gotext/README.md

@@ -9,258 +9,151 @@
 
 [GNU gettext utilities](https://www.gnu.org/software/gettext) for Go.
 
+`gotext` is a native Go implementation of the GNU Gettext utilities. It provides a thread-safe, flexible, and powerful way to handle internationalization (i18n) and localization (l10n) in your Go applications.
 
-# Features
+---
 
-- Implements GNU gettext support in native Go.
-- Complete support for [PO files](https://www.gnu.org/software/gettext/manual/html_node/PO-Files.html) including:
-  - Support for multiline strings and headers.
-  - Support for variables inside translation strings using Go's [fmt syntax](https://golang.org/pkg/fmt/).
-  - Support for [pluralization rules](https://www.gnu.org/software/gettext/manual/html_node/Translating-plural-forms.html).
-  - Support for [message contexts](https://www.gnu.org/software/gettext/manual/html_node/Contexts.html).
-- Support for MO files.
-- Thread-safe: This package is safe for concurrent use across multiple goroutines.
-- It works with UTF-8 encoding as it's the default for Go language.
-- Unit tests available.
-- Language codes are automatically simplified from the form `en_UK` to `en` if the first isn't available.
-- Ready to use inside Go templates.
-- Objects are serializable to []byte to store them in cache.
-- Support for Go Modules.
+**📖 [Read the Full Documentation](https://leonelquinteros.github.io/gotext/)**
 
+---
 
-# License
+### Table of Contents
+- [Features](#features)
+- [Installation](#installation)
+- [Getting Started](#getting-started)
+- [CLI Tool (xgotext)](#cli-tool-xgotext)
+- [Advanced Usage](#advanced-usage)
+  - [Locale Object](#using-locale-object)
+  - [Plural Forms](#use-plural-forms-of-translations)
+  - [Dynamic Variables](#using-dynamic-variables-on-translations)
+- [Directory Structure](#locales-directories-structure)
+- [Contributing](#contributing)
+- [License](#license)
 
-[MIT license](LICENSE)
+---
 
+## Features
+- Native Go implementation of Gettext (the core library has no external dependencies).
+- Full support for **PO and MO files**.
+- **Pluralization rules** support via GNU Gettext plural-form expressions.
+- **Message context** support (`msgctxt`).
+- Thread-safe for concurrent use.
+- Works with UTF-8 by default.
+- Integrated CLI tool (`xgotext`) for string extraction.
+- Serializable objects for caching.
+- Plain-string results that plug directly into Go's `text/template` and `html/template` pipelines.
 
-# Documentation
+---
 
-Refer to package documentation at (https://pkg.go.dev/github.com/leonelquinteros/gotext)
-
-
-# Installation
-
-```
+## Installation
+```bash
 go get github.com/leonelquinteros/gotext
 ```
 
-- There are no requirements or dependencies to use this package.
-- No need to install GNU gettext utilities (unless specific needs of CLI tools).
-- No need for environment variables. Some naming conventions are applied but not needed.
+---
 
-
-# Usage examples
-
-## Using package for single language/domain settings
-
-For quick/simple translations you can use the package level functions directly.
+## Getting Started
+For a quick start, use the package-level API:
 
 ```go
+package main
+
 import (
     "fmt"
     "github.com/leonelquinteros/gotext"
 )
 
 func main() {
-    // Configure package
-    gotext.Configure("/path/to/locales/root/dir", "en_UK", "domain-name")
+    // Configure package: locales path, language, and domain
+    gotext.Configure("/path/to/locales", "en_US", "default")
 
-    // Translate text from default domain
-    fmt.Println(gotext.Get("My text on 'domain-name' domain"))
+    // Simple translation
+    fmt.Println(gotext.Get("Hello, world!"))
 
-    // Translate text from a different domain without reconfigure
-    fmt.Println(gotext.GetD("domain2", "Another text on a different domain"))
+    // Translation with variables
+    fmt.Println(gotext.Get("Hello, %s!", "Gopher"))
 }
-
 ```
 
-## Using dynamic variables on translations
+For more details, see the [Getting Started Guide](docs/GETTING_STARTED.md).
 
-All translation strings support dynamic variables to be inserted without translate.
-Use the fmt.Printf syntax (from Go's "fmt" package) to specify how to print the non-translated variable inside the translation string.
+---
+
+## CLI Tool (xgotext)
+`gotext` includes a command-line tool to extract translatable strings from your Go source code.
+
+**Install xgotext:**
+```bash
+go install github.com/leonelquinteros/gotext/cli/xgotext@latest
+```
+
+**Extract strings:**
+```bash
+xgotext -in . -out locales/templates
+```
+The command generates `.pot` templates under `locales/templates`; merge those templates into language-specific `.po` files.
+
+See the [xgotext Documentation](docs/xgotext.md) for full usage details.
+
+---
+
+## Advanced Usage
+
+### Using Locale object
+For managing multiple languages or domains independently:
 
