docs: more formatting and typo

Updated by "Update PO files to match POT (msgmerge)" add-on in Weblate.

Translation: Co-op Cloud/abra
Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/

.drone.yml

@@ -8,12 +8,17 @@ steps:
       - make check
 
   - name: xgettext-go
-    image: git.coopcloud.tech/toolshed/drone-xgettext-go:latest
-    settings:
-      keyword: i18n.G
-      keyword_ctx: i18n.GC
-      out: pkg/i18n/locales/abra.pot
-      comments_tag: translators
+    image: golang:1.26
+    environment:
+      GOPRIVATE: coopcloud.tech
+    commands:
+      - go run git.coopcloud.tech/toolshed/xgettext-go@latest
+        -o pkg/i18n/locales/abra.pot
+        --keyword=i18n.G
+        --keyword-ctx=i18n.GC
+        --sort-output
+        --add-comments-tag="translators"
+        $(find . -name "*.go" -not -path "*vendor*" | sort)
     depends_on:
       - make check
     when:

Dockerfile

@@ -15,7 +15,7 @@ WORKDIR /app
 
 RUN CGO_ENABLED=0 make build
 
-FROM alpine:3.22
+FROM alpine:3.24
 
 RUN apk add --no-cache \
   ca-certificates \

Makefile

@@ -1,5 +1,5 @@
 ABRA         := ./cmd/abra
-XGETTEXT     := ./bin/xgettext-go
+XGETTEXT     := go run git.coopcloud.tech/toolshed/xgettext-go@latest
 COMMIT       := $(shell git rev-list -1 HEAD)
 GOPATH       := $(shell go env GOPATH)
 GOVERSION    := 1.26
@@ -62,8 +62,8 @@ update-po:
 	done
 
 .PHONY: update-pot
-update-pot: $(XGETTEXT)
-	@${XGETTEXT} \
+update-pot:
+	@$(XGETTEXT) \
 		-o pkg/i18n/locales/$(DOMAIN).pot \
 		--keyword=i18n.G \
 		--keyword-ctx=i18n.GC \
@@ -71,11 +71,6 @@ update-pot: $(XGETTEXT)
 		--add-comments-tag="translators" \
 		$$(find . -name "*.go" -not -path "*vendor*" | sort)
 
-${XGETTEXT}:
-	@mkdir -p ./bin && \
-	wget -O ./bin/xgettext-go https://git.coopcloud.tech/toolshed/xgettext-go/raw/branch/main/xgettext-go && \
-	chmod +x ./bin/xgettext-go
-
 .PHONY: update-pot-po-metadata
 update-pot-po-metadata:
 	@sed -i "s/charset=CHARSET/charset=UTF-8/g" pkg/i18n/locales/*.po pkg/i18n/locales/*.pot
@@ -89,3 +84,45 @@ build-mo:
 
 release:
 	@goreleaser release --clean
+
+CLIENT_VM := abra-client
+vm-client-status:
+	sudo systemctl status microvm@$(CLIENT_VM).service
+vm-client-create:test-integration-hosts
+	sudo microvm -f git+file://$$(pwd) -c $(CLIENT_VM)
+vm-client-start:
+	sudo systemctl start microvm@$(CLIENT_VM).service
+vm-client-update:test-integration-hosts
+	sudo microvm -R -f git+file://$$(pwd) -u $(CLIENT_VM) 
+vm-client-run:
+	sudo microvm -f git+file://$$(pwd) -r $(CLIENT_VM)
+vm-client-stop:
+	sudo systemctl stop microvm@$(CLIENT_VM)
+vm-client-delete: vm-client-stop
+	sudo rm -rf /var/lib/microvms/$(CLIENT_VM)
+vm-client-connect:
+	ssh abra@10.0.0.2 -i ./tests/resources/local_integration_ssh
+
+SERVER_VM := abra-server
+vm-server-status:
+	sudo systemctl status microvm@$(SERVER_VM).service
+vm-server-create:
+	sudo microvm -f git+file://$$(pwd) -c $(SERVER_VM)
+vm-server-start:
+	sudo systemctl start microvm@$(SERVER_VM).service
+vm-server-update:
+	sudo microvm -R -f git+file://$$(pwd) -u $(SERVER_VM) 
+vm-server-run:
+	sudo microvm -f git+file://$$(pwd) -r $(SERVER_VM)
+vm-server-stop:
+	sudo systemctl stop microvm@$(SERVER_VM)
+vm-server-delete: vm-server-stop
+	sudo rm -rf /var/lib/microvms/$(SERVER_VM)
+vm-server-connect:
+	ssh abra@10.0.0.3 -i ./tests/resources/local_integration_ssh
+
+test-integration-hosts:
+	./scripts/tests/extra_hosts
+test-integration:
+	ssh-add ./tests/resources/local_integration_ssh
+	@bats -Tp tests/integration --verbose-run

cli/app/deploy.go

@@ -151,11 +151,12 @@ checkout as-is. Recipe commit hashes are also supported as values for
 
 		stackName := app.StackName()
 		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    stackName,
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
+			Composefiles:     composeFiles,
+			Namespace:        stackName,
+			Prune:            false,
+			ResolveImage:     stack.ResolveImageAlways,
+			Detach:           false,
+			SendRegistryAuth: true,
 		}
 		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
 		if err != nil {

cli/app/new.go

@@ -112,7 +112,11 @@ var AppNewCommand = &cobra.Command{
 				}
 			}
 
-			if len(recipeVersions) > 0 {
+			if recipeVersion != "" {
+				if _, err := recipe.EnsureVersion(recipeVersion); err != nil {
+					log.Fatal(err)
+				}
+			} else if len(recipeVersions) > 0 {
 				latest := recipeVersions[len(recipeVersions)-1]
 				for tag := range latest {
 					recipeVersion = tag

cli/app/rollback.go

@@ -166,11 +166,12 @@ beforehand. See "abra app backup" for more.`),
 
 		stackName := app.StackName()
 		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    stackName,
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
+			Composefiles:     composeFiles,
+			Namespace:        stackName,
+			Prune:            false,
+			ResolveImage:     stack.ResolveImageAlways,
+			Detach:           false,
+			SendRegistryAuth: true,
 		}
 
 		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)

cli/app/upgrade.go

@@ -178,11 +178,12 @@ beforehand. See "abra app backup" for more.`),
 
 		stackName := app.StackName()
 		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    stackName,
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
+			Composefiles:     composeFiles,
+			Namespace:        stackName,
+			Prune:            false,
+			ResolveImage:     stack.ResolveImageAlways,
+			Detach:           false,
+			SendRegistryAuth: true,
 		}
 
 		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)

flake.lock

@@ -0,0 +1,99 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "microvm": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1784666190,
+        "narHash": "sha256-xgfS6slV7J3baMooNN1UuBi51RIgg9y0DbCxfSA0668=",
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "rev": "fa5340ac684cdce8a22b6d4a0bcebb0cc999275e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1778443072,
+        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "microvm": "microvm",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1783694892,
+        "narHash": "sha256-xO8f7Qng+18FK2UlB9vcrkxCaQMCt5WjCH24aW/11eg=",
+        "ref": "refs/heads/main",
+        "rev": "24c4346e30fdea8d8e80f34aec3554a15a667d24",
+        "revCount": 1410,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,106 @@
+{
+  description = "The Co-op Cloud utility belt";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    microvm = {
+      url = "github:astro/microvm.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      microvm,
+      flake-utils,
+    }:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+      publicKey = builtins.readFile ./tests/resources/local_integration_ssh.pub;
+      privateKey = builtins.readFile ./tests/resources/local_integration_ssh;
+      pathToRepo = builtins.readFile ./tests/resources/path_to_repo;
+      # local DNS aliases for the server host
+      extraHosts = builtins.readFile ./tests/resources/extra_hosts;
+      username = "abra";
+      password = "abra";
+      defaultDNS = [
+        # Quad9.net
+        "9.9.9.9"
+        "149.112.112.112"
+        "2620:fe::fe"
+        "2620:fe::9"
+      ];
+    in
+    {
+      nixosConfigurations = {
+        abra-client = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            microvm.nixosModules.microvm
+            ./nix/hosts/client/configuration.nix
+          ];
+          specialArgs = {
+            inherit
+              publicKey
+              privateKey
+              username
+              password
+              defaultDNS
+              extraHosts
+              pathToRepo
+              ;
+          };
+        };
+        abra-server = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            microvm.nixosModules.microvm
+            ./nix/hosts/server/configuration.nix
+          ];
+          specialArgs = {
+            inherit
+              publicKey
+              privateKey
+              username
+              password
+              defaultDNS
+              ;
+          };
+        };
+      };
+      nixosModules = rec {
+        host = {
+          imports = [
+            microvm.nixosModules.host
+            ./nix/modules/host.nix
+          ];
+        };
+        default = host;
+      };
+      packages = rec {
+        abra = pkgs.callPackage ./nix/package.nix { };
+        default = abra;
+      };
+      apps = rec {
+        abra = flake-utils.lib.mkApp { drv = self.packages.${system}.abra; };
+        default = abra;
+      };
+      devShells.${system}.default = pkgs.mkShell {
+        # testing env variables
+        BATS_LIB_PATH = "~/.local/share/bats/";
+        TEST_SERVER = "abra.local";
+        ABRA_DIR = "$HOME/.abra_test";
+
+        packages = with pkgs; [
+          go_1_26
+          gnumake
+          gopls
+        ];
+      };
+
+    };
+}

go.mod

@@ -3,7 +3,7 @@ module coopcloud.tech/abra
 go 1.26.0
 
 require (
-	coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca
+	coopcloud.tech/tagcmp v0.0.0-20260515102403-c26951b55977
 	git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c
 	github.com/AlecAivazis/survey/v2 v2.3.7
 	github.com/charmbracelet/bubbletea v1.3.10
@@ -13,14 +13,14 @@ require (
 	github.com/docker/cli v28.4.0+incompatible
 	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-units v0.5.0
-	github.com/go-git/go-git/v5 v5.18.0
+	github.com/go-git/go-git/v5 v5.19.1
 	github.com/google/go-cmp v0.7.0
 	github.com/leonelquinteros/gotext v1.7.2
 	github.com/moby/sys/signal v0.7.1
 	github.com/moby/term v0.5.2
 	github.com/pkg/errors v0.9.1
-	github.com/schollz/progressbar/v3 v3.19.0
-	golang.org/x/term v0.42.0
+	github.com/schollz/progressbar/v3 v3.19.1
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
@@ -37,7 +37,7 @@ require (
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/x/ansi v0.11.7 // indirect
+	github.com/charmbracelet/x/ansi v0.11.6 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
@@ -52,7 +52,7 @@ require (
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
@@ -60,31 +60,31 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.8.0 // indirect
+	github.com/go-git/go-billy/v5 v5.9.0 // indirect
 	github.com/go-logfmt/logfmt v0.6.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.23 // indirect
+	github.com/mattn/go-runewidth v0.0.21 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
 	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
@@ -111,16 +111,16 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
+	go.opentelemetry.io/otel v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/trace v1.42.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
@@ -129,8 +129,8 @@ require (
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260427160629-7cedc36a6bc4 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	google.golang.org/grpc v1.80.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
@@ -141,7 +141,7 @@ require (
 	github.com/containers/image v3.0.2+incompatible
 	github.com/containers/storage v1.38.2 // indirect
 	github.com/decentral1se/passgen v1.0.1
-	github.com/docker/docker-credential-helpers v0.9.6 // indirect
+	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
@@ -155,9 +155,9 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.43.0
+	golang.org/x/sys v0.46.0
 )
 
 replace github.com/docker/cli v28.4.0+incompatible => git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible
 
-replace github.com/spf13/cobra => github.com/decentral1se/cobra v1.10.2-i18n
+replace github.com/spf13/cobra => github.com/decentral1se/cobra v1.10.2

go.sum

@@ -22,8 +22,8 @@ cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIA
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca h1:gSD53tBAsbIGq4SnFfq+mEep6foekQ2a5ea7b38qkm0=
-coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
+coopcloud.tech/tagcmp v0.0.0-20260515102403-c26951b55977 h1:J7I0HFjwVAj/kkX6lwSTHmlXDRjQRsdIFNUUqu55ADY=
+coopcloud.tech/tagcmp v0.0.0-20260515102403-c26951b55977/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -130,7 +130,6 @@ github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -145,8 +144,6 @@ github.com/charmbracelet/log v1.0.0 h1:HVVVMmfOorfj3BA9i8X8UL69Hoz9lI0PYwXfJvOdR
 github.com/charmbracelet/log v1.0.0/go.mod h1:uYgY3SmLpwJWxmlrPwXvzVYujxis1vAKRV/0VQB7yWA=
 github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
 github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
-github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
-github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
 github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
 github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
 github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 h1:payRxjMjKgx2PaCWLZ4p3ro9y97+TVLZNaRZgJwSVDQ=
@@ -311,8 +308,8 @@ github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjI
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/decentral1se/cobra v1.10.2-i18n h1:XR+6AHHfnf4k5NM9f09oLMrEVwz3rkQIAIcqgL8R08g=
-github.com/decentral1se/cobra v1.10.2-i18n/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/decentral1se/cobra v1.10.2 h1:MZ8Ifi/jRels9sZrpSccDbUlK++3b2HlBODfv0Bh6x0=
+github.com/decentral1se/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/decentral1se/passgen v1.0.1 h1:j2AxK/kHKxDHWZZfkJj8Wgae9+O+DYEqR5sjKthIYKA=
 github.com/decentral1se/passgen v1.0.1/go.mod h1:530V+lNoPhKtkrX2fIVsIfLhkl47CuiOM7HRgi7C+SU=
 github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
@@ -334,15 +331,11 @@ github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bc
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
 github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
 github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/docker-credential-helpers v0.9.6 h1:cT2PbRPSlnMmNTfT2TDMXRyQ1KMWHG7xoTLBcn1ZNv0=
-github.com/docker/docker-credential-helpers v0.9.6/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
 github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
-github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
-github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
@@ -396,14 +389,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
-github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.17.2 h1:B+nkdlxdYrvyFK4GPXVU8w1U+YkbsgciIR7f2sZJ104=
-github.com/go-git/go-git/v5 v5.17.2/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
-github.com/go-git/go-git/v5 v5.18.0 h1:O831KI+0PR51hM2kep6T8k+w0/LIAD490gvqMCvL5hM=
-github.com/go-git/go-git/v5 v5.18.0/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -534,12 +525,9 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:Fecb
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -598,8 +586,6 @@ github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdY
 github.com/klauspost/compress v1.14.2/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -637,8 +623,6 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
 github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
@@ -646,8 +630,6 @@ github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+Ei
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
 github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
-github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
@@ -672,8 +654,6 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
 github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
-github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
-github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
@@ -773,8 +753,6 @@ github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuh
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pjbgf/sha1cd v0.5.0 h1:a+UkboSi1znleCDUNT3M5YxjOnN1fz2FhN48FlwCxs0=
-github.com/pjbgf/sha1cd v0.5.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
 github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -825,15 +803,13 @@ github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6L
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3VRLtww=
-github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/schollz/progressbar/v3 v3.19.0 h1:Ea18xuIRQXLAUidVDox3AbwfUhD0/1IvohyTutOIFoc=
-github.com/schollz/progressbar/v3 v3.19.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
+github.com/schollz/progressbar/v3 v3.19.1 h1:iv8BgwOvdML/S3p84uBpy/IMigv4U9594vPZYa2EdrU=
+github.com/schollz/progressbar/v3 v3.19.1/go.mod h1:LFL7jqimKxfhero4K1eCkUr/6R39AgQeiPCJtlTWIW8=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
@@ -941,42 +917,24 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
 go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
 go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
 go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
 go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
 go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
 go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
 go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
 go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
 go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
 go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
@@ -1008,8 +966,6 @@ golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
 golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1022,8 +978,6 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
@@ -1089,8 +1043,6 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
 golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1187,18 +1139,13 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1208,8 +1155,6 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1317,12 +1262,8 @@ google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
-google.golang.org/genproto/googleapis/api v0.0.0-20260427160629-7cedc36a6bc4 h1:yOzSCGPx+cp5VO7IxvZ9SBFF7j1tZVcNtlHR2iYKtVo=
-google.golang.org/genproto/googleapis/api v0.0.0-20260427160629-7cedc36a6bc4/go.mod h1:Q9HWtNeE7tM9npdIsEvqXj1QJIvVoeAV3rtXtS715Cw=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4 h1:tEkOQcXgF6dH1G+MVKZrfpYvozGrzb91k6ha7jireSM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1396,7 +1337,6 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=

nix/hosts/README.md

@@ -0,0 +1,72 @@
+# Hosts
+These hosts are VMs used for running the integration tests on your local machine.
+The hosts contain a client where abra with the tests will be run and a server
+to simulate a remote machine.
+
+## Prepare the host
+For this setup to work you need a machine with NixOS and flakes enabled.
+
+1. Import the abra flake
+
+The install example is based on the [using nix flakes wiki page](https://nixos.wiki/wiki/flakes#Using_nix_flakes_with_NixOS).
+```nix
+inputs = {
+  abra = {
+    url = "git+https://git.coopcloud.tech/toolshed/abra.git";
+  };
+};
+```
+2. Add the host module to your configuration
+
+Now add the host module to your configuration. At the toplevel of a flake it could look like this:
+```nix
+desktop = inputs.nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    abra.nixosModules.host
+    ./configuration.nix
+  ];
+  specialArgs = inputs;
+};
+```
+3. Adjust the required config
+```nix
+abra.testing = {
+  enable = true; # loads the required config, when set true
+  externalInterface = "eth1"; # adjust this to your network interface that has access to the internet
+};
+```
+You can look up the interface with `ip link`. After that rebuild your system and you are ready to go.
+
+## Get started
+All commands are run on the repository root path.
+1. Set path to repo 
+
+The VM will create a shared volume from the content of the file `tests/resources/path_to_repo`.
+Set the content of the file to the path of your abra repository.
+This will share the repository from your machine with the VM and you can edit files while testing without rebuiling
+or restarting the VM.
+
+2. Create the VMs
+```sh
+make vm-client-create
+make vm-server-create
+```
+3. Start the VMs
+```sh
+make vm-client-start
+make vm-server-start
+```
+After running that command you should be able to ping the machines.
+The client runs on 10.0.0.2 and server 10.0.0.3
+
+4. Connect to the client
+
+Running the following command will connect to the client VM via SSH.
+```sh
+make vm-client-connect
+```
+5. Run the tests
+```sh
+make test-integration
+```

nix/hosts/client/configuration.nix

@@ -0,0 +1,145 @@
+{
+  lib,
+  pkgs,
+  publicKey,
+  username,
+  pathToRepo,
+  defaultDNS,
+  extraHosts,
+  ...
+}:
+let
+  index = 2;
+  mac = "00:00:00:00:00:01";
+  serverIp = "10.0.0.3";
+in
+{
+  imports = [
+    ../../modules/ssh.nix
+    ../../modules/user.nix
+    ../../modules/docker.nix
+  ];
+
+  microvm = {
+    vcpu = 4;
+    mem = 2049; # see issue related in microvm repo with 2048, so add 1MB
+    interfaces = [
+      {
+        id = "vm${toString index}";
+        type = "tap";
+        inherit mac;
+      }
+    ];
+    shares = [
+      {
+        proto = "virtiofs";
+        tag = "repo";
+        # Source path can be absolute or relative
+        # to /var/lib/microvms/$hostName
+        source = "${lib.trim pathToRepo}";
+        mountPoint = "/home/${username}/abra";
+      }
+    ];
+  };
+
+  boot.tmp = {
+    useTmpfs = true;
+    tmpfsSize = "2G";
+  };
+
+  networking = {
+    hostName = "abra-client";
+    useNetworkd = true;
+  };
+  systemd.network.networks."10-eth" = {
+    matchConfig.MACAddress = mac;
+    # Static IP configuration
+    address = [
+      "10.0.0.${toString index}/32"
+      "fec0::${lib.toHexString index}/128"
+    ];
+    routes = [
+      {
+        # A route to the host
+        Destination = "10.0.0.0/32";
+        GatewayOnLink = true;
+      }
+      {
+        # Route to server
+        Destination = "${serverIp}/32";
+        Gateway = "10.0.0.0";
+        GatewayOnLink = true;
+      }
+      {
+        # Default route
+        Destination = "0.0.0.0/0";
+        Gateway = "10.0.0.0";
+        GatewayOnLink = true;
+      }
+      {
+        # Default route
+        Destination = "::/0";
+        Gateway = "fec0::";
+        GatewayOnLink = true;
+      }
+    ];
+    networkConfig = {
+      # DNS servers no longer come from DHCP nor Router
+      # Advertisements. Perhaps you want to change the defaults:
+      DNS = defaultDNS;
+    };
+  };
+
+  # open the ports to allow ssh access from the host
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  networking.firewall.allowedUDPPorts = [ 22 ];
+
+  networking.extraHosts = extraHosts;
+
+  environment.variables = {
+    CGO_ENABLED = 0;
+    TEST_SERVER = "abra.local";
+    ABRA_DIR = "$HOME/.abra_test";
+  };
+
+  programs.ssh = {
+    startAgent = true;
+    knownHostsFiles = [
+      (pkgs.writeText "local.keys" ''
+        abra.local ${publicKey} 
+      '')
+    ];
+    extraConfig = ''
+      Host abra.local
+        HostName abra.local
+        Port 22
+        User ${username}
+    '';
+  };
+  programs.git = {
+    enable = true;
+    # many recipe commands need a preset git user
+    config = [
+      {
+        user = {
+          name = "abra dev";
+          email = "helo@coopcloud.tech";
+        };
+      }
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    # build dependencies, copied from flake.nix
+    go_1_26
+    gnumake
+    # testing dependencies
+    (bats.withLibraries (p: [
+      p.bats-assert
+      p.bats-file
+      p.bats-support
+    ]))
+    jq
+    wget
+  ];
+}

nix/hosts/client/home.nix

@@ -0,0 +1,42 @@
+{
+  serverIp,
+  username,
+  ...
+}:
+{
+  # Home Manager needs a bit of information about you and the
+  # paths it should manage.
+  home.username = username;
+  home.homeDirectory = "/home/${username}";
+
+  # This value determines the Home Manager release that your
+  # configuration is compatible with. This helps avoid breakage
+  # when a new Home Manager release introduces backwards
+  # incompatible changes.
+  #
+  # You can update Home Manager without changing this value. See
+  # the Home Manager release notes for a list of state version
+  # changes in each release.
+  home.stateVersion = "26.05";
+
+  # Let Home Manager install and manage itself.
+  programs.home-manager.enable = true;
+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+    settings = {
+      "abra.local" = {
+        HostName = serverIp;
+        User = username;
+        Port = 22;
+        IdentityFile = "/home/${username}/abra/tests/resources/local_integration_ssh";
+      };
+      "*.abra.local" = {
+        HostName = serverIp;
+        User = username;
+        Port = 22;
+        IdentityFile = "/home/${username}/abra/tests/resources/local_integration_sshn";
+      };
+    };
+  };
+}

nix/hosts/server/configuration.nix

@@ -0,0 +1,91 @@
+{
+  lib,
+  defaultDNS,
+  ...
+}:
+let
+  index = 3;
+  mac = "00:00:00:00:00:02";
+  clientIp = "10.0.0.2";
+in
+{
+  imports = [
+    ../../modules/ssh.nix
+    ../../modules/user.nix
+    ../../modules/docker.nix
+  ];
+
+  microvm = {
+    vcpu = 4;
+    mem = 8097; # see issue related in microvm repo with 2048, so add 1MB
+    interfaces = [
+      {
+        id = "vm${toString index}";
+        type = "tap";
+        inherit mac;
+      }
+    ];
+  };
+
+  boot.tmp = {
+    useTmpfs = true;
+    tmpfsSize = "8G";
+  };
+
+  networking = {
+    hostName = "abra-server";
+    useNetworkd = true;
+  };
+  systemd.network.networks."11-eth" = {
+    matchConfig.MACAddress = mac;
+    # Static IP configuration
+    address = [
+      "10.0.0.${toString index}/32"
+      "fec0::${lib.toHexString index}/128"
+    ];
+    routes = [
+      {
+        # A route to the host
+        Destination = "10.0.0.0/32";
+        GatewayOnLink = true;
+      }
+      {
+        # Route to server
+        Destination = "${clientIp}/32";
+        Gateway = "10.0.0.0";
+        GatewayOnLink = true;
+      }
+      {
+        # Default route
+        Destination = "0.0.0.0/0";
+        Gateway = "10.0.0.0";
+        GatewayOnLink = true;
+      }
+      {
+        # Default route
+        Destination = "::/0";
+        Gateway = "fec0::";
+        GatewayOnLink = true;
+      }
+    ];
+    networkConfig = {
+      # DNS servers no longer come from DHCP nor Router
+      # Advertisements. Perhaps you want to change the defaults:
+      DNS = defaultDNS;
+    };
+  };
+
+  # open the ports to allow ssh access from the host
+  networking.firewall.allowedTCPPorts = [
+    22
+    80
+    443
+    1312 # deploy with udp and tcp on same port test
+  ];
+  networking.firewall.allowedUDPPorts = [
+    22
+    80
+    443
+    1312 # deploy with udp and tcp on same port test
+  ];
+}

nix/modules/docker.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+    liveRestore = false;
+  };
+}

nix/modules/host.nix

@@ -0,0 +1,59 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  maxVMs = 3;
+in
+{
+  options = {
+    abra.testing.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable the abra integration testing framework";
+    };
+    abra.testing.externalInterface = lib.mkOption {
+      type = lib.types.str;
+      default = null;
+      description = "Change this to the interface with upstream Internet access";
+    };
+  };
+
+  config = lib.mkIf config.abra.testing.enable {
+    networking.useNetworkd = true;
+    systemd.network.wait-online.enable = false;
+    systemd.network.networks = builtins.listToAttrs (
+      map (index: {
+        name = "30-vm${toString index}";
+        value = {
+          matchConfig.Name = "vm${toString index}";
+          # Host's addresses
+          address = [
+            "10.0.0.0/32"
+            "fec0::/128"
+          ];
+          # Setup routes to the VM
+          routes = [
+            {
+              Destination = "10.0.0.${toString index}/32";
+            }
+            {
+              Destination = "fec0::${lib.toHexString index}/128";
+            }
+          ];
+          # Enable routing
+          networkConfig = {
+            IPv4Forwarding = true;
+            IPv6Forwarding = true;
+          };
+        };
+      }) (lib.genList (i: i + 1) maxVMs)
+    );
+    networking.nat = {
+      enable = true;
+      internalIPs = [ "10.0.0.0/24" ];
+      externalInterface = config.abra.testing.externalInterface;
+    };
+  };
+}

nix/modules/ssh.nix

@@ -0,0 +1,33 @@
+{
+  privateKey,
+  publicKey,
+  username,
+  ...
+}:
+{
+  # default host key location
+  environment.etc."ssh/ssh_host_ed25519_key" = {
+    text = privateKey;
+    mode = "0600";
+  };
+  environment.etc."ssh/ssh_host_ed25519_key.pub" = {
+    text = publicKey;
+    mode = "0644";
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+      AllowUsers = [ "${username}" ];
+    };
+    generateHostKeys = false;
+    hostKeys = [
+      {
+        path = "/etc/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      }
+    ];
+  };
+}

nix/modules/user.nix

@@ -0,0 +1,22 @@
+{
+  username,
+  password,
+  publicKey,
+  ...
+}:
+{
+  users.users."${username}" = {
+    isNormalUser = true;
+    password = password;
+    home = "/home/${username}";
+    description = "Abra user";
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "docker"
+    ];
+    openssh.authorizedKeys.keys = [
+      publicKey
+    ];
+  };
+}

nix/package.nix

@@ -0,0 +1,54 @@
+{
+  buildGo126Module,
+  fetchgit,
+  lib,
+  installShellFiles,
+}:
+
+buildGo126Module rec {
+  pname = "abra";
+  version = "0.13.0-beta";
+  rev = "06a57ded025a43c80f94d4e65299add8a31830dc";
+
+  src = fetchgit {
+    url = "https://git.coopcloud.tech/toolshed/abra.git";
+    tag = version;
+    hash = "sha256-rgoK0TY0WLSQ39lPvVM80zW/qJF40VFBSxYDOaKXZQo=";
+  };
+
+  vendorHash = null;
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  env.CGO_ENABLED = 0;
+  buildPhase = ''
+    runHook preBuild
+    go build -ldflags="-s -w -X 'main.Commit=${rev}' -X 'main.Version=${version}'" ./cmd/abra
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -D abra $out/bin/abra
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    export ABRA_DIR="$out"
+    $out/bin/abra autocomplete bash >abra.bash
+    $out/bin/abra autocomplete fish >abra.fish
+    $out/bin/abra autocomplete zsh >abra.zsh
+    installShellCompletion abra.{bash,fish,zsh}
+  '';
+
+  meta = with lib; {
+    description = "The Co-op Cloud utility belt";
+    homepage = "https://docs.coopcloud.tech/abra";
+    changelog = "https://git.coopcloud.tech/toolshed/abra/releases/tag/${version}";
+    mainProgram = "abra";
+    license = licenses.gpl3Plus;
+    maintainers = "devydave";
+  };
+}

pkg/i18n/locales/abra.pot

@@ -7,7 +7,7 @@
 msgid   ""
 msgstr  "Project-Id-Version: \n"
         "Report-Msgid-Bugs-To: EMAIL\n"
-        "POT-Creation-Date: 2026-04-11 11:34+0200\n"
+        "POT-Creation-Date: 2026-06-14 17:56+0200\n"
         "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
         "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
         "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -214,7 +214,7 @@ msgstr  ""
 msgid   "%s already exists?"
 msgstr  ""
 
