add --pindigests flag

* also run `go mod vendor`

.gitattributes

@@ -1 +0,0 @@
-vendor/** linguist-generated=true

cli/recipe/release.go

@@ -92,7 +92,7 @@ your private key and enter your passphrase beforehand.
 			log.Fatal(err)
 		}
 
-		mainAppVersion := formatter.RemoveSha(imagesTmp[mainApp])
+		mainAppVersion := imagesTmp[mainApp]
 		if mainAppVersion == "" {
 			log.Fatal(i18n.G("main app service version for %s is empty?", recipe.Name))
 		}
@@ -192,9 +192,6 @@ likely to change.
 						serviceMeta := serviceVersions[serviceName]
 
 						existingImageTag := fmt.Sprintf("%s:%s", serviceMeta.Image, serviceMeta.Tag)
-						if serviceMeta.Digest != "" {
-							existingImageTag += "@" + serviceMeta.Digest
-						}
 						newImageTag := fmt.Sprintf("%s:%s", serviceMeta.Image, imagesTmp[serviceMeta.Image])
 
 						if existingImageTag == newImageTag {
@@ -334,8 +331,10 @@ func GetImageVersions(recipe recipePkg.Recipe) (map[string]string, error) {
 
 		path = formatter.StripTagMeta(path)
 
+		var tag string
 		switch img.(type) {
 		case reference.NamedTagged:
+			tag = img.(reference.NamedTagged).Tag()
 		case reference.Named:
 			if service.Name == "app" {
 				missingTag = true
@@ -343,7 +342,7 @@ func GetImageVersions(recipe recipePkg.Recipe) (map[string]string, error) {
 			continue
 		}
 
-		services[path] = formatter.GetTagAndDigest(img)
+		services[path] = tag
 	}
 
 	if missingTag {

cli/recipe/upgrade.go

@@ -130,7 +130,7 @@ interface.`),
 		}
 
 		for _, service := range config.Services {
-			img, err := reference.ParseNormalizedNamed(formatter.RemoveSha(service.Image))
+			img, err := reference.ParseNormalizedNamed(service.Image)
 			if err != nil {
 				log.Fatal(err)
 			}
@@ -178,14 +178,9 @@ interface.`),
 
 			sort.Sort(tagcmp.ByTagDesc(compatible))
 
-			var upgradeTag string
 			if len(compatible) == 0 && !allTags {
 				log.Info(i18n.G("no new versions available for %s, assuming %s is the latest (use -a/--all-tags to see all anyway)", image, tag))
-
-				if !shouldPin(service.Image, internal.PinDigests) {
-					continue
-				}
-				upgradeTag = tag.String()
+				continue // skip on to the next tag and don't update any compose files
 			}
 
 			catlVersions, err := recipePkg.VersionsOfService(recipe.Name, service.Name, internal.Offline)
@@ -208,8 +203,9 @@ interface.`),
 
 			log.Debug(i18n.G("detected compatible upgradable tags %s for %s", compatibleStrings, service.Name))
 
+			var upgradeTag string
 			_, ok := servicePins[service.Name]
-			if upgradeTag == "" && versionsPresent && ok {
+			if versionsPresent && ok {
 				pinnedTag := servicePins[service.Name].version
 				if tag.IsLessThan(pinnedTag) {
 					pinnedTagString := pinnedTag.String()
@@ -231,7 +227,7 @@ interface.`),
 					log.Fatal(i18n.G("service %s is at version %s, but pinned to %s, please correct your compose.yml file manually!", service.Name, tag.String(), pinnedTag.String()))
 					continue
 				}
-			} else if upgradeTag == "" {
+			} else {
 				if bumpType != 0 {
 					for _, upTag := range compatible {
 						upElement, err := tag.UpgradeDelta(upTag)
@@ -246,10 +242,7 @@ interface.`),
 					}
 					if upgradeTag == "" {
 						log.Warn(i18n.G("not upgrading from %s to %s for %s, because the upgrade type is more serious than what user wants", tag.String(), compatible[0].String(), image))
-						if !shouldPin(service.Image, internal.PinDigests) {
-							continue
-						}
-						upgradeTag = tag.String()
+						continue
 					}
 				} else {
 					msg := i18n.G("upgrade to which tag? (service: %s, image: %s, tag: %s)", service.Name, image, tag)
@@ -300,21 +293,27 @@ interface.`),
 				}
 			}
 			if upgradeTag != "skip" {
+				var ok bool
+				var err error
 				var resolvedDigest string
-				if shouldPin(service.Image, internal.PinDigests) {
-					resolvedDigest, err = client.GetImageMultiplatformDigest(img, upgradeTag)
-					if err != nil {
-						log.Fatal(i18n.G("failed to resolve digest for %s:%s: %s", image, upgradeTag, err.Error()))
-					}
-				}
 
-				ok, err := recipe.UpdateTag(service.Image, upgradeTag, resolvedDigest)
+				if internal.PinDigests {
+					digest, dErr := client.GetImageDigest(img, upgradeTag)
+					if dErr != nil {
+						log.Fatal(i18n.G("failed to resolve digest for %s:%s: %s", image, upgradeTag, dErr.Error()))
+					}
+					resolvedDigest = digest
+
+					ok, err = recipe.UpdatePinnedTag(image, upgradeTag, digest)
+				} else {
+					ok, err = recipe.UpdateTag(image, upgradeTag)
+				}
 
 				if err != nil {
 					log.Fatal(err)
 				}
 				if ok {
-					if shouldPin(service.Image, internal.PinDigests) {
+					if internal.PinDigests {
 						log.Info(i18n.G("tag upgraded and pinned from %s to %s@%s for %s", tag.String(), upgradeTag, resolvedDigest, image))
 					} else {
 						log.Info(i18n.G("tag upgraded from %s to %s for %s", tag.String(), upgradeTag, image))
@@ -384,12 +383,6 @@ interface.`),
 	},
 }
 
-// shouldPin reports whether a service image should be pinned to a digest.
-// An image that is already pinned stays pinned, even without --pindigests.
-func shouldPin(image string, pinDigestsFlag bool) bool {
-	return pinDigestsFlag || strings.Contains(image, "@sha256:")
-}
-
 var (
 	allTags      bool
 	createCommit bool
@@ -448,7 +441,7 @@ func init() {
 		&internal.PinDigests,
 		i18n.G("pindigests"),
 		i18n.GC("p", "pin container image by digest"),
-		true,
+		false,
 		i18n.G("pin the container image version by manifest digest (image:tag@sha256:...)"),
 	)
 }

cli/recipe/upgrade_test.go

@@ -1,22 +0,0 @@
-package recipe
-
-import "testing"
-
-func TestShouldPin(t *testing.T) {
-	tests := []struct {
-		image      string
-		pinDigests bool
-		want       bool
-	}{
-		{"nginx:1.21.0", false, false},
-		{"nginx:1.21.0", true, true},
-		{"nginx:1.21.0@sha256:2bcabc23b45489fb0885d69a06ba1d648aeda973fae7bb981bafbb884165e514", false, true},
-		{"nginx:1.21.0@sha256:2bcabc23b45489fb0885d69a06ba1d648aeda973fae7bb981bafbb884165e514", true, true},
-	}
-
-	for _, test := range tests {
-		if got := shouldPin(test.image, test.pinDigests); got != test.want {
-			t.Errorf("shouldPin(%q, %v) = %v, want %v", test.image, test.pinDigests, got, test.want)
-		}
-	}
-}

go.mod

@@ -21,7 +21,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/regclient/regclient v0.11.5
 	github.com/schollz/progressbar/v3 v3.19.1
-	golang.org/x/term v0.46.0
+	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
@@ -155,7 +155,7 @@ require (
 	github.com/stretchr/testify v1.12.1
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.48.0
+	golang.org/x/sys v0.47.0
 )
 
 replace github.com/docker/cli v28.4.0+incompatible => git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible

go.sum

@@ -1148,13 +1148,13 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

pkg/client/registry.go

@@ -13,6 +13,8 @@ import (
 	"github.com/regclient/regclient/types/ref"
 )
 
+var rc = regclient.New()
+
 // GetRegistryTags retrieves all tags of an image from a container registry.
 func GetRegistryTags(img reference.Named) ([]string, error) {
 	var tags []string
@@ -33,30 +35,20 @@ func GetRegistryTags(img reference.Named) ([]string, error) {
 