 ```go
-import (
-    "fmt"
-    "github.com/leonelquinteros/gotext"
-)
-
-func main() {
-    // Configure package
-    gotext.Configure("/path/to/locales/root/dir", "en_UK", "domain-name")
-
-    // Set variables
-    name := "John"
-
-    // Translate text with variables
-    fmt.Println(gotext.Get("Hi, my name is %s", name))
-}
-
+l := gotext.NewLocale("/path/to/locales", "es_UY")
+l.AddDomain("default")
+fmt.Println(l.Get("Translate this"))
 ```
 
-
-## Using Locale object
-
-When having multiple languages/domains/libraries at the same time, you can create Locale objects for each variation
-so you can handle each settings on their own.
+### Use plural forms of translations
+`gotext` handles complex pluralization rules defined in PO headers:
 
 ```go
-import (
-    "fmt"
-    "github.com/leonelquinteros/gotext"
-)
-
-func main() {
-    // Create Locale with library path and language code
-    l := gotext.NewLocale("/path/to/locales/root/dir", "es_UY")
-
-    // Load domain '/path/to/locales/root/dir/es_UY/default.po'
-    l.AddDomain("default")
-
-    // Translate text from default domain
-    fmt.Println(l.Get("Translate this"))
-
-    // Load different domain
-    l.AddDomain("translations")
-
-    // Translate text from domain
-    fmt.Println(l.GetD("translations", "Translate this"))
-}
+// GetN(singular, plural, quantity, args...)
+fmt.Println(gotext.GetN("I have one apple.", "I have %d apples.", 5, 5))
 ```
+See the [Plural Forms Guide](docs/PLURALS.md) for more examples.
 
-This is also helpful for using inside templates (from the "text/template" package), where you can pass the Locale object to the template.
-If you set the Locale object as "Loc" in the template, then the template code would look like:
-
-```
-{{ .Loc.Get "Translate this" }}
-```
-
-
-## Using the Po object to handle .po files and PO-formatted strings
-
-For when you need to work with PO files and strings,
-you can directly use the Po object to parse it and access the translations in there in the same way.
-
+### Using dynamic variables on translations
+Supports standard `fmt` package syntax:
 ```go
-import (
-    "fmt"
-    "github.com/leonelquinteros/gotext"
-)
-
-func main() {
-    // Set PO content
-    str := `
-msgid "Translate this"
-msgstr "Translated text"
-
-msgid "Another string"
-msgstr ""
-
-msgid "One with var: %s"
-msgstr "This one sets the var: %s"
-`
-
-    // Create Po object
-    po := gotext.NewPo()
-    po.Parse(str)
-
-    fmt.Println(po.Get("Translate this"))
-}
+name := "John"
+fmt.Println(gotext.Get("Hi, my name is %s", name))
 ```
 
+### More advanced scenarios
+- **Embedded translation files** (`embed.FS`) and named `%(name)s` formatting: see the [Advanced Usage Guide](docs/ADVANCED.md).
+- **Languages fallback**: pass multiple languages to `Configure` as a colon-separated list (`gotext.Configure("/path/to/locales", "es_UY:es:en_US", "default")`).
+- **Serialization/caching** of parsed locales: `Locale.MarshalBinary` / `UnmarshalBinary`.
 
-## Use plural forms of translations
-
-PO format supports defining one or more plural forms for the same translation.
-Relying on the PO file headers, a Plural-Forms formula can be set on the translation file
-as defined in (https://www.gnu.org/savannah-checkouts/gnu/gettext/manual/html_node/Plural-forms.html)
-
-```go
-import (
-    "fmt"
-    "github.com/leonelquinteros/gotext"
-)
-
-func main() {
-    // Set PO content
-    str := `
-msgid ""
-msgstr ""
-
-# Header below
-"Plural-Forms: nplurals=2; plural=(n != 1);\n"
-
-msgid "Translate this"
-msgstr "Translated text"
-
-msgid "Another string"
-msgstr ""
-
-msgid "One with var: %s"
-msgid_plural "Several with vars: %s"
-msgstr[0] "This one is the singular: %s"
-msgstr[1] "This one is the plural: %s"
-`
-
-    // Create Po object
-    po := new(gotext.Po)
-    po.Parse(str)
-
-    fmt.Println(po.GetN("One with var: %s", "Several with vars: %s", 54, v))
-    // "This one is the plural: Variable"
-}
-```
-
-
-# Locales directories structure
-
-The package will assume a directories structure starting with a base path that will be provided to the package configuration
-or to object constructors depending on the use, but either will use the same convention to lookup inside the base path.
-
-Inside the base directory where will be the language directories named using the language and country 2-letter codes (en_US, es_AR, ...).
-All package functions can lookup after the simplified version for each language in case the full code isn't present but the more general language code exists.