-#: ./cli/app/new.go:202
+#: ./cli/app/new.go:206
 #, c-format
 msgid   "%s created (version: %s)"
 msgstr  ""
@@ -299,7 +299,7 @@ msgstr  ""
 msgid   "%s has no published versions?"
 msgstr  ""
 
-#: ./cli/app/new.go:311
+#: ./cli/app/new.go:315
 #, c-format
 msgid   "%s has no secrets to generate, skipping..."
 msgstr  ""
@@ -339,17 +339,17 @@ msgstr  ""
 msgid   "%s is missing the TYPE env var?"
 msgstr  ""
 
-#: ./cli/app/rollback.go:309 ./cli/app/rollback.go:313
+#: ./cli/app/rollback.go:310 ./cli/app/rollback.go:314
 #, c-format
 msgid   "%s is not a downgrade for %s?"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:429 ./cli/app/upgrade.go:433
+#: ./cli/app/upgrade.go:430 ./cli/app/upgrade.go:434
 #, c-format
 msgid   "%s is not an upgrade for %s?"
 msgstr  ""
 
-#: ./cli/app/env.go:146 ./cli/app/logs.go:65 ./cli/app/ps.go:62 ./cli/app/restart.go:100 ./cli/app/services.go:55 ./cli/app/undeploy.go:66 ./cli/app/upgrade.go:450
+#: ./cli/app/env.go:146 ./cli/app/logs.go:65 ./cli/app/ps.go:62 ./cli/app/restart.go:100 ./cli/app/services.go:55 ./cli/app/undeploy.go:66 ./cli/app/upgrade.go:451
 #, c-format
 msgid   "%s is not deployed?"
 msgstr  ""
@@ -369,7 +369,7 @@ msgstr  ""
 msgid   "%s missing context, run \"abra server add %s\"?"
 msgstr  ""
 
-#: ./cli/app/deploy.go:194 ./cli/app/upgrade.go:210
+#: ./cli/app/deploy.go:195 ./cli/app/upgrade.go:211
 #, c-format
 msgid   "%s missing from %s.env"
 msgstr  ""
@@ -404,17 +404,17 @@ msgstr  ""
 msgid   "%s removed from pass store"
 msgstr  ""
 
-#: ./cli/app/new.go:220
+#: ./cli/app/new.go:224
 #, c-format
 msgid   "%s requires secret generation before deploy, run \"abra app secret generate %s --all\""
 msgstr  ""
 
-#: ./cli/app/new.go:224
+#: ./cli/app/new.go:228
 #, c-format
 msgid   "%s requires secret insertion before deploy (#generate=false)"
 msgstr  ""
 
-#: ./cli/app/new.go:151
+#: ./cli/app/new.go:155
 #, c-format
 msgid   "%s sanitised as %s for new app"
 msgstr  ""
@@ -549,12 +549,12 @@ msgstr  ""
 msgid   "%s: waiting %d seconds before next retry"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:424
+#: ./cli/app/upgrade.go:425
 #, c-format
 msgid   "'%s' is not a known version"
 msgstr  ""
 
-#: ./cli/app/rollback.go:304 ./cli/app/upgrade.go:419
+#: ./cli/app/rollback.go:305 ./cli/app/upgrade.go:420
 #, c-format
 msgid   "'%s' is not a known version for %s"
 msgstr  ""
@@ -626,7 +626,7 @@ msgstr  ""
 msgid   "Both local recipe and live deployment labels are shown."
 msgstr  ""
 
-#: ./cli/app/backup.go:319 ./cli/app/backup.go:335 ./cli/app/check.go:95 ./cli/app/cmd.go:285 ./cli/app/cp.go:385 ./cli/app/deploy.go:414 ./cli/app/labels.go:143 ./cli/app/list.go:335 ./cli/app/new.go:407 ./cli/app/ps.go:213 ./cli/app/restart.go:163 ./cli/app/restore.go:138 ./cli/app/secret.go:569 ./cli/app/secret.go:609 ./cli/app/secret.go:633 ./cli/app/secret.go:641 ./cli/catalogue/catalogue.go:318 ./cli/recipe/lint.go:137
+#: ./cli/app/backup.go:319 ./cli/app/backup.go:335 ./cli/app/check.go:95 ./cli/app/cmd.go:285 ./cli/app/cp.go:385 ./cli/app/deploy.go:415 ./cli/app/labels.go:143 ./cli/app/list.go:335 ./cli/app/new.go:411 ./cli/app/ps.go:213 ./cli/app/restart.go:163 ./cli/app/restore.go:138 ./cli/app/secret.go:569 ./cli/app/secret.go:609 ./cli/app/secret.go:633 ./cli/app/secret.go:641 ./cli/catalogue/catalogue.go:318 ./cli/recipe/lint.go:137
 msgid   "C"
 msgstr  ""
 
@@ -767,7 +767,7 @@ msgid   "Creates a new app from a default recipe.\n"
         "on your $PATH."
 msgstr  ""
 
-#: ./cli/app/deploy.go:430 ./cli/app/new.go:383 ./cli/app/rollback.go:361 ./cli/app/upgrade.go:470
+#: ./cli/app/deploy.go:431 ./cli/app/new.go:387 ./cli/app/rollback.go:362 ./cli/app/upgrade.go:471
 msgid   "D"
 msgstr  ""
 
@@ -878,7 +878,7 @@ msgid   "Generate a report of all managed apps.\n"
         "Use \"--status/-S\" flag to query all servers for the live deployment status."
 msgstr  ""
 
-#: ./cli/app/new.go:317
+#: ./cli/app/new.go:321
 msgid   "Generate app secrets?"
 msgstr  ""
 
@@ -1257,7 +1257,7 @@ msgstr  ""
 msgid   "Run app commands"
 msgstr  ""
 
-#: ./cli/app/backup.go:303 ./cli/app/list.go:296 ./cli/app/logs.go:109 ./cli/app/new.go:399
+#: ./cli/app/backup.go:303 ./cli/app/list.go:296 ./cli/app/logs.go:109 ./cli/app/new.go:403
 msgid   "S"
 msgstr  ""
 
@@ -1265,7 +1265,7 @@ msgstr  ""
 msgid   "SECRETS"
 msgstr  ""
 
-#: ./cli/app/new.go:234
+#: ./cli/app/new.go:238
 msgid   "SECRETS OVERVIEW"
 msgstr  ""
 
@@ -1298,7 +1298,7 @@ msgstr  ""
 msgid   "STATUS"
 msgstr  ""
 
-#: ./cli/app/new.go:342
+#: ./cli/app/new.go:346
 msgid   "Select app server:"
 msgstr  ""
 
@@ -1330,7 +1330,7 @@ msgstr  ""
 msgid   "Specify a server name"
 msgstr  ""
 
-#: ./cli/app/new.go:293
+#: ./cli/app/new.go:297
 msgid   "Specify app domain"
 msgstr  ""
 
@@ -1462,7 +1462,7 @@ msgid   "To load completions:\n"
         "  # and source this file from your PowerShell profile."
 msgstr  ""
 
-#: ./cli/app/deploy.go:454 ./cli/app/rollback.go:377 ./cli/app/upgrade.go:494
+#: ./cli/app/deploy.go:455 ./cli/app/rollback.go:378 ./cli/app/upgrade.go:495
 msgid   "U"
 msgstr  ""
 
@@ -1835,7 +1835,7 @@ msgstr  ""
 msgid   "attempting to run %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:283 ./cli/app/upgrade.go:296
+#: ./cli/app/deploy.go:284 ./cli/app/upgrade.go:297
 #, c-format
 msgid   "attempting to run post deploy commands, saw: %s"
 msgstr  ""
@@ -1865,7 +1865,7 @@ msgstr  ""
 msgid   "autocomplete failed: %s"
 msgstr  ""
 
-#: ./cli/app/new.go:401
+#: ./cli/app/new.go:405
 msgid   "automatically generate secrets"
 msgstr  ""
 
@@ -1915,7 +1915,7 @@ msgstr  ""
 #. no spaces in between
 #. translators: `abra app cp` aliases. use a comma separated list of aliases with
 #. no spaces in between
-#: ./cli/app/backup.go:148 ./cli/app/cp.go:30 ./cli/app/deploy.go:438 ./cli/app/rollback.go:369 ./cli/app/upgrade.go:478
+#: ./cli/app/backup.go:148 ./cli/app/cp.go:30 ./cli/app/deploy.go:439 ./cli/app/rollback.go:370 ./cli/app/upgrade.go:479
 msgid   "c"
 msgstr  ""
 
@@ -1971,7 +1971,7 @@ msgstr  ""
 msgid   "cannot redeploy previous chaos version (%s), did you mean to use \"--chaos\"?"
 msgstr  ""
 
-#: ./cli/app/deploy.go:388
+#: ./cli/app/deploy.go:389
 #, c-format
 msgid   "cannot redeploy previous chaos version (%s), did you mean to use \"--chaos\"?\n"
         "     to return to a regular release, specify a release tag, commit SHA or use \"--latest\""
@@ -1990,7 +1990,7 @@ msgstr  ""
 msgid   "cannot use '[secret] [version]' and '--all' together"
 msgstr  ""
 
-#: ./cli/app/deploy.go:330
+#: ./cli/app/deploy.go:331
 msgid   "cannot use --chaos and --latest together"
 msgstr  ""
 
@@ -2014,11 +2014,11 @@ msgstr  ""
 msgid   "cannot use [service] and --all-services/-a together"
 msgstr  ""
 
-#: ./cli/app/deploy.go:322 ./cli/app/new.go:80
+#: ./cli/app/deploy.go:323 ./cli/app/new.go:80
 msgid   "cannot use [version] and --chaos together"
 msgstr  ""
 
-#: ./cli/app/deploy.go:326
+#: ./cli/app/deploy.go:327
 msgid   "cannot use [version] and --latest together"
 msgstr  ""
 
@@ -2054,7 +2054,7 @@ msgstr  ""
 msgid   "cfg"
 msgstr  ""
 
-#: ./cli/app/backup.go:318 ./cli/app/backup.go:334 ./cli/app/check.go:94 ./cli/app/cmd.go:284 ./cli/app/cp.go:384 ./cli/app/deploy.go:413 ./cli/app/labels.go:142 ./cli/app/list.go:334 ./cli/app/new.go:406 ./cli/app/ps.go:212 ./cli/app/restart.go:162 ./cli/app/restore.go:137 ./cli/app/secret.go:568 ./cli/app/secret.go:608 ./cli/app/secret.go:632 ./cli/app/secret.go:640 ./cli/catalogue/catalogue.go:317 ./cli/recipe/lint.go:136
+#: ./cli/app/backup.go:318 ./cli/app/backup.go:334 ./cli/app/check.go:94 ./cli/app/cmd.go:284 ./cli/app/cp.go:384 ./cli/app/deploy.go:414 ./cli/app/labels.go:142 ./cli/app/list.go:334 ./cli/app/new.go:410 ./cli/app/ps.go:212 ./cli/app/restart.go:162 ./cli/app/restore.go:137 ./cli/app/secret.go:568 ./cli/app/secret.go:608 ./cli/app/secret.go:632 ./cli/app/secret.go:640 ./cli/catalogue/catalogue.go:317 ./cli/recipe/lint.go:136
 msgid   "chaos"
 msgstr  ""
 
@@ -2068,7 +2068,7 @@ msgstr  ""
 msgid   "check <domain> [flags]"
 msgstr  ""
 
-#: ./cli/app/deploy.go:95 ./cli/app/undeploy.go:58 ./cli/app/upgrade.go:442
+#: ./cli/app/deploy.go:95 ./cli/app/undeploy.go:58 ./cli/app/upgrade.go:443
 #, c-format
 msgid   "checking whether %s is already deployed"
 msgstr  ""
@@ -2371,7 +2371,7 @@ msgstr  ""
 msgid   "critical errors present in %s config"
 msgstr  ""
 
-#: ./cli/app/rollback.go:299
+#: ./cli/app/rollback.go:300
 #, c-format
 msgid   "current deployment '%s' is not a known version for %s"
 msgstr  ""
@@ -2422,7 +2422,7 @@ msgstr  ""
 msgid   "deploy labels stanza present"
 msgstr  ""
 
-#: ./cli/app/deploy.go:448
+#: ./cli/app/deploy.go:449
 msgid   "deploy latest recipe version"
 msgstr  ""
 
@@ -2524,11 +2524,11 @@ msgstr  ""
 msgid   "dirty: %v, "
 msgstr  ""
 
-#: ./cli/app/deploy.go:440 ./cli/app/rollback.go:371 ./cli/app/upgrade.go:480
+#: ./cli/app/deploy.go:441 ./cli/app/rollback.go:372 ./cli/app/upgrade.go:481
 msgid   "disable converge logic checks"
 msgstr  ""
 
-#: ./cli/app/deploy.go:432 ./cli/app/rollback.go:363 ./cli/app/upgrade.go:472
+#: ./cli/app/deploy.go:433 ./cli/app/rollback.go:364 ./cli/app/upgrade.go:473
 msgid   "disable public DNS checks"
 msgstr  ""
 
@@ -2544,11 +2544,11 @@ msgstr  ""
 msgid   "docker: is the daemon running / your user has docker permissions?"
 msgstr  ""
 
-#: ./cli/app/new.go:382
+#: ./cli/app/new.go:386
 msgid   "domain"
 msgstr  ""
 
-#: ./cli/app/new.go:385
+#: ./cli/app/new.go:389
 msgid   "domain name for app"
 msgstr  ""
 
@@ -2737,7 +2737,7 @@ msgstr  ""
 
 #. translators: `abra recipe fetch` aliases. use a comma separated list of aliases
 #. with no spaces in between
-#: ./cli/app/deploy.go:422 ./cli/app/env.go:325 ./cli/app/remove.go:163 ./cli/app/rollback.go:353 ./cli/app/secret.go:593 ./cli/app/upgrade.go:462 ./cli/app/volume.go:217 ./cli/recipe/fetch.go:20 ./cli/recipe/fetch.go:138
+#: ./cli/app/deploy.go:423 ./cli/app/env.go:325 ./cli/app/remove.go:163 ./cli/app/rollback.go:354 ./cli/app/secret.go:593 ./cli/app/upgrade.go:463 ./cli/app/volume.go:217 ./cli/recipe/fetch.go:20 ./cli/recipe/fetch.go:138
 msgid   "f"
 msgstr  ""
 
@@ -2898,7 +2898,7 @@ msgstr  ""
 msgid   "failed to resize tty, using default size"
 msgstr  ""
 
-#: ./cli/app/new.go:134
+#: ./cli/app/new.go:138
 #, c-format
 msgid   "failed to retrieve latest commit for %s: %s"
 msgstr  ""
@@ -2988,7 +2988,7 @@ msgstr  ""
 msgid   "final merged env values for %s are: %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:421 ./cli/app/env.go:324 ./cli/app/remove.go:162 ./cli/app/rollback.go:352 ./cli/app/upgrade.go:461 ./cli/app/volume.go:216 ./cli/recipe/fetch.go:137
+#: ./cli/app/deploy.go:422 ./cli/app/env.go:324 ./cli/app/remove.go:162 ./cli/app/rollback.go:353 ./cli/app/upgrade.go:462 ./cli/app/volume.go:216 ./cli/recipe/fetch.go:137
 msgid   "force"
 msgstr  ""
 
@@ -3202,7 +3202,7 @@ msgstr  ""
 msgid   "id: %s, "
 msgstr  ""
 
-#: ./cli/app/backup.go:321 ./cli/app/backup.go:337 ./cli/app/check.go:97 ./cli/app/cmd.go:287 ./cli/app/cp.go:387 ./cli/app/deploy.go:416 ./cli/app/labels.go:145 ./cli/app/list.go:337 ./cli/app/new.go:409 ./cli/app/ps.go:215 ./cli/app/restart.go:165 ./cli/app/restore.go:140 ./cli/app/secret.go:571 ./cli/app/secret.go:611 ./cli/app/secret.go:635 ./cli/app/secret.go:643 ./cli/catalogue/catalogue.go:320 ./cli/recipe/lint.go:139
+#: ./cli/app/backup.go:321 ./cli/app/backup.go:337 ./cli/app/check.go:97 ./cli/app/cmd.go:287 ./cli/app/cp.go:387 ./cli/app/deploy.go:417 ./cli/app/labels.go:145 ./cli/app/list.go:337 ./cli/app/new.go:413 ./cli/app/ps.go:215 ./cli/app/restart.go:165 ./cli/app/restore.go:140 ./cli/app/secret.go:571 ./cli/app/secret.go:611 ./cli/app/secret.go:635 ./cli/app/secret.go:643 ./cli/catalogue/catalogue.go:320 ./cli/recipe/lint.go:139
 msgid   "ignore uncommitted recipes changes"
 msgstr  ""
 
@@ -3400,7 +3400,7 @@ msgstr  ""
 #. no spaces in between
 #. translators: `abra recipe lint` aliases. use a comma separated list of
 #. aliases with no spaces in between
-#: ./cli/app/cmd.go:261 ./cli/app/deploy.go:446 ./cli/app/logs.go:20 ./cli/recipe/lint.go:17 ./cli/server/add.go:207
+#: ./cli/app/cmd.go:261 ./cli/app/deploy.go:447 ./cli/app/logs.go:20 ./cli/recipe/lint.go:17 ./cli/server/add.go:207
 msgid   "l"
 msgstr  ""
 
@@ -3415,7 +3415,7 @@ msgstr  ""
 msgid   "labels <domain> [flags]"
 msgstr  ""
 
-#: ./cli/app/deploy.go:445 ./cli/app/list.go:186
+#: ./cli/app/deploy.go:446 ./cli/app/list.go:186
 msgid   "latest"
 msgstr  ""
 
@@ -3752,7 +3752,7 @@ msgstr  ""
 msgid   "no containers matching the %v filter found?"
 msgstr  ""
 
-#: ./cli/app/new.go:302 ./cli/internal/validate.go:129
+#: ./cli/app/new.go:306 ./cli/internal/validate.go:129
 msgid   "no domain provided"
 msgstr  ""
 
@@ -3779,7 +3779,7 @@ msgstr  ""
 msgid   "no recipe name provided"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:241
+#: ./cli/app/upgrade.go:242
 #, c-format
 msgid   "no release notes for upgrading from %s to %s"
 msgstr  ""
@@ -3810,7 +3810,7 @@ msgstr  ""
 msgid   "no secrets to remove?"
 msgstr  ""
 
-#: ./cli/app/new.go:351 ./cli/internal/validate.go:167
+#: ./cli/app/new.go:355 ./cli/internal/validate.go:167
 msgid   "no server provided"
 msgstr  ""
 
@@ -3868,11 +3868,11 @@ msgstr  ""
 msgid   "no volumes to remove"
 msgstr  ""
 
-#: ./cli/app/deploy.go:437 ./cli/app/rollback.go:368 ./cli/app/upgrade.go:477
+#: ./cli/app/deploy.go:438 ./cli/app/rollback.go:369 ./cli/app/upgrade.go:478
 msgid   "no-converge-checks"
 msgstr  ""
 
-#: ./cli/app/deploy.go:429 ./cli/app/rollback.go:360 ./cli/app/upgrade.go:469
+#: ./cli/app/deploy.go:430 ./cli/app/rollback.go:361 ./cli/app/upgrade.go:470
 msgid   "no-domain-checks"
 msgstr  ""
 
@@ -3940,7 +3940,7 @@ msgstr  ""
 msgid   "only show errors"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:488
+#: ./cli/app/upgrade.go:489
 msgid   "only show release notes"
 msgstr  ""
 
@@ -3952,7 +3952,7 @@ msgstr  ""
 #. with no spaces in between
 #. translators: `abra server prune` aliases. use a comma separated list of
 #. aliases with no spaces in between
-#: ./cli/app/backup.go:295 ./cli/app/new.go:391 ./cli/app/ps.go:29 ./cli/app/secret.go:561 ./cli/app/secret.go:585 ./cli/app/secret.go:625 ./cli/app/undeploy.go:169 ./cli/catalogue/catalogue.go:294 ./cli/recipe/list.go:112 ./cli/server/prune.go:18
+#: ./cli/app/backup.go:295 ./cli/app/new.go:395 ./cli/app/ps.go:29 ./cli/app/secret.go:561 ./cli/app/secret.go:585 ./cli/app/secret.go:625 ./cli/app/undeploy.go:169 ./cli/catalogue/catalogue.go:294 ./cli/recipe/list.go:112 ./cli/server/prune.go:18
 msgid   "p"
 msgstr  ""
 
@@ -3971,27 +3971,27 @@ msgstr  ""
 msgid   "parsed following command arguments: %s"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:345
+#: ./cli/app/upgrade.go:346
 #, c-format
 msgid   "parsing chosen upgrade version failed: %s"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:389
+#: ./cli/app/upgrade.go:390
 #, c-format
 msgid   "parsing deployed version failed: %s"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:350
+#: ./cli/app/upgrade.go:351
 #, c-format
 msgid   "parsing deployment version failed: %s"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:356 ./cli/app/upgrade.go:395
+#: ./cli/app/upgrade.go:357 ./cli/app/upgrade.go:396
 #, c-format
 msgid   "parsing recipe version failed: %s"
 msgstr  ""
 
-#: ./cli/app/new.go:390 ./cli/app/secret.go:560 ./cli/app/secret.go:584 ./cli/app/secret.go:624
+#: ./cli/app/new.go:394 ./cli/app/secret.go:560 ./cli/app/secret.go:584 ./cli/app/secret.go:624
 msgid   "pass"
 msgstr  ""
 
@@ -4011,7 +4011,7 @@ msgstr  ""
 msgid   "pattern"
 msgstr  ""
 
-#: ./cli/app/deploy.go:424 ./cli/app/env.go:327 ./cli/app/remove.go:165 ./cli/app/rollback.go:355 ./cli/app/upgrade.go:464 ./cli/app/volume.go:219
+#: ./cli/app/deploy.go:425 ./cli/app/env.go:327 ./cli/app/remove.go:165 ./cli/app/rollback.go:356 ./cli/app/upgrade.go:465 ./cli/app/volume.go:219
 msgid   "perform action without further prompt"
 msgstr  ""
 
@@ -4021,22 +4021,22 @@ msgstr  ""
 msgid   "pl,p"
 msgstr  ""
 
-#: ./cli/app/rollback.go:267
+#: ./cli/app/rollback.go:268
 #, c-format
 msgid   "please select a downgrade (version: %s):"
 msgstr  ""
 