 // GetImageDigest resolves the content digest (sha256:...) for a specific
 // image:tag reference by querying the registry manifest. This gives us a
-// digest to pin to while keeping support for multi-arch deployments
-// See: https://docs.docker.com/build/building/multi-platform/#why-multi-platform-builds
-// and: https://docs.docker.com/dhi/explore/security-concepts/digests/#multi-platform-images-and-manifests
-func GetImageMultiplatformDigest(img reference.Named, tag string) (string, error) {
-	tagged, err := reference.WithTag(reference.TrimNamed(img), tag)
+// digest to pin to while keeping support for multi-arch deployments: when
+// the tag points at a manifest list/OCI index, the digest returned is the
+// digest of that top-level index, so the pin still resolves correctly
+// regardless of the deploying host's architecture.
+func GetImageDigest(img reference.Named, tag string) (string, error) {
+	r, err := ref.New(fmt.Sprintf("%s:%s", img.Name(), tag))
 	if err != nil {
-		return "", errors.New(i18n.G("failed to parse image %s:%s, saw: %s", img.Name(), tag, err.Error()))
+		return "", fmt.Errorf("parsing reference %s:%s: %w", img.Name(), tag, err)
 	}
-	r, err := ref.New(tagged.String())
-	if err != nil {
-		return "", errors.New(i18n.G("failed to parse image %s:%s, saw: %s", img.Name(), tag, err.Error()))
-	}
-
-	rc := regclient.New(regclient.WithDockerCreds())
 
 	m, err := rc.ManifestHead(context.Background(), r)
 	if err != nil {
-		return "", errors.New(i18n.G("failed to fetch manifest for %s:%s, saw: %s", img.Name(), tag, err.Error()))
+		return "", fmt.Errorf("fetching manifest for %s:%s: %w", img.Name(), tag, err)
 	}
 
-	digest := m.GetDescriptor().Digest.String()
-	if digest == "" {
-		return "", errors.New(i18n.G("registry did not return a digest for %s:%s", img.Name(), tag))
-	}
-
-	return digest, nil
+	return m.GetDescriptor().Digest.String(), nil
 }

pkg/deploy/utils.go

@@ -171,7 +171,7 @@ func GetImagesForStack(cl *dockerClient.Client, app appPkg.App) (map[string]stri
 				images[imageBaseName] = ""
 				continue
 			}
-			imageTag := formatter.GetTagAndDigest(namedTag)
+			imageTag := namedTag.Tag()
 
 			existingImageVersion, ok := images[imageBaseName]
 			if !ok {
@@ -294,7 +294,7 @@ func GatherImagesForDeploy(cl *dockerClient.Client, app appPkg.App, compose *com
 			newImages[imageBaseName] = ""
 			continue
 		}
-		imageTag := formatter.GetTagAndDigest(namedTag)
+		imageTag := namedTag.Tag()
 
 		existingImageVersion, ok := newImages[imageBaseName]
 		if !ok {
@@ -312,10 +312,6 @@ func GatherImagesForDeploy(cl *dockerClient.Client, app appPkg.App, compose *com
 	var imageInfo []string
 	for newImageName, newImageVersion := range newImages {
 		if currentVersion, exists := currentImages[newImageName]; exists {
-			// Swarm adds a resolved digest even for unpinned compose images.
-			if !strings.Contains(newImageVersion, "@") {
-				currentVersion = formatter.RemoveSha(currentVersion)
-			}
 			if currentVersion == newImageVersion {
 				if showUnchanged {
 					imageInfo = append(imageInfo, i18n.G("%s: %s (unchanged)", formatter.StripTagMeta(newImageName), newImageVersion))

pkg/formatter/formatter.go

@@ -11,7 +11,6 @@ import (
 	"coopcloud.tech/abra/pkg/i18n"
 	"github.com/charmbracelet/lipgloss"
 	"github.com/charmbracelet/lipgloss/table"
-	"github.com/distribution/reference"
 	"github.com/docker/go-units"
 	"golang.org/x/term"
 
@@ -41,18 +40,6 @@ func RemoveSha(str string) string {
 	return strings.Split(str, "@")[0]
 }
 
-// GetTagAndDigest returns the tag and any digest for comparison and display.
-func GetTagAndDigest(image reference.Named) string {
-	var version string
-	if tagged, ok := image.(reference.NamedTagged); ok {
-		version = tagged.Tag()
-	}
-	if pinned, ok := image.(reference.Digested); ok {
-		version += "@" + pinned.Digest().String()
-	}
-	return version
-}
-
 // HumanDuration from docker/cli RunningFor() to be accessible outside of the class
 func HumanDuration(timestamp int64) string {
 	date := time.Unix(timestamp, 0)
@@ -236,8 +223,7 @@ func CreateProgressbar(length int, title string) *progressbar.ProgressBar {
 	)
 }
 
-// StripTagMeta strips front-matter image tag data that we don't need for parsing,
-// like registry host and library prefix.
+// StripTagMeta strips front-matter image tag data that we don't need for parsing.
 func StripTagMeta(image string) string {
 	originalImage := image
 

pkg/formatter/formatter_test.go

@@ -3,13 +3,12 @@ package formatter
 import (
 	"testing"
 
-	"github.com/distribution/reference"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestRemoveSha(t *testing.T) {
-	assert.Equal(t, "nginx:latest", RemoveSha("nginx:latest@sha256:1234567890abcdef"))
-	assert.Equal(t, "nginx:latest", RemoveSha("nginx:latest"))
+	assert.Equal(t, "ubuntu:latest", RemoveSha("ubuntu:latest@sha256:1234567890abcdef"))
+	assert.Equal(t, "ubuntu:latest", RemoveSha("ubuntu:latest"))
 	assert.Equal(t, "my-repo/my-image:v1", RemoveSha("my-repo/my-image:v1@sha256:abcdef1234567890"))
 	assert.Equal(t, "my-repo/my-image", RemoveSha("my-repo/my-image@sha256:abcdef1234567890"))
 }
@@ -17,21 +16,3 @@ func TestRemoveSha(t *testing.T) {
 func TestBoldDirtyDefault(t *testing.T) {
 	assert.Equal(t, "foo", BoldDirtyDefault("foo"))
 }
-
-func TestGetTagAndDigest(t *testing.T) {
-	digest := "sha256:908dc23e643a1447dbfb2e189ed268bfde6a51a5bf9a34d3dd3440a24f58ccf7"
-	for _, tc := range []struct{ image, want string }{
-		{"nginx:1.21.6", "1.21.6"},
-		{"ghcr.io/foo/bar:1.0@" + digest, "1.0@" + digest},
-		{"nginx@" + digest, "@" + digest},
-		{"nginx", ""},
-	} {
-		img, err := reference.ParseNormalizedNamed(tc.image)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if got := GetTagAndDigest(img); got != tc.want {
-			t.Errorf("%s: got %s, want %s", tc.image, got, tc.want)
-		}
-	}
-}

pkg/git/clone.go

@@ -52,6 +52,7 @@ func Clone(dir, url string) error {
 				URL:           url,
 				Tags:          git.AllTags,
 				ReferenceName: plumbing.ReferenceName("refs/heads/main"),
+				SingleBranch:  true,
 			})
 
 			if err != nil && gitCloneIgnoreErr(err) {
@@ -70,6 +71,7 @@ func Clone(dir, url string) error {
 					URL:           url,
 					Tags:          git.AllTags,
 					ReferenceName: plumbing.ReferenceName("refs/heads/master"),
+					SingleBranch:  true,
 				})
 
 				if err != nil && gitCloneIgnoreErr(err) {

pkg/lint/recipe.go

@@ -125,13 +125,6 @@ var LintRules = map[string][]LintRule{
 			HowToResolve: i18n.G("reduce length of secret names to 12 chars"),
 			Function:     LintSecretLengths,
 		},
-		{
-			Ref:          "R016",
-			Level:        i18n.G("warn"),
-			Description:  i18n.G("all images use a digest"),
-			HowToResolve: i18n.G("use a digest for all images"),
-			Function:     LintAllImagesTaggedWithDigest,
-		},
 	},
 	"error": {
 		{
@@ -340,28 +333,6 @@ func LintAllImagesTagged(recipe recipe.Recipe) (bool, error) {
 	return true, nil
 }
 