-So if the language set is `en_UK`, but there is no directory named after that code and there is a directory named `en`,
-all package functions will be able to resolve this generalization and provide translations for the more general library.
-
-The language codes are assumed to be [ISO 639-1](https://en.wikipedia.org/wiki/List_of_ISO_639-1_codes) codes (2-letter codes).
-That said, most functions will work with any coding standard as long the directory name matches the language code set on the configuration.
-
-Then, there can be a `LC_MESSAGES` containing all PO files or the PO files themselves.
-A library directory structure can look like:
+---
 
+## Locales directories structure
+The package expects a standard Gettext directory structure:
 ```
 /path/to/locales
-/path/to/locales/en_US
-/path/to/locales/en_US/LC_MESSAGES
-/path/to/locales/en_US/LC_MESSAGES/default.po
-/path/to/locales/en_US/LC_MESSAGES/extras.po
-/path/to/locales/en_UK
-/path/to/locales/en_UK/LC_MESSAGES
-/path/to/locales/en_UK/LC_MESSAGES/default.po
-/path/to/locales/en_UK/LC_MESSAGES/extras.po
-/path/to/locales/en_AU
-/path/to/locales/en_AU/LC_MESSAGES
-/path/to/locales/en_AU/LC_MESSAGES/default.po
-/path/to/locales/en_AU/LC_MESSAGES/extras.po
-/path/to/locales/es
-/path/to/locales/es/default.po
-/path/to/locales/es/extras.po
-/path/to/locales/es_ES
-/path/to/locales/es_ES/default.po
-/path/to/locales/es_ES/extras.po
-/path/to/locales/fr
-/path/to/locales/fr/default.po
-/path/to/locales/fr/extras.po
+  /en_US
+    /LC_MESSAGES
+      default.po
+  /es_ES
+    /LC_MESSAGES
+      default.po
 ```
+Translation files can live either inside an `LC_MESSAGES` subdirectory or directly under the language code (`/es_ES/default.po`); both layouts are supported.
 
-And so on...
+It supports automatic language simplification (e.g., falling back from `en_UK` to `en`).
 
+---
 
-# Contribute
+## Contributing
+We welcome contributions of all kinds! 
+- [Contributing Guidelines](CONTRIBUTING.md)
+- [Code of Conduct](CODE_OF_CONDUCT.md)
 
-- Please, contribute.
-- Use the package on your projects.
-- Report issues on Github.
-- Send pull requests for bugfixes and improvements.
-- Send proposals on Github issues.
+---
 
+## License
+`gotext` is released under the [MIT License](LICENSE).

vendor/github.com/leonelquinteros/gotext/domain.go

@@ -4,7 +4,7 @@ import (
 	"bytes"
 	"encoding/gob"
 	"fmt"
-	"regexp"
+	"maps"
 	"sort"
 	"strconv"
 	"strings"
@@ -64,9 +64,6 @@ func (m HeaderMap) Del(key string) {
 
 // Get value for key from HeaderMap
 func (m HeaderMap) Get(key string) string {
-	if m == nil {
-		return ""
-	}
 	v := m[key]
 	if len(v) == 0 {
 		return ""
@@ -81,9 +78,6 @@ func (m HeaderMap) Set(key, value string) {
 
 // Values returns all values for a given key from HeaderMap
 func (m HeaderMap) Values(key string) []string {
-	if m == nil {
-		return nil
-	}
 	return m[key]
 }
 
@@ -100,29 +94,111 @@ func NewDomain() *Domain {
 	return domain
 }
 
+func cloneRefs(refs []string) []string {
+	if refs == nil {
+		return nil
+	}
+
+	owned := make([]string, len(refs))
+	copy(owned, refs)
+	return owned
+}
+
+func cloneHeaderMap(headers HeaderMap) HeaderMap {
+	if headers == nil {
+		return nil
+	}
+
+	owned := make(HeaderMap, len(headers))
+	for key, values := range headers {
+		owned[key] = cloneRefs(values)
+	}
+	return owned
+}
+
+func cloneTranslation(trans *Translation) *Translation {
+	if trans == nil {
+		return nil
+	}
+
+	owned := NewTranslation()
+	owned.ID = trans.ID
+	owned.PluralID = trans.PluralID
+	owned.dirty = trans.dirty
+	owned.Refs = cloneRefs(trans.Refs)
+
+	maps.Copy(owned.Trs, trans.Trs)
+
+	return owned
+}
+
+func cloneTranslations(translations map[string]*Translation) map[string]*Translation {
+	if translations == nil {
+		return nil
+	}
+
+	owned := make(map[string]*Translation, len(translations))
+	for id, trans := range translations {
+		owned[id] = cloneTranslation(trans)
+	}
+	return owned
+}
+
+func cloneContextTranslations(contexts map[string]map[string]*Translation) map[string]map[string]*Translation {
+	if contexts == nil {
+		return nil
+	}
+
+	owned := make(map[string]map[string]*Translation, len(contexts))
+	for context, translations := range contexts {
+		owned[context] = cloneTranslations(translations)
+	}
+	return owned
+}
+
+func (do *Domain) hasTranslation(id string) bool {
+	do.trMutex.RLock()
+	defer do.trMutex.RUnlock()
+
+	return do.translations[id] != nil
+}
+
+func (do *Domain) hasContextTranslation(id, context string) bool {
+	do.trMutex.RLock()
+	defer do.trMutex.RUnlock()
+
+	return do.contextTranslations[context][id] != nil
+}
+