-#: ./cli/app/rollback.go:272
+#: ./cli/app/rollback.go:273
 #, c-format
 msgid   "please select a downgrade (version: %s, chaos: %s):"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:312
+#: ./cli/app/upgrade.go:313
 #, c-format
 msgid   "please select an upgrade (version: %s):"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:317
+#: ./cli/app/upgrade.go:318
 #, c-format
 msgid   "please select an upgrade (version: %s, chaos: %s):"
 msgstr  ""
@@ -4119,7 +4119,7 @@ msgstr  ""
 #. with no spaces in between
 #. translators: `abra recipe` aliases. use a comma separated list of aliases
 #. with no spaces in between
-#: ./cli/app/backup.go:327 ./cli/app/list.go:304 ./cli/app/move.go:350 ./cli/app/run.go:23 ./cli/app/upgrade.go:486 ./cli/catalogue/catalogue.go:302 ./cli/recipe/recipe.go:12 ./cli/recipe/release.go:624
+#: ./cli/app/backup.go:327 ./cli/app/list.go:304 ./cli/app/move.go:350 ./cli/app/run.go:23 ./cli/app/upgrade.go:487 ./cli/catalogue/catalogue.go:302 ./cli/recipe/recipe.go:12 ./cli/recipe/release.go:624
 msgid   "r"
 msgstr  ""
 
@@ -4239,7 +4239,7 @@ msgstr  ""
 msgid   "release failed. any changes made have been reverted"
 msgstr  ""
 
-#: ./cli/app/upgrade.go:485
+#: ./cli/app/upgrade.go:486
 msgid   "releasenotes"
 msgstr  ""
 
@@ -4543,7 +4543,7 @@ msgstr  ""
 msgid   "run command locally"
 msgstr  ""
 
-#: ./cli/app/deploy.go:281 ./cli/app/upgrade.go:293
+#: ./cli/app/deploy.go:282 ./cli/app/upgrade.go:294
 #, c-format
 msgid   "run the following post-deploy commands: %s"
 msgstr  ""
@@ -4584,7 +4584,7 @@ msgstr  ""
 #. no spaces in between
 #. translators: `abra server` aliases. use a comma separated list of aliases
 #. with no spaces in between
-#: ./cli/app/backup.go:198 ./cli/app/backup.go:263 ./cli/app/backup.go:287 ./cli/app/env.go:333 ./cli/app/list.go:327 ./cli/app/logs.go:101 ./cli/app/new.go:368 ./cli/app/restore.go:114 ./cli/app/secret.go:535 ./cli/catalogue/catalogue.go:27 ./cli/catalogue/catalogue.go:310 ./cli/recipe/fetch.go:130 ./cli/server/server.go:12
+#: ./cli/app/backup.go:198 ./cli/app/backup.go:263 ./cli/app/backup.go:287 ./cli/app/env.go:333 ./cli/app/list.go:327 ./cli/app/logs.go:101 ./cli/app/new.go:372 ./cli/app/restore.go:114 ./cli/app/secret.go:535 ./cli/catalogue/catalogue.go:27 ./cli/catalogue/catalogue.go:310 ./cli/recipe/fetch.go:130 ./cli/server/server.go:12
 msgid   "s"
 msgstr  ""
 
@@ -4626,12 +4626,12 @@ msgstr  ""
 msgid   "secret not found: %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:358
+#: ./cli/app/deploy.go:359
 #, c-format
 msgid   "secret not generated: %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:356
+#: ./cli/app/deploy.go:357
 #, c-format
 msgid   "secret not inserted (#generate=false): %s"
 msgstr  ""
@@ -4641,27 +4641,27 @@ msgstr  ""
 msgid   "secret: %s removed"
 msgstr  ""
 
-#: ./cli/app/backup.go:302 ./cli/app/new.go:398
+#: ./cli/app/backup.go:302 ./cli/app/new.go:402
 msgid   "secrets"
 msgstr  ""
 
-#: ./cli/app/new.go:238
+#: ./cli/app/new.go:242
 #, c-format
 msgid   "secrets are %s shown again, please save them %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:306
+#: ./cli/app/deploy.go:307
 #, c-format
 msgid   "selected latest recipe version: %s (from %d available versions)"
 msgstr  ""
 
-#: ./cli/app/new.go:121
+#: ./cli/app/new.go:125
 #, c-format
 msgid   "selected recipe version: %s (from %d available versions)"
 msgstr  ""
 
 #. translators: `abra server` command for autocompletion
-#: ./cli/app/env.go:332 ./cli/app/env.go:339 ./cli/app/list.go:326 ./cli/app/list.go:341 ./cli/app/new.go:367 ./cli/app/new.go:374 ./cli/run.go:101
+#: ./cli/app/env.go:332 ./cli/app/env.go:339 ./cli/app/list.go:326 ./cli/app/list.go:341 ./cli/app/new.go:371 ./cli/app/new.go:378 ./cli/run.go:101
 msgid   "server"
 msgstr  ""
 
@@ -4775,7 +4775,7 @@ msgstr  ""
 msgid   "severity"
 msgstr  ""
 
-#: ./cli/app/deploy.go:456 ./cli/app/rollback.go:379 ./cli/app/upgrade.go:496
+#: ./cli/app/deploy.go:457 ./cli/app/rollback.go:380 ./cli/app/upgrade.go:497
 msgid   "show all configs & images, including unchanged ones"
 msgstr  ""
 
@@ -4799,7 +4799,7 @@ msgstr  ""
 msgid   "show debug messages"
 msgstr  ""
 
-#: ./cli/app/deploy.go:453 ./cli/app/rollback.go:376 ./cli/app/upgrade.go:493
+#: ./cli/app/deploy.go:454 ./cli/app/rollback.go:377 ./cli/app/upgrade.go:494
 msgid   "show-unchanged"
 msgstr  ""
 
@@ -4807,7 +4807,7 @@ msgstr  ""
 msgid   "since"
 msgstr  ""
 
-#: ./cli/app/new.go:336
+#: ./cli/app/new.go:340
 #, c-format
 msgid   "single server detected, choosing %s automatically"
 msgstr  ""
@@ -4847,11 +4847,11 @@ msgstr  ""
 msgid   "skipping converge logic checks"
 msgstr  ""
 
-#: ./cli/app/deploy.go:208
+#: ./cli/app/deploy.go:209
 msgid   "skipping domain checks"
 msgstr  ""
 
-#: ./cli/app/deploy.go:205
+#: ./cli/app/deploy.go:206
 msgid   "skipping domain checks, no DOMAIN=... configured"
 msgstr  ""
 
@@ -4907,7 +4907,7 @@ msgstr  ""
 msgid   "specify secret value"
 msgstr  ""
 
-#: ./cli/app/new.go:370
+#: ./cli/app/new.go:374
 msgid   "specify server for new app"
 msgstr  ""
 
@@ -4965,7 +4965,7 @@ msgstr  ""
 msgid   "store generated secrets in a local pass store"
 msgstr  ""
 
-#: ./cli/app/new.go:393
+#: ./cli/app/new.go:397
 msgid   "store secrets in a local pass store"
 msgstr  ""
 
@@ -5115,7 +5115,7 @@ msgstr  ""
 msgid   "trim input"
 msgstr  ""
 
-#: ./cli/app/new.go:263 ./pkg/app/app.go:141
+#: ./cli/app/new.go:267 ./pkg/app/app.go:141
 #, c-format
 msgid   "trimming %s to %s to avoid runtime limits"
 msgstr  ""
@@ -5653,27 +5653,27 @@ msgstr  ""
 msgid   "version wiped from %s.env"
 msgstr  ""
 
-#: ./cli/app/deploy.go:372
+#: ./cli/app/deploy.go:373
 #, c-format
 msgid   "version: taking chaos version: %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:398
+#: ./cli/app/deploy.go:399
 #, c-format
 msgid   "version: taking deployed version: %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:403
+#: ./cli/app/deploy.go:404
 #, c-format
 msgid   "version: taking new recipe version: %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:392
+#: ./cli/app/deploy.go:393
 #, c-format
 msgid   "version: taking version from .env file: %s"
 msgstr  ""
 
-#: ./cli/app/deploy.go:378
+#: ./cli/app/deploy.go:379
 #, c-format
 msgid   "version: taking version from cli arg: %s"
 msgstr  ""
@@ -5801,7 +5801,7 @@ msgstr  ""
 msgid   "writer: %v, "
 msgstr  ""
 
-#: ./cli/app/deploy.go:288 ./cli/app/new.go:251 ./cli/app/rollback.go:256 ./cli/app/undeploy.go:120 ./cli/app/upgrade.go:301
+#: ./cli/app/deploy.go:289 ./cli/app/new.go:255 ./cli/app/rollback.go:257 ./cli/app/undeploy.go:120 ./cli/app/upgrade.go:302
 #, c-format
 msgid   "writing recipe version failed: %s"
 msgstr  ""

pkg/i18n/locales/es.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-04-11 11:34+0200\n"
+"POT-Creation-Date: 2026-06-14 17:56+0200\n"
 "PO-Revision-Date: 2026-02-28 13:52+0000\n"
 "Last-Translator: chasqui <chasqui@cryptolab.net>\n"
 "Language-Team: Spanish <https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/>\n"
@@ -318,7 +318,7 @@ msgstr "%s ya existe"
 msgid "%s already exists?"
 msgstr "%s ¿ya existe?"
 
-#: cli/app/new.go:202
+#: cli/app/new.go:206
 #, c-format
 msgid "%s created (version: %s)"
 msgstr "%s creado (versión: %s)"
@@ -403,7 +403,7 @@ msgstr "¿%s no tiene una aplicación principal?"
 msgid "%s has no published versions?"
 msgstr "¿%s no tiene versiones publicadas?"
 
-#: cli/app/new.go:311
+#: cli/app/new.go:315
 #, c-format
 msgid "%s has no secrets to generate, skipping..."
 msgstr "%s no tiene secretos para generar, omitiendo..."
@@ -443,19 +443,19 @@ msgstr "¿%s no tiene un archivo compose.yml o compose.*.yml?"
 msgid "%s is missing the TYPE env var?"
 msgstr "¿A %s le falta la variable de entorno TYPE?"
 
-#: cli/app/rollback.go:309 cli/app/rollback.go:313
+#: cli/app/rollback.go:310 cli/app/rollback.go:314
 #, c-format
 msgid "%s is not a downgrade for %s?"
 msgstr "¿%s no es un downgrade para %s?"
 
-#: cli/app/upgrade.go:429 cli/app/upgrade.go:433
+#: cli/app/upgrade.go:430 cli/app/upgrade.go:434
 #, c-format
 msgid "%s is not an upgrade for %s?"
 msgstr "¿%s no es una actualización para %s?"
 
 #: cli/app/env.go:146 cli/app/logs.go:65 cli/app/ps.go:62
 #: cli/app/restart.go:100 cli/app/services.go:55 cli/app/undeploy.go:66
-#: cli/app/upgrade.go:450
+#: cli/app/upgrade.go:451
 #, c-format
 msgid "%s is not deployed?"
 msgstr "¿%s no está desplegado?"
@@ -475,7 +475,7 @@ msgstr "%s todavía está desplegado. Ejecuta \"abra aplicacion plegar %s\""
 msgid "%s missing context, run \"abra server add %s\"?"
 msgstr "falta contexto %s, ¿ejecutar \"abra servidor agregar %s\"?"
 
-#: cli/app/deploy.go:194 cli/app/upgrade.go:210
+#: cli/app/deploy.go:195 cli/app/upgrade.go:211
 #, c-format
 msgid "%s missing from %s.env"
 msgstr "falta %s de %s.env"
@@ -510,17 +510,17 @@ msgstr "notas de la versión %s:"
 msgid "%s removed from pass store"
 msgstr "%s eliminado del almacén de contraseñas"
 
-#: cli/app/new.go:220
+#: cli/app/new.go:224
 #, c-format
 msgid "%s requires secret generation before deploy, run \"abra app secret generate %s --all\""
 msgstr "%s requiere generación de secretos antes del despliegue, ejecuta \"abra aplicacion secreto generar %s --all\""
 
-#: cli/app/new.go:224
+#: cli/app/new.go:228
 #, c-format
 msgid "%s requires secret insertion before deploy (#generate=false)"
 msgstr "%s requiere inserción de secretos antes del despliegue (#generate=false)"
 
-#: cli/app/new.go:151
+#: cli/app/new.go:155
 #, c-format
 msgid "%s sanitised as %s for new app"
 msgstr "%s sanitisado como %s para nueva aplicación"
@@ -655,12 +655,12 @@ msgstr "%s: no se puede resolver la dirección IPv4: %s"
 msgid "%s: waiting %d seconds before next retry"
 msgstr "%s: esperando %d segundos antes del siguiente reintento"
 
-#: cli/app/upgrade.go:424
+#: cli/app/upgrade.go:425
 #, c-format
 msgid "'%s' is not a known version"
 msgstr "'%s' no es una versión conocida"
 
-#: cli/app/rollback.go:304 cli/app/upgrade.go:419
+#: cli/app/rollback.go:305 cli/app/upgrade.go:420
 #, c-format
 msgid "'%s' is not a known version for %s"
 msgstr "'%s' no es una versión conocida para %s"
@@ -759,8 +759,8 @@ msgid "Both local recipe and live deployment labels are shown."
 msgstr "Se muestran tanto la receta local como las etiquetas del despliegue en vivo."
 
 #: cli/app/backup.go:319 cli/app/backup.go:335 cli/app/check.go:95
-#: cli/app/cmd.go:285 cli/app/cp.go:385 cli/app/deploy.go:414
-#: cli/app/labels.go:143 cli/app/list.go:335 cli/app/new.go:407
+#: cli/app/cmd.go:285 cli/app/cp.go:385 cli/app/deploy.go:415
+#: cli/app/labels.go:143 cli/app/list.go:335 cli/app/new.go:411
 #: cli/app/ps.go:213 cli/app/restart.go:163 cli/app/restore.go:138
 #: cli/app/secret.go:569 cli/app/secret.go:609 cli/app/secret.go:633
 #: cli/app/secret.go:641 cli/catalogue/catalogue.go:318 cli/recipe/lint.go:137
@@ -959,8 +959,8 @@ msgstr ""
 "en un almacén pass (ver passwordstore.org). El comando pass debe estar \n"
 "disponible en tu $PATH."
 
-#: cli/app/deploy.go:430 cli/app/new.go:383 cli/app/rollback.go:361
-#: cli/app/upgrade.go:470
+#: cli/app/deploy.go:431 cli/app/new.go:387 cli/app/rollback.go:362
+#: cli/app/upgrade.go:471
 msgid "D"
 msgstr ""
 
@@ -1112,7 +1112,7 @@ msgstr ""
 "\n"
 "Usa la opción \"--estado/-S\" para consultar en todos los servidores sobre el estado de despliegue."
 
-#: cli/app/new.go:317
+#: cli/app/new.go:321
 msgid "Generate app secrets?"
 msgstr "¿Generar secretos de la aplicación?"
 
@@ -1579,7 +1579,7 @@ msgid "Run app commands"
 msgstr "Ejecutar 💻 comando dentro una 🚀aplicación"
 
 #: cli/app/backup.go:303 cli/app/list.go:296 cli/app/logs.go:109
-#: cli/app/new.go:399
+#: cli/app/new.go:403
 msgid "S"
 msgstr ""
 
@@ -1587,7 +1587,7 @@ msgstr ""
 msgid "SECRETS"
 msgstr "🥷 SECRETOS"
 
-#: cli/app/new.go:234
+#: cli/app/new.go:238
 msgid "SECRETS OVERVIEW"
 msgstr "RESUMEN DE LOS 🥷 SECRETOS"
 
@@ -1621,7 +1621,7 @@ msgstr ""
 msgid "STATUS"
 msgstr "🩻 ESTADO"
 
-#: cli/app/new.go:342
+#: cli/app/new.go:346
 msgid "Select app server:"
 msgstr "Seleccionar servidor para la aplicación:"
 
@@ -1659,7 +1659,7 @@ msgstr "Especifica un 🌐 nombre de dominio (DNS)"
 msgid "Specify a server name"
 msgstr "Especifica un nombre de servidor"
 
-#: cli/app/new.go:293
+#: cli/app/new.go:297
 msgid "Specify app domain"
 msgstr "Especifica un 🌐 nombre de dominio (DNS) para la aplicación"
 
@@ -1881,7 +1881,7 @@ msgstr ""
 "  PS> abra autocomplete powershell > abra.ps1\n"
 "  # y fuente (source) ese archivo desde tu perfil de PowerShell."
 
-#: cli/app/deploy.go:454 cli/app/rollback.go:377 cli/app/upgrade.go:494
+#: cli/app/deploy.go:455 cli/app/rollback.go:378 cli/app/upgrade.go:495
 msgid "U"
 msgstr ""
 
@@ -2368,7 +2368,7 @@ msgstr "Intentando generar y almacenar %s en %s"
 msgid "attempting to run %s"
 msgstr "Intentando ejecutar %s"
 
-#: cli/app/deploy.go:283 cli/app/upgrade.go:296
+#: cli/app/deploy.go:284 cli/app/upgrade.go:297
 #, c-format
 msgid "attempting to run post deploy commands, saw: %s"
 msgstr "Intentando ejecutar los comandos posteriores al despliegue: %s"
@@ -2404,7 +2404,7 @@ msgstr "autocompletar [bash|zsh|fish|powershell]"
 msgid "autocomplete failed: %s"
 msgstr "autocompletar falló: %s"
 
-#: cli/app/new.go:401
+#: cli/app/new.go:405
 msgid "automatically generate secrets"
 msgstr "generar secretos automáticamente"
 
@@ -2454,8 +2454,8 @@ msgstr "enlace symlink roto en tus carpetas de configuración de abra: %s"
 #. no spaces in between
 #. translators: `abra app cp` aliases. use a comma separated list of aliases with
 #. no spaces in between
-#: cli/app/backup.go:148 cli/app/cp.go:30 cli/app/deploy.go:438
-#: cli/app/rollback.go:369 cli/app/upgrade.go:478
+#: cli/app/backup.go:148 cli/app/cp.go:30 cli/app/deploy.go:439
+#: cli/app/rollback.go:370 cli/app/upgrade.go:479
 msgid "c"
 msgstr ""
 
@@ -2511,7 +2511,7 @@ msgstr "no se puede obtener la etiqueta %s para %s"
 msgid "cannot redeploy previous chaos version (%s), did you mean to use \"--chaos\"?"
 msgstr "no se puede redeplegar la versión anterior de caos (%s), ¿Era tu intención usar \"--caos\"?"
 
-#: cli/app/deploy.go:388
+#: cli/app/deploy.go:389
 #, c-format
 msgid ""
 "cannot redeploy previous chaos version (%s), did you mean to use \"--chaos\"?\n"
@@ -2533,7 +2533,7 @@ msgstr "no se puede especificar una etiqueta y un tipo de incremento al mismo ti
 msgid "cannot use '[secret] [version]' and '--all' together"
 msgstr "no se puede usar '[secreto] [versión]' y '--todos' juntos"
 
-#: cli/app/deploy.go:330
+#: cli/app/deploy.go:331
 msgid "cannot use --chaos and --latest together"
 msgstr "no se puede usar --caos y --latest juntos"
 
@@ -2557,11 +2557,11 @@ msgstr "no se puede usar [server] y --local al mismo tiempo"
 msgid "cannot use [service] and --all-services/-a together"
 msgstr "no se puede usar [servicio] y --todos-los-servicios/-a juntos"
 
-#: cli/app/deploy.go:322 cli/app/new.go:80
+#: cli/app/deploy.go:323 cli/app/new.go:80
 msgid "cannot use [version] and --chaos together"
 msgstr "no se puede usar [versión] y --caos juntos"
 
-#: cli/app/deploy.go:326
+#: cli/app/deploy.go:327
 msgid "cannot use [version] and --latest together"
 msgstr "no se puede usar [versión] y --latest juntos"
 
@@ -2598,8 +2598,8 @@ msgid "cfg"
 msgstr ""
 
 #: cli/app/backup.go:318 cli/app/backup.go:334 cli/app/check.go:94
-#: cli/app/cmd.go:284 cli/app/cp.go:384 cli/app/deploy.go:413
-#: cli/app/labels.go:142 cli/app/list.go:334 cli/app/new.go:406
+#: cli/app/cmd.go:284 cli/app/cp.go:384 cli/app/deploy.go:414
+#: cli/app/labels.go:142 cli/app/list.go:334 cli/app/new.go:410
 #: cli/app/ps.go:212 cli/app/restart.go:162 cli/app/restore.go:137
 #: cli/app/secret.go:568 cli/app/secret.go:608 cli/app/secret.go:632
 #: cli/app/secret.go:640 cli/catalogue/catalogue.go:317 cli/recipe/lint.go:136
@@ -2616,7 +2616,7 @@ msgstr ""
 msgid "check <domain> [flags]"
 msgstr "verificar <aplicacion> [opciones]"
 
-#: cli/app/deploy.go:95 cli/app/undeploy.go:58 cli/app/upgrade.go:442
+#: cli/app/deploy.go:95 cli/app/undeploy.go:58 cli/app/upgrade.go:443
 #, c-format
 msgid "checking whether %s is already deployed"
 msgstr "verificando si %s ya está desplegado"
@@ -2919,7 +2919,7 @@ msgstr "crítico"
 msgid "critical errors present in %s config"
 msgstr "errores críticos presentes en la configuración de %s"
 
-#: cli/app/rollback.go:299
+#: cli/app/rollback.go:300
 #, c-format
 msgid "current deployment '%s' is not a known version for %s"
 msgstr "el despliegue actual '%s' no es una versión conocida para %s"
@@ -2971,7 +2971,7 @@ msgstr "despliegue en proceso 🟠"
 msgid "deploy labels stanza present"
 msgstr "stanza de etiquetas de despliegue presente"
 
-#: cli/app/deploy.go:448
+#: cli/app/deploy.go:449
 msgid "deploy latest recipe version"
 msgstr "desplegar la última versión de la receta"
 
@@ -3073,11 +3073,11 @@ msgstr "el directorio está vacío: %s"
 msgid "dirty: %v, "
 msgstr ""
 
-#: cli/app/deploy.go:440 cli/app/rollback.go:371 cli/app/upgrade.go:480
+#: cli/app/deploy.go:441 cli/app/rollback.go:372 cli/app/upgrade.go:481
 msgid "disable converge logic checks"
 msgstr "desactivar comprobaciones de lógica de convergencia"
 
-#: cli/app/deploy.go:432 cli/app/rollback.go:363 cli/app/upgrade.go:472
+#: cli/app/deploy.go:433 cli/app/rollback.go:364 cli/app/upgrade.go:473
 msgid "disable public DNS checks"
 msgstr "desactivar comprobaciones de DNS público"
 
@@ -3093,11 +3093,11 @@ msgstr "no solicitar un TTY"
 msgid "docker: is the daemon running / your user has docker permissions?"
 msgstr "docker: ¿está corriendo el daemon / tu usuario tiene permisos de Docker?"
 
-#: cli/app/new.go:382
+#: cli/app/new.go:386
 msgid "domain"
 msgstr "dominio"
 
-#: cli/app/new.go:385
+#: cli/app/new.go:389
 msgid "domain name for app"
 msgstr "nombre de dominio para la aplicación"
 
@@ -3288,8 +3288,8 @@ msgstr "extrayendo secreto %s en %s"
 
 #. translators: `abra recipe fetch` aliases. use a comma separated list of aliases
 #. with no spaces in between
-#: cli/app/deploy.go:422 cli/app/env.go:325 cli/app/remove.go:163
-#: cli/app/rollback.go:353 cli/app/secret.go:593 cli/app/upgrade.go:462
+#: cli/app/deploy.go:423 cli/app/env.go:325 cli/app/remove.go:163
+#: cli/app/rollback.go:354 cli/app/secret.go:593 cli/app/upgrade.go:463
 #: cli/app/volume.go:217 cli/recipe/fetch.go:20 cli/recipe/fetch.go:138
 msgid "f"
 msgstr ""
@@ -3451,7 +3451,7 @@ msgstr "🛑 No se pudo eliminar algunos recursos del stock: %s"
 msgid "failed to resize tty, using default size"
 msgstr "🛑 No se pudo redimensionar el TTY; se usará el tamaño predeterminado"
 
-#: cli/app/new.go:134
+#: cli/app/new.go:138
 #, c-format
 msgid "failed to retrieve latest commit for %s: %s"
 msgstr "🛑 No se pudo obtener el último commit de %s: %s"
@@ -3541,8 +3541,8 @@ msgstr "Filtrar por receta"
 msgid "final merged env values for %s are: %s"
 msgstr "Los valores finales combinados de entorno para %s son: %s"
 
-#: cli/app/deploy.go:421 cli/app/env.go:324 cli/app/remove.go:162
-#: cli/app/rollback.go:352 cli/app/upgrade.go:461 cli/app/volume.go:216
+#: cli/app/deploy.go:422 cli/app/env.go:324 cli/app/remove.go:162
+#: cli/app/rollback.go:353 cli/app/upgrade.go:462 cli/app/volume.go:216
 #: cli/recipe/fetch.go:137
 msgid "force"
 msgstr "forzar"
@@ -3758,8 +3758,8 @@ msgid "id: %s, "
 msgstr ""
 
 #: cli/app/backup.go:321 cli/app/backup.go:337 cli/app/check.go:97
-#: cli/app/cmd.go:287 cli/app/cp.go:387 cli/app/deploy.go:416
-#: cli/app/labels.go:145 cli/app/list.go:337 cli/app/new.go:409
+#: cli/app/cmd.go:287 cli/app/cp.go:387 cli/app/deploy.go:417
+#: cli/app/labels.go:145 cli/app/list.go:337 cli/app/new.go:413
 #: cli/app/ps.go:215 cli/app/restart.go:165 cli/app/restore.go:140
 #: cli/app/secret.go:571 cli/app/secret.go:611 cli/app/secret.go:635
 #: cli/app/secret.go:643 cli/catalogue/catalogue.go:320 cli/recipe/lint.go:139
@@ -3960,7 +3960,7 @@ msgstr "versión %s especificada inválida"
 #. no spaces in between
 #. translators: `abra recipe lint` aliases. use a comma separated list of
 #. aliases with no spaces in between
-#: cli/app/cmd.go:261 cli/app/deploy.go:446 cli/app/logs.go:20
+#: cli/app/cmd.go:261 cli/app/deploy.go:447 cli/app/logs.go:20
 #: cli/recipe/lint.go:17 cli/server/add.go:207
 msgid "l"
 msgstr ""
@@ -3976,7 +3976,7 @@ msgstr ""
 msgid "labels <domain> [flags]"
 msgstr "etiquetas <aplicacion> [opciones]"
 
-#: cli/app/deploy.go:445 cli/app/list.go:186
+#: cli/app/deploy.go:446 cli/app/list.go:186
 msgid "latest"
 msgstr "ultima"
 
@@ -4325,7 +4325,7 @@ msgstr "no hay configuraciones para eliminar"
 msgid "no containers matching the %v filter found?"
 msgstr "no se encontraron contenedores que coincidan con el filtro %v?"
 