-func LintAllImagesTaggedWithDigest(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
-	if err != nil {
-		return false, err
-	}
-	for _, service := range config.Services {
-		img, err := reference.ParseNormalizedNamed(service.Image)
-		if err != nil {
-			return false, err
-		}
-		if reference.IsNameOnly(img) {
-			return false, nil
-		}
-		_, ok := img.(reference.Digested)
-		if !ok {
-			return false, nil
-		}
-	}
-
-	return true, nil
-}
-
 func LintNoUnstableTags(recipe recipe.Recipe) (bool, error) {
 	config, err := recipe.GetComposeConfig(nil)
 	if err != nil {

pkg/recipe/catalogue_e2e_test.go

@@ -1,82 +0,0 @@
-package recipe
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"coopcloud.tech/abra/pkg/config"
-	gitPkg "coopcloud.tech/abra/pkg/git"
-	"github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/plumbing"
-)
-
-// Use the test recipe at the given commit, in a temporary recipes directory.
-func setupTestRecipe(t *testing.T, commit string) Recipe {
-	t.Helper()
-	// Other tests in this package use the real RECIPES_DIR.
-	recipesDir := config.RECIPES_DIR
-	config.RECIPES_DIR = t.TempDir()
-	t.Cleanup(func() { config.RECIPES_DIR = recipesDir })
-
-	r := Get("abra-test-recipe")
-	if err := gitPkg.Clone(r.Dir, "https://git.coopcloud.tech/toolshed/abra-test-recipe"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := r.EnsureVersion(commit); err != nil {
-		t.Fatal(err)
-	}
-	return r
-}
-
-func TestGetRecipeVersionsIncludesDigest(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping e2e test in short mode")
-	}
-	// https://git.coopcloud.tech/toolshed/abra-test-recipe/commit/4f0642719d2e2a568f4350cf7eea182438d58be3
-	r := setupTestRecipe(t, "4f0642719d2e2a568f4350cf7eea182438d58be3")
-	repo, err := git.PlainOpen(r.Dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for version, commit := range map[string]string{
-		"9.0.0+1.21.5": "4f0642719d2e2a568f4350cf7eea182438d58be3",
-		"9.0.1+1.21.6": "77d752b3c61a71bfb2c45f40ec07c9d626a0e580",
-	} {
-		if _, err := repo.CreateTag(version, plumbing.NewHash(commit), nil); err != nil {
-			t.Fatal(err)
-		}
-	}
-	versions, _, err := r.GetRecipeVersions()
-	if err != nil {
-		t.Fatal(err)
-	}
-	found := map[string]ServiceMeta{}
-	for _, version := range versions {
-		for tag, services := range version {
-			if strings.HasPrefix(tag, "9.0.") {
-				found[tag] = services["app"]
-			}
-		}
-	}
-	pinned := found["9.0.0+1.21.5"]
-	if pinned.Tag != "1.21.5" || pinned.Digest != "sha256:0d17b565c37bcbd895e9d92315a05c1c3c9a29f762b011a10c54a66cd53c9b31" {
-		t.Fatalf("got pinned metadata %+v", pinned)
-	}
-	unpinned := found["9.0.1+1.21.6"]
-	if unpinned.Tag != "1.21.6" || unpinned.Digest != "" {
-		t.Fatalf("got unpinned metadata %+v", unpinned)
-	}
-	for _, tc := range []struct {
-		meta       ServiceMeta
-		wantDigest bool
-	}{{pinned, true}, {unpinned, false}} {
-		encoded, err := json.Marshal(tc.meta)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if strings.Contains(string(encoded), `"digest"`) != tc.wantDigest {
-			t.Fatalf("unexpected JSON %s", encoded)
-		}
-	}
-}

pkg/recipe/compose.go

@@ -6,7 +6,6 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
-	"regexp"
 	"strings"
 
 	"coopcloud.tech/abra/pkg/formatter"
@@ -111,23 +110,10 @@ func (r Recipe) GetVersionLabelLocal() (string, error) {
 	return label, nil
 }
 
-var sha256Digest = regexp.MustCompile(`^sha256:[a-f0-9]{64}$`)
-
 // UpdateTag updates an image tag in-place on file system local compose files.
-// A non-empty digest pins the tag (image:tag@sha256:...).
-func (r Recipe) UpdateTag(image, tag, digest string) (bool, error) {
-	// Optional parameter, but must be a valid sha256 digest if provided.
-	if digest != "" && !sha256Digest.MatchString(digest) {
-		return false, errors.New(i18n.G("invalid digest %s, want sha256:<64 hex digits>", digest))
-	}
-
+func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 	fullPattern := fmt.Sprintf("%s/compose**yml", r.Dir)
-	source, parseErr := reference.ParseNormalizedNamed(image)
-	_, exactImage := source.(reference.NamedTagged)
-	if parseErr != nil {
-		return false, parseErr
-	}
-	imageName := formatter.StripTagMeta(reference.Path(source))
+	image = formatter.StripTagMeta(image)
 
 	composeFiles, err := filepath.Glob(fullPattern)
 	if err != nil {
@@ -155,48 +141,99 @@ func (r Recipe) UpdateTag(image, tag, digest string) (bool, error) {
 				continue // may be a compose.$optional.yml file
 			}
 
-			img, err := reference.ParseNormalizedNamed(formatter.RemoveSha(service.Image))
+			img, _ := reference.ParseNormalizedNamed(service.Image)
 			if err != nil {
 				return false, err
 			}
 
+			var composeTag string
 			switch img.(type) {
 			case reference.NamedTagged:
+				composeTag = img.(reference.NamedTagged).Tag()
 			default:
 				log.Debug(i18n.G("unable to parse %s, skipping", img))
 				continue
 			}
 
-			// Found image that needs replacing
 			composeImage := formatter.StripTagMeta(reference.Path(img))
-			if imageName == composeImage && (!exactImage || service.Image == image) {
+
+			log.Debug(i18n.G("parsed %s from %s", composeTag, service.Image))
+
+			if image == composeImage {
+				bytes, err := ioutil.ReadFile(composeFile)
+				if err != nil {
+					return false, err
+				}
+
+				old := fmt.Sprintf("%s:%s", composeImage, composeTag)
+				new := fmt.Sprintf("%s:%s", composeImage, tag)
+				if old == new {
+					continue
+				}
+
+				replacedBytes := strings.Replace(string(bytes), old, new, -1)
+
+				log.Debug(i18n.G("updating %s to %s in %s", old, new, compose.Filename))
+
+				if err := os.WriteFile(compose.Filename, []byte(replacedBytes), 0o764); err != nil {
+					return false, err
+				}
+				updated = true
+			}
+		}
+	}
+
+	return updated, nil
+}
+
+// UpdatePinnedTag updates an image reference to a pinned version (image:tag@sha256:...) in-place on local compose files.
+func (r Recipe) UpdatePinnedTag(image, tag, digest string) (bool, error) {
+	glob := fmt.Sprintf("%s/compose**yml", r.Dir)
+	image = formatter.StripTagMeta(image)
+
+	composeFiles, err := filepath.Glob(glob)
+	if err != nil {
+		return false, err
+	}
+
+	updated := false
+	for _, composeFile := range composeFiles {
+		opts := stack.Deploy{Composefiles: []string{composeFile}}
+
+		sampleEnv, err := r.SampleEnv()
+		if err != nil {
+			return false, err
+		}
+
+		compose, err := loader.LoadComposefile(opts, sampleEnv)
+		if err != nil {
+			return false, err
+		}
+
+		for _, service := range compose.Services {
+			if service.Image == "" {
+				continue
+			}
+
+			img, _ := reference.ParseNormalizedNamed(formatter.StripDigest(service.Image))
+			composeImage := formatter.StripTagMeta(reference.Path(img))
+
+			if image == composeImage {
 				bytes, err := ioutil.ReadFile(composeFile)
 				if err != nil {
 					return false, err
 				}
 
 				old := service.Image
-				tagged, err := reference.WithTag(reference.TrimNamed(img), tag)
-				if err != nil {
-					return false, err
-				}
-				new := reference.FamiliarString(tagged)
-				if digest != "" {
-					new += "@" + digest
-				}
+				new := fmt.Sprintf("%s:%s@%s", composeImage, tag, digest)
+
 				if old == new {
 					continue
 				}
 
-				// Don't confuse digests if the image isn't an exact match. E.g. if old is postgres:13, don't
-				// match postgres:13-alpine
-				pattern := regexp.MustCompile(`(?m)(^\s*image:\s*["']?)` + regexp.QuoteMeta(old) + `(["']?\s*(?:#.*)?$)`)
-				replacedBytes := pattern.ReplaceAllString(string(bytes), "${1}"+new+"${2}")
-				if replacedBytes == string(bytes) {
-					continue
-				}
+				replacedBytes := strings.Replace(string(bytes), old, new, -1)
 
-				log.Debug(i18n.G("updating %s to %s in %s", old, new, compose.Filename))
+				log.Debug(i18n.G("updating pinned reference %s to %s in %s", old, new, compose.Filename))
 
 				if err := os.WriteFile(compose.Filename, []byte(replacedBytes), 0o764); err != nil {
 					return false, err

pkg/recipe/git.go

@@ -16,7 +16,6 @@ import (
 	"coopcloud.tech/tagcmp"
 	"github.com/distribution/reference"
 	"github.com/go-git/go-git/v5"
-	gitCfg "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 )
 