 // SetPluralResolver sets a custom plural resolver function
 func (do *Domain) SetPluralResolver(f func(int) int) {
+	do.pluralMutex.Lock()
+	defer do.pluralMutex.Unlock()
+
 	do.customPluralResolver = f
 }
 
 func (do *Domain) pluralForm(n int) int {
-	// do we really need locking here? not sure how this plurals.Expression works, so sticking with it for now
+	// Snapshot plural state before calling an expression or custom resolver.
 	do.pluralMutex.RLock()
-	defer do.pluralMutex.RUnlock()
+	pluralforms := do.pluralforms
+	customPluralResolver := do.customPluralResolver
+	do.pluralMutex.RUnlock()
+
+	if pluralforms != nil {
+		return pluralforms.Eval(uint32(n))
+	}
 
 	// Failure fallback
-	if do.pluralforms == nil {
-		if do.customPluralResolver != nil {
-			return do.customPluralResolver(n)
-		}
-
-		/* Use the Germanic plural rule.  */
-		if n == 1 {
-			return 0
-		}
-		return 1
+	if customPluralResolver != nil {
+		return customPluralResolver(n)
 	}
-	return do.pluralforms.Eval(uint32(n))
+
+	/* Use the Germanic plural rule.  */
+	if n == 1 {
+		return 0
+	}
+	return 1
 }
 
 // parseHeaders retrieves data from previously parsed headers. it's called by both Mo and Po when parsing
@@ -136,18 +212,16 @@ func (do *Domain) parseHeaders() {
 	languageKey := "Language"
 	pluralFormsKey := "Plural-Forms"
 
-	rawLines := strings.Split(raw, "\n")
-	for _, line := range rawLines {
+	for line := range strings.SplitSeq(raw, "\n") {
 		if len(line) == 0 {
 			continue
 		}
 
-		colonIdx := strings.Index(line, ":")
-		if colonIdx < 0 {
+		key, value, ok := strings.Cut(line, ":")
+		if !ok {
 			continue
 		}
 
-		key := line[:colonIdx]
 		lowerKey := strings.ToLower(key)
 		if lowerKey == strings.ToLower(languageKey) {
 			languageKey = key
@@ -155,7 +229,7 @@ func (do *Domain) parseHeaders() {
 			pluralFormsKey = key
 		}
 
-		value := strings.TrimSpace(line[colonIdx+1:])
+		value = strings.TrimSpace(value)
 		do.Headers.Add(key, value)
 	}
 
@@ -168,22 +242,18 @@ func (do *Domain) parseHeaders() {
 		return
 	}
 
-	// Split plural form header value
-	pfs := strings.Split(do.PluralForms, ";")
-
-	// Parse values
-	for _, i := range pfs {
-		vs := strings.SplitN(i, "=", 2)
-		if len(vs) != 2 {
+	for i := range strings.SplitSeq(do.PluralForms, ";") {
+		key, value, ok := strings.Cut(i, "=")
+		if !ok {
 			continue
 		}
 
-		switch strings.TrimSpace(vs[0]) {
+		switch strings.TrimSpace(key) {
 		case "nplurals":
-			do.nplurals, _ = strconv.Atoi(vs[1])
+			do.nplurals, _ = strconv.Atoi(value)
 
 		case "plural":
-			do.plural = vs[1]
+			do.plural = value
 
 			if expr, err := plurals.Compile(do.plural); err == nil {
 				do.pluralforms = expr
@@ -221,17 +291,19 @@ func (do *Domain) DropStaleTranslations() {
 
 // SetRefs set source references for a given translation
 func (do *Domain) SetRefs(str string, refs []string) {
+	ownedRefs := cloneRefs(refs)
+
 	do.trMutex.Lock()
 	do.pluralMutex.Lock()
 	defer do.trMutex.Unlock()
 	defer do.pluralMutex.Unlock()
 
-	if trans, ok := do.translations[str]; ok {
-		trans.Refs = refs
+	if trans, ok := do.translations[str]; ok && trans != nil {
+		trans.SetRefs(ownedRefs)
 	} else {
-		trans = NewTranslation()
+		trans := NewTranslation()
 		trans.ID = str
-		trans.SetRefs(refs)
+		trans.SetRefs(ownedRefs)
 		do.translations[str] = trans
 	}
 }
@@ -243,8 +315,8 @@ func (do *Domain) GetRefs(str string) []string {
 	defer do.trMutex.RUnlock()
 
 	if do.translations != nil {
-		if trans, ok := do.translations[str]; ok {
-			return trans.Refs
+		if trans, ok := do.translations[str]; ok && trans != nil {
+			return cloneRefs(trans.Refs)
 		}
 	}
 	return nil
@@ -268,7 +340,7 @@ func (do *Domain) Set(id, str string) {
 }
 
 // Get retrieves the Translation for the given string.
-func (do *Domain) Get(str string, vars ...interface{}) string {
+func (do *Domain) Get(str string, vars ...any) string {
 	// Sync read
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
@@ -284,8 +356,8 @@ func (do *Domain) Get(str string, vars ...interface{}) string {
 }
 
 // Append retrieves the Translation for the given string.
-// Supports optional parameters (vars... interface{}) to be inserted on the formatted string using the fmt.Printf syntax.
-func (do *Domain) Append(b []byte, str string, vars ...interface{}) []byte {
+// Supports optional parameters (vars... any) to be inserted on the formatted string using the fmt.Printf syntax.
+func (do *Domain) Append(b []byte, str string, vars ...any) []byte {
 	// Sync read
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
@@ -322,40 +394,48 @@ func (do *Domain) SetN(id, plural string, n int, str string) {