-#: cli/app/new.go:302 cli/internal/validate.go:129
+#: cli/app/new.go:306 cli/internal/validate.go:129
 msgid "no domain provided"
 msgstr "no se proporcionó dominio"
 
@@ -4352,7 +4352,7 @@ msgstr "¿no existe la receta '%s'?"
 msgid "no recipe name provided"
 msgstr "no se proporcionó el nombre de la receta"
 
-#: cli/app/upgrade.go:241
+#: cli/app/upgrade.go:242
 #, fuzzy, c-format
 msgid "no release notes for upgrading from %s to %s"
 msgstr "ejecución de prueba: mover la nota de la versión de 'next' a %s"
@@ -4383,7 +4383,7 @@ msgstr "no hay secretos para eliminar"
 msgid "no secrets to remove?"
 msgstr "¿No hay secretos para eliminar?"
 
-#: cli/app/new.go:351 cli/internal/validate.go:167
+#: cli/app/new.go:355 cli/internal/validate.go:167
 msgid "no server provided"
 msgstr "no se proporcionó servidor"
 
@@ -4441,11 +4441,11 @@ msgstr "no se eliminaron volúmenes"
 msgid "no volumes to remove"
 msgstr "no hay volúmenes para eliminar"
 
-#: cli/app/deploy.go:437 cli/app/rollback.go:368 cli/app/upgrade.go:477
+#: cli/app/deploy.go:438 cli/app/rollback.go:369 cli/app/upgrade.go:478
 msgid "no-converge-checks"
 msgstr "sin-verificaciones-de-convergencia"
 
-#: cli/app/deploy.go:429 cli/app/rollback.go:360 cli/app/upgrade.go:469
+#: cli/app/deploy.go:430 cli/app/rollback.go:361 cli/app/upgrade.go:470
 msgid "no-domain-checks"
 msgstr "sin-verificaciones-de-dominio"
 
@@ -4513,7 +4513,7 @@ msgstr "solo se usaron etiquetas anotadas para la versión de la receta"
 msgid "only show errors"
 msgstr "mostrar solo errores"
 
-#: cli/app/upgrade.go:488
+#: cli/app/upgrade.go:489
 msgid "only show release notes"
 msgstr "solo mostrar notas de la versión"
 
@@ -4525,7 +4525,7 @@ msgstr "solo cola de stderr"
 #. with no spaces in between
 #. translators: `abra server prune` aliases. use a comma separated list of
 #. aliases with no spaces in between
-#: cli/app/backup.go:295 cli/app/new.go:391 cli/app/ps.go:29
+#: cli/app/backup.go:295 cli/app/new.go:395 cli/app/ps.go:29
 #: cli/app/secret.go:561 cli/app/secret.go:585 cli/app/secret.go:625
 #: cli/app/undeploy.go:169 cli/catalogue/catalogue.go:294
 #: cli/recipe/list.go:112 cli/server/prune.go:18
@@ -4547,27 +4547,27 @@ msgstr "parseado %s de %s"
 msgid "parsed following command arguments: %s"
 msgstr "parseados los siguientes argumentos del comando: %s"
 
-#: cli/app/upgrade.go:345
+#: cli/app/upgrade.go:346
 #, c-format
 msgid "parsing chosen upgrade version failed: %s"
 msgstr "falló la actualización de versión elegida para el parsing: %s"
 
-#: cli/app/upgrade.go:389
+#: cli/app/upgrade.go:390
 #, c-format
 msgid "parsing deployed version failed: %s"
 msgstr "parsing fallido de la versión desplegada: %s"
 
-#: cli/app/upgrade.go:350
+#: cli/app/upgrade.go:351
 #, c-format
 msgid "parsing deployment version failed: %s"
 msgstr "parsing fallido de la versión de despliegue: %s"
 
-#: cli/app/upgrade.go:356 cli/app/upgrade.go:395
+#: cli/app/upgrade.go:357 cli/app/upgrade.go:396
 #, c-format
 msgid "parsing recipe version failed: %s"
 msgstr "parsing fallido de la versión de la receta: %s"
 
-#: cli/app/new.go:390 cli/app/secret.go:560 cli/app/secret.go:584
+#: cli/app/new.go:394 cli/app/secret.go:560 cli/app/secret.go:584
 #: cli/app/secret.go:624
 msgid "pass"
 msgstr ""
@@ -4590,8 +4590,8 @@ msgstr "ruta"
 msgid "pattern"
 msgstr "patrón"
 
-#: cli/app/deploy.go:424 cli/app/env.go:327 cli/app/remove.go:165
-#: cli/app/rollback.go:355 cli/app/upgrade.go:464 cli/app/volume.go:219
+#: cli/app/deploy.go:425 cli/app/env.go:327 cli/app/remove.go:165
+#: cli/app/rollback.go:356 cli/app/upgrade.go:465 cli/app/volume.go:219
 msgid "perform action without further prompt"
 msgstr "realizar acción sin más avisos"
 
@@ -4601,22 +4601,22 @@ msgstr "realizar acción sin más avisos"
 msgid "pl,p"
 msgstr ""
 
-#: cli/app/rollback.go:267
+#: cli/app/rollback.go:268
 #, c-format
 msgid "please select a downgrade (version: %s):"
 msgstr "por favor, selecciona una versión anterior (downgrade) (versión: %s):"
 
-#: cli/app/rollback.go:272
+#: cli/app/rollback.go:273
 #, c-format
 msgid "please select a downgrade (version: %s, chaos: %s):"
 msgstr "por favor, selecciona una versión anterior (downgrade) (versión: %s, caos: %s):"
 
-#: cli/app/upgrade.go:312
+#: cli/app/upgrade.go:313
 #, c-format
 msgid "please select an upgrade (version: %s):"
 msgstr "por favor, selecciona una actualización (versión: %s):"
 
-#: cli/app/upgrade.go:317
+#: cli/app/upgrade.go:318
 #, c-format
 msgid "please select an upgrade (version: %s, chaos: %s):"
 msgstr "por favor, selecciona una actualización (versión: %s, caos: %s):"
@@ -4702,7 +4702,7 @@ msgstr "consultando servidores remotos..."
 #. translators: `abra recipe` aliases. use a comma separated list of aliases
 #. with no spaces in between
 #: cli/app/backup.go:327 cli/app/list.go:304 cli/app/move.go:350
-#: cli/app/run.go:23 cli/app/upgrade.go:486 cli/catalogue/catalogue.go:302
+#: cli/app/run.go:23 cli/app/upgrade.go:487 cli/catalogue/catalogue.go:302
 #: cli/recipe/recipe.go:12 cli/recipe/release.go:624
 msgid "r"
 msgstr ""
@@ -4827,7 +4827,7 @@ msgstr "publicar <receta> [version] [opciones]"
 msgid "release failed. any changes made have been reverted"
 msgstr ""
 
-#: cli/app/upgrade.go:485
+#: cli/app/upgrade.go:486
 msgid "releasenotes"
 msgstr "notas de la versión"
 
@@ -5132,7 +5132,7 @@ msgstr "ejecutar comando como usuario"
 msgid "run command locally"
 msgstr "ejecutar comando localmente"
 
-#: cli/app/deploy.go:281 cli/app/upgrade.go:293
+#: cli/app/deploy.go:282 cli/app/upgrade.go:294
 #, c-format
 msgid "run the following post-deploy commands: %s"
 msgstr "Ejecutar los siguientes comandos después del despliegue: %s"
@@ -5175,7 +5175,7 @@ msgstr "ejecutando el comando posterior '%s %s' en el contenedor %s"
 #. with no spaces in between
 #: cli/app/backup.go:198 cli/app/backup.go:263 cli/app/backup.go:287
 #: cli/app/env.go:333 cli/app/list.go:327 cli/app/logs.go:101
-#: cli/app/new.go:368 cli/app/restore.go:114 cli/app/secret.go:535
+#: cli/app/new.go:372 cli/app/restore.go:114 cli/app/secret.go:535
 #: cli/catalogue/catalogue.go:27 cli/catalogue/catalogue.go:310
 #: cli/recipe/fetch.go:130 cli/server/server.go:12
 msgid "s"
@@ -5219,12 +5219,12 @@ msgstr "datos del secreto no proporcionados en la línea de comandos o stdin, so
 msgid "secret not found: %s"
 msgstr "secreto no encontrado: %s"
 
-#: cli/app/deploy.go:358
+#: cli/app/deploy.go:359
 #, c-format
 msgid "secret not generated: %s"
 msgstr "secreto no generado: %s"
 
-#: cli/app/deploy.go:356
+#: cli/app/deploy.go:357
 #, c-format
 msgid "secret not inserted (#generate=false): %s"
 msgstr "secreto no insertado (#generate=false): %s"
@@ -5234,28 +5234,28 @@ msgstr "secreto no insertado (#generate=false): %s"
 msgid "secret: %s removed"
 msgstr "secreto: %s eliminado"
 
-#: cli/app/backup.go:302 cli/app/new.go:398
+#: cli/app/backup.go:302 cli/app/new.go:402
 msgid "secrets"
 msgstr "secretos"
 
-#: cli/app/new.go:238
+#: cli/app/new.go:242
 #, c-format
 msgid "secrets are %s shown again, please save them %s"
 msgstr "los secretos se muestran %s nuevamente, por favor guárdalos %s"
 
-#: cli/app/deploy.go:306
+#: cli/app/deploy.go:307
 #, c-format
 msgid "selected latest recipe version: %s (from %d available versions)"
 msgstr "versión de receta más reciente seleccionada: %s (de %d versiones disponibles)"
 
-#: cli/app/new.go:121
+#: cli/app/new.go:125
 #, c-format
 msgid "selected recipe version: %s (from %d available versions)"
 msgstr "versión de receta seleccionada: %s (de %d versiones disponibles)"
 
 #. translators: `abra server` command for autocompletion
 #: cli/app/env.go:332 cli/app/env.go:339 cli/app/list.go:326
-#: cli/app/list.go:341 cli/app/new.go:367 cli/app/new.go:374 cli/run.go:101
+#: cli/app/list.go:341 cli/app/new.go:371 cli/app/new.go:378 cli/run.go:101
 msgid "server"
 msgstr "servidor"
 
@@ -5369,7 +5369,7 @@ msgstr "establecer referencia: %s"
 msgid "severity"
 msgstr "gravedad"
 
-#: cli/app/deploy.go:456 cli/app/rollback.go:379 cli/app/upgrade.go:496
+#: cli/app/deploy.go:457 cli/app/rollback.go:380 cli/app/upgrade.go:497
 msgid "show all configs & images, including unchanged ones"
 msgstr "mostrar todas las configuraciones e imágenes, incluidas las no cambiadas"
 
@@ -5393,7 +5393,7 @@ msgstr "mostrar aplicaciones de un servidor específico"
 msgid "show debug messages"
 msgstr "mostrar mensajes para el debugeo"
 
-#: cli/app/deploy.go:453 cli/app/rollback.go:376 cli/app/upgrade.go:493
+#: cli/app/deploy.go:454 cli/app/rollback.go:377 cli/app/upgrade.go:494
 msgid "show-unchanged"
 msgstr "mostrar-sin-cambios"
 
@@ -5401,7 +5401,7 @@ msgstr "mostrar-sin-cambios"
 msgid "since"
 msgstr "desde"
 
-#: cli/app/new.go:336
+#: cli/app/new.go:340
 #, c-format
 msgid "single server detected, choosing %s automatically"
 msgstr "se ha detectado un único servidor, eligiendo %s automáticamente"
@@ -5441,11 +5441,11 @@ msgstr "omitiendo según lo solicitado, plegado aún está en progreso 🟠"
 msgid "skipping converge logic checks"
 msgstr "omitiendo comprobaciones de lógica de convergencia"
 
-#: cli/app/deploy.go:208
+#: cli/app/deploy.go:209
 msgid "skipping domain checks"
 msgstr "omitiendo comprobaciones de dominio"
 
-#: cli/app/deploy.go:205
+#: cli/app/deploy.go:206
 msgid "skipping domain checks, no DOMAIN=... configured"
 msgstr "omitiendo comprobaciones de dominio, no DOMAIN=... configurado"
 
@@ -5501,7 +5501,7 @@ msgstr "especificar archivo de secreto"
 msgid "specify secret value"
 msgstr "especificar valor de secreto"
 
-#: cli/app/new.go:370
+#: cli/app/new.go:374
 msgid "specify server for new app"
 msgstr "especificar servidor para la nueva aplicación"
 
@@ -5559,7 +5559,7 @@ msgstr ""
 msgid "store generated secrets in a local pass store"
 msgstr "almacenar secretos generados en un almacén de contraseñas local"
 
-#: cli/app/new.go:393
+#: cli/app/new.go:397
 msgid "store secrets in a local pass store"
 msgstr "almacenar secretos en un almacén de contraseñas local"
 
@@ -5710,7 +5710,7 @@ msgstr "recortar"
 msgid "trim input"
 msgstr "recortar entrada"
 
-#: cli/app/new.go:263 pkg/app/app.go:141
+#: cli/app/new.go:267 pkg/app/app.go:141
 #, c-format
 msgid "trimming %s to %s to avoid runtime limits"
 msgstr "recortando %s a %s para evitar límites de tiempo de ejecución"
@@ -6255,27 +6255,27 @@ msgstr "la versión parece inválida: %s"
 msgid "version wiped from %s.env"
 msgstr "versión eliminada de %s.env"
 
-#: cli/app/deploy.go:372
+#: cli/app/deploy.go:373
 #, c-format
 msgid "version: taking chaos version: %s"
 msgstr "versión: tomando la versión de caos: %s"
 
-#: cli/app/deploy.go:398
+#: cli/app/deploy.go:399
 #, c-format
 msgid "version: taking deployed version: %s"
 msgstr "versión: tomando la versión desplegada: %s"
 
-#: cli/app/deploy.go:403
+#: cli/app/deploy.go:404
 #, c-format
 msgid "version: taking new recipe version: %s"
 msgstr "versión: tomando la nueva versión de la receta: %s"
 
-#: cli/app/deploy.go:392
+#: cli/app/deploy.go:393
 #, c-format
 msgid "version: taking version from .env file: %s"
 msgstr "versión: tomando la versión desde el archivo .env: %s"
 
-#: cli/app/deploy.go:378
+#: cli/app/deploy.go:379
 #, c-format
 msgid "version: taking version from cli arg: %s"
 msgstr "versión: tomando la versión desde el argumento de la línea de comandos: %s"
@@ -6406,8 +6406,8 @@ msgstr "el directorio de trabajo no está limpio en %s, abortando"
 msgid "writer: %v, "
 msgstr ""
 
-#: cli/app/deploy.go:288 cli/app/new.go:251 cli/app/rollback.go:256
-#: cli/app/undeploy.go:120 cli/app/upgrade.go:301
+#: cli/app/deploy.go:289 cli/app/new.go:255 cli/app/rollback.go:257
+#: cli/app/undeploy.go:120 cli/app/upgrade.go:302
 #, c-format
 msgid "writing recipe version failed: %s"
 msgstr "escritura de la versión de la receta fallida: %s"

pkg/secret/testdir/compose.yaml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.21.0
+    image: nginx:1.31.2
     secrets:
       - test_pass_one
       - test_pass_two

scripts/tests/extra_hosts

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# This file generates local DNS aliases for the client VM for integration testing
+
+echo "generating hosts file..."
+hosts_file_path="./tests/resources/extra_hosts"
+echo "removing old file..."
+rm -f $hosts_file_path
+
+# the server domain
+server_ip="10.0.0.3"
+domain="abra.local"
+echo "$server_ip $domain" >> $hosts_file_path
+# static subdomains used in integration tests
+subdomains=("gitea" "zammad" "custom-html" "foo" "foobar")
+
+for subdomain in "${subdomains[@]}"
+do
+  echo "$server_ip $subdomain.$domain" >> $hosts_file_path
+done
+
+search_dir=./tests/integration
+for entry in "$search_dir"/*.bats
+do
+	file_name=$(basename "${entry}")
+	# converting file names to testing subdomains
+	subdomain=$(echo "$file_name" | tr . _)
+	echo "$server_ip $subdomain.$domain" >> $hosts_file_path
+done
+
+echo "writing extra hosts success"

tests/README.md

@@ -7,4 +7,5 @@
 
 * Integration tests are in `./tests/integration`. Please see [these
   docs](https://docs.coopcloud.tech/abra/hack/#integration-tests) for
-  instructions and tips on how to run them.
+  instructions and tips on how to run them. If you want to run it locally via nix,
+  read the [nix testing docs](../nix/hosts/README.md). 

tests/integration/app_deploy.bats

@@ -598,8 +598,7 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
   assert_success
 
-  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
-    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+ 	_inspect_env_test_app 
   assert_success
   assert_output --partial "WITH_COMMENT=foo"
 
@@ -610,8 +609,7 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --force
   assert_success
 
-  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
-    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+ 	_inspect_env_test_app 
   assert_success
   refute_output --partial "WITH_COMMENT=foo"
   assert_output --partial "WITH_COMMENT=bar"
@@ -629,8 +627,14 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
   assert_success
 
-  run docker service inspect  --format '{{ range .Endpoint.Ports }}{{ .Protocol }}={{ .PublishedPort }}{{ end }}' \
+	if _is_local; 
+	then 
+		run docker service inspect --format "{{ range .Endpoint.Ports }}{{ .Protocol }}={{ .PublishedPort }}{{ end }}" \
     "${TEST_APP_DOMAIN//./_}_app"
+	else 
+		run ssh "$TEST_SERVER" "docker service inspect --format '{{ range .Endpoint.Ports }}{{ .Protocol }}={{ .PublishedPort }}{{ end }}' ${TEST_APP_DOMAIN//./_}_app"
+	fi
+  
   assert_success
   assert_output --partial "tcp=1312"
   assert_output --partial "udp=1312"

tests/integration/app_deploy_env_version.bats

@@ -133,8 +133,7 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input
   assert_success
 
-  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
-    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+ 	_inspect_env_test_app 
   assert_success
   assert_output --partial "$TEST_RECIIPE:0.1.0+1.20.0"
 }

tests/integration/app_new.bats

@@ -61,6 +61,16 @@ teardown(){
   run grep -q "TYPE=$TEST_RECIPE:0.3.0+1.21.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
+
+  # 0.3.0-only
+  run grep -q "NETWORK_WITH_COMMENT=BAZ" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  # latest-only
+  run grep -q "TIMEOUT=120" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_failure
 }
 
 @test "ensure recipe is up-to-date" {
@@ -100,6 +110,16 @@ teardown(){
   run grep -q "TYPE=$TEST_RECIPE:${tagHash}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
+
+  # 0.3.0-only
+  run grep -q "NETWORK_WITH_COMMENT=BAZ" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  # latest-only
+  run grep -q "TIMEOUT=120" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_failure
 }
 
 @test "does not overwrite existing env files" {

tests/integration/app_remove.bats

@@ -140,15 +140,22 @@ teardown(){
   _undeploy_app
 
   sanitisedDomainName="${TEST_APP_DOMAIN//./_}"
-  run docker config create "${sanitisedDomainName}_test_conf_v99" "$ABRA_DIR/recipes/abra-test-recipe/abra.sh"
-  assert_success
+	remote_ssh_command=""
+	if _is_local; 
+	then 
+  	run docker config create "${sanitisedDomainName}_test_conf_v99" "$ABRA_DIR/recipes/abra-test-recipe/abra.sh"
+	else
+		remote_ssh_command="ssh '$TEST_SERVER'"
+		run cat "$ABRA_DIR/recipes/abra-test-recipe/abra.sh" | ssh "$TEST_SERVER" docker config create "${sanitisedDomainName}_test_conf_v99 -"
+		assert_success
+	fi
 
-  assert bash -c "docker config ls | grep -q test_conf_v99"
+  assert bash -c "$remote_ssh_command docker config ls | grep -q test_conf_v99"
 
   run $ABRA app rm "$TEST_APP_DOMAIN" --no-input
   assert_success
 
-  refute bash -c "docker config ls | grep -q test_conf_v99"
+  refute bash -c "$remote_ssh_command docker config ls | grep -q test_conf_v99"
 }
 
 @test "remove .env file" {

tests/integration/app_rollback_env_version.bats

@@ -54,8 +54,7 @@ teardown(){
     --no-input
   assert_success
 
-  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
-    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+	_inspect_env_test_app
   assert_success
   assert_output --partial "$TEST_RECIIPE:0.1.0+1.20.0"
 }

tests/integration/app_upgrade_env_version.bats

@@ -53,8 +53,7 @@ teardown(){
   run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.2.0+1.21.0" --no-input
   assert_success
 
-  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
-    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+ 	_inspect_env_test_app 
   assert_success
-  assert_output --partial "$TEST_RECIIPE:0.2.0+1.21.0"
+  assert_output --partial "$TEST_RECIPE:0.2.0+1.21.0"
 }

tests/integration/helpers/common.bash

@@ -31,9 +31,18 @@ _ensure_ssh_agent() {
     exit 1
   fi
 
-  export SSH_AUTH_SOCK="$HOME/.ssh/ssh_auth_sock"
-  if [ ! -S ~/.ssh/ssh_auth_sock ]; then
+  if [[ ! -v SSH_AUTH_SOCK ]]; then
+		export SSH_AUTH_SOCK="$HOME/.ssh/ssh_auth_sock"
     eval `ssh-agent`
     ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
   fi
 }
+
+_is_local() {
+	if [[ "$TEST_SERVER" == "default" ]];
+  then
+    return 0 
+  else
+    return 1
+  fi
+}

tests/integration/helpers/docker.bash

@@ -1,13 +1,37 @@
 #!/usr/bin/env bash
 
 _ensure_swarm() {
-  if [ "$(docker info | grep Swarm | sed 's/Swarm: //g' | tr -d ' ')" == "inactive" ]; then
-    run docker swarm init --advertise-addr 127.0.0.1:2377
-    assert_success
+	if [ "$(docker info | grep Swarm | sed 's/Swarm: //g' | tr -d ' ')" == "inactive" ]; then
+   	run docker swarm init --advertise-addr 127.0.0.1:2377
+   	assert_success
   fi
 
-  if ! $(docker network ls | grep -q 'proxy'); then
-    run docker network create -d overlay proxy
-    assert_success
+  if ! docker network ls | grep -q 'proxy'; then
+   	run docker network create -d overlay proxy
+   	assert_success
   fi
+
+	if ! _is_local; 
+	then 
+		if [ "$(ssh "$TEST_SERVER" docker info | grep Swarm | sed 's/Swarm: //g' | tr -d ' ')" == "inactive" ]; then
+    	run ssh "$TEST_SERVER" docker swarm init --advertise-addr 127.0.0.1:2377
+    	assert_success
+  	fi
+
+  	if ! ssh "$TEST_SERVER" docker network ls | grep -q 'proxy'; then
+    	run ssh "$TEST_SERVER" docker network create -d overlay proxy
+    	assert_success
+  	fi
+	fi
+}
+
+_inspect_env_test_app() {
+	if _is_local; 
+	then 
+		containerId="$(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)" 
+		run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' "$containerId"
+	else 
+		containerId="$(ssh "$TEST_SERVER" docker ps -f name="$TEST_APP_DOMAIN" -q)"
+		run ssh "$TEST_SERVER" "docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' '$containerId'"
+	fi
 }

tests/integration/recipe_upgrade.bats

@@ -38,8 +38,6 @@ teardown(){
 
   run $ABRA recipe upgrade "custom-html" --no-input
   assert_success
-  assert_output --partial 'can upgrade service: app'
-
   assert_exists "$ABRA_DIR/recipes/custom-html"
 }
 

tests/integration/server_add.bats

@@ -27,7 +27,7 @@ teardown(){
   assert bash -c "docker context ls | grep -q $TEST_SERVER"
 
   server_dir_perms=$(stat -c "%a" "$ABRA_DIR/servers/$TEST_SERVER")
-  assert_equal $server_dir_perms "700"
+  assert_equal "$server_dir_perms" "700"
 }
 
 @test "error if using name and --local together" {
@@ -43,8 +43,8 @@ teardown(){
   assert bash -c "docker context ls | grep -q default"
   assert_output --partial 'local server successfully added'
 
-  server_dir_perms=$(stat -c "%a" "$ABRA_DIR/servers/$TEST_SERVER")
-  assert_equal $server_dir_perms "700"
+  server_dir_perms=$(stat -c "%a" "$ABRA_DIR/servers/default")
+  assert_equal "$server_dir_perms" "700"
 }
 
 @test "create local server fails when no docker swarm" {

tests/resources/extra_hosts

@@ -0,0 +1,57 @@
+10.0.0.3 abra.local
+10.0.0.3 gitea.abra.local
+10.0.0.3 zammad.abra.local
+10.0.0.3 custom-html.abra.local
+10.0.0.3 foo.abra.local
+10.0.0.3 foobar.abra.local
+10.0.0.3 app_check_bats.abra.local
+10.0.0.3 app_cmd_bats.abra.local
+10.0.0.3 app_config_bats.abra.local
+10.0.0.3 app_cp_bats.abra.local
+10.0.0.3 app_deploy_bats.abra.local
+10.0.0.3 app_deploy_env_version_bats.abra.local
+10.0.0.3 app_deploy_overview_bats.abra.local
+10.0.0.3 app_deploy_remote_recipes_bats.abra.local
+10.0.0.3 app_env_bats.abra.local
+10.0.0.3 app_env_version_bats.abra.local
+10.0.0.3 app_labels_bats.abra.local
+10.0.0.3 app_list_bats.abra.local
+10.0.0.3 app_logs_bats.abra.local
+10.0.0.3 app_move_bats.abra.local
+10.0.0.3 app_new_bats.abra.local
+10.0.0.3 app_ps_bats.abra.local
+10.0.0.3 app_remove_bats.abra.local
+10.0.0.3 app_restart_bats.abra.local
+10.0.0.3 app_rollback_bats.abra.local
+10.0.0.3 app_rollback_env_version_bats.abra.local
+10.0.0.3 app_rollback_overview_bats.abra.local
+10.0.0.3 app_run_bats.abra.local
+10.0.0.3 app_secret_bats.abra.local
+10.0.0.3 app_secret_env_version_bats.abra.local
+10.0.0.3 app_services_bats.abra.local
+10.0.0.3 app_undeploy_bats.abra.local
+10.0.0.3 app_undeploy_env_version_bats.abra.local
+10.0.0.3 app_undeploy_overview_bats.abra.local
+10.0.0.3 app_upgrade_bats.abra.local
+10.0.0.3 app_upgrade_env_version_bats.abra.local
+10.0.0.3 app_upgrade_overview_bats.abra.local
+10.0.0.3 app_volume_bats.abra.local
+10.0.0.3 autocomplete_bats.abra.local
+10.0.0.3 catalogue_bats.abra.local
+10.0.0.3 dirs_bats.abra.local
+10.0.0.3 install_bats.abra.local
+10.0.0.3 recipe_diff_bats.abra.local
+10.0.0.3 recipe_fetch_bats.abra.local
+10.0.0.3 recipe_lint_bats.abra.local
+10.0.0.3 recipe_list_bats.abra.local
+10.0.0.3 recipe_new_bats.abra.local
+10.0.0.3 recipe_release_bats.abra.local
+10.0.0.3 recipe_reset_bats.abra.local
+10.0.0.3 recipe_upgrade_bats.abra.local
+10.0.0.3 recipe_version_bats.abra.local
+10.0.0.3 server_add_bats.abra.local
+10.0.0.3 server_list_bats.abra.local
+10.0.0.3 server_prune_bats.abra.local
+10.0.0.3 server_remove_bats.abra.local
+10.0.0.3 upgrade_bats.abra.local
+10.0.0.3 version_bats.abra.local

tests/resources/local_integration_ssh

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBQ967UhxmFkq71WXvVRkEmtehCGsEnBVppAXxgtHHm7wAAAJhFGwTnRRsE
+5wAAAAtzc2gtZWQyNTUxOQAAACBQ967UhxmFkq71WXvVRkEmtehCGsEnBVppAXxgtHHm7w
+AAAEAnHEZcf2NeRQEcJC/aVgUWsdOz+vQgEG9ZY+3ErCeaKFD3rtSHGYWSrvVZe9VGQSa1
+6EIawScFWmkBfGC0cebvAAAAFWFicmEgaW50ZWdyYXRpb24gdGVzdA==
+-----END OPENSSH PRIVATE KEY-----

tests/resources/local_integration_ssh.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFD3rtSHGYWSrvVZe9VGQSa16EIawScFWmkBfGC0cebv abra integration test

tests/resources/path_to_repo

@@ -0,0 +1 @@
+/path/to/this/repo

tests/resources/test_recipe/compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.29.0
+    image: nginx:1.31.2
     networks:
       - proxy
     deploy:

vendor/coopcloud.tech/tagcmp/.drone.yml

@@ -3,16 +3,16 @@ kind: pipeline
 name: coopcloud.tech/tagcmp
 steps:
   - name: gofmt
-    image: golang:1.21
+    image: golang:1.26
     commands:
       - test -z "$(gofmt -l .)"
 