@@ -164,7 +163,7 @@ func (r Recipe) EnsureVersion(version string) (bool, error) {
 
 		hash, err := repo.ResolveRevision(plumbing.Revision(version))
 		if err != nil {
-			return isChaosCommit, errors.New(i18n.G("unable to resolve '%s': %s", version, err))
+			log.Fatal(i18n.G("unable to resolve '%s': %s", version, err))
 		}
 
 		opts = &git.CheckoutOptions{Hash: *hash, Create: false, Force: true}
@@ -175,11 +174,11 @@ func (r Recipe) EnsureVersion(version string) (bool, error) {
 
 	worktree, err := repo.Worktree()
 	if err != nil {
-		return isChaosCommit, err
+		return isChaosCommit, nil
 	}
 
 	if err := worktree.Checkout(opts); err != nil {
-		return isChaosCommit, err
+		return isChaosCommit, nil
 	}
 
 	log.Debug(i18n.G("successfully checked %s out to %s in %s", r.Name, tagRef.Short(), r.Dir))
@@ -263,12 +262,7 @@ func (r Recipe) EnsureUpToDate() error {
 		return errors.New(i18n.G("unable to check out default branch in %s: %s", r.Dir, err))
 	}
 
-	// the refspec is passed explicitly, because a repository cloned by an older abra has a
-	// single-branch refspec stored in its config and would otherwise never see other branches
-	fetchOpts := &git.FetchOptions{
-		Tags:     git.AllTags,
-		RefSpecs: []gitCfg.RefSpec{"+refs/heads/*:refs/remotes/origin/*"},
-	}
+	fetchOpts := &git.FetchOptions{Tags: git.AllTags}
 	if err := repo.Fetch(fetchOpts); err != nil {
 		if !strings.Contains(err.Error(), "already up-to-date") {
 			return errors.New(i18n.G("unable to fetch tags in %s: %s", r.Dir, err))
@@ -452,11 +446,10 @@ func (r Recipe) GetRecipeVersions() (RecipeVersions, []string, error) {
 				continue
 			}
 
-			meta := ServiceMeta{Image: path, Tag: tag}
-			if pinned, ok := img.(reference.Digested); ok {
-				meta.Digest = pinned.Digest().String()
+			versionMeta[service.Name] = ServiceMeta{
+				Image: path,
+				Tag:   tag,
 			}
-			versionMeta[service.Name] = meta
 		}
 
 		versions = append(versions, map[string]map[string]ServiceMeta{tag: versionMeta})

pkg/recipe/recipe.go

@@ -39,9 +39,8 @@ type service = string
 
 // ServiceMeta represents meta info associated with a service.
 type ServiceMeta struct {
-	Image  string `json:"image"`
-	Tag    string `json:"tag"`
-	Digest string `json:"digest,omitempty"`
+	Image string `json:"image"`
+	Tag   string `json:"tag"`
 }
 
 // RecipeVersions are the versions associated with a recipe.

pkg/secret/testdir/compose.yaml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.31.5
+    image: nginx:1.31.4
     secrets:
       - test_pass_one
       - test_pass_two

tests/integration/app_deploy.bats

@@ -702,65 +702,3 @@ teardown(){
   assert_failure
   assert_output --partial "unexpected character"
 }
-
-# Deploy pinned 1.21.5, upgrade to pinned 1.21.6, then roll back to 1.21.5.
-# bats test_tags=slow
-@test "deploy, upgrade and rollback digest-pinned images" {
-  recipeDir="$ABRA_DIR/recipes/$TEST_RECIPE"
-  service="${TEST_APP_DOMAIN//./_}_app"
-
-  # Manually upgrade the unpinned 0.3.5 recipe to 1.21.5 and pin it.
-  run git -C "$recipeDir" checkout "0.3.5+1.21.0"
-  assert_success
-  run docker pull nginx:1.21.5
-  assert_success
-  run docker image inspect --format '{{index .RepoDigests 0}}' nginx:1.21.5
-  assert_success
-  oldImage="nginx:1.21.5@${output#*@}"
-  run sed -i "s|image: nginx:1.21.0|image: $oldImage|" "$recipeDir/compose.yml"
-  assert_success
-
-  # Label and tag the local recipe release so app commands can track it.
-  run sed -i 's/version=0.3.5+1.21.0/version=0.4.0+1.21.5/' "$recipeDir/compose.yml"
-  assert_success
-  _git_commit
-  run git -C "$recipeDir" tag "0.4.0+1.21.5"
-  assert_success
-
-  # Manually upgrade and pin the next release to 1.21.6.
-  run docker pull nginx:1.21.6
-  assert_success
-  run docker image inspect --format '{{index .RepoDigests 0}}' nginx:1.21.6
-  assert_success
-  newImage="nginx:1.21.6@${output#*@}"
-  run sed -i "s|image: $oldImage|image: $newImage|" "$recipeDir/compose.yml"
-  assert_success
-
-  # Update the release label to match the next recipe tag.
-  run sed -i 's/version=0.4.0+1.21.5/version=0.4.1+1.21.6/' "$recipeDir/compose.yml"
-  assert_success
-  _git_commit
-  run git -C "$recipeDir" tag "0.4.1+1.21.6"
-  assert_success
-
-  # Deploy recipe 0.4.0 with the exact pinned 1.21.5 image.
-  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.4.0+1.21.5" --offline --no-input --no-converge-checks
-  assert_success
-  run docker service inspect --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}' "$service"
-  assert_success
-  assert_output "$oldImage"
-
-  # Upgrade to recipe 0.4.1 and the exact pinned 1.21.6 image.
-  run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.4.1+1.21.6" --offline --no-input --no-converge-checks
-  assert_success
-  run docker service inspect --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}' "$service"
-  assert_success
-  assert_output "$newImage"
-
-  # Roll back to recipe 0.4.0 and its original pinned image.
-  run $ABRA app rollback "$TEST_APP_DOMAIN" "0.4.0+1.21.5" --offline --no-input --no-converge-checks
-  assert_success
-  run docker service inspect --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}' "$service"
-  assert_success
-  assert_output "$oldImage"
-}

tests/integration/app_new.bats

@@ -122,39 +122,6 @@ teardown(){
   assert_failure
 }
 
-@test "create new app with commit from another branch" {
-  branchHash=$(_get_other_branch_hash)
-  if [[ -z "$branchHash" ]]; then
-    skip "$TEST_RECIPE has no branch besides main"
-  fi
-
-  # re-clone the recipe the way an older abra did, with a single-branch refspec. --no-local
-  # forces a real transfer, a local clone would hardlink the whole object database and leave
-  # the commit reachable
-  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
-  assert_success
-
-  run git clone -q --no-local --single-branch --branch main \
-    "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" "$ABRA_DIR/recipes/$TEST_RECIPE"
-  assert_success
-
-  # the commit has to be genuinely missing, otherwise this test passes for the wrong reason
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-parse --verify "$branchHash^{commit}"
-  assert_failure
-
-  run $ABRA app new "$TEST_RECIPE" "$branchHash" \
-    --no-input \
-    --server "$TEST_SERVER" \
-    --domain "$TEST_APP_DOMAIN"
-  assert_success
-  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-
-  # the recipe names itself in TYPE, which differs per branch, so only the version is checked
-  run grep -q "TYPE=.*:${branchHash}$" \
-    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_success
-}
-
 @test "does not overwrite existing env files" {
   run $ABRA app new "$TEST_RECIPE" \
     --no-input \

tests/integration/helpers/git.bash

@@ -56,13 +56,6 @@ _get_tag_hash() {
   echo $(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-list -n 1 "$1")
 }
 
-_get_other_branch_hash() {
-  # asked from the origin mirror, not from the recipe checkout, so that the result does not
-  # depend on what has been fetched. empty when the recipe only has a default branch
-  echo $(git ls-remote "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" \
-    | grep 'refs/heads/' | grep -v 'refs/heads/main$' | head -1 | cut -f1)
-}
-
 _get_head_hash() {
   echo $(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show -s --format="%H" HEAD)
 }

tests/resources/test_recipe/compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.31.5
+    image: nginx:1.31.4
     networks:
       - proxy
     deploy:

vendor/github.com/pjbgf/sha1cd/Dockerfile.arm

@@ -1,4 +1,4 @@
-FROM golang:1.27@sha256:512690a5660563b57d37ecc31129e7f136e831db2aed24a1dbeb8ad7380dc0fa
+FROM golang:1.27@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb
 
 ENV GOOS=linux
 ENV GOARCH=arm

vendor/github.com/pjbgf/sha1cd/Dockerfile.arm64

@@ -1,4 +1,4 @@
-FROM golang:1.27@sha256:512690a5660563b57d37ecc31129e7f136e831db2aed24a1dbeb8ad7380dc0fa
+FROM golang:1.27@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb
 