 }
 
 // GetN retrieves the (N)th plural form of Translation for the given string.
-// Supports optional parameters (vars... interface{}) to be inserted on the formatted string using the fmt.Printf syntax.
-func (do *Domain) GetN(str, plural string, n int, vars ...interface{}) string {
+// Supports optional parameters (vars... any) to be inserted on the formatted string using the fmt.Printf syntax.
+func (do *Domain) GetN(str, plural string, n int, vars ...any) string {
+	// Get plural form before acquiring the translation lock so a custom
+	// resolver is never called while a project lock is held.
+	pluralForm := do.pluralForm(n)
+
 	// Sync read
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
 
 	if do.translations != nil {
 		if _, ok := do.translations[str]; ok {
-			return FormatString(do.translations[str].GetN(do.pluralForm(n)), vars...)
+			return FormatString(do.translations[str].GetN(pluralForm), vars...)
 		}
 	}
 
 	// Parse plural forms to distinguish between plural and singular
-	if do.pluralForm(n) == 0 {
+	if pluralForm == 0 {
 		return FormatString(str, vars...)
 	}
 	return FormatString(plural, vars...)
 }
 
 // AppendN adds the (N)th plural form of Translation for the given string.
-// Supports optional parameters (vars... interface{}) to be inserted on the formatted string using the fmt.Printf syntax.
-func (do *Domain) AppendN(b []byte, str, plural string, n int, vars ...interface{}) []byte {
+// Supports optional parameters (vars... any) to be inserted on the formatted string using the fmt.Printf syntax.
+func (do *Domain) AppendN(b []byte, str, plural string, n int, vars ...any) []byte {
+	// Get plural form before acquiring the translation lock so a custom
+	// resolver is never called while a project lock is held.
+	pluralForm := do.pluralForm(n)
+
 	// Sync read
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
 
 	if do.translations != nil {
 		if _, ok := do.translations[str]; ok {
-			return Appendf(b, do.translations[str].GetN(do.pluralForm(n)), vars...)
+			return Appendf(b, do.translations[str].GetN(pluralForm), vars...)
 		}
 	}
 
 	// Parse plural forms to distinguish between plural and singular
-	if do.pluralForm(n) == 0 {
+	if pluralForm == 0 {
 		return Appendf(b, str, vars...)
 	}
 	return Appendf(b, plural, vars...)
@@ -388,8 +468,8 @@ func (do *Domain) SetC(id, ctx, str string) {
 }
 
 // GetC retrieves the corresponding Translation for a given string in the given context.
-// Supports optional parameters (vars... interface{}) to be inserted on the formatted string using the fmt.Printf syntax.
-func (do *Domain) GetC(str, ctx string, vars ...interface{}) string {
+// Supports optional parameters (vars... any) to be inserted on the formatted string using the fmt.Printf syntax.
+func (do *Domain) GetC(str, ctx string, vars ...any) string {
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
 
@@ -408,8 +488,8 @@ func (do *Domain) GetC(str, ctx string, vars ...interface{}) string {
 }
 
 // AppendC retrieves the corresponding Translation for a given string in the given context.
-// Supports optional parameters (vars... interface{}) to be inserted on the formatted string using the fmt.Printf syntax.
-func (do *Domain) AppendC(b []byte, str, ctx string, vars ...interface{}) []byte {
+// Supports optional parameters (vars... any) to be inserted on the formatted string using the fmt.Printf syntax.
+func (do *Domain) AppendC(b []byte, str, ctx string, vars ...any) []byte {
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
 
@@ -443,12 +523,14 @@ func (do *Domain) SetNC(id, plural, ctx string, n int, str string) {
 		} else {
 			trans = NewTranslation()
 			trans.ID = id
+			trans.PluralID = plural
 			trans.SetN(pluralForm, str)
 			context[id] = trans
 		}
 	} else {
 		trans := NewTranslation()
 		trans.ID = id
+		trans.PluralID = plural
 		trans.SetN(pluralForm, str)
 		do.contextTranslations[ctx] = map[string]*Translation{
 			id: trans,
@@ -457,19 +539,22 @@ func (do *Domain) SetNC(id, plural, ctx string, n int, str string) {
 }
 
 // GetNC retrieves the (N)th plural form of Translation for the given string in the given context.
-// Supports optional parameters (vars... interface{}) to be inserted on the formatted string using the fmt.Printf syntax.
-func (do *Domain) GetNC(str, plural string, n int, ctx string, vars ...interface{}) string {
-	do.trMutex.RLock()
-	defer do.trMutex.RUnlock()
+// Supports optional parameters (vars... any) to be inserted on the formatted string using the fmt.Printf syntax.