   - name: go build
-    image: golang:1.21
+    image: golang:1.26
     commands:
       - go build -v .
 
   - name: go test
-    image: golang:1.21
+    image: golang:1.26
     commands:
       - go test . -cover

vendor/coopcloud.tech/tagcmp/renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

vendor/github.com/charmbracelet/x/ansi/width.go

@@ -87,7 +87,7 @@ func stringWidth(m Method, s string) int {
 
 	for i := 0; i < len(s); i++ {
 		state, action := parser.Table.Transition(pstate, s[i])
-		if action == parser.PrintAction || state == parser.Utf8State {
+		if state == parser.Utf8State {
 			cluster, w := FirstGraphemeCluster(s[i:], m)
 			width += w
 

vendor/github.com/docker/go-connections/nat/nat.go

@@ -27,15 +27,19 @@ type PortSet map[Port]struct{}
 type Port string
 
 // NewPort creates a new instance of a Port given a protocol and port number or port range
-func NewPort(proto, portOrRange string) (Port, error) {
-	start, end, err := parsePortRange(portOrRange)
+func NewPort(proto, port string) (Port, error) {
+	// Check for parsing issues on "port" now so we can avoid having
+	// to check it later on.
+
+	portStartInt, portEndInt, err := ParsePortRangeToInt(port)
 	if err != nil {
 		return "", err
 	}
-	if start == end {
-		return Port(fmt.Sprintf("%d/%s", start, proto)), nil
+
+	if portStartInt == portEndInt {
+		return Port(fmt.Sprintf("%d/%s", portStartInt, proto)), nil
 	}
-	return Port(fmt.Sprintf("%d-%d/%s", start, end, proto)), nil
+	return Port(fmt.Sprintf("%d-%d/%s", portStartInt, portEndInt, proto)), nil
 }
 
 // ParsePort parses the port number string and returns an int
@@ -43,53 +47,49 @@ func ParsePort(rawPort string) (int, error) {
 	if rawPort == "" {
 		return 0, nil
 	}
-	port, err := parsePortNumber(rawPort)
+	port, err := strconv.ParseUint(rawPort, 10, 16)
 	if err != nil {
-		return 0, fmt.Errorf("invalid port '%s': %w", rawPort, err)
+		return 0, fmt.Errorf("invalid port '%s': %w", rawPort, errors.Unwrap(err))
 	}
-	return port, nil
+	return int(port), nil
 }
 
 // ParsePortRangeToInt parses the port range string and returns start/end ints
-func ParsePortRangeToInt(rawPort string) (startPort, endPort int, _ error) {
+func ParsePortRangeToInt(rawPort string) (int, int, error) {
 	if rawPort == "" {
-		// TODO(thaJeztah): consider making this an error; this was kept to keep existing behavior.
 		return 0, 0, nil
 	}
-	return parsePortRange(rawPort)
+	start, end, err := ParsePortRange(rawPort)
+	if err != nil {
+		return 0, 0, err
+	}
+	return int(start), int(end), nil
 }
 
 // Proto returns the protocol of a Port
 func (p Port) Proto() string {
-	_, proto, _ := strings.Cut(string(p), "/")
-	if proto == "" {
-		proto = "tcp"
-	}
+	proto, _ := SplitProtoPort(string(p))
 	return proto
 }
 
 // Port returns the port number of a Port
 func (p Port) Port() string {
-	port, _, _ := strings.Cut(string(p), "/")
+	_, port := SplitProtoPort(string(p))
 	return port
 }
 
-// Int returns the port number of a Port as an int. It assumes [Port]
-// is valid, and returns 0 otherwise.
+// Int returns the port number of a Port as an int
 func (p Port) Int() int {
+	portStr := p.Port()
 	// We don't need to check for an error because we're going to
-	// assume that any error would have been found, and reported, in [NewPort]
-	port, _ := parsePortNumber(p.Port())
+	// assume that any error would have been found, and reported, in NewPort()
+	port, _ := ParsePort(portStr)
 	return port
 }
 
 // Range returns the start/end port numbers of a Port range as ints
 func (p Port) Range() (int, int, error) {
-	portRange := p.Port()
-	if portRange == "" {
-		return 0, 0, nil
-	}
-	return parsePortRange(portRange)
+	return ParsePortRangeToInt(p.Port())
 }
 
 // SplitProtoPort splits a port(range) and protocol, formatted as "<portnum>/[<proto>]"
@@ -173,10 +173,6 @@ func splitParts(rawport string) (hostIP, hostPort, containerPort string) {
 func ParsePortSpec(rawPort string) ([]PortMapping, error) {
 	ip, hostPort, containerPort := splitParts(rawPort)
 	proto, containerPort := SplitProtoPort(containerPort)
-	if containerPort == "" {
-		return nil, fmt.Errorf("no port specified: %s<empty>", rawPort)
-	}
-
 	proto = strings.ToLower(proto)
 	if err := validateProto(proto); err != nil {
 		return nil, err
@@ -193,15 +189,18 @@ func ParsePortSpec(rawPort string) ([]PortMapping, error) {
 	if ip != "" && net.ParseIP(ip) == nil {
 		return nil, errors.New("invalid IP address: " + ip)
 	}
+	if containerPort == "" {
+		return nil, fmt.Errorf("no port specified: %s<empty>", rawPort)
+	}
 
-	startPort, endPort, err := parsePortRange(containerPort)
+	startPort, endPort, err := ParsePortRange(containerPort)
 	if err != nil {
 		return nil, errors.New("invalid containerPort: " + containerPort)
 	}
 
-	var startHostPort, endHostPort int
+	var startHostPort, endHostPort uint64
 	if hostPort != "" {
-		startHostPort, endHostPort, err = parsePortRange(hostPort)
+		startHostPort, endHostPort, err = ParsePortRange(hostPort)
 		if err != nil {
 			return nil, errors.New("invalid hostPort: " + hostPort)
 		}
@@ -218,18 +217,19 @@ func ParsePortSpec(rawPort string) ([]PortMapping, error) {
 	count := endPort - startPort + 1
 	ports := make([]PortMapping, 0, count)
 
-	for i := range count {
+	for i := uint64(0); i < count; i++ {
+		cPort := Port(strconv.FormatUint(startPort+i, 10) + "/" + proto)
 		hPort := ""
 		if hostPort != "" {
-			hPort = strconv.Itoa(startHostPort + i)
+			hPort = strconv.FormatUint(startHostPort+i, 10)
 			// Set hostPort to a range only if there is a single container port
 			// and a dynamic host port.
 			if count == 1 && startHostPort != endHostPort {
-				hPort += "-" + strconv.Itoa(endHostPort)
+				hPort += "-" + strconv.FormatUint(endHostPort, 10)
 			}
 		}
 		ports = append(ports, PortMapping{
-			Port:    Port(strconv.Itoa(startPort+i) + "/" + proto),
+			Port:    cPort,
 			Binding: PortBinding{HostIP: ip, HostPort: hPort},
 		})
 	}

vendor/github.com/docker/go-connections/nat/parse.go

@@ -2,59 +2,32 @@ package nat
 
 import (
 	"errors"
-	"fmt"
 	"strconv"
 	"strings"
 )
 
-// ParsePortRange parses and validates the specified string as a port range (e.g., "8000-9000").
-func ParsePortRange(ports string) (startPort, endPort uint64, _ error) {
-	start, end, err := parsePortRange(ports)
-	return uint64(start), uint64(end), err
-}
-
-// parsePortRange parses and validates the specified string as a port range (e.g., "8000-9000").
-func parsePortRange(ports string) (startPort, endPort int, _ error) {
+// ParsePortRange parses and validates the specified string as a port-range (8000-9000)
+func ParsePortRange(ports string) (uint64, uint64, error) {
 	if ports == "" {
 		return 0, 0, errors.New("empty string specified for ports")
 	}
-	start, end, ok := strings.Cut(ports, "-")
-
-	startPort, err := parsePortNumber(start)
-	if err != nil {
-		return 0, 0, fmt.Errorf("invalid start port '%s': %w", start, err)
-	}
-	if !ok || start == end {
-		return startPort, startPort, nil
+	if !strings.Contains(ports, "-") {
+		start, err := strconv.ParseUint(ports, 10, 16)
+		end := start
+		return start, end, err
 	}
 
-	endPort, err = parsePortNumber(end)
+	parts := strings.Split(ports, "-")
+	start, err := strconv.ParseUint(parts[0], 10, 16)
 	if err != nil {
-		return 0, 0, fmt.Errorf("invalid end port '%s': %w", end, err)
+		return 0, 0, err
 	}
-	if endPort < startPort {
-		return 0, 0, errors.New("invalid port range: " + ports)
+	end, err := strconv.ParseUint(parts[1], 10, 16)
+	if err != nil {
+		return 0, 0, err
 	}
-	return startPort, endPort, nil
-}
-
-// parsePortNumber parses rawPort into an int, unwrapping strconv errors
-// and returning a single "out of range" error for any value outside 0–65535.
-func parsePortNumber(rawPort string) (int, error) {
-	if rawPort == "" {
-		return 0, errors.New("value is empty")
+	if end < start {
+		return 0, 0, errors.New("invalid range specified for port: " + ports)
 	}
-	port, err := strconv.ParseInt(rawPort, 10, 0)
-	if err != nil {
-		var numErr *strconv.NumError
-		if errors.As(err, &numErr) {
-			err = numErr.Err
-		}
-		return 0, err
-	}
-	if port < 0 || port > 65535 {
-		return 0, errors.New("value out of range (0–65535)")
-	}
-
-	return int(port), nil
+	return start, end, nil
 }

vendor/github.com/docker/go-connections/nat/sort.go

@@ -34,10 +34,8 @@ func Sort(ports []Port, predicate func(i, j Port) bool) {
 }
 
 type portMapEntry struct {
-	port      Port
-	binding   *PortBinding
-	portInt   int
-	portProto string
+	port    Port
+	binding PortBinding
 }
 
 type portMapSorter []portMapEntry
@@ -50,36 +48,23 @@ func (s portMapSorter) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
 // 2. larger port
 // 3. port with tcp protocol
 func (s portMapSorter) Less(i, j int) bool {
-	pi, pj := s[i].portInt, s[j].portInt
-	var hpi, hpj int
-	if s[i].binding != nil {
-		hpi = toInt(s[i].binding.HostPort)
-	}
-	if s[j].binding != nil {
-		hpj = toInt(s[j].binding.HostPort)
-	}
-	return hpi > hpj || pi > pj || (pi == pj && strings.EqualFold(s[i].portProto, "tcp"))
+	pi, pj := s[i].port, s[j].port
+	hpi, hpj := toInt(s[i].binding.HostPort), toInt(s[j].binding.HostPort)
+	return hpi > hpj || pi.Int() > pj.Int() || (pi.Int() == pj.Int() && strings.ToLower(pi.Proto()) == "tcp")
 }
 
 // SortPortMap sorts the list of ports and their respected mapping. The ports
 // will explicit HostPort will be placed first.
-func SortPortMap(ports []Port, bindings map[Port][]PortBinding) {
+func SortPortMap(ports []Port, bindings PortMap) {
 	s := portMapSorter{}
 	for _, p := range ports {
-		portInt, portProto := p.Int(), p.Proto()
 		if binding, ok := bindings[p]; ok && len(binding) > 0 {
 			for _, b := range binding {
-				s = append(s, portMapEntry{
-					port: p, binding: &b,
-					portInt: portInt, portProto: portProto,
-				})
+				s = append(s, portMapEntry{port: p, binding: b})
 			}
 			bindings[p] = []PortBinding{}
 		} else {
-			s = append(s, portMapEntry{
-				port:    p,
-				portInt: portInt, portProto: portProto,
-			})
+			s = append(s, portMapEntry{port: p})
 		}
 	}
 
@@ -96,13 +81,16 @@ func SortPortMap(ports []Port, bindings map[Port][]PortBinding) {
 			i++
 		}
 		// reorder bindings for this port
-		if entry.binding != nil {
-			bindings[entry.port] = append(bindings[entry.port], *entry.binding)
+		if _, ok := bindings[entry.port]; ok {
+			bindings[entry.port] = append(bindings[entry.port], entry.binding)
 		}
 	}
 }
 
-func toInt(s string) int {
-	i, _, _ := parsePortRange(s)
+func toInt(s string) uint64 {
+	i, _, err := ParsePortRange(s)
+	if err != nil {
+		i = 0
+	}
 	return i
 }

vendor/github.com/docker/go-connections/sockets/inmem_socket.go

@@ -1,57 +1,48 @@
 package sockets
 
 import (
+	"errors"
 	"net"
 	"sync"
 )
 
+var errClosed = errors.New("use of closed network connection")
+
+// InmemSocket implements net.Listener using in-memory only connections.
+type InmemSocket struct {
+	chConn  chan net.Conn
+	chClose chan struct{}
+	addr    string
+	mu      sync.Mutex
+}
+
 // dummyAddr is used to satisfy net.Addr for the in-mem socket
 // it is just stored as a string and returns the string for all calls
 type dummyAddr string
 
-// Network returns the addr string, satisfies net.Addr
-func (a dummyAddr) Network() string {
-	return string(a)
-}
-
-// String returns the string form
-func (a dummyAddr) String() string {
-	return string(a)
-}
-
-// InmemSocket implements [net.Listener] using in-memory only connections.
-type InmemSocket struct {
-	chConn  chan net.Conn
-	chClose chan struct{}
-	addr    dummyAddr
-	mu      sync.Mutex
-}
-
-// NewInmemSocket creates an in-memory only [net.Listener]. The addr argument
-// can be any string, but is used to satisfy the [net.Listener.Addr] part
-// of the [net.Listener] interface
+// NewInmemSocket creates an in-memory only net.Listener
+// The addr argument can be any string, but is used to satisfy the `Addr()` part
+// of the net.Listener interface
 func NewInmemSocket(addr string, bufSize int) *InmemSocket {
 	return &InmemSocket{
 		chConn:  make(chan net.Conn, bufSize),
 		chClose: make(chan struct{}),
-		addr:    dummyAddr(addr),
+		addr:    addr,
 	}
 }
 
 // Addr returns the socket's addr string to satisfy net.Listener
 func (s *InmemSocket) Addr() net.Addr {
-	return s.addr
+	return dummyAddr(s.addr)
 }
 
-// Accept implements the Accept method in the Listener interface; it waits
-// for the next call and returns a generic Conn. It returns a [net.ErrClosed]
-// if the connection is already closed.
+// Accept implements the Accept method in the Listener interface; it waits for the next call and returns a generic Conn.
 func (s *InmemSocket) Accept() (net.Conn, error) {
 	select {
 	case conn := <-s.chConn:
 		return conn, nil
 	case <-s.chClose:
-		return nil, net.ErrClosed
+		return nil, errClosed
 	}
 }
 
@@ -67,15 +58,24 @@ func (s *InmemSocket) Close() error {
 	return nil
 }
 
-// Dial is used to establish a connection with the in-mem server.
-// It returns a [net.ErrClosed] if the connection is already closed.
+// Dial is used to establish a connection with the in-mem server
 func (s *InmemSocket) Dial(network, addr string) (net.Conn, error) {
 	srvConn, clientConn := net.Pipe()
 	select {
 	case s.chConn <- srvConn:
 	case <-s.chClose:
-		return nil, net.ErrClosed
+		return nil, errClosed
 	}
 
 	return clientConn, nil
 }
+
+// Network returns the addr string, satisfies net.Addr
+func (a dummyAddr) Network() string {
+	return string(a)
+}
+
+// String returns the string form
+func (a dummyAddr) String() string {
+	return string(a)
+}

vendor/github.com/docker/go-connections/sockets/proxy.go

@@ -0,0 +1,31 @@
+package sockets
+
+import (
+	"net"
+	"os"
+	"strings"
+)
+
+// GetProxyEnv allows access to the uppercase and the lowercase forms of
+// proxy-related variables.  See the Go specification for details on these
+// variables. https://golang.org/pkg/net/http/
+//
+// Deprecated: this function was used as helper for [DialerFromEnvironment] and is no longer used. It will be removed in the next release.
+func GetProxyEnv(key string) string {
+	proxyValue := os.Getenv(strings.ToUpper(key))
+	if proxyValue == "" {
+		return os.Getenv(strings.ToLower(key))
+	}
+	return proxyValue
+}
+
+// DialerFromEnvironment was previously used to configure a net.Dialer to route
+// connections through a SOCKS proxy.
+//
+// Deprecated: SOCKS proxies are now supported by configuring only
+// http.Transport.Proxy, and no longer require changing http.Transport.Dial.
+// Therefore, only [sockets.ConfigureTransport] needs to be called, and any
+// [sockets.DialerFromEnvironment] calls can be dropped.
+func DialerFromEnvironment(direct *net.Dialer) (*net.Dialer, error) {
+	return direct, nil
+}

vendor/github.com/docker/go-connections/sockets/sockets.go

@@ -27,19 +27,11 @@ var ErrProtocolNotAvailable = errors.New("protocol not available")
 // make sure you do it _after_ any subsequent calls to ConfigureTransport is made against the same
 // [http.Transport].
 func ConfigureTransport(tr *http.Transport, proto, addr string) error {
-	if tr.MaxIdleConns == 0 {
-		// prevent long-lived processes from leaking connections
-		// due to idle connections not being released.
-		//
-		// TODO: see if we can also address this from the server side; see: https://github.com/moby/moby/issues/45539
-		tr.MaxIdleConns = 6
-		tr.IdleConnTimeout = 30 * time.Second
-	}
 	switch proto {
 	case "unix":
-		return configureUnixTransport(tr, addr)
+		return configureUnixTransport(tr, proto, addr)
 	case "npipe":
-		return configureNpipeTransport(tr, addr)
+		return configureNpipeTransport(tr, proto, addr)
 	default:
 		tr.Proxy = http.ProxyFromEnvironment
 		tr.DisableCompression = false
@@ -50,7 +42,15 @@ func ConfigureTransport(tr *http.Transport, proto, addr string) error {
 	return nil
 }
 
-func configureUnixTransport(tr *http.Transport, addr string) error {
+// DialPipe connects to a Windows named pipe. It is not supported on
+// non-Windows platforms.
+//
+// Deprecated: use [github.com/Microsoft/go-winio.DialPipe] or [github.com/Microsoft/go-winio.DialPipeContext].
+func DialPipe(addr string, timeout time.Duration) (net.Conn, error) {
+	return dialPipe(addr, timeout)
+}
+
+func configureUnixTransport(tr *http.Transport, proto, addr string) error {
 	if len(addr) > maxUnixSocketPathSize {
 		return fmt.Errorf("unix socket path %q is too long", addr)
 	}
@@ -60,7 +60,7 @@ func configureUnixTransport(tr *http.Transport, addr string) error {
 		Timeout: defaultTimeout,
 	}
 	tr.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
-		return dialer.DialContext(ctx, "unix", addr)
+		return dialer.DialContext(ctx, proto, addr)
 	}
 	return nil
 }

vendor/github.com/docker/go-connections/sockets/sockets_unix.go

@@ -2,6 +2,17 @@
 
 package sockets
 
-func configureNpipeTransport(any, string) error {
+import (
+	"net"
+	"net/http"
+	"syscall"
+	"time"
+)
+
+func configureNpipeTransport(tr *http.Transport, proto, addr string) error {
 	return ErrProtocolNotAvailable
 }
+
+func dialPipe(_ string, _ time.Duration) (net.Conn, error) {
+	return nil, syscall.EAFNOSUPPORT
+}

vendor/github.com/docker/go-connections/sockets/sockets_windows.go

@@ -4,11 +4,12 @@ import (
 	"context"
 	"net"
 	"net/http"
+	"time"
 
 	"github.com/Microsoft/go-winio"
 )
 
-func configureNpipeTransport(tr *http.Transport, addr string) error {
+func configureNpipeTransport(tr *http.Transport, proto, addr string) error {
 	// No need for compression in local communications.
 	tr.DisableCompression = true
 	tr.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
@@ -16,3 +17,7 @@ func configureNpipeTransport(tr *http.Transport, addr string) error {
 	}
 	return nil
 }
+
+func dialPipe(addr string, timeout time.Duration) (net.Conn, error) {
+	return winio.DialPipe(addr, &timeout)
+}

vendor/github.com/docker/go-connections/sockets/unix_socket_windows.go

@@ -1,128 +1,6 @@
 package sockets
 
-import (
-	"errors"
-	"fmt"
-	"net"
-	"strings"
-
-	"github.com/Microsoft/go-winio"
-	"golang.org/x/sys/windows"
-)
-
-// BasePermissions defines the default DACL, which allows Administrators
-// and LocalSystem full access (similar to defaults used in [moby]);
-//
-// - D:P: DACL without inheritance (protected, (P)).
-// - (A;;GA;;;BA): Allow full access (GA) for built-in Administrators (BA).
-// - (A;;GA;;;SY); Allow full access (GA) for LocalSystem (SY).
-// - Any other user is denied access.
-//
-// [moby]: https://github.com/moby/moby/blob/6b45c76a233b1b8b56465f76c21c09fd7920e82d/daemon/listeners/listeners_windows.go#L53-L59
-const BasePermissions = "D:P(A;;GA;;;BA)(A;;GA;;;SY)"
-
-// WithBasePermissions sets a default DACL, which allows Administrators
-// and LocalSystem full access (similar to defaults used in [moby]);
-//
-// - D:P: DACL without inheritance (protected, (P)).
-// - (A;;GA;;;BA): Allow full access (GA) for built-in Administrators (BA).
-// - (A;;GA;;;SY); Allow full access (GA) for LocalSystem (SY).
-// - Any other user is denied access.
-//
-// [moby]: https://github.com/moby/moby/blob/6b45c76a233b1b8b56465f76c21c09fd7920e82d/daemon/listeners/listeners_windows.go#L53-L59
-func WithBasePermissions() SockOption {
-	return withSDDL(BasePermissions)
-}
-
-// WithAdditionalUsersAndGroups modifies the socket file's DACL to grant
-// access to additional users and groups.
-//
-// It sets [BasePermissions] on the socket path and grants the given additional
-// users and groups to generic read (GR) and write (GW) access. It returns
-// an error if no groups were given, when failing to resolve any of the
-// additional users and groups, or when failing to apply the ACL.
-func WithAdditionalUsersAndGroups(additionalUsersAndGroups []string) SockOption {
-	return func(path string) error {
-		if len(additionalUsersAndGroups) == 0 {
-			return errors.New("no additional users specified")
-		}
-		sd, err := getSecurityDescriptor(additionalUsersAndGroups...)
-		if err != nil {
-			return fmt.Errorf("looking up SID: %w", err)
-		}
-		return withSDDL(sd)(path)
-	}
-}
-
-// withSDDL applies the given SDDL to the socket. It returns an error
-// when failing parse the SDDL, or if the DACL was defaulted.
-//
-// TODO(thaJeztah); this is not exported yet, as some of the checks may need review if they're not too opinionated.
-func withSDDL(sddl string) SockOption {
-	return func(path string) error {
-		sd, err := windows.SecurityDescriptorFromString(sddl)
-		if err != nil {
-			return fmt.Errorf("parsing SDDL: %w", err)
-		}
-		dacl, defaulted, err := sd.DACL()
-		if err != nil {
-			return fmt.Errorf("extracting DACL: %w", err)
-		}
-		if dacl == nil || defaulted {
-			// should never be hit with our [DefaultPermissions],
-			// as it contains "D:" and "P" (protected, don't inherit).
-			return errors.New("no DACL found in security descriptor or defaulted")
-		}
-		return windows.SetNamedSecurityInfo(
-			path,
-			windows.SE_FILE_OBJECT,
-			windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
-			nil, // do not change the owner
-			nil, // do not change the owner
-			dacl,
-			nil,
-		)
-	}
-}
-
-// NewUnixSocket creates a new unix socket.
-//
-// It sets [BasePermissions] on the socket path and grants the given additional
-// users and groups to generic read (GR) and write (GW) access. It returns
-// an error when failing to resolve any of the additional users and groups,
-// or when failing to apply the ACL.
-func NewUnixSocket(path string, additionalUsersAndGroups []string) (net.Listener, error) {
-	var opts []SockOption
-	if len(additionalUsersAndGroups) > 0 {
-		opts = append(opts, WithAdditionalUsersAndGroups(additionalUsersAndGroups))
-	} else {
-		opts = append(opts, WithBasePermissions())
-	}
-	return NewUnixSocketWithOpts(path, opts...)
-}
-
-// getSecurityDescriptor returns the DACL for the Unix socket.
-//
-// By default, it grants [BasePermissions], but allows for additional
-// users and groups to get generic read (GR) and write (GW) access. It
-// returns an error when failing to resolve any of the additional users
-// and groups.
-func getSecurityDescriptor(additionalUsersAndGroups ...string) (string, error) {
-	sddl := BasePermissions
-
-	// Grant generic read (GR) and write (GW) access to whatever
-	// additional users or groups were specified.
-	//
-	// TODO(thaJeztah): should we fail on, or remove duplicates?
-	for _, g := range additionalUsersAndGroups {
-		sid, err := winio.LookupSidByName(strings.TrimSpace(g))
-		if err != nil {
-			return "", fmt.Errorf("looking up SID: %w", err)
-		}
-		sddl += fmt.Sprintf("(A;;GRGW;;;%s)", sid)
-	}
-	return sddl, nil
-}
+import "net"
 
 func listenUnix(path string) (net.Listener, error) {
 	return net.Listen("unix", path)

vendor/github.com/docker/go-connections/tlsconfig/certpool.go

@@ -1,12 +1,16 @@
 package tlsconfig
 
-import "crypto/x509"
+import (
+	"crypto/x509"
+	"runtime"
+)
 