 ENV GOOS=linux
 ENV GOARCH=arm64

vendor/golang.org/x/sys/cpu/cpu.go

@@ -182,13 +182,12 @@ var MIPS64X struct {
 // require kernel support to work (DARN, SCV), so there are feature bits for
 // those as well. The struct is padded to avoid false sharing.
 var PPC64 struct {
-	_         CacheLinePad
-	HasDARN   bool // Hardware random number generator (requires kernel enablement)
-	HasSCV    bool // Syscall vectored (requires kernel enablement)
-	IsPOWER8  bool // ISA v2.07 (POWER8)
-	IsPOWER9  bool // ISA v3.00 (POWER9), implies IsPOWER8
-	IsPOWER10 bool // ISA v3.1 (POWER10 and POWER11; POWER11 did not add a new architected level), implies IsPOWER9
-	_         CacheLinePad
+	_        CacheLinePad
+	HasDARN  bool // Hardware random number generator (requires kernel enablement)
+	HasSCV   bool // Syscall vectored (requires kernel enablement)
+	IsPOWER8 bool // ISA v2.07 (POWER8)
+	IsPOWER9 bool // ISA v3.00 (POWER9), implies IsPOWER8
+	_        CacheLinePad
 }
 
 // S390X contains the supported CPU features of the current IBM Z
@@ -249,21 +248,13 @@ var RISCV64 struct {
 	HasZvks           bool // ShangMi Algorithm Suite
 	HasZvksc          bool // ShangMi Algorithm Suite with carryless multiplication
 	HasZvksg          bool // ShangMi Algorithm Suite with GCM
-	VLENB             uint // Vector register length in bytes, 0 if undetected
 	_                 CacheLinePad
 }
 
-// doDerived, if non-nil, is called after processing GODEBUG to set "derived"
-// feature flags.
-var doDerived func()
-
 func init() {
 	archInit()
 	initOptions()
 	processOptions()
-	if doDerived != nil {
-		doDerived()
-	}
 }
 
 // options contains the cpu debug options that can be used in GODEBUG.

vendor/golang.org/x/sys/cpu/cpu_gc_riscv64.go

@@ -1,11 +0,0 @@
-// Copyright 2026 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build gc
-
-package cpu
-
-// Can only be called when the vector extension is present.
-// Implemented in cpu_riscv64.s.
-func readVLENB() uint

vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go

@@ -11,7 +11,6 @@ const (
 	// ISA Level
 	_PPC_FEATURE2_ARCH_2_07 = 0x80000000
 	_PPC_FEATURE2_ARCH_3_00 = 0x00800000
-	_PPC_FEATURE2_ARCH_3_1  = 0x00040000
 
 	// CPU features
 	_PPC_FEATURE2_DARN = 0x00200000
@@ -22,9 +21,6 @@ func doinit() {
 	// HWCAP2 feature bits
 	PPC64.IsPOWER8 = isSet(hwCap2, _PPC_FEATURE2_ARCH_2_07)
 	PPC64.IsPOWER9 = isSet(hwCap2, _PPC_FEATURE2_ARCH_3_00)
-	// ISA 3.1 covers both POWER10 and POWER11: POWER11 did not introduce a
-	// new architected HWCAP level, so there is no separate IsPOWER11.
-	PPC64.IsPOWER10 = isSet(hwCap2, _PPC_FEATURE2_ARCH_3_1)
 	PPC64.HasDARN = isSet(hwCap2, _PPC_FEATURE2_DARN)
 	PPC64.HasSCV = isSet(hwCap2, _PPC_FEATURE2_SCV)
 }

vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go

@@ -130,9 +130,6 @@ func doinit() {
 			RISCV64.HasFastMisaligned = v == riscv_HWPROBE_MISALIGNED_FAST
 		}
 	}
-	if RISCV64.HasV {
-		RISCV64.VLENB = readVLENB()
-	}
 
 	// Let's double check with HWCAP if the C extension does not appear to be supported.
 	// This may happen if we're running on a kernel older than 6.4.
@@ -140,14 +137,6 @@ func doinit() {
 	if !RISCV64.HasC {
 		RISCV64.HasC = isSet(hwCap, hwcap_RISCV_ISA_C)
 	}
-
-	doDerived = func() {
-		// If the vector extension is disabled by GODEBUG, then the VLENB is zero.
-		if !RISCV64.HasV {
-			RISCV64.VLENB = 0
-		}
-	}
-
 }
 
 func isSet(hwc uint, value uint) bool {

vendor/golang.org/x/sys/cpu/cpu_netbsd_amd64.go

@@ -1,47 +0,0 @@
-// Copyright 2026 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build netbsd && amd64 && gc
-
-package cpu
-
-func doinit() {
-	// NetBSD corrupts avx registers when receiving signals.
-	// See issue 80285.
-	// TODO: when NetBSD fixes the bug, add a version
-	// check and skip here.
-	X86.HasAVX = false
-	X86.HasAVX2 = false
-	// Set these also, just to be safe
-	X86.HasAVXVNNI = false
-	X86.HasAVX512 = false
-	X86.HasAVX512F = false
-	X86.HasAVX512CD = false
-	X86.HasAVX512CD = false
-	X86.HasAVX512ER = false
-	X86.HasAVX512PF = false
-	X86.HasAVX512VL = false
-	X86.HasAVX512BW = false
-	X86.HasAVX512DQ = false
-	X86.HasAVX512IFMA = false
-	X86.HasAVX512VBMI = false
-	X86.HasAVX5124VNNIW = false
-	X86.HasAVX5124FMAPS = false
-	X86.HasAVX512VPOPCNTDQ = false
-	X86.HasAVX512VPCLMULQDQ = false
-	X86.HasAVX512VNNI = false
-	X86.HasAVX512GFNI = false
-	X86.HasAVX512VAES = false
-	X86.HasAVX512VBMI2 = false
-	X86.HasAVX512BITALG = false
-	X86.HasAVX512BF16 = false
-	X86.HasAVXIFMA = false
-	X86.HasAVXVNNI = false
-	X86.HasAVXVNNIInt8 = false
-
-}
-
-func darwinSupportsAVX512() bool {
-	panic("only implemented for gc && amd64 && darwin")
-}

vendor/golang.org/x/sys/cpu/cpu_other_x86.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build 386 || amd64p32 || (amd64 && ((!darwin && !netbsd) || !gc))
+//go:build 386 || amd64p32 || (amd64 && (!darwin || !gc))
 
 package cpu
 

vendor/golang.org/x/sys/cpu/cpu_riscv64.s

@@ -1,17 +0,0 @@
-// Copyright 2026 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build gc
-
-#include "textflag.h"
-
-// Read the vector register length in bytes from the vlenb CSR.
-// May only be called when the vector extension is present.
-// func readVLENB() uint
-TEXT ·readVLENB(SB), NOSPLIT|NOFRAME, $0-8
-	// Go 1.25's assembler does not recognize VLENB, so use its raw CSRR encoding.
-	// Replace WORD with CSRR VLENB, X10 once go.mod requires Go 1.27.
-	WORD	$0xc2202573
-	MOV	X10, ret+0(FP)
-	RET

vendor/golang.org/x/sys/cpu/cpu_sparc64.go

@@ -1,12 +0,0 @@
-// Copyright 2026 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build sparc64
-
-package cpu
-
-// The L1 line is 32 bytes; false sharing is governed by the 64-byte L2 line.
-const cacheLineSize = 64
-
-func initOptions() {}

vendor/golang.org/x/sys/unix/ifreq_linux.go

@@ -22,13 +22,7 @@ import (
 // fields can be get and set using the following methods:
 //   - Uint16/SetUint16: flags
 //   - Uint32/SetUint32: ifindex, metric, mtu
-type Ifreq struct {
-	// Aligns the union for the accessors below, which cast it in place;
-	// the generated ifreq is all byte arrays, so its alignment is one.
-	_ [0]int64
-
-	raw ifreq
-}
+type Ifreq struct{ raw ifreq }
 
 // NewIfreq creates an Ifreq with the input network interface name after
 // validating the name does not exceed IFNAMSIZ-1 (trailing NULL required)

vendor/golang.org/x/sys/unix/ioctl_linux.go

@@ -332,10 +332,3 @@ func IoctlLoopSetStatus64(fd int, value *LoopInfo64) error {
 func IoctlLoopConfigure(fd int, value *LoopConfig) error {
 	return ioctlPtr(fd, LOOP_CONFIGURE, unsafe.Pointer(value))
 }
-
-// IoctlPidfdInfo fetches information about a pidfd.
-// The Mask field of the info argument indicates which
-// values to fetch.
-func IoctlPidfdInfo(fd int, info *PidfdInfo) error {
-	return ioctlPtr(fd, PIDFD_GET_INFO, unsafe.Pointer(info))
-}

vendor/golang.org/x/sys/unix/mkerrors.sh

@@ -290,7 +290,14 @@ struct ltchars {
 #include <mtd/mtd-user.h>
 #include <net/route.h>
 