+func (do *Domain) GetNC(str, plural string, n int, ctx string, vars ...any) string {
+	if do.hasContextTranslation(str, ctx) {
+		// Get plural form before acquiring the translation lock so a custom
+		// resolver is never called while a project lock is held.
+		pluralForm := do.pluralForm(n)
 
-	if do.contextTranslations != nil {
-		if _, ok := do.contextTranslations[ctx]; ok {
-			if do.contextTranslations[ctx] != nil {
-				if _, ok := do.contextTranslations[ctx][str]; ok {
-					return FormatString(do.contextTranslations[ctx][str].GetN(do.pluralForm(n)), vars...)
-				}
+		do.trMutex.RLock()
+		if translations, ok := do.contextTranslations[ctx]; ok && translations != nil {
+			if trans, ok := translations[str]; ok && trans != nil {
+				translated := trans.GetN(pluralForm)
+				do.trMutex.RUnlock()
+				return FormatString(translated, vars...)
 			}
 		}
+		do.trMutex.RUnlock()
 	}
 
 	if n == 1 {
@@ -479,19 +564,22 @@ func (do *Domain) GetNC(str, plural string, n int, ctx string, vars ...interface
 }
 
 // AppendNC retrieves the (N)th plural form of Translation for the given string in the given context.
-// Supports optional parameters (vars... interface{}) to be inserted on the formatted string using the fmt.Printf syntax.
-func (do *Domain) AppendNC(b []byte, str, plural string, n int, ctx string, vars ...interface{}) []byte {
-	do.trMutex.RLock()
-	defer do.trMutex.RUnlock()
+// Supports optional parameters (vars... any) to be inserted on the formatted string using the fmt.Printf syntax.
+func (do *Domain) AppendNC(b []byte, str, plural string, n int, ctx string, vars ...any) []byte {
+	if do.hasContextTranslation(str, ctx) {
+		// Get plural form before acquiring the translation lock so a custom
+		// resolver is never called while a project lock is held.
+		pluralForm := do.pluralForm(n)
 
-	if do.contextTranslations != nil {
-		if _, ok := do.contextTranslations[ctx]; ok {
-			if do.contextTranslations[ctx] != nil {
-				if _, ok := do.contextTranslations[ctx][str]; ok {
-					return Appendf(b, do.contextTranslations[ctx][str].GetN(do.pluralForm(n)), vars...)
-				}
+		do.trMutex.RLock()
+		if translations, ok := do.contextTranslations[ctx]; ok && translations != nil {
+			if trans, ok := translations[str]; ok && trans != nil {
+				translated := trans.GetN(pluralForm)
+				do.trMutex.RUnlock()
+				return Appendf(b, translated, vars...)
 			}
 		}
+		do.trMutex.RUnlock()
 	}
 
 	if n == 1 {
@@ -507,6 +595,14 @@ func (do *Domain) IsTranslated(str string) bool {
 
 // IsTranslatedN reports whether a plural string is translated
 func (do *Domain) IsTranslatedN(str string, n int) bool {
+	if !do.hasTranslation(str) {
+		return false
+	}
+
+	// Get plural form before acquiring the translation lock so a custom
+	// resolver is never called while a project lock is held.
+	pluralForm := do.pluralForm(n)
+
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
 
@@ -514,10 +610,10 @@ func (do *Domain) IsTranslatedN(str string, n int) bool {
 		return false
 	}
 	tr, ok := do.translations[str]
-	if !ok {
+	if !ok || tr == nil {
 		return false
 	}
-	return tr.IsTranslatedN(do.pluralForm(n))
+	return tr.IsTranslatedN(pluralForm)
 }
 
 // IsTranslatedC reports whether a context string is translated
@@ -527,6 +623,14 @@ func (do *Domain) IsTranslatedC(str, ctx string) bool {
 
 // IsTranslatedNC reports whether a plural context string is translated
 func (do *Domain) IsTranslatedNC(str string, n int, ctx string) bool {
+	if !do.hasContextTranslation(str, ctx) {
+		return false
+	}
+
+	// Get plural form before acquiring the translation lock so a custom
+	// resolver is never called while a project lock is held.
+	pluralForm := do.pluralForm(n)
+
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
 
@@ -534,36 +638,24 @@ func (do *Domain) IsTranslatedNC(str string, n int, ctx string) bool {
 		return false
 	}
 	translations, ok := do.contextTranslations[ctx]
-	if !ok {
+	if !ok || translations == nil {
 		return false
 	}
 	tr, ok := translations[str]
-	if !ok {
+	if !ok || tr == nil {
 		return false
 	}
-	return tr.IsTranslatedN(do.pluralForm(n))
+	return tr.IsTranslatedN(pluralForm)
 }
 
 // GetTranslations returns a copy of every translation in the domain. It does not support contexts.
 func (do *Domain) GetTranslations() map[string]*Translation {
-	all := make(map[string]*Translation, len(do.translations))
-
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
 
+	all := make(map[string]*Translation, len(do.translations))
 	for msgID, trans := range do.translations {
-		newTrans := NewTranslation()
-		newTrans.ID = trans.ID