-// SystemCertPool returns a copy of the system cert pool.
-//
-// Deprecated: use [x509.SystemCertPool] instead.
-//
-//go:fix inline
+// SystemCertPool returns a copy of the system cert pool,
+// returns an error if failed to load or empty pool on windows.
 func SystemCertPool() (*x509.CertPool, error) {
-	return x509.SystemCertPool()
+	certpool, err := x509.SystemCertPool()
+	if err != nil && runtime.GOOS == "windows" {
+		return x509.NewCertPool(), nil
+	}
+	return certpool, err
 }

vendor/github.com/docker/go-connections/tlsconfig/config.go

@@ -34,9 +34,6 @@ type Options struct {
 	// the system pool will be used.
 	ExclusiveRootPools bool
 	MinVersion         uint16
-
-	// systemCertPool allows mocking the system cert-pool for testing.
-	systemCertPool func() (*x509.CertPool, error)
 }
 
 // DefaultServerAcceptedCiphers should be uses by code which already has a crypto/tls
@@ -50,8 +47,6 @@ var defaultCipherSuites = []uint16{
 	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
 	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
 	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-	tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-	tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
 }
 
 // ServerDefault returns a secure-enough TLS configuration for the server TLS configuration.
@@ -80,33 +75,26 @@ func defaultConfig(ops ...func(*tls.Config)) *tls.Config {
 }
 
 // certPool returns an X.509 certificate pool from `caFile`, the certificate file.
-func certPool(opts Options) (*x509.CertPool, error) {
+func certPool(caFile string, exclusivePool bool) (*x509.CertPool, error) {
 	// If we should verify the server, we need to load a trusted ca
 	var (
 		pool *x509.CertPool
 		err  error
 	)
-	if opts.ExclusiveRootPools {
+	if exclusivePool {
 		pool = x509.NewCertPool()
 	} else {
-		if opts.systemCertPool != nil {
-			pool, err = opts.systemCertPool()
-		} else {
-			pool, err = x509.SystemCertPool()
-		}
+		pool, err = SystemCertPool()
 		if err != nil {
 			return nil, fmt.Errorf("failed to read system certificates: %v", err)
 		}
 	}
-	if opts.CAFile == "" {
-		return pool, nil
-	}
-	pemData, err := os.ReadFile(opts.CAFile)
+	pemData, err := os.ReadFile(caFile)
 	if err != nil {
-		return nil, fmt.Errorf("could not read CA certificate %q: %v", opts.CAFile, err)
+		return nil, fmt.Errorf("could not read CA certificate %q: %v", caFile, err)
 	}
 	if !pool.AppendCertsFromPEM(pemData) {
-		return nil, fmt.Errorf("failed to append certificates from PEM file: %q", opts.CAFile)
+		return nil, fmt.Errorf("failed to append certificates from PEM file: %q", caFile)
 	}
 	return pool, nil
 }
@@ -209,7 +197,7 @@ func Client(options Options) (*tls.Config, error) {
 	tlsConfig := defaultConfig()
 	tlsConfig.InsecureSkipVerify = options.InsecureSkipVerify
 	if !options.InsecureSkipVerify && options.CAFile != "" {
-		CAs, err := certPool(options)
+		CAs, err := certPool(options.CAFile, options.ExclusiveRootPools)
 		if err != nil {
 			return nil, err
 		}
@@ -242,7 +230,7 @@ func Server(options Options) (*tls.Config, error) {
 	}
 	tlsConfig.Certificates = []tls.Certificate{tlsCert}
 	if options.ClientAuth >= tls.VerifyClientCertIfGiven && options.CAFile != "" {
-		CAs, err := certPool(options)
+		CAs, err := certPool(options.CAFile, options.ExclusiveRootPools)
 		if err != nil {
 			return nil, err
 		}

vendor/github.com/go-git/go-billy/v5/README.md

@@ -5,6 +5,10 @@ Billy implements an interface based on the `os` standard library, allowing to de
 
 Billy was born as part of [go-git/go-git](https://github.com/go-git/go-git) project.
 