+#if defined(__sparc__)
+// On sparc{,64}, the kernel defines struct termios2 itself which clashes with the
+// definition in glibc. As only the error constants are needed here, include the
+// generic termibits.h (which is included by termbits.h on sparc).
+#include <asm-generic/termbits.h>
+#else
 #include <asm/termbits.h>
+#endif
 
 #ifndef PTRACE_GETREGS
 #define PTRACE_GETREGS	0xc
@@ -537,7 +544,7 @@ ccflags="$@"
 		$2 ~ /^LO_(KEY|NAME)_SIZE$/ ||
 		$2 ~ /^LOOP_(CLR|CTL|GET|SET)_/ ||
 		$2 == "LOOP_CONFIGURE" ||
-		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MREMAP|MFD|MLOCK|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ ||
+		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MREMAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ ||
 		$2 ~ /^NFC_(GENL|PROTO|COMM|RF|SE|DIRECTION|LLCP|SOCKPROTO)_/ ||
 		$2 ~ /^NFC_.*_(MAX)?SIZE$/ ||
 		$2 ~ /^PTP_/ ||

vendor/golang.org/x/sys/unix/syscall.go

@@ -76,7 +76,7 @@ func BytePtrToString(p *byte) string {
 	// Find NUL terminator.
 	n := 0
 	for ptr := unsafe.Pointer(p); *(*byte)(ptr) != 0; n++ {
-		ptr = unsafe.Add(ptr, 1)
+		ptr = unsafe.Pointer(uintptr(ptr) + 1)
 	}
 
 	return string(unsafe.Slice(p, n))

vendor/golang.org/x/sys/unix/syscall_bsd.go

@@ -188,7 +188,7 @@ func (sa *SockaddrUnix) sockaddr() (unsafe.Pointer, _Socklen, error) {
 	}
 	sa.raw.Len = byte(3 + n) // 2 for Family, Len; 1 for NUL
 	sa.raw.Family = AF_UNIX
-	for i := range n {
+	for i := 0; i < n; i++ {
 		sa.raw.Path[i] = int8(name[i])
 	}
 	return unsafe.Pointer(&sa.raw), _Socklen(sa.raw.Len), nil

vendor/golang.org/x/sys/unix/syscall_linux.go

@@ -2363,7 +2363,7 @@ func (fh *FileHandle) Bytes() []byte {
 	if n == 0 {
 		return nil
 	}
-	return unsafe.Slice((*byte)(unsafe.Add(unsafe.Pointer(&fh.fileHandle.Type), 4)), n)
+	return unsafe.Slice((*byte)(unsafe.Pointer(uintptr(unsafe.Pointer(&fh.fileHandle.Type))+4)), n)
 }
 
 // NameToHandleAt wraps the name_to_handle_at system call; it obtains

vendor/golang.org/x/sys/unix/zerrors_linux.go

@@ -2048,7 +2048,6 @@ const (
 	MINIX3_SUPER_MAGIC                          = 0x4d5a
 	MINIX_SUPER_MAGIC                           = 0x137f
 	MINIX_SUPER_MAGIC2                          = 0x138f
-	MLOCK_ONFAULT                               = 0x1
 	MNT_DETACH                                  = 0x2
 	MNT_EXPIRE                                  = 0x4
 	MNT_FORCE                                   = 0x1
@@ -3863,7 +3862,6 @@ const (
 	TIOCPKT_NOSTOP                              = 0x10
 	TIOCPKT_START                               = 0x8
 	TIOCPKT_STOP                                = 0x4
-	TIOCSER_TEMT                                = 0x1
 	TIPC_ADDR_ID                                = 0x3
 	TIPC_ADDR_MCAST                             = 0x1
 	TIPC_ADDR_NAME                              = 0x2

vendor/golang.org/x/sys/unix/zerrors_linux_386.go

@@ -483,6 +483,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443

vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go

@@ -484,6 +484,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443

vendor/golang.org/x/sys/unix/zerrors_linux_arm.go

@@ -489,6 +489,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443

vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go

@@ -483,6 +483,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443

vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go

@@ -476,6 +476,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443

vendor/golang.org/x/sys/unix/zerrors_linux_mips.go

@@ -481,6 +481,7 @@ const (
 	TIOCSERGWILD                     = 0x5489
 	TIOCSERSETMULTI                  = 0x5490
 	TIOCSERSWILD                     = 0x548a
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x7401
 	TIOCSETN                         = 0x740a
 	TIOCSETP                         = 0x7409

vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go

@@ -481,6 +481,7 @@ const (
 	TIOCSERGWILD                     = 0x5489
 	TIOCSERSETMULTI                  = 0x5490
 	TIOCSERSWILD                     = 0x548a
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x7401
 	TIOCSETN                         = 0x740a
 	TIOCSETP                         = 0x7409

vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go

@@ -481,6 +481,7 @@ const (
 	TIOCSERGWILD                     = 0x5489
 	TIOCSERSETMULTI                  = 0x5490
 	TIOCSERSWILD                     = 0x548a
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x7401
 	TIOCSETN                         = 0x740a
 	TIOCSETP                         = 0x7409

vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go

@@ -481,6 +481,7 @@ const (
 	TIOCSERGWILD                     = 0x5489
 	TIOCSERSETMULTI                  = 0x5490
 	TIOCSERSWILD                     = 0x548a
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x7401
 	TIOCSETN                         = 0x740a
 	TIOCSETP                         = 0x7409

vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go

@@ -535,6 +535,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETC                         = 0x80067411
 	TIOCSETD                         = 0x5423
 	TIOCSETN                         = 0x8006740a

vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go

@@ -539,6 +539,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETC                         = 0x80067411
 	TIOCSETD                         = 0x5423
 	TIOCSETN                         = 0x8006740a

vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go

@@ -539,6 +539,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETC                         = 0x80067411
 	TIOCSETD                         = 0x5423
 	TIOCSETN                         = 0x8006740a

vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go

@@ -486,6 +486,7 @@ const (
 	TIOCSERGWILD                                 = 0x5454
 	TIOCSERSETMULTI                              = 0x545b
 	TIOCSERSWILD                                 = 0x5455
+	TIOCSER_TEMT                                 = 0x1
 	TIOCSETD                                     = 0x5423
 	TIOCSIG                                      = 0x40045436
 	TIOCSISO7816                                 = 0xc0285443

vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go

@@ -545,6 +545,7 @@ const (
 	TIOCSERGWILD                     = 0x5454
 	TIOCSERSETMULTI                  = 0x545b
 	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
 	TIOCSETD                         = 0x5423
 	TIOCSIG                          = 0x40045436
 	TIOCSISO7816                     = 0xc0285443

vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go

@@ -14,21 +14,21 @@ const (
 	ASI_LEON_DFLUSH                  = 0x11
 	ASI_LEON_IFLUSH                  = 0x10
 	ASI_LEON_MMUFLUSH                = 0x18
-	B1000000                         = 0x100c
+	B1000000                         = 0x1008
 	B115200                          = 0x1002
-	B1152000                         = 0x100d
-	B1500000                         = 0x100e
-	B153600                          = 0x1006
-	B2000000                         = 0x100f
+	B1152000                         = 0x1009
+	B1500000                         = 0x100a
+	B2000000                         = 0x100b
 	B230400                          = 0x1003
-	B307200                          = 0x1007
+	B2500000                         = 0x100c
+	B3000000                         = 0x100d
+	B3500000                         = 0x100e
+	B4000000                         = 0x100f
 	B460800                          = 0x1004
-	B500000                          = 0x100a
+	B500000                          = 0x1005
 	B57600                           = 0x1001
-	B576000                          = 0x100b
-	B614400                          = 0x1008
-	B76800                           = 0x1005
-	B921600                          = 0x1009
+	B576000                          = 0x1006
+	B921600                          = 0x1007
 	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40081270
 	BLKBSZSET                        = 0x80081271
@@ -91,7 +91,7 @@ const (
 	FFDLY                            = 0x8000
 	FICLONE                          = 0x80049409
 	FICLONERANGE                     = 0x8020940d
-	FLUSHO                           = 0x2000
+	FLUSHO                           = 0x1000
 	FS_IOC_ENABLE_VERITY             = 0x80806685
 	FS_IOC_GETFLAGS                  = 0x40086601
 	FS_IOC_GET_ENCRYPTION_NONCE      = 0x4010661b
@@ -563,9 +563,6 @@ const (
 	TIOCM_CD                         = 0x40
 	TIOCM_CTS                        = 0x20
 	TIOCM_DSR                        = 0x100
-	TIOCM_LOOP                       = 0x8000
-	TIOCM_OUT1                       = 0x2000
-	TIOCM_OUT2                       = 0x4000
 	TIOCM_RI                         = 0x80
 	TIOCM_RNG                        = 0x80
 	TIOCM_SR                         = 0x10
@@ -644,11 +641,10 @@ const (
 	UBI_IOCVOLRMBLK                  = 0x20004f08
 	UBI_IOCVOLUP                     = 0x80084f00
 	VDISCARD                         = 0xd
-	VDSUSP                           = 0xb
 	VEOF                             = 0x4
-	VEOL                             = 0x5
-	VEOL2                            = 0x6
-	VMIN                             = 0x4
+	VEOL                             = 0xb
+	VEOL2                            = 0x10
+	VMIN                             = 0x6
 	VREPRINT                         = 0xc
 	VSTART                           = 0x8
 	VSTOP                            = 0x9
@@ -668,7 +664,6 @@ const (
 	WDIOC_KEEPALIVE                  = 0x40045705
 	WDIOC_SETOPTIONS                 = 0x40045704
 	WORDSIZE                         = 0x40
-	WRAP                             = 0x20000
 	XCASE                            = 0x4
 	XTABS                            = 0x1800
 	_HIDIOCGRAWNAME                  = 0x40804804