-		newTrans.PluralID = trans.PluralID
-		newTrans.dirty = trans.dirty
-		if len(trans.Refs) > 0 {
-			newTrans.Refs = make([]string, len(trans.Refs))
-			copy(newTrans.Refs, trans.Refs)
-		}
-		for k, v := range trans.Trs {
-			newTrans.Trs[k] = v
-		}
-		all[msgID] = newTrans
+		all[msgID] = cloneTranslation(trans)
 	}
 
 	return all
@@ -571,32 +663,18 @@ func (do *Domain) GetTranslations() map[string]*Translation {
 
 // GetCtxTranslations returns a copy of every translation in the domain with context
 func (do *Domain) GetCtxTranslations() map[string]map[string]*Translation {
-	all := make(map[string]map[string]*Translation, len(do.contextTranslations))
-
 	do.trMutex.RLock()
 	defer do.trMutex.RUnlock()
 
+	all := make(map[string]map[string]*Translation, len(do.contextTranslations))
 	for ctx, translations := range do.contextTranslations {
 		for msgID, trans := range translations {
-			newTrans := NewTranslation()
-			newTrans.ID = trans.ID
-			newTrans.PluralID = trans.PluralID
-			newTrans.dirty = trans.dirty
-			if len(trans.Refs) > 0 {
-				newTrans.Refs = make([]string, len(trans.Refs))
-				copy(newTrans.Refs, trans.Refs)
-			}
-			for k, v := range trans.Trs {
-				newTrans.Trs[k] = v
-			}
-
 			if all[ctx] == nil {
 				all[ctx] = make(map[string]*Translation)
 			}
 
-			all[ctx][msgID] = newTrans
+			all[ctx][msgID] = cloneTranslation(trans)
 		}
-
 	}
 
 	return all
@@ -604,10 +682,11 @@ func (do *Domain) GetCtxTranslations() map[string]map[string]*Translation {
 
 // SourceReference is a struct to hold source reference information
 type SourceReference struct {
-	path    string
-	line    int
-	context string
-	trans   *Translation
+	path       string
+	line       int
+	context    string
+	hasContext bool
+	trans      *Translation
 }
 
 func extractPathAndLine(ref string) (string, int) {
@@ -627,6 +706,11 @@ func extractPathAndLine(ref string) (string, int) {
 // MarshalText implements encoding.TextMarshaler interface
 // Assists round-trip of POT/PO content
 func (do *Domain) MarshalText() ([]byte, error) {
+	do.trMutex.RLock()
+	do.pluralMutex.RLock()
+	defer do.trMutex.RUnlock()
+	defer do.pluralMutex.RUnlock()
+
 	var buf bytes.Buffer
 	if len(do.headerComments) > 0 {
 		buf.WriteString(strings.Join(do.headerComments, "\n"))
@@ -681,31 +765,29 @@ func (do *Domain) MarshalText() ([]byte, error) {
 		v := do.Headers[k]
 
 		for _, value := range v {
-			buf.WriteString("\n\"" + k + ": " + value + "\\n\"")
+			encoded := EscapeSpecialCharacters(k + ": " + value + "\n")
+			buf.WriteString("\n\"" + encoded + "\"")
 		}
 	}
 
 	// Just as with headers, output translations in consistent order (to minimise diffs between round-trips), with (first) source reference taking priority, followed by context and finally ID
 	references := make([]SourceReference, 0)
 	for name, ctx := range do.contextTranslations {
-		for id, trans := range ctx {
-			if id == "" {
-				continue
-			}
+		for _, trans := range ctx {
 			if len(trans.Refs) > 0 {
 				path, line := extractPathAndLine(trans.Refs[0])
 				references = append(references, SourceReference{
-					path,
-					line,
-					name,
-					trans,
+					path:       path,
+					line:       line,
+					context:    name,
+					hasContext: true,
+					trans:      trans,
 				})
 			} else {
 				references = append(references, SourceReference{
-					"",
-					0,
-					name,
-					trans,
+					context:    name,
+					hasContext: true,
+					trans:      trans,
 				})
 			}
 		}
@@ -719,17 +801,13 @@ func (do *Domain) MarshalText() ([]byte, error) {
 		if len(trans.Refs) > 0 {
 			path, line := extractPathAndLine(trans.Refs[0])
 			references = append(references, SourceReference{
-				path,
-				line,
-				"",
-				trans,
+				path:  path,
+				line:  line,
+				trans: trans,
 			})
 		} else {
 			references = append(references, SourceReference{
-				"",
-				0,
-				"",
-				trans,
+				trans: trans,
 			})
 		}
 	}
@@ -754,6 +832,9 @@ func (do *Domain) MarshalText() ([]byte, error) {
 		if references[i].context > references[j].context {
 			return false
 		}
+		if references[i].hasContext != references[j].hasContext {
+			return !references[i].hasContext
+		}
 		return references[i].trans.ID < references[j].trans.ID
 	})
 
@@ -765,7 +846,7 @@ func (do *Domain) MarshalText() ([]byte, error) {
 			buf.WriteByte(byte('\n'))
 		}
 
-		if ref.context == "" {
+		if !ref.hasContext {
 			buf.WriteString("\nmsgid \"" + EscapeSpecialCharacters(trans.ID) + "\"")
 		} else {
 			buf.WriteString("\nmsgctxt \"" + EscapeSpecialCharacters(ref.context) + "\"\nmsgid \"" + EscapeSpecialCharacters(trans.ID) + "\"")