+## Version support
+
+go-billy v5 is in maintenance mode. Users should upgrade to [go-billy v6](https://pkg.go.dev/github.com/go-git/go-billy/v6) where possible.
+
 ## Installation
 
 ```go

vendor/github.com/go-git/go-billy/v5/helper/chroot/chroot.go

@@ -3,19 +3,25 @@ package chroot
 import (
 	"errors"
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
+	"syscall"
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-billy/v5/helper/polyfill"
 )
 
 // ChrootHelper is a helper to implement billy.Chroot.
+// It is not a security boundary, callers that need containment should use a
+// filesystem implementation that enforces paths at the OS boundary instead.
 type ChrootHelper struct {
 	underlying billy.Filesystem
 	base       string
 }
 
+const maxFollowedSymlinks = 8 // Aligns with POSIX_SYMLOOP_MAX
+
 // New creates a new filesystem wrapping up the given 'fs'.
 // The created filesystem has its base in the given ChrootHelperectory of the
 // underlying filesystem.
@@ -34,15 +40,184 @@ func (fs *ChrootHelper) underlyingPath(filename string) (string, error) {
 	return fs.Join(fs.Root(), filename), nil
 }
 
-func isCrossBoundaries(path string) bool {
-	path = filepath.ToSlash(path)
-	path = filepath.Clean(path)
+func (fs *ChrootHelper) followedPath(filename string, followFinal bool, op string) (string, error) {
+	fullpath, err := fs.underlyingPath(filename)
+	if err != nil {
+		return "", err
+	}
 
-	return strings.HasPrefix(path, ".."+string(filepath.Separator))
+	sl, ok := fs.underlying.(billy.Symlink)
+	if !ok {
+		return fullpath, nil
+	}
+
+	rel, err := fs.relativeToRoot(fullpath)
+	if err != nil {
+		return "", err
+	}
+
+	fullpath, err = fs.resolveFollowedPath(rel, followFinal, op, sl)
+	if errors.Is(err, billy.ErrNotSupported) {
+		return fs.underlyingPath(filename)
+	}
+
+	return fullpath, err
+}
+
+func (fs *ChrootHelper) resolveFollowedPath(rel string, followFinal bool, op string, sl billy.Symlink) (string, error) {
+	if rel == "" {
+		return fs.resolveFollowedRoot(followFinal, op, sl)
+	}
+
+	parts := splitRelativePath(rel)
+	resolved := ""
+	followed := 0
+
+	for len(parts) > 0 {
+		part := parts[0]
+		parts = parts[1:]
+
+		currentRel := joinRelativePath(resolved, part)
+		currentPath := fs.Join(fs.Root(), currentRel)
+		if len(parts) == 0 && !followFinal {
+			return currentPath, nil
+		}
+
+		fi, err := sl.Lstat(currentPath)
+		if err != nil {
+			if os.IsNotExist(err) {
+				return fs.Join(fs.Root(), joinRelativePath(append([]string{currentRel}, parts...)...)), nil
+			}
+			return "", err
+		}
+
+		if fi.Mode()&os.ModeSymlink == 0 {
+			resolved = currentRel
+			continue
+		}
+
+		followed++
+		if followed > maxFollowedSymlinks {
+			return "", symlinkLoopError(op, currentPath)
+		}
+
+		target, err := sl.Readlink(currentPath)
+		if err != nil {
+			return "", err
+		}
+
+		targetRel, err := fs.linkTargetRel(currentPath, target)
+		if err != nil {
+			return "", err
+		}
+		if targetRel == currentRel {
+			return "", symlinkLoopError(op, currentPath)
+		}
+
+		parts = append(splitRelativePath(targetRel), parts...)
+		resolved = ""
+	}
+
+	return fs.Join(fs.Root(), resolved), nil
+}
+
+func symlinkLoopError(op, path string) error {
+	return &os.PathError{Op: op, Path: path, Err: syscall.ELOOP}
+}
+
+func (fs *ChrootHelper) resolveFollowedRoot(followFinal bool, op string, sl billy.Symlink) (string, error) {
+	root := fs.Join(fs.Root(), "")
+	if !followFinal {
+		return root, nil
+	}
+
+	fi, err := sl.Lstat(root)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return root, nil
+		}
+		return "", err
+	}
+
+	if fi.Mode()&os.ModeSymlink == 0 {
+		return root, nil
+	}
+
+	target, err := sl.Readlink(root)
+	if err != nil {
+		return "", err
+	}
+
+	targetRel, err := fs.linkTargetRel(root, target)
+	if err != nil {
+		return root, err
+	}
+	if targetRel == "" {
+		return "", symlinkLoopError(op, root)
+	}
+
+	return fs.resolveFollowedPath(targetRel, followFinal, op, sl)
+}
+
+func (fs *ChrootHelper) relativeToRoot(filename string) (string, error) {
+	rel, err := filepath.Rel(filepath.Clean(fs.Root()), filepath.Clean(filename))
+	if err != nil || isCrossBoundaries(rel) {
+		return "", billy.ErrCrossedBoundary
+	}
+
+	if rel == "." {
+		return "", nil
+	}
+	return rel, nil
+}
+
+func (fs *ChrootHelper) linkTargetRel(linkPath, target string) (string, error) {
+	target = filepath.FromSlash(target)
+	if filepath.IsAbs(target) || strings.HasPrefix(target, string(filepath.Separator)) {
+		return fs.relativeToRoot(target)
+	}
+
+	return fs.relativeToRoot(fs.Join(filepath.Dir(linkPath), target))
+}
+
+func splitRelativePath(filename string) []string {
+	filename = filepath.Clean(filename)
+	if filename == "" || filename == "." {
+		return nil
+	}
+
+	return strings.Split(filepath.ToSlash(filename), "/")
+}
+
+func joinRelativePath(elem ...string) string {
+	parts := make([]string, 0, len(elem))
+	for _, part := range elem {
+		if part == "" || part == "." {
+			continue
+		}
+		parts = append(parts, part)
+	}
+
+	if len(parts) == 0 {
+		return ""
+	}
+	return filepath.Join(parts...)
+}
+
+func isCreateExclusive(flag int) bool {
+	return flag&os.O_CREATE != 0 && flag&os.O_EXCL != 0
+}
+
+func isCrossBoundaries(name string) bool {
+	name = filepath.ToSlash(name)
+	name = strings.TrimLeft(name, "/")
+	name = path.Clean(name)
+
+	return name == ".." || strings.HasPrefix(name, "../")
 }
 
 func (fs *ChrootHelper) Create(filename string) (billy.File, error) {
-	fullpath, err := fs.underlyingPath(filename)
+	fullpath, err := fs.followedPath(filename, true, "create")
 	if err != nil {
 		return nil, err
 	}
@@ -56,7 +231,7 @@ func (fs *ChrootHelper) Create(filename string) (billy.File, error) {
 }
 
 func (fs *ChrootHelper) Open(filename string) (billy.File, error) {
-	fullpath, err := fs.underlyingPath(filename)
+	fullpath, err := fs.followedPath(filename, true, "open")
 	if err != nil {
 		return nil, err
 	}
@@ -70,7 +245,7 @@ func (fs *ChrootHelper) Open(filename string) (billy.File, error) {
 }
 
 func (fs *ChrootHelper) OpenFile(filename string, flag int, mode os.FileMode) (billy.File, error) {
-	fullpath, err := fs.underlyingPath(filename)
+	fullpath, err := fs.followedPath(filename, !isCreateExclusive(flag), "open")
 	if err != nil {
 		return nil, err
 	}
@@ -84,12 +259,16 @@ func (fs *ChrootHelper) OpenFile(filename string, flag int, mode os.FileMode) (b
 }
 
 func (fs *ChrootHelper) Stat(filename string) (os.FileInfo, error) {
-	fullpath, err := fs.underlyingPath(filename)
+	fullpath, err := fs.followedPath(filename, true, "stat")
 	if err != nil {
 		return nil, err
 	}
 
-	return fs.underlying.Stat(fullpath)
+	fi, err := fs.underlying.Stat(fullpath)
+	if err != nil {
+		return nil, err
+	}
+	return fileInfo{FileInfo: fi, name: filepath.Base(filename)}, nil
 }
 
 func (fs *ChrootHelper) Rename(from, to string) error {
@@ -135,7 +314,7 @@ func (fs *ChrootHelper) TempFile(dir, prefix string) (billy.File, error) {
 }
 
 func (fs *ChrootHelper) ReadDir(path string) ([]os.FileInfo, error) {
-	fullpath, err := fs.underlyingPath(path)
+	fullpath, err := fs.followedPath(path, true, "readdir")
 	if err != nil {
 		return nil, err
 	}
@@ -241,6 +420,11 @@ type file struct {
 	name string
 }
 
+type fileInfo struct {
+	os.FileInfo
+	name string
+}
+
 func newFile(fs billy.Filesystem, f billy.File, filename string) billy.File {
 	filename = fs.Join(fs.Root(), filename)
 	filename, _ = filepath.Rel(fs.Root(), filename)
@@ -254,3 +438,7 @@ func newFile(fs billy.Filesystem, f billy.File, filename string) billy.File {
 func (f *file) Name() string {
 	return f.name
 }
+
+func (fi fileInfo) Name() string {
+	return fi.name
+}

vendor/github.com/go-git/go-billy/v5/osfs/os.go

@@ -24,6 +24,9 @@ var Default = &ChrootOS{}
 // New returns a new OS filesystem.
 // By default paths are deduplicated, but still enforced
 // under baseDir. For more info refer to WithDeduplicatePath.
+//
+// New returns ChrootOS by default for v5 compatibility. Users should prefer
+// New with WithBoundOS.
 func New(baseDir string, opts ...Option) billy.Filesystem {
 	o := &options{
 		deduplicatePath: true,
@@ -47,6 +50,8 @@ func WithBoundOS() Option {
 }
 
 // WithChrootOS returns the option of using a Chroot filesystem OS.
+//
+// Deprecated: use WithBoundOS instead.
 func WithChrootOS() Option {
 	return func(o *options) {
 		o.Type = ChrootOSFS

vendor/github.com/go-git/go-billy/v5/osfs/os_bound.go

@@ -20,6 +20,7 @@
 package osfs
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -29,6 +30,31 @@ import (
 	"github.com/go-git/go-billy/v5"
 )
 
+var (
+	// ErrBaseDirCannotBeRemoved is returned when removing the BoundOS base dir.
+	ErrBaseDirCannotBeRemoved = errors.New("base dir cannot be removed")
+
+	// ErrBaseDirCannotBeRenamed is returned when renaming the BoundOS base dir.
+	ErrBaseDirCannotBeRenamed = errors.New("base dir cannot be renamed")
+
+	dotPrefixes   = dotPathPrefixes()
+	dotSeparators = dotPathSeparators()
+)
+
+func dotPathPrefixes() []string {
+	if filepath.Separator == '\\' {
+		return []string{"./", ".\\"}
+	}
+	return []string{"./"}
+}
+
+func dotPathSeparators() string {
+	if filepath.Separator == '\\' {
+		return `/\`
+	}
+	return `/`
+}
+
 // BoundOS is a fs implementation based on the OS filesystem which is bound to
 // a base dir.
 // Prefer this fs implementation over ChrootOS.
@@ -54,6 +80,7 @@ func (fs *BoundOS) Create(filename string) (billy.File, error) {
 }
 
 func (fs *BoundOS) OpenFile(filename string, flag int, perm os.FileMode) (billy.File, error) {
+	filename = fs.expandDot(filename)
 	fn, err := fs.abs(filename)
 	if err != nil {
 		return nil, err
@@ -62,6 +89,7 @@ func (fs *BoundOS) OpenFile(filename string, flag int, perm os.FileMode) (billy.
 }
 
 func (fs *BoundOS) ReadDir(path string) ([]os.FileInfo, error) {
+	path = fs.expandDot(path)
 	dir, err := fs.abs(path)
 	if err != nil {
 		return nil, err
@@ -71,6 +99,12 @@ func (fs *BoundOS) ReadDir(path string) ([]os.FileInfo, error) {
 }
 
 func (fs *BoundOS) Rename(from, to string) error {
+	if fs.isBaseDir(from) {
+		return ErrBaseDirCannotBeRenamed
+	}
+	from = fs.expandDot(from)
+	to = fs.expandDot(to)
+
 	f, err := fs.abs(from)
 	if err != nil {
 		return err
@@ -89,6 +123,7 @@ func (fs *BoundOS) Rename(from, to string) error {
 }
 
 func (fs *BoundOS) MkdirAll(path string, perm os.FileMode) error {
+	path = fs.expandDot(path)
 	dir, err := fs.abs(path)
 	if err != nil {
 		return err
@@ -101,6 +136,7 @@ func (fs *BoundOS) Open(filename string) (billy.File, error) {
 }
 
 func (fs *BoundOS) Stat(filename string) (os.FileInfo, error) {
+	filename = fs.expandDot(filename)
 	filename, err := fs.abs(filename)
 	if err != nil {
 		return nil, err
@@ -109,6 +145,11 @@ func (fs *BoundOS) Stat(filename string) (os.FileInfo, error) {
 }
 
 func (fs *BoundOS) Remove(filename string) error {
+	if fs.isBaseDir(filename) {
+		return ErrBaseDirCannotBeRemoved
+	}
+	filename = fs.expandDot(filename)
+
 	fn, err := fs.abs(filename)
 	if err != nil {
 		return err
@@ -122,6 +163,7 @@ func (fs *BoundOS) Remove(filename string) error {
 func (fs *BoundOS) TempFile(dir, prefix string) (billy.File, error) {
 	if dir != "" {
 		var err error
+		dir = fs.expandDot(dir)
 		dir, err = fs.abs(dir)
 		if err != nil {
 			return nil, err
@@ -144,6 +186,11 @@ func (fs *BoundOS) Join(elem ...string) string {
 }
 
 func (fs *BoundOS) RemoveAll(path string) error {
+	if fs.isBaseDir(path) {
+		return ErrBaseDirCannotBeRemoved
+	}
+	path = fs.expandDot(path)
+
 	dir, err := fs.abs(path)
 	if err != nil {
 		return err
@@ -152,6 +199,7 @@ func (fs *BoundOS) RemoveAll(path string) error {
 }
 
 func (fs *BoundOS) Symlink(target, link string) error {
+	link = fs.expandDot(link)
 	ln, err := fs.abs(link)
 	if err != nil {
 		return err
@@ -164,6 +212,7 @@ func (fs *BoundOS) Symlink(target, link string) error {
 }
 
 func (fs *BoundOS) Lstat(filename string) (os.FileInfo, error) {
+	filename = fs.expandDot(filename)
 	filename = filepath.Clean(filename)
 	if !filepath.IsAbs(filename) {
 		filename = filepath.Join(fs.baseDir, filename)
@@ -175,6 +224,7 @@ func (fs *BoundOS) Lstat(filename string) (os.FileInfo, error) {
 }
 
 func (fs *BoundOS) Readlink(link string) (string, error) {
+	link = fs.expandDot(link)
 	if !filepath.IsAbs(link) {
 		link = filepath.Clean(filepath.Join(fs.baseDir, link))
 	}
@@ -185,6 +235,7 @@ func (fs *BoundOS) Readlink(link string) (string, error) {
 }
 
 func (fs *BoundOS) Chmod(path string, mode os.FileMode) error {
+	path = fs.expandDot(path)
 	abspath, err := fs.abs(path)
 	if err != nil {
 		return err
@@ -199,7 +250,7 @@ func (fs *BoundOS) Chroot(path string) (billy.Filesystem, error) {
 	if err != nil {
 		return nil, err
 	}
-	return New(joined), nil
+	return New(joined, WithBoundOS()), nil
 }
 
 // Root returns the current base dir of the billy.Filesystem.
@@ -220,6 +271,37 @@ func (fs *BoundOS) createDir(fullpath string) error {
 	return nil
 }
 
+func (fs *BoundOS) expandDot(path string) string {
+	if path == "." {
+		return fs.baseDir
+	}
+	for _, prefix := range dotPrefixes {
+		if strings.HasPrefix(path, prefix) {
+			path = strings.TrimLeft(strings.TrimPrefix(path, prefix), dotSeparators)
+			if path == "" {
+				return fs.baseDir
+			}
+			return path
+		}
+	}
+	return path
+}
+
+func (fs *BoundOS) isBaseDir(path string) bool {
+	if path == "" || filepath.Clean(path) == "." {
+		return true
+	}
+	path = fs.expandDot(path)
+	if filepath.Clean(path) == filepath.Clean(fs.baseDir) {
+		return true
+	}
+	abspath, err := fs.abs(path)
+	if err != nil {
+		return false
+	}
+	return filepath.Clean(abspath) == filepath.Clean(fs.baseDir)
+}
+
 // abs transforms filename to an absolute path, taking into account the base dir.
 // Relative paths won't be allowed to ascend the base dir, so `../file` will become
 // `/working-dir/file`.
@@ -233,7 +315,7 @@ func (fs *BoundOS) abs(filename string) (string, error) {
 
 	path, err := securejoin.SecureJoin(fs.baseDir, filename)
 	if err != nil {
-		return "", nil
+		return "", err
 	}
 
 	if fs.deduplicatePath {
@@ -246,24 +328,12 @@ func (fs *BoundOS) abs(filename string) (string, error) {
 	return path, nil
 }
 
-// insideBaseDir checks whether filename is located within
-// the fs.baseDir.
-func (fs *BoundOS) insideBaseDir(filename string) (bool, error) {
-	if filename == fs.baseDir {
-		return true, nil
-	}
-	if !strings.HasPrefix(filename, fs.baseDir+string(filepath.Separator)) {
-		return false, fmt.Errorf("path outside base dir")
-	}
-	return true, nil
-}
-
 // insideBaseDirEval checks whether filename is contained within
 // a dir that is within the fs.baseDir, by first evaluating any symlinks
 // that either filename or fs.baseDir may contain.
 func (fs *BoundOS) insideBaseDirEval(filename string) (bool, error) {
 	// "/" contains all others.
-	if fs.baseDir == "/" {
+	if fs.baseDir == "/" || fs.baseDir == filename {
 		return true, nil
 	}
 	dir, err := filepath.EvalSymlinks(filepath.Dir(filename))

vendor/github.com/go-git/go-billy/v5/osfs/os_chroot.go

@@ -14,6 +14,8 @@ import (
 // ChrootOS is a legacy filesystem based on a "soft chroot" of the os filesystem.
 // Although this is still the default os filesystem, consider using BoundOS instead.
 //
+// Deprecated: use New with WithBoundOS instead.
+//
 // Behaviours of note:
 //  1. A "soft chroot" translates the base dir to "/" for the purposes of the
 //     fs abstraction.
@@ -24,6 +26,14 @@ import (
 type ChrootOS struct{}
 
 func newChrootOS(baseDir string) billy.Filesystem {
+	if baseDir != "" {
+		resolved, err := filepath.EvalSymlinks(baseDir)
+		if err != nil {
+			return chroot.New(&ChrootOS{}, baseDir)
+		}
+		baseDir = resolved
+	}
+
 	return chroot.New(&ChrootOS{}, baseDir)
 }
 

vendor/github.com/go-git/go-billy/v5/util/util.go

@@ -16,8 +16,6 @@ import (
 // can but returns the first error it encounters. If the path does not exist,
 // RemoveAll returns nil (no error).
 func RemoveAll(fs billy.Basic, path string) error {
-	fs, path = getUnderlyingAndPath(fs, path)
-
 	if r, ok := fs.(removerAll); ok {
 		return r.RemoveAll(path)
 	}
@@ -39,7 +37,7 @@ func removeAll(fs billy.Basic, path string) error {
 	}
 
 	// Otherwise, is this a directory we need to recurse into?
-	dir, serr := fs.Stat(path)
+	dir, serr := lstat(fs, path)
 	if serr != nil {
 		if errors.Is(serr, os.ErrNotExist) {
 			return nil
@@ -48,8 +46,8 @@ func removeAll(fs billy.Basic, path string) error {
 		return serr
 	}
 
-	if !dir.IsDir() {
-		// Not a directory; return the error from Remove.
+	if dir.Mode()&os.ModeSymlink != 0 || !dir.IsDir() {
+		// Not a directory we should recurse into; return the error from Remove.
 		return err
 	}
 
@@ -62,7 +60,7 @@ func removeAll(fs billy.Basic, path string) error {
 	fis, err := dirfs.ReadDir(path)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			// Race. It was deleted between the Lstat and Open.
+			// Race. It was deleted between the Lstat and ReadDir.
 			// Return nil per RemoveAll's docs.
 			return nil
 		}
@@ -91,7 +89,18 @@ func removeAll(fs billy.Basic, path string) error {
 	}
 
 	return err
+}
 
+func lstat(filesystem billy.Basic, path string) (os.FileInfo, error) {
+	if sl, ok := filesystem.(billy.Symlink); ok {
+		// Avoid following a symlink substituted after the initial Remove fails.
+		fi, err := sl.Lstat(path)
+		if err == nil || !errors.Is(err, billy.ErrNotSupported) {
+			return fi, err
+		}
+	}
+
+	return filesystem.Stat(path)
 }
 
 // WriteFile writes data to a file named by filename in the given filesystem.
@@ -123,8 +132,10 @@ func WriteFile(fs billy.Basic, filename string, data []byte, perm os.FileMode) (
 // We generate random temporary file names so that there's a good
 // chance the file doesn't exist yet - keeps the number of tries in
 // TempFile to a minimum.
-var rand uint32
-var randmu sync.Mutex
+var (
+	rand   uint32
+	randmu sync.Mutex
+)
 
 func reseed() uint32 {
 	return uint32(time.Now().UnixNano() + int64(os.Getpid()))
@@ -220,22 +231,6 @@ func getTempDir(fs billy.Basic) string {
 	return ".tmp"
 }
 
-type underlying interface {
-	Underlying() billy.Basic
-}
-
-func getUnderlyingAndPath(fs billy.Basic, path string) (billy.Basic, string) {
-	u, ok := fs.(underlying)
-	if !ok {
-		return fs, path
-	}
-	if ch, ok := fs.(billy.Chroot); ok {
-		path = fs.Join(ch.Root(), path)
-	}
-
-	return u.Underlying(), path
-}
-
 // ReadFile reads the named file and returns the contents from the given filesystem.
 // A successful call returns err == nil, not err == EOF.
 // Because ReadFile reads the whole file, it does not treat an EOF from Read

vendor/github.com/go-git/go-git/v5/config/config.go

@@ -61,6 +61,16 @@ type Config struct {
 		CommentChar string
 		// RepositoryFormatVersion identifies the repository format and layout version.
 		RepositoryFormatVersion format.RepositoryFormatVersion
+		// ProtectNTFS controls whether NTFS-specific path protections are
+		// applied (e.g. rejecting .git trailing spaces/periods, alternate
+		// data streams, 8.3 short names). When unset, defaults to true on
+		// Windows.
+		ProtectNTFS OptBool
+		// ProtectHFS controls whether HFS+-specific path protections are
+		// applied (e.g. rejecting .git with Unicode zero-width or
+		// directional characters that HFS+ would normalize away).
+		// When unset, defaults to true on macOS.
+		ProtectHFS OptBool
 	}
 
 	User struct {
@@ -266,6 +276,8 @@ const (
 	repositoryFormatVersionKey = "repositoryformatversion"
 	objectFormat               = "objectformat"
 	mirrorKey                  = "mirror"
+	protectNTFSKey             = "protectNTFS"
+	protectHFSKey              = "protectHFS"
 
 	// DefaultPackWindow holds the number of previous objects used to
 	// generate deltas. The value 10 is the same used by git command.
@@ -309,6 +321,14 @@ func (c *Config) unmarshalCore() {
 
 	c.Core.Worktree = s.Options.Get(worktreeKey)
 	c.Core.CommentChar = s.Options.Get(commentCharKey)
+
+	if parsed := parseConfigBool(s.Options.Get(protectNTFSKey)); parsed.IsSet() {
+		c.Core.ProtectNTFS = parsed
+	}
+
+	if parsed := parseConfigBool(s.Options.Get(protectHFSKey)); parsed.IsSet() {
+		c.Core.ProtectHFS = parsed
+	}
 }
 
 func (c *Config) unmarshalUser() {
@@ -379,7 +399,8 @@ func unmarshalSubmodules(fc *format.Config, submodules map[string]*Submodule) {
 		m := &Submodule{}
 		m.unmarshal(sub)
 
-		if m.Validate() == ErrModuleBadPath {
+		if err := m.Validate(); errors.Is(err, ErrModuleBadPath) ||
+			errors.Is(err, ErrModuleBadName) {
 			continue
 		}
 
@@ -436,6 +457,14 @@ func (c *Config) marshalCore() {
 	if c.Core.Worktree != "" {
 		s.SetOption(worktreeKey, c.Core.Worktree)
 	}
+
+	if c.Core.ProtectNTFS.IsSet() {
+		s.SetOption(protectNTFSKey, c.Core.ProtectNTFS.FormatBool())
+	}
+
+	if c.Core.ProtectHFS.IsSet() {
+		s.SetOption(protectHFSKey, c.Core.ProtectHFS.FormatBool())
+	}
 }
 
 func (c *Config) marshalExtensions() {

vendor/github.com/go-git/go-git/v5/config/modules.go

@@ -3,8 +3,11 @@ package config
 import (
 	"bytes"
 	"errors"
+	"fmt"
 	"regexp"
+	"strings"
 
+	"github.com/go-git/go-git/v5/internal/pathutil"
 	format "github.com/go-git/go-git/v5/plumbing/format/config"
 )
 
@@ -12,6 +15,7 @@ var (
 	ErrModuleEmptyURL  = errors.New("module config: empty URL")
 	ErrModuleEmptyPath = errors.New("module config: empty path")
 	ErrModuleBadPath   = errors.New("submodule has an invalid path")
+	ErrModuleBadName   = errors.New("ignoring suspicious submodule name")
 )
 
 var (
@@ -94,6 +98,10 @@ type Submodule struct {
 
 // Validate validates the fields and sets the default values.
 func (m *Submodule) Validate() error {
+	if err := validSubmoduleName(m.Name); err != nil {
+		return fmt.Errorf("%w: %q", ErrModuleBadName, m.Name)
+	}
+
 	if m.Path == "" {
 		return ErrModuleEmptyPath
 	}
@@ -109,6 +117,50 @@ func (m *Submodule) Validate() error {
 	return nil
 }
 
+// validSubmoduleName mirrors canonical Git's check_submodule_name in
+// submodule-config.c [1]: reject empty names and any name with a ".."
+// path component, using both '/' and '\\' as separators so the rule
+// is consistent across platforms. The component check is delegated to
+// `pathutil.IsHFSDot` and `pathutil.IsNTFSDot` with `.` as the needle,
+// which both cover the bare ".." case and reject components that
+// resolve to ".." after HFS+ Unicode normalisation (ignored code
+// points, e.g. `.<U+200C>.`) or NTFS trailing-space/dot/ADS
+// canonicalisation (e.g. `.. `, `..::$INDEX_ALLOCATION`).
+// `.gitmodules` is attacker-controlled by definition, so both checks
+// run unconditionally regardless of host OS.
+//
+// The additional checks (bare ".", NUL byte, leading or trailing
+// separator, drive-letter prefix) close go-git-specific edge cases
+// the canonical loop does not exercise: canonical Git treats names
+// as opaque C strings, while Go strings carry NULs through and the
+// billy filesystem layer is path-aware in ways Git's working storage
+// is not.
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/submodule-config.c#L214-L237
+func validSubmoduleName(name string) error {
+	if name == "" || name == "." {
+		return ErrModuleBadName
+	}
+	for _, seg := range strings.FieldsFunc(name, isPathSep) {
+		if pathutil.IsHFSDot(seg, ".") || pathutil.IsNTFSDot(seg, ".", "") {
+			return ErrModuleBadName
+		}
+	}
+	// go-git-specific defensive checks beyond canonical Git.
+	if strings.ContainsRune(name, 0) {
+		return ErrModuleBadName
+	}
+	if isPathSep(rune(name[0])) || isPathSep(rune(name[len(name)-1])) {
+		return ErrModuleBadName
+	}
+	if len(name) >= 2 && name[1] == ':' {
+		return ErrModuleBadName
+	}
+	return nil
+}
+
+func isPathSep(r rune) bool { return r == '/' || r == '\\' }
+
 func (m *Submodule) unmarshal(s *format.Subsection) {
 	m.raw = s
 

vendor/github.com/go-git/go-git/v5/config/optbool.go

@@ -0,0 +1,82 @@
+package config
+
+import (
+	"strconv"
+	"strings"
+)
+
+// OptBool is a tri-state boolean: unset, explicitly false, or explicitly true.
+// Its zero value (OptBoolUnset) means the setting was not specified, which
+// allows merge logic based on reflect.Value.IsZero to skip unset fields while
+// still letting an explicit "false" override a previously set "true".
+type OptBool byte
+
+const (
+	// OptBoolUnset indicates the setting was not specified.
+	OptBoolUnset OptBool = iota
+	// OptBoolFalse indicates the setting was explicitly set to false.
+	OptBoolFalse
+	// OptBoolTrue indicates the setting was explicitly set to true.
+	OptBoolTrue
+)
+
+// NewOptBool converts a plain bool into an OptBool.
+func NewOptBool(v bool) OptBool {
+	if v {
+		return OptBoolTrue
+	}
+	return OptBoolFalse
+}
+
+// IsTrue returns whether the value is explicitly true.
+func (o OptBool) IsTrue() bool { return o == OptBoolTrue }
+
+// IsSet returns whether the value was explicitly specified (true or false).
+func (o OptBool) IsSet() bool { return o != OptBoolUnset }
+
+func (o OptBool) String() string {
+	switch o {
+	case OptBoolTrue:
+		return "true"
+	case OptBoolFalse:
+		return "false"
+	default:
+		return "unset"
+	}
+}
+
+// FormatBool returns the strconv-formatted value. Only meaningful when IsSet.
+func (o OptBool) FormatBool() string {
+	return strconv.FormatBool(o.IsTrue())
+}
+
+// parseConfigBool mirrors upstream Git's git_parse_maybe_bool: it
+// accepts true/yes/on (→ OptBoolTrue) and false/no/off (→
+// OptBoolFalse) case-insensitively, plus any decimal integer (zero
+// → OptBoolFalse, non-zero → OptBoolTrue). Empty or otherwise
+// unrecognised values return OptBoolUnset, leaving the caller's
+// platform default in place. The empty-string handling is the only
+// intentional divergence from upstream, which returns false for
+// empty: in our unmarshalCore caller, an empty value means the key
+// is unset and the platform default should apply.
+//
+// Reference: upstream Git git_parse_maybe_bool_text at parse.c
+// L157-L173 and git_parse_maybe_bool at parse.c L174-L182 in tag
+// v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/parse.c#L157-L182
+func parseConfigBool(v string) OptBool {
+	switch strings.ToLower(v) {
+	case "true", "yes", "on":
+		return OptBoolTrue
+	case "false", "no", "off":
+		return OptBoolFalse
+	}
+	if i, err := strconv.Atoi(v); err == nil {
+		if i != 0 {
+			return OptBoolTrue
+		}
+		return OptBoolFalse
+	}
+	return OptBoolUnset
+}

vendor/github.com/go-git/go-git/v5/internal/pathutil/dotgit.go

@@ -0,0 +1,21 @@
+package pathutil
+
+import "strings"
+
+// IsDotGitName reports whether name is `.git` or its 8.3 NTFS short
+// alias `git~1`, case-insensitively. Both are forbidden as path
+// components (and as submodule names) because they refer to the
+// repository's own metadata directory.
+//
+// File names that do not conform to the 8.3 format (up to eight
+// characters for the basename, three for the file extension) are
+// associated with a so-called "short name" on NTFS — at least on
+// the `C:` drive by default — which means that `git~1/` is a valid
+// way to refer to `.git/`.
+func IsDotGitName(name string) bool {
+	switch strings.ToLower(name) {
+	case ".git", "git~1":
+		return true
+	}
+	return false
+}

vendor/github.com/go-git/go-git/v5/internal/pathutil/hfs.go

@@ -0,0 +1,99 @@
+package pathutil
+
+import "unicode"
+
+// hfsIgnoredCodepoints contains Unicode code points that HFS+ ignores
+// during path normalization. A path component containing these
+// characters between the bytes of ".git" (or ".gitmodules", etc.)
+// will be treated as that name by HFS+, so they have to be filtered
+// out before comparison.
+//
+// See upstream Git utf8.c next_hfs_char in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/utf8.c#L703-L740
+var hfsIgnoredCodepoints = map[rune]struct{}{
+	0x200c: {}, // ZERO WIDTH NON-JOINER
+	0x200d: {}, // ZERO WIDTH JOINER
+	0x200e: {}, // LEFT-TO-RIGHT MARK
+	0x200f: {}, // RIGHT-TO-LEFT MARK
+	0x202a: {}, // LEFT-TO-RIGHT EMBEDDING
+	0x202b: {}, // RIGHT-TO-LEFT EMBEDDING
+	0x202c: {}, // POP DIRECTIONAL FORMATTING
+	0x202d: {}, // LEFT-TO-RIGHT OVERRIDE
+	0x202e: {}, // RIGHT-TO-LEFT OVERRIDE
+	0x206a: {}, // INHIBIT SYMMETRIC SWAPPING
+	0x206b: {}, // ACTIVATE SYMMETRIC SWAPPING
+	0x206c: {}, // INHIBIT ARABIC FORM SHAPING
+	0x206d: {}, // ACTIVATE ARABIC FORM SHAPING
+	0x206e: {}, // NATIONAL DIGIT SHAPES
+	0x206f: {}, // NOMINAL DIGIT SHAPES
+	0xfeff: {}, // ZERO WIDTH NO-BREAK SPACE
+}
+
+// IsHFSDot reports whether part would be treated as ".<needle>" on an
+// HFS+ filesystem after stripping ignored Unicode code points and
+// folding ASCII to lower case. The needle is the lowercase ASCII
+// suffix without the leading dot (e.g. "git", "gitmodules"). It
+// mirrors upstream Git's is_hfs_dot_generic and is the building
+// block of IsHFSDotGit / IsHFSDotGitmodules.
+//
+// Reference: upstream Git utf8.c is_hfs_dot_generic at L741-L774 and
+// the dotgit family at L784-L809 in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/utf8.c#L741-L809
+func IsHFSDot(part, needle string) bool {
+	runes := []rune(part)
+	i := 0
+
+	// skip ignored code points, then expect '.'
+	for i < len(runes) {
+		if _, ok := hfsIgnoredCodepoints[runes[i]]; !ok {
+			break
+		}
+		i++
+	}
+	if i >= len(runes) || runes[i] != '.' {
+		return false
+	}
+	i++
+
+	// match needle case-insensitively, skipping ignored code points
+	for _, expected := range needle {
+		for i < len(runes) {
+			if _, ok := hfsIgnoredCodepoints[runes[i]]; !ok {
+				break
+			}
+			i++
+		}
+		if i >= len(runes) {
+			return false
+		}
+		r := runes[i]
+		if r > 127 {
+			return false
+		}
+		if unicode.ToLower(r) != expected {
+			return false
+		}
+		i++
+	}
+
+	// skip trailing ignored code points
+	for i < len(runes) {
+		if _, ok := hfsIgnoredCodepoints[runes[i]]; !ok {
+			break
+		}
+		i++
+	}
+
+	// must be at end of component
+	return i == len(runes)
+}
+
+// IsHFSDotGit reports whether part is an HFS+ equivalent of ".git".
+func IsHFSDotGit(part string) bool { return IsHFSDot(part, "git") }
+
+// IsHFSDotGitmodules reports whether part is an HFS+ equivalent of
+// ".gitmodules", catching attempts to plant the file via Unicode
+// code points that HFS+ would strip during normalisation.
+func IsHFSDotGitmodules(part string) bool { return IsHFSDot(part, "gitmodules") }