vendor/golang.org/x/sys/unix/ztypes_linux.go

@@ -4264,29 +4264,19 @@ type HwTstampConfig struct {
 }
 
 const (
-	HWTSTAMP_FILTER_NONE                = 0x0
-	HWTSTAMP_FILTER_ALL                 = 0x1
-	HWTSTAMP_FILTER_SOME                = 0x2
-	HWTSTAMP_FILTER_PTP_V1_L4_EVENT     = 0x3
-	HWTSTAMP_FILTER_PTP_V1_L4_SYNC      = 0x4
-	HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ = 0x5
-	HWTSTAMP_FILTER_PTP_V2_L4_EVENT     = 0x6
-	HWTSTAMP_FILTER_PTP_V2_L4_SYNC      = 0x7
-	HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ = 0x8
-	HWTSTAMP_FILTER_PTP_V2_L2_EVENT     = 0x9
-	HWTSTAMP_FILTER_PTP_V2_L2_SYNC      = 0xa
-	HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ = 0xb
-	HWTSTAMP_FILTER_PTP_V2_EVENT        = 0xc
-	HWTSTAMP_FILTER_PTP_V2_SYNC         = 0xd
-	HWTSTAMP_FILTER_PTP_V2_DELAY_REQ    = 0xe
-	HWTSTAMP_FILTER_NTP_ALL             = 0xf
+	HWTSTAMP_FILTER_NONE            = 0x0
+	HWTSTAMP_FILTER_ALL             = 0x1
+	HWTSTAMP_FILTER_SOME            = 0x2
+	HWTSTAMP_FILTER_PTP_V1_L4_EVENT = 0x3
+	HWTSTAMP_FILTER_PTP_V2_L4_EVENT = 0x6
+	HWTSTAMP_FILTER_PTP_V2_L2_EVENT = 0x9
+	HWTSTAMP_FILTER_PTP_V2_EVENT    = 0xc
 )
 
 const (
 	HWTSTAMP_TX_OFF          = 0x0
 	HWTSTAMP_TX_ON           = 0x1
 	HWTSTAMP_TX_ONESTEP_SYNC = 0x2
-	HWTSTAMP_TX_ONESTEP_P2P  = 0x3
 )
 
 type (
@@ -4551,48 +4541,6 @@ const (
 	LANDLOCK_RULE_PATH_BENEATH = 0x1
 )
 
-const (
-	PIDFD_SIGNAL_THREAD        = 0x1
-	PIDFD_SIGNAL_THREAD_GROUP  = 0x2
-	PIDFD_SIGNAL_PROCESS_GROUP = 0x4
-	PIDFD_SELF_THREAD          = -0x2710
-	PIDFD_SELF_THREAD_GROUP    = -0x2711
-	PIDFD_SELF                 = -0x2710
-	PIDFD_SELF_PROCESS         = -0x2711
-	PIDFD_INFO_PID             = 0x1
-	PIDFD_INFO_CREDS           = 0x2
-	PIDFD_INFO_CGROUPID        = 0x4
-	PIDFD_INFO_EXIT            = 0x8
-	PIDFD_INFO_COREDUMP        = 0x10
-	PIDFD_COREDUMPED           = 0x1
-	PIDFD_COREDUMP_SKIP        = 0x2
-	PIDFD_COREDUMP_USER        = 0x4
-	PIDFD_COREDUMP_ROOT        = 0x8
-	PIDFD_INFO_SIZE_VER0       = 0x40
-	PIDFD_GET_INFO             = 0xc048ff0b
-)
-
-const SizeofPidfdInfo = 0x48
-
-type PidfdInfo struct {
-	Mask          uint64
-	Cgroupid      uint64
-	Pid           uint32
-	Tgid          uint32
-	Ppid          uint32
-	Ruid          uint32
-	Rgid          uint32
-	Euid          uint32
-	Egid          uint32
-	Suid          uint32
-	Sgid          uint32
-	Fsuid         uint32
-	Fsgid         uint32
-	Exit_code     int32
-	Coredump_mask uint32
-	_             uint32
-}
-
 const (
 	IPC_CREAT   = 0x200
 	IPC_EXCL    = 0x400
@@ -6525,23 +6473,3 @@ type GPIOV2LineEvent struct {
 	Line_seqno   uint32
 	_            [6]uint32
 }
-
-const (
-	IPMI_MAX_ADDR_SIZE              = 0x20
-	IPMI_SYSTEM_INTERFACE_ADDR_TYPE = 0xc
-	IPMI_BMC_CHANNEL                = 0xf
-	IPMI_RESPONSE_RECV_TYPE         = 0x1
-)
-
-type IPMISystemInterfaceAddr struct {
-	Type    int32
-	Channel int16
-	Lun     uint8
-	_       [1]byte
-}
-type IPMIMsg struct {
-	Netfn uint8
-	Cmd   uint8
-	Len   uint16
-	Data  *uint8
-}

vendor/golang.org/x/sys/unix/ztypes_linux_386.go

@@ -680,18 +680,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
-	PIDFD_GET_IPC_NAMESPACE               = 0xff02
-	PIDFD_GET_MNT_NAMESPACE               = 0xff03
-	PIDFD_GET_NET_NAMESPACE               = 0xff04
-	PIDFD_GET_PID_NAMESPACE               = 0xff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
-	PIDFD_GET_TIME_NAMESPACE              = 0xff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
-	PIDFD_GET_USER_NAMESPACE              = 0xff09
-	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -726,22 +715,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x8014690d
-	IPMICTL_RECEIVE_MSG  = 0xc018690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int32
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int32
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go

@@ -697,18 +697,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
-	PIDFD_GET_IPC_NAMESPACE               = 0xff02
-	PIDFD_GET_MNT_NAMESPACE               = 0xff03
-	PIDFD_GET_NET_NAMESPACE               = 0xff04
-	PIDFD_GET_PID_NAMESPACE               = 0xff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
-	PIDFD_GET_TIME_NAMESPACE              = 0xff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
-	PIDFD_GET_USER_NAMESPACE              = 0xff09
-	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -740,22 +729,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x8028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_arm.go

@@ -674,18 +674,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
-	PIDFD_GET_IPC_NAMESPACE               = 0xff02
-	PIDFD_GET_MNT_NAMESPACE               = 0xff03
-	PIDFD_GET_NET_NAMESPACE               = 0xff04
-	PIDFD_GET_PID_NAMESPACE               = 0xff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
-	PIDFD_GET_TIME_NAMESPACE              = 0xff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
-	PIDFD_GET_USER_NAMESPACE              = 0xff09
-	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -720,22 +709,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x8014690d
-	IPMICTL_RECEIVE_MSG  = 0xc018690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int32
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int32
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go

@@ -676,18 +676,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
-	PIDFD_GET_IPC_NAMESPACE               = 0xff02
-	PIDFD_GET_MNT_NAMESPACE               = 0xff03
-	PIDFD_GET_NET_NAMESPACE               = 0xff04
-	PIDFD_GET_PID_NAMESPACE               = 0xff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
-	PIDFD_GET_TIME_NAMESPACE              = 0xff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
-	PIDFD_GET_USER_NAMESPACE              = 0xff09
-	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -719,22 +708,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x8028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go