@@ -774,9 +855,16 @@ func (do *Domain) MarshalText() ([]byte, error) {
 		if trans.PluralID == "" {
 			buf.WriteString("\nmsgstr \"" + EscapeSpecialCharacters(trans.Trs[0]) + "\"")
 		} else {
-			buf.WriteString("\nmsgid_plural \"" + trans.PluralID + "\"")
-			for i, tr := range trans.Trs {
-				buf.WriteString("\nmsgstr[" + EscapeSpecialCharacters(strconv.Itoa(i)) + "] \"" + tr + "\"")
+			buf.WriteString("\nmsgid_plural \"" + EscapeSpecialCharacters(trans.PluralID) + "\"")
+
+			pluralIndexes := make([]int, 0, len(trans.Trs))
+			for i := range trans.Trs {
+				pluralIndexes = append(pluralIndexes, i)
+			}
+			sort.Ints(pluralIndexes)
+
+			for _, i := range pluralIndexes {
+				buf.WriteString("\nmsgstr[" + strconv.Itoa(i) + "] \"" + EscapeSpecialCharacters(trans.Trs[i]) + "\"")
 			}
 		}
 	}
@@ -786,8 +874,23 @@ func (do *Domain) MarshalText() ([]byte, error) {
 
 // EscapeSpecialCharacters escapes special characters in a string
 func EscapeSpecialCharacters(s string) string {
-	s = regexp.MustCompile(`([^\\])(")`).ReplaceAllString(s, "$1\\\"") // Escape non-escaped double quotation marks
+	var escaped strings.Builder
+	escaped.Grow(len(s))
 
+	for i := range len(s) {
+		switch s[i] {
+		case '\\':
+			escaped.WriteByte('\\')
+			escaped.WriteByte('\\')
+		case '"':
+			escaped.WriteByte('\\')
+			escaped.WriteByte('"')
+		default:
+			escaped.WriteByte(s[i])
+		}
+	}
+
+	s = escaped.String()
 	if strings.Count(s, "\n") == 0 {
 		return s
 	}
@@ -821,16 +924,26 @@ func EscapeSpecialCharacters(s string) string {
 	return strings.Join(data, "\n")
 }
 
+func (do *Domain) translatorEncodingSnapshot() *TranslatorEncoding {
+	do.trMutex.RLock()
+	do.pluralMutex.RLock()
+	defer do.trMutex.RUnlock()
+	defer do.pluralMutex.RUnlock()
+
+	return &TranslatorEncoding{
+		Headers:      cloneHeaderMap(do.Headers),
+		Language:     do.Language,
+		PluralForms:  do.PluralForms,
+		Nplurals:     do.nplurals,
+		Plural:       do.plural,
+		Translations: cloneTranslations(do.translations),
+		Contexts:     cloneContextTranslations(do.contextTranslations),
+	}
+}
+
 // MarshalBinary implements encoding.BinaryMarshaler interface
 func (do *Domain) MarshalBinary() ([]byte, error) {
-	obj := new(TranslatorEncoding)
-	obj.Headers = do.Headers
-	obj.Language = do.Language
-	obj.PluralForms = do.PluralForms
-	obj.Nplurals = do.nplurals
-	obj.Plural = do.plural
-	obj.Translations = do.translations
-	obj.Contexts = do.contextTranslations
+	obj := do.translatorEncodingSnapshot()
 
 	var buff bytes.Buffer
 	encoder := gob.NewEncoder(&buff)
@@ -845,22 +958,68 @@ func (do *Domain) UnmarshalBinary(data []byte) error {
 	obj := new(TranslatorEncoding)
 
 	decoder := gob.NewDecoder(buff)
-	err := decoder.Decode(obj)
-	if err != nil {
+	if err := decoder.Decode(obj); err != nil {
 		return err
 	}
 
-	do.Headers = obj.Headers
+	headers := cloneHeaderMap(obj.Headers)
+	if headers == nil {
+		headers = make(HeaderMap)
+	}
+	translations := cloneTranslations(obj.Translations)
+	if translations == nil {
+		translations = make(map[string]*Translation)
+	}
+	contextTranslations := cloneContextTranslations(obj.Contexts)
+	if contextTranslations == nil {
+		contextTranslations = make(map[string]map[string]*Translation)
+	}
+
+	for id, trans := range translations {
+		if trans == nil {
+			trans = NewTranslation()
+			trans.ID = id
+			translations[id] = trans
+		}
+	}
+	for context, translationsForContext := range contextTranslations {
+		if translationsForContext == nil {
+			contextTranslations[context] = make(map[string]*Translation)
+			continue
+		}
+		for id, trans := range translationsForContext {
+			if trans == nil {
+				trans = NewTranslation()
+				trans.ID = id
+				translationsForContext[id] = trans
+			}
+		}
+	}
+
+	var pluralforms plurals.Expression
+	if expr, err := plurals.Compile(obj.Plural); err == nil {
+		pluralforms = expr
+	}
+
+	do.trMutex.Lock()
+	do.pluralMutex.Lock()
+
+	do.Headers = headers
 	do.Language = obj.Language
 	do.PluralForms = obj.PluralForms
 	do.nplurals = obj.Nplurals
 	do.plural = obj.Plural
-	do.translations = obj.Translations
-	do.contextTranslations = obj.Contexts
+	do.pluralforms = pluralforms
+	do.translations = translations
+	do.contextTranslations = contextTranslations
+	do.pluralTranslations = make(map[string]*Translation)
+	do.headerComments = make([]string, 0)
+	do.trBuffer = nil
+	do.ctxBuffer = ""
+	do.refBuffer = ""
 
-	if expr, err := plurals.Compile(do.plural); err == nil {
-		do.pluralforms = expr
-	}
+	do.pluralMutex.Unlock()
+	do.trMutex.Unlock()
 
 	return nil
 }