@@ -677,18 +677,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
-	PIDFD_GET_IPC_NAMESPACE               = 0xff02
-	PIDFD_GET_MNT_NAMESPACE               = 0xff03
-	PIDFD_GET_NET_NAMESPACE               = 0xff04
-	PIDFD_GET_PID_NAMESPACE               = 0xff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
-	PIDFD_GET_TIME_NAMESPACE              = 0xff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
-	PIDFD_GET_USER_NAMESPACE              = 0xff09
-	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -720,22 +709,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x8028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_mips.go

@@ -680,18 +680,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x80
-	PIDFD_THREAD                          = 0x400
-	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
-	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
-	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
-	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
-	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
-	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
-	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
-	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
+	PIDFD_NONBLOCK = 0x80
 )
 
 type SysvIpcPerm struct {
@@ -725,22 +714,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x4014690d
-	IPMICTL_RECEIVE_MSG  = 0xc018690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int32
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int32
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go

@@ -679,18 +679,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x80
-	PIDFD_THREAD                          = 0x400
-	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
-	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
-	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
-	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
-	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
-	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
-	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
-	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
+	PIDFD_NONBLOCK = 0x80
 )
 
 type SysvIpcPerm struct {
@@ -722,22 +711,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x4028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go

@@ -679,18 +679,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x80
-	PIDFD_THREAD                          = 0x400
-	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
-	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
-	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
-	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
-	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
-	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
-	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
-	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
+	PIDFD_NONBLOCK = 0x80
 )
 
 type SysvIpcPerm struct {
@@ -722,22 +711,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x4028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go

@@ -680,18 +680,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x80
-	PIDFD_THREAD                          = 0x400
-	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
-	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
-	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
-	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
-	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
-	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
-	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
-	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
+	PIDFD_NONBLOCK = 0x80
 )
 
 type SysvIpcPerm struct {
@@ -725,22 +714,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x4014690d
-	IPMICTL_RECEIVE_MSG  = 0xc018690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int32
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int32
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go

@@ -686,18 +686,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
-	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
-	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
-	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
-	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
-	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
-	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
-	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -733,22 +722,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x4014690d
-	IPMICTL_RECEIVE_MSG  = 0xc018690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int32
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int32
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go

@@ -686,18 +686,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
-	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
-	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
-	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
-	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
-	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
-	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
-	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -728,22 +717,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x4028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go

@@ -686,18 +686,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
-	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
-	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
-	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
-	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
-	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
-	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
-	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -728,22 +717,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x4028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go

@@ -704,18 +704,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
-	PIDFD_GET_IPC_NAMESPACE               = 0xff02
-	PIDFD_GET_MNT_NAMESPACE               = 0xff03
-	PIDFD_GET_NET_NAMESPACE               = 0xff04
-	PIDFD_GET_PID_NAMESPACE               = 0xff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
-	PIDFD_GET_TIME_NAMESPACE              = 0xff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
-	PIDFD_GET_USER_NAMESPACE              = 0xff09
-	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -807,22 +796,3 @@ const (
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x8028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go

@@ -700,18 +700,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x800
-	PIDFD_THREAD                          = 0x80
-	PIDFD_GET_CGROUP_NAMESPACE            = 0xff01
-	PIDFD_GET_IPC_NAMESPACE               = 0xff02
-	PIDFD_GET_MNT_NAMESPACE               = 0xff03
-	PIDFD_GET_NET_NAMESPACE               = 0xff04
-	PIDFD_GET_PID_NAMESPACE               = 0xff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0xff06
-	PIDFD_GET_TIME_NAMESPACE              = 0xff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08
-	PIDFD_GET_USER_NAMESPACE              = 0xff09
-	PIDFD_GET_UTS_NAMESPACE               = 0xff0a
+	PIDFD_NONBLOCK = 0x800
 )
 
 type SysvIpcPerm struct {
@@ -742,22 +731,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x8028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go

@@ -681,18 +681,7 @@ const (
 )
 
 const (
-	PIDFD_NONBLOCK                        = 0x4000
-	PIDFD_THREAD                          = 0x800
-	PIDFD_GET_CGROUP_NAMESPACE            = 0x2000ff01
-	PIDFD_GET_IPC_NAMESPACE               = 0x2000ff02
-	PIDFD_GET_MNT_NAMESPACE               = 0x2000ff03
-	PIDFD_GET_NET_NAMESPACE               = 0x2000ff04
-	PIDFD_GET_PID_NAMESPACE               = 0x2000ff05
-	PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE  = 0x2000ff06
-	PIDFD_GET_TIME_NAMESPACE              = 0x2000ff07
-	PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08
-	PIDFD_GET_USER_NAMESPACE              = 0x2000ff09
-	PIDFD_GET_UTS_NAMESPACE               = 0x2000ff0a
+	PIDFD_NONBLOCK = 0x4000
 )
 
 type SysvIpcPerm struct {
@@ -723,22 +712,3 @@ type SysvShmDesc struct {
 const (
 	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
 )
-
-const (
-	IPMICTL_SEND_COMMAND = 0x4028690d
-	IPMICTL_RECEIVE_MSG  = 0xc030690c
-)
-
-type IPMIReq struct {
-	Addr  *uint8
-	Len   uint32
-	Msgid int64
-	Msg   IPMIMsg
-}
-type IPMIRecv struct {
-	Recv_type int32
-	Addr      *uint8
-	Addr_len  uint32
-	Msgid     int64
-	Msg       IPMIMsg
-}

vendor/golang.org/x/sys/windows/types_windows.go

@@ -1065,7 +1065,6 @@ const (
 	SO_BROADCAST              = 32
 	SO_LINGER                 = 128
 	SO_RCVBUF                 = 0x1002
-	SO_SNDTIMEO               = 0x1005
 	SO_RCVTIMEO               = 0x1006
 	SO_SNDBUF                 = 0x1001
 	SO_UPDATE_ACCEPT_CONTEXT  = 0x700b

vendor/golang.org/x/term/terminal.go

@@ -106,9 +106,6 @@ type Terminal struct {
 	// a read. It aliases into inBuf.
 	remainder []byte
 	inBuf     [256]byte
-	// readErr is an error returned by a read that also returned data. It is
-	// reported after all of that data has been processed.
-	readErr error
 
 	// History records and retrieves lines of input read by [ReadLine] which
 	// a user can retrieve and navigate using the up and down arrow keys.
@@ -791,11 +788,7 @@ func (t *Terminal) ReadPassword(prompt string) (line string, err error) {
 	return
 }
 
-// ReadLine returns a line of input from the terminal, excluding the
-// trailing newline. It may return partial data along with an error.
-// An [io.EOF] error indicates the end of the stream. For other errors,
-// such as [ErrPasteIndicator] in bracketed paste mode, a subsequent
-// call may return more data.
+// ReadLine returns a line of input from the terminal.
 func (t *Terminal) ReadLine() (line string, err error) {
 	t.lock.Lock()
 	defer t.lock.Unlock()
@@ -870,24 +863,21 @@ func (t *Terminal) readLine() (line string, err error) {
 			}
 			return
 		}
-		if t.readErr != nil {
-			err = t.readErr
-			t.readErr = nil
-			return
-		}
 
 		// t.remainder is a slice at the beginning of t.inBuf
 		// containing a partial key sequence
 		readBuf := t.inBuf[len(t.remainder):]
+		var n int
 
 		t.lock.Unlock()
-		n, readErr := t.c.Read(readBuf)
+		n, err = t.c.Read(readBuf)
 		t.lock.Lock()
 
-		t.remainder = t.inBuf[:n+len(t.remainder)]
-		if readErr != nil {
-			t.readErr = readErr
+		if err != nil {
+			return
 		}
+
+		t.remainder = t.inBuf[:n+len(t.remainder)]
 	}
 }
 

vendor/modules.txt

@@ -743,16 +743,16 @@ golang.org/x/net/internal/socks
 golang.org/x/net/internal/timeseries
 golang.org/x/net/proxy
 golang.org/x/net/trace
-# golang.org/x/sys v0.48.0
-## explicit; go 1.26.0
+# golang.org/x/sys v0.47.0
+## explicit; go 1.25.0
 golang.org/x/sys/cpu
 golang.org/x/sys/execabs
 golang.org/x/sys/plan9
 golang.org/x/sys/unix
 golang.org/x/sys/windows
 golang.org/x/sys/windows/registry
-# golang.org/x/term v0.46.0
-## explicit; go 1.26.0
+# golang.org/x/term v0.45.0
+## explicit; go 1.25.0
 golang.org/x/term
 # golang.org/x/text v0.39.0
 ## explicit; go 1.25.0