vendor/github.com/go-git/go-git/v5/internal/pathutil/ntfs.go

@@ -0,0 +1,187 @@
+package pathutil
+
+import "strings"
+
+// IsNTFSDotGit ports upstream Git's is_ntfs_dotgit. It detects path
+// components that NTFS would resolve to ".git": the canonical name
+// itself and its 8.3 short-name alias "git~1", each followed by any
+// number of trailing spaces or periods (which NTFS silently trims)
+// and an optional Alternate Data Stream suffix (":<stream>"). The
+// bare strings ".git" and "git~1" also match, mirroring upstream.
+//
+// Reference: upstream Git path.c is_ntfs_dotgit at L1415-L1449
+// in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/path.c#L1415-L1449
+func IsNTFSDotGit(part string) bool {
+	var i int
+	switch {
+	case len(part) >= 4 && part[0] == '.' &&
+		asciiToLower(part[1]) == 'g' &&
+		asciiToLower(part[2]) == 'i' &&
+		asciiToLower(part[3]) == 't':
+		i = 4
+	case len(part) >= 5 &&
+		asciiToLower(part[0]) == 'g' &&
+		asciiToLower(part[1]) == 'i' &&
+		asciiToLower(part[2]) == 't' &&
+		part[3] == '~' && part[4] == '1':
+		i = 5
+	default:
+		return false
+	}
+
+	for ; i < len(part); i++ {
+		c := part[i]
+		if c == ':' {
+			return true
+		}
+		if c != '.' && c != ' ' {
+			return false
+		}
+	}
+	return true
+}
+
+// WindowsValidPath reports whether part is a valid Windows / NTFS
+// path component for the worktree filesystem abstraction. It rejects
+// NTFS-disguised variants of `.git` and `git~1` (trailing spaces,
+// periods, Alternate Data Streams) and Windows reserved device
+// names. Bare `.git` and `git~1` are allowed at this layer; the
+// caller decides whether they are permissible at the current path
+// position.
+func WindowsValidPath(part string) bool {
+	if IsNTFSDotGit(part) && !IsDotGitName(part) {
+		return false
+	}
+	return !isWindowsReservedName(part)
+}
+
+// windowsReservedNames lists the Windows reserved device names.
+// A path component is reserved if its base name (ignoring trailing
+// spaces, extensions, and NTFS Alternate Data Streams) matches one of
+// these case-insensitively.
+//
+// See upstream Git compat/mingw.c is_valid_win32_path().
+var windowsReservedNames = []string{
+	"CON", "PRN", "AUX", "NUL",
+	"COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
+	"LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
+	"CONIN$", "CONOUT$",
+}
+
+func isWindowsReservedName(part string) bool {
+	for _, name := range windowsReservedNames {
+		if len(part) < len(name) {
+			continue
+		}
+		if !strings.EqualFold(part[:len(name)], name) {
+			continue
+		}
+		// Exact match or followed by space, dot, colon (ADS), or separator.
+		if len(part) == len(name) {
+			return true
+		}
+		switch part[len(name)] {
+		case ' ', '.', ':':
+			return true
+		}
+	}
+	return false
+}
+
+// IsNTFSDot ports upstream Git's is_ntfs_dot_generic. It detects NTFS
+// path-component variants of a dotfile name that attackers can use to
+// bypass case-insensitive comparisons against the canonical name on
+// Windows. The dotgit parameter is the lowercase name without the
+// leading dot (e.g. "gitmodules"); shortnamePrefix is the canonical
+// 6-character NTFS short-name prefix used as a fall-back match
+// (e.g. "gi7eba" for ".gitmodules").
+//
+// Reference: upstream Git path.c is_ntfs_dot_generic at L1451-L1507
+// in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/path.c#L1451-L1507
+func IsNTFSDot(name, dotgit, shortnamePrefix string) bool {
+	// onlySpacesAndPeriods returns true when the suffix from start
+	// onwards consists only of trailing spaces and periods, possibly
+	// terminated by a NTFS Alternate Data Stream colon. Mirrors the
+	// only_spaces_and_periods label in upstream's is_ntfs_dot_generic.
+	onlySpacesAndPeriods := func(start int) bool {
+		for i := start; i < len(name); i++ {
+			c := name[i]
+			if c == ':' {
+				return true
+			}
+			if c != ' ' && c != '.' {
+				return false
+			}
+		}
+		return true
+	}
+
+	// Pattern 1: ".<dotgit>" prefix + trailing spaces / periods / ADS.
+	if len(name) >= len(dotgit)+1 && name[0] == '.' &&
+		strings.EqualFold(name[1:1+len(dotgit)], dotgit) {
+		if onlySpacesAndPeriods(len(dotgit) + 1) {
+			return true
+		}
+	}
+
+	// Pattern 2: standard NTFS short name <dotgit[:6]>~[1-4].
+	if len(dotgit) >= 6 && len(name) >= 8 &&
+		strings.EqualFold(name[:6], dotgit[:6]) &&
+		name[6] == '~' && name[7] >= '1' && name[7] <= '4' {
+		if onlySpacesAndPeriods(8) {
+			return true
+		}
+	}
+
+	// Pattern 3: fall-back NTFS short name keyed by shortnamePrefix.
+	if len(shortnamePrefix) < 6 || len(name) < 8 {
+		return false
+	}
+	sawTilde := false
+	i := 0
+	for i < 8 {
+		c := name[i]
+		switch {
+		case sawTilde:
+			if c < '0' || c > '9' {
+				return false
+			}
+		case c == '~':
+			i++
+			if i >= len(name) || name[i] < '1' || name[i] > '9' {
+				return false
+			}
+			sawTilde = true
+		case i >= 6:
+			return false
+		case c&0x80 != 0:
+			return false
+		default:
+			if asciiToLower(c) != shortnamePrefix[i] {
+				return false
+			}
+		}
+		i++
+	}
+	return onlySpacesAndPeriods(8)
+}
+
+// IsNTFSDotGitmodules reports whether part is an NTFS-equivalent of
+// ".gitmodules" — the file name (or any of its variants that NTFS
+// would resolve to it) that attackers can use to plant submodule
+// configuration disguised as a symlink. The 6-character canonical
+// short-name prefix "gi7eba" mirrors upstream Git's is_ntfs_dotgitmodules.
+func IsNTFSDotGitmodules(part string) bool {
+	return IsNTFSDot(part, "gitmodules", "gi7eba")
+}
+
+func asciiToLower(c byte) byte {
+	if c >= 'A' && c <= 'Z' {
+		return c + ('a' - 'A')
+	}
+	return c
+}

vendor/github.com/go-git/go-git/v5/internal/pathutil/tree.go

@@ -0,0 +1,66 @@
+package pathutil
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+)
+
+// ErrInvalidPath is returned by ValidTreePath when its argument is
+// not a safe path to materialise into the worktree.
+var ErrInvalidPath = fmt.Errorf("invalid path")
+
+// ValidTreePath rejects path strings that, if materialised into a
+// worktree, would let an attacker-controlled tree entry escape the
+// worktree or rewrite repository metadata. It rejects:
+//
+//   - control characters (< 0x20, 0x7f);
+//   - empty paths and "." / ".." components;
+//   - Windows volume name prefixes (e.g. C:);
+//   - .git, its 8.3 NTFS short-name git~1, plus their HFS+ and NTFS
+//     variants — at every position, not just the root.
+//
+// HFS+/NTFS variants of `.git` are always rejected at this layer
+// regardless of runtime config: tree paths are canonical UTF-8 with
+// no zero-width characters or NTFS short-name forms, so an entry
+// that looks like a disguised `.git` is suspicious anywhere. Windows
+// reserved device names (CON, NUL, etc.) are not policed here — they
+// are legitimate filenames on non-Windows filesystems and upstream
+// Git accepts them. The wrapper layer (validPath in package git)
+// rejects them at materialisation time when core.protectNTFS is on.
+//
+// Mirrors upstream Git's verify_path_internal at read-cache.c#L987
+// in tag v2.54.0[1] with protect_hfs / protect_ntfs treated as
+// always-on for `.git`-disguise detection (tree paths are not
+// application-supplied) and is_valid_win32_path left to the wrapper.
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/read-cache.c#L987
+func ValidTreePath(p string) error {
+	for i := 0; i < len(p); i++ {
+		if p[i] < 0x20 || p[i] == 0x7f {
+			return fmt.Errorf("%w %q: contains control character", ErrInvalidPath, p)
+		}
+	}
+
+	parts := strings.FieldsFunc(p, func(r rune) bool { return r == '\\' || r == '/' })
+	if len(parts) == 0 {
+		return fmt.Errorf("%w: %q", ErrInvalidPath, p)
+	}
+
+	// Volume names are not supported, in both formats: \\ and <DRIVE_LETTER>:.
+	if vol := filepath.VolumeName(p); vol != "" {
+		return fmt.Errorf("%w: %q", ErrInvalidPath, p)
+	}
+
+	for _, part := range parts {
+		if part == "." || part == ".." {
+			return fmt.Errorf("%w %q: cannot use %q", ErrInvalidPath, p, part)
+		}
+
+		if IsDotGitName(part) || IsHFSDotGit(part) || IsNTFSDotGit(part) {
+			return fmt.Errorf("%w component: %q", ErrInvalidPath, p)
+		}
+	}
+
+	return nil
+}

vendor/github.com/go-git/go-git/v5/internal/url/url.go

@@ -2,12 +2,14 @@ package url
 
 import (
 	"regexp"
+	"runtime"
+	"strings"
 )
 
 var (
 	isSchemeRegExp = regexp.MustCompile(`^[^:]+://`)
 
-	// Ref: https://github.com/git/git/blob/master/Documentation/urls.txt#L37
+	// Ref: https://github.com/git/git/blob/v2.54.0/Documentation/urls.adoc#L41-L48
 	scpLikeUrlRegExp = regexp.MustCompile(`^(?:(?P<user>[^@]+)@)?(?P<host>[^:\s]+):(?:(?P<port>[0-9]{1,5}):)?(?P<path>[^\\].*)$`)
 )
 
@@ -20,7 +22,38 @@ func MatchesScheme(url string) bool {
 // MatchesScpLike returns true if the given string matches an SCP-like
 // format scheme.
 func MatchesScpLike(url string) bool {
-	return scpLikeUrlRegExp.MatchString(url)
+	if !scpLikeUrlRegExp.MatchString(url) {
+		return false
+	}
+	// Mirror canonical Git's url_is_local_not_ssh in connect.c[1] for
+	// the cases the regex above cannot disambiguate by itself: a URL
+	// is treated as a local path (not SCP-style SSH) when a `/`
+	// precedes the first `:` (e.g. `./relative:path`,
+	// `/abs/with:colon/file`), or — on Windows only — when it has a
+	// DOS drive prefix like `C:foo` where the host is a single
+	// ASCII letter.
+	//
+	// [1]: https://github.com/git/git/blob/v2.54.0/connect.c#L710-L716
+	if before, _, _ := strings.Cut(url, ":"); strings.Contains(before, "/") {
+		return false
+	}
+	if runtime.GOOS == "windows" && hasDosDrivePrefix(url) {
+		return false
+	}
+	return true
+}
+
+// hasDosDrivePrefix reports whether s begins with `<letter>:` (a
+// Windows drive prefix such as `C:` or `c:`). Mirrors canonical Git's
+// win32_has_dos_drive_prefix[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/compat/win32/path-utils.c#L20-L29
+func hasDosDrivePrefix(s string) bool {
+	if len(s) < 2 || s[1] != ':' {
+		return false
+	}
+	c := s[0]
+	return ('A' <= c && c <= 'Z') || ('a' <= c && c <= 'z')
 }
 
 // FindScpLikeComponents returns the user, host, port and path of the

vendor/github.com/go-git/go-git/v5/plumbing/format/idxfile/decoder.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 
 	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/utils/binary"
@@ -25,35 +26,88 @@ const (
 	objectIDLength = hash.Size
 )
 
+// Byte sizes of the idx v2 layout elements, used by the size formula
+// in [validateIdxV2Size]. See [gitformat-pack] for the canonical
+// layout.
+//
+// [gitformat-pack]: https://git-scm.com/docs/gitformat-pack
+const (
+	headerLen     = 8          // magic + version
+	fanoutLen     = fanout * 4 // uint32 per bucket
+	crc32Len      = 4          // CRC32 per object
+	offset32Len   = 4          // 32-bit offset per object
+	offset64Len   = 8          // 64-bit overflow offset
+	trailerHashes = 2          // pack checksum + idx checksum, each hashsz
+)
+
+// statInput is the optional shape the [Decoder] probes for at the
+// start of [Decoder.Decode] to learn the on-disk length of the idx
+// blob, which it uses to validate the canonical-Git size formula
+// before any allocations driven by the fanout table. Callers that
+// pass an [*os.File] or a `billy.File` backed by an `*os.File`
+// (the production call sites in `storage/filesystem`) satisfy it
+// directly; arbitrary [io.Reader]s do not, and decode for them
+// retains the pre-existing behaviour of erroring out at the
+// truncated-payload boundary instead.
+//
+// The interface is intentionally unexported so the public
+// [NewDecoder] signature stays compatible with v5.
+type statInput interface {
+	Stat() (fs.FileInfo, error)
+}
+
 // Decoder reads and decodes idx files from an input stream.
 type Decoder struct {
 	io.Reader
-	h hash.Hash
+	src io.Reader
+	h   hash.Hash
 }
 
 // NewDecoder builds a new idx stream decoder, that reads from r.
 func NewDecoder(r io.Reader) *Decoder {
 	h := hash.New(crypto.SHA1)
 	tr := io.TeeReader(r, h)
-	return &Decoder{tr, h}
+	return &Decoder{tr, r, h}
 }
 
 // Decode reads from the stream and decode the content into the MemoryIndex struct.
 func (d *Decoder) Decode(idx *MemoryIndex) error {
+	idxSize := int64(-1)
+	if in, ok := d.src.(statInput); ok {
+		fi, err := in.Stat()
+		if err != nil {
+			return fmt.Errorf("%w: stat input: %w", ErrMalformedIdxFile, err)
+		}
+		idxSize = fi.Size()
+	}
+
 	if err := validateHeader(d); err != nil {
 		return err
 	}
 
-	flow := []func(*MemoryIndex, io.Reader) error{
+	headerFlow := []func(*MemoryIndex, io.Reader) error{
 		readVersion,
 		readFanout,
+	}
+	for _, f := range headerFlow {
+		if err := f(idx, d); err != nil {
+			return err
+		}
+	}
+
+	if idxSize >= 0 {
+		if err := validateIdxV2Size(idx, idxSize); err != nil {
+			return err
+		}
+	}
+
+	bodyFlow := []func(*MemoryIndex, io.Reader) error{
 		readObjectNames,
 		readCRC32,
 		readOffsets,
 		readPackChecksum,
 	}
-
-	for _, f := range flow {
+	for _, f := range bodyFlow {
 		if err := f(idx, d); err != nil {
 			return err
 		}
@@ -199,3 +253,103 @@ func readIdxChecksum(idx *MemoryIndex, r io.Reader) error {
 
 	return nil
 }
+
+// validateIdxV2Size enforces the size formula used by canonical Git
+// load_idx for idx v2 files: the on-disk length must lie within
+// [minSize, maxSize] where
+//
+//	perObject = hashsz + crc32Len + offset32Len
+//	minSize   = headerLen + fanoutLen + trailerHashes*hashsz + nr*perObject
+//	maxSize   = minSize + (nr-1)*offset64Len     when nr > 0
+//
+// with nr taken from the last fanout entry and hashsz fixed at
+// [objectIDLength] (SHA-1 in v5). Multiplications use a self-checking
+// overflow guard so inputs whose claimed object count overflows the
+// formula are rejected rather than wrapping into a smaller value.
+func validateIdxV2Size(idx *MemoryIndex, idxSize int64) error {
+	nr := int64(idx.Fanout[fanout-1])
+	hashsz := int64(objectIDLength)
+
+	minSize := minIdxV2Size(nr, hashsz)
+	maxSize := maxIdxV2Size(nr, hashsz)
+	if minSize < 0 || maxSize < 0 {
+		return fmt.Errorf("%w: object count %d is inconsistent with file size", ErrMalformedIdxFile, nr)
+	}
+
+	if idxSize < minSize || idxSize > maxSize {
+		return fmt.Errorf("%w: file size %d is inconsistent with object count %d", ErrMalformedIdxFile, idxSize, nr)
+	}
+	return nil
+}
+
+// minIdxV2Size returns the minimum on-disk size of an idx v2 file
+// holding nr objects with the given hash size, mirroring the
+// computation in canonical Git load_idx. Returns -1 when any
+// intermediate multiplication or addition would overflow int64.
+func minIdxV2Size(nr, hashsz int64) int64 {
+	perObject := hashsz + crc32Len + offset32Len
+	fixed := int64(headerLen+fanoutLen) + trailerHashes*hashsz
+
+	objects, ok := mulInt64(nr, perObject)
+	if !ok {
+		return -1
+	}
+	sum, ok := addInt64(fixed, objects)
+	if !ok {
+		return -1
+	}
+	return sum
+}
+
+// maxIdxV2Size returns the maximum on-disk size of an idx v2 file
+// holding nr objects with the given hash size, mirroring the
+// computation in canonical Git load_idx. Returns -1 on overflow.
+func maxIdxV2Size(nr, hashsz int64) int64 {
+	minSize := minIdxV2Size(nr, hashsz)
+	if minSize < 0 {
+		return -1
+	}
+	if nr == 0 {
+		return minSize
+	}
+	overflow, ok := mulInt64(nr-1, offset64Len)
+	if !ok {
+		return -1
+	}
+	sum, ok := addInt64(minSize, overflow)
+	if !ok {
+		return -1
+	}
+	return sum
+}
+
+// mulInt64 returns a*b and whether the result fits in an int64 without
+// overflow. Negative operands or overflow yield ok=false. The overflow
+// check uses the standard self-inverse identity: a*b/b == a only when
+// the multiplication did not wrap.
+func mulInt64(a, b int64) (int64, bool) {
+	if a < 0 || b < 0 {
+		return 0, false
+	}
+	if a == 0 || b == 0 {
+		return 0, true
+	}
+	c := a * b
+	if c/b != a {
+		return 0, false
+	}
+	return c, true
+}
+
+// addInt64 returns a+b and whether the result fits in an int64 without
+// overflow. Negative operands or overflow yield ok=false.
+func addInt64(a, b int64) (int64, bool) {
+	if a < 0 || b < 0 {
+		return 0, false
+	}
+	c := a + b
+	if c < a {
+		return 0, false
+	}
+	return c, true
+}

vendor/github.com/go-git/go-git/v5/plumbing/format/idxfile/idxfile.go

@@ -2,6 +2,7 @@ package idxfile
 
 import (
 	"bytes"
+	"fmt"
 	"io"
 	"sort"
 	"sync"
@@ -126,7 +127,10 @@ func (idx *MemoryIndex) FindOffset(h plumbing.Hash) (int64, error) {
 		return 0, plumbing.ErrObjectNotFound
 	}
 
-	offset := idx.getOffset(k, i)
+	offset, err := idx.getOffset(k, i)
+	if err != nil {
+		return 0, err
+	}
 
 	// Save the offset for reverse lookup
 	idx.mu.Lock()
@@ -141,17 +145,19 @@ func (idx *MemoryIndex) FindOffset(h plumbing.Hash) (int64, error) {
 
 const isO64Mask = uint64(1) << 31
 
-func (idx *MemoryIndex) getOffset(firstLevel, secondLevel int) uint64 {
+func (idx *MemoryIndex) getOffset(firstLevel, secondLevel int) (uint64, error) {
 	offset := secondLevel << 2
 	ofs := encbin.BigEndian.Uint32(idx.Offset32[firstLevel][offset : offset+4])
 
 	if (uint64(ofs) & isO64Mask) != 0 {
 		offset := 8 * (uint64(ofs) & ^isO64Mask)
-		n := encbin.BigEndian.Uint64(idx.Offset64[offset : offset+8])
-		return n
+		if l := uint64(len(idx.Offset64)); l < 8 || offset > l-8 {
+			return 0, fmt.Errorf("%w: offset64 index out of range", ErrMalformedIdxFile)
+		}
+		return encbin.BigEndian.Uint64(idx.Offset64[offset : offset+8]), nil
 	}
 
-	return uint64(ofs)
+	return uint64(ofs), nil
 }
 
 // FindCRC32 implements the Index interface.
@@ -209,8 +215,11 @@ func (idx *MemoryIndex) genOffsetHash() error {
 		mappedFirstLevel := idx.FanoutMapping[firstLevel]
 		for secondLevel := uint32(0); i < fanoutValue; i++ {
 			copy(hash[:], idx.Names[mappedFirstLevel][secondLevel*objectIDLength:])
-			offset := int64(idx.getOffset(mappedFirstLevel, int(secondLevel)))
-			offsetHash[offset] = hash
+			off, err := idx.getOffset(mappedFirstLevel, int(secondLevel))
+			if err != nil {
+				return err
+			}
+			offsetHash[int64(off)] = hash
 			secondLevel++
 		}
 	}
@@ -291,7 +300,11 @@ func (i *idxfileEntryIter) Next() (*Entry, error) {
 		mappedFirstLevel := i.idx.FanoutMapping[i.firstLevel]
 		entry := new(Entry)
 		copy(entry.Hash[:], i.idx.Names[mappedFirstLevel][i.secondLevel*objectIDLength:])
-		entry.Offset = i.idx.getOffset(mappedFirstLevel, i.secondLevel)
+		var err error
+		entry.Offset, err = i.idx.getOffset(mappedFirstLevel, i.secondLevel)
+		if err != nil {
+			return nil, err
+		}
 		entry.CRC32 = i.idx.getCRC32(mappedFirstLevel, i.secondLevel)
 
 		i.secondLevel++

vendor/github.com/go-git/go-git/v5/plumbing/format/objfile/reader.go

@@ -11,9 +11,10 @@ import (
 )
 
 var (
-	ErrClosed       = errors.New("objfile: already closed")
-	ErrHeader       = errors.New("objfile: invalid header")
-	ErrNegativeSize = errors.New("objfile: negative object size")
+	ErrClosed        = errors.New("objfile: already closed")
+	ErrHeader        = errors.New("objfile: invalid header")
+	ErrHeaderNotRead = errors.New("objfile: Header must be called before Read")
+	ErrNegativeSize  = errors.New("objfile: negative object size")
 )
 
 // Reader reads and decodes compressed objfile data from a provided io.Reader.
@@ -100,12 +101,23 @@ func (r *Reader) prepareForRead(t plumbing.ObjectType, size int64) {
 //
 // If Read encounters the end of the data stream it will return err == io.EOF,
 // either in the current call if n > 0 or in a subsequent call.
+//
+// Read returns ErrHeaderNotRead if Header has not been called successfully.
 func (r *Reader) Read(p []byte) (n int, err error) {
+	if r.multi == nil {
+		return 0, ErrHeaderNotRead
+	}
 	return r.multi.Read(p)
 }
 
 // Hash returns the hash of the object data stream that has been read so far.
+// It returns the zero plumbing.Hash if Header has not been called
+// successfully — guarding against the nil hasher that prepareForRead has
+// not yet allocated.
 func (r *Reader) Hash() plumbing.Hash {
+	if r.multi == nil {
+		return plumbing.ZeroHash
+	}
 	return r.hasher.Sum()
 }
 

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/diff_delta.go

@@ -19,9 +19,6 @@ const (
 	// https://github.com/git/git/blob/f7466e94375b3be27f229c78873f0acf8301c0a5/diff-delta.c#L428
 	// Max size of a copy operation (64KB).
 	maxCopySize = 64 * 1024
-
-	// Min size of a copy operation.
-	minCopySize = 4
 )
 
 // GetDelta returns an EncodedObject of type OFSDeltaObject. Base and Target object,

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/fsobject.go

@@ -78,7 +78,13 @@ func (o *FSObject) Reader() (io.ReadCloser, error) {
 			_ = f.Close()
 			return nil, err
 		}
-		return ioutil.NewReadCloserWithCloser(r, f.Close), nil
+		// Cap the lazy stream at the resolved object size: well-formed
+		// content reaches EOF inside the bound, an inflated stream that
+		// runs past surfaces ErrInflatedSizeMismatch on the byte just
+		// past the limit. For delta-resolved objects o.size is the
+		// expanded size, which is what the caller is reading here.
+		bounded := newBoundedReadCloser(r, o.size)
+		return ioutil.NewReadCloserWithCloser(bounded, f.Close), nil
 	}
 	r, err := p.getObjectContent(o.offset)
 	if err != nil {

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/packfile.go

@@ -126,11 +126,17 @@ func (p *Packfile) nextObjectHeader() (*ObjectHeader, error) {
 	return h, err
 }
 
-func (p *Packfile) getDeltaObjectSize(buf *bytes.Buffer) int64 {
+func (p *Packfile) getDeltaObjectSize(buf *bytes.Buffer) (int64, error) {
 	delta := buf.Bytes()
-	_, delta = decodeLEB128(delta) // skip src size
-	sz, _ := decodeLEB128(delta)
-	return int64(sz)
+	_, delta, err := decodeLEB128(delta) // skip src size
+	if err != nil {
+		return 0, err
+	}
+	sz, _, err := decodeLEB128(delta)
+	if err != nil {
+		return 0, err
+	}
+	return int64(sz), nil
 }
 
 func (p *Packfile) getObjectSize(h *ObjectHeader) (int64, error) {
@@ -145,7 +151,7 @@ func (p *Packfile) getObjectSize(h *ObjectHeader) (int64, error) {
 			return 0, err
 		}
 
-		return p.getDeltaObjectSize(buf), nil
+		return p.getDeltaObjectSize(buf)
 	default:
 		return 0, ErrInvalidObject.AddDetails("type %q", h.Type)
 	}
@@ -233,7 +239,10 @@ func (p *Packfile) getNextObject(h *ObjectHeader, hash plumbing.Hash) (plumbing.
 			return nil, err
 		}
 
-		size = p.getDeltaObjectSize(buf)
+		size, err = p.getDeltaObjectSize(buf)
+		if err != nil {
+			return nil, err
+		}
 		if size <= smallObjectThreshold {
 			var obj = new(plumbing.MemoryObject)
 			obj.SetSize(size)

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/parser.go

@@ -26,6 +26,45 @@ var (
 	ErrDeltaNotCached = errors.New("delta could not be found in cache")
 )
 
+// maxObjectPreallocBytes caps the up-front size hint passed to
+// bytes.Buffer.Grow when staging an object's contents, so a malformed length
+// cannot trigger a huge or out-of-range allocation. The buffer still grows
+// dynamically as data is written; this is purely a hint cap.
+const maxObjectPreallocBytes = 1 << 30 // 1 GiB
+
+// maxObjectsPrealloc caps the up-front capacity reserved from the pack's
+// declared object count, so a header advertising an absurd quantity cannot
+// trigger a multi-gigabyte allocation. The slice and maps still grow
+// organically beyond this hint.
+const maxObjectsPrealloc = 1 << 16 // 64 Ki entries
+
+// Match upstream Git's pack depth ceiling: pack-objects.h OE_DEPTH_BITS,
+// enforced in builtin/pack-objects.c as (1 << OE_DEPTH_BITS) - 1.
+const maxDeltaChainDepth = 4095
+
+// growHint returns a non-negative int64 size, clamped to a sane upper bound,
+// suitable for passing to bytes.Buffer.Grow.
+func growHint(n int64) int {
+	switch {
+	case n <= 0:
+		return 0
+	case n > maxObjectPreallocBytes:
+		return maxObjectPreallocBytes
+	default:
+		return int(n)
+	}
+}
+
+// objectsHint returns a non-negative count, clamped to maxObjectsPrealloc,
+// suitable for passing to make() as the capacity hint for slices or maps
+// sized from a pack's declared object count.
+func objectsHint(n uint32) int {
+	if n > maxObjectsPrealloc {
+		return maxObjectsPrealloc
+	}
+	return int(n)
+}
+
 // Observer interface is implemented by index encoders.
 type Observer interface {
 	// OnHeader is called when a new packfile is opened.
@@ -166,9 +205,10 @@ func (p *Parser) init() error {
 	}
 
 	p.count = c
-	p.oiByHash = make(map[plumbing.Hash]*objectInfo, p.count)
-	p.oiByOffset = make(map[int64]*objectInfo, p.count)
-	p.oi = make([]*objectInfo, p.count)
+	hint := objectsHint(p.count)
+	p.oiByHash = make(map[plumbing.Hash]*objectInfo, hint)
+	p.oiByOffset = make(map[int64]*objectInfo, hint)
+	p.oi = make([]*objectInfo, 0, hint)
 
 	return nil
 }
@@ -261,7 +301,7 @@ func (p *Parser) indexObjects() error {
 		}
 		if delta && !p.scanner.IsSeekable {
 			buf.Reset()
-			buf.Grow(int(oh.Length))
+			buf.Grow(growHint(oh.Length))
 			writers = append(writers, buf)
 		}
 
@@ -306,7 +346,7 @@ func (p *Parser) indexObjects() error {
 		}
 
 		p.oiByOffset[oh.Offset] = ota
-		p.oi[i] = ota
+		p.oi = append(p.oi, ota)
 	}
 
 	return nil
@@ -317,8 +357,12 @@ func (p *Parser) resolveDeltas() error {
 	defer sync.PutBytesBuffer(buf)
 
 	for _, obj := range p.oi {
+		if err := checkDeltaChainDepth(obj); err != nil {
+			return err
+		}
+
 		buf.Reset()
-		buf.Grow(int(obj.Length))
+		buf.Grow(growHint(obj.Length))
 		err := p.get(obj, buf)
 		if err != nil {
 			return err
@@ -337,6 +381,9 @@ func (p *Parser) resolveDeltas() error {
 			// create it once and reuse across all children.
 			r := bytes.NewReader(buf.Bytes())
 			for _, child := range obj.Children {
+				if err := checkDeltaChainDepth(child); err != nil {
+					return err
+				}
 				// Even though we are discarding the output, we still need to read it to
 				// so that the scanner can advance to the next object, and the SHA1 can be
 				// calculated.
@@ -356,6 +403,17 @@ func (p *Parser) resolveDeltas() error {
 	return nil
 }
 
+func checkDeltaChainDepth(o *objectInfo) error {
+	var depth int
+	for current := o; current != nil && current.DiskType.IsDelta(); current = current.Parent {
+		depth++
+		if depth > maxDeltaChainDepth {
+			return fmt.Errorf("%w: delta chain depth exceeds %d", ErrMalformedPackFile, maxDeltaChainDepth)
+		}
+	}
+	return nil
+}
+
 func (p *Parser) resolveExternalRef(o *objectInfo) {
 	if ref, ok := p.oiByHash[o.SHA1]; ok && ref.ExternalRef {
 		p.oiByHash[o.SHA1] = o
@@ -405,7 +463,7 @@ func (p *Parser) get(o *objectInfo, buf *bytes.Buffer) (err error) {
 	if o.DiskType.IsDelta() {
 		b := sync.GetBytesBuffer()
 		defer sync.PutBytesBuffer(b)
-		buf.Grow(int(o.Length))
+		buf.Grow(growHint(o.Length))
 		err := p.get(o.Parent, b)
 		if err != nil {
 			return err

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/patch_delta.go

@@ -31,10 +31,15 @@ const (
 	// premptively made available for a patch operation.
 	maxPatchPreemptionSize uint = 65536
 
-	// minDeltaSize defines the smallest size for a delta.
-	minDeltaSize = 4
+	// minDeltaSize is the smallest valid delta: a 1-byte srcSz LEB128
+	// header followed by a 1-byte targetSz LEB128 header (the
+	// shortest case being targetSz=0 with no operations).
+	minDeltaSize = 2
 )
 
+// uintBits is the bit width of uint on the current platform (32 or 64).
+const uintBits = 32 << (^uint(0) >> 63)
+
 type offset struct {
 	mask  byte
 	shift uint
@@ -142,7 +147,7 @@ func ReaderFromDelta(base plumbing.EncodedObject, deltaRC io.Reader) (io.ReadClo
 		baseBuf := bufio.NewReader(baseRd)
 		basePos := uint(0)
 
-		for {
+		for remainingTargetSz > 0 {
 			cmd, err := deltaBuf.ReadByte()
 			if err == io.EOF {
 				_ = dstWr.CloseWithError(ErrInvalidDelta)
@@ -166,9 +171,9 @@ func ReaderFromDelta(base plumbing.EncodedObject, deltaRC io.Reader) (io.ReadClo
 					return
 				}
 
-				if invalidSize(sz, targetSz) ||
+				if invalidSize(sz, remainingTargetSz) ||
 					invalidOffsetSize(offset, sz, srcSz) {
-					_ = dstWr.Close()
+					_ = dstWr.CloseWithError(ErrInvalidDelta)
 					return
 				}
 
@@ -210,7 +215,7 @@ func ReaderFromDelta(base plumbing.EncodedObject, deltaRC io.Reader) (io.ReadClo
 
 			case isCopyFromDelta(cmd):
 				sz := uint(cmd) // cmd is the size itself
-				if invalidSize(sz, targetSz) {
+				if invalidSize(sz, remainingTargetSz) {
 					_ = dstWr.CloseWithError(ErrInvalidDelta)
 					return
 				}
@@ -225,40 +230,48 @@ func ReaderFromDelta(base plumbing.EncodedObject, deltaRC io.Reader) (io.ReadClo
 				_ = dstWr.CloseWithError(ErrDeltaCmd)
 				return
 			}
-
-			if remainingTargetSz <= 0 {
-				_ = dstWr.Close()
-				return
-			}
 		}
+
+		// Mirror upstream's `data != top` post-loop check: every byte
+		// of the delta payload must be consumed.
+		if _, err := deltaBuf.ReadByte(); err == nil {
+			_ = dstWr.CloseWithError(ErrInvalidDelta)
+			return
+		} else if err != io.EOF {
+			_ = dstWr.CloseWithError(err)
+			return
+		}
+
+		_ = dstWr.Close()
 	}()
 
 	return dstRd, nil
 }
 
 func patchDelta(dst *bytes.Buffer, src, delta []byte) error {
-	if len(delta) < minCopySize {
-		return ErrInvalidDelta
+	srcSz, delta, err := decodeLEB128(delta)
+	if err != nil {
+		return fmt.Errorf("%w: %w", ErrInvalidDelta, err)
 	}
-
-	srcSz, delta := decodeLEB128(delta)
 	if srcSz != uint(len(src)) {
 		return ErrInvalidDelta
 	}
 
-	targetSz, delta := decodeLEB128(delta)
+	targetSz, delta, err := decodeLEB128(delta)
+	if err != nil {
+		return fmt.Errorf("%w: %w", ErrInvalidDelta, err)
+	}
 	remainingTargetSz := targetSz
 
-	var cmd byte
-
 	growSz := min(targetSz, maxPatchPreemptionSize)
 	dst.Grow(int(growSz))
-	for {
+
+	for remainingTargetSz > 0 {
 		if len(delta) == 0 {
 			return ErrInvalidDelta
 		}
 
-		cmd = delta[0]
+		cmd := delta[0]
 		delta = delta[1:]
 
 		switch {
@@ -275,16 +288,16 @@ func patchDelta(dst *bytes.Buffer, src, delta []byte) error {
 				return err
 			}
 
-			if invalidSize(sz, targetSz) ||
+			if invalidSize(sz, remainingTargetSz) ||
 				invalidOffsetSize(offset, sz, srcSz) {
-				break
+				return ErrInvalidDelta
 			}
 			dst.Write(src[offset : offset+sz])
 			remainingTargetSz -= sz
 
 		case isCopyFromDelta(cmd):
 			sz := uint(cmd) // cmd is the size itself
-			if invalidSize(sz, targetSz) {
+			if invalidSize(sz, remainingTargetSz) {
 				return ErrInvalidDelta
 			}
 
@@ -299,10 +312,12 @@ func patchDelta(dst *bytes.Buffer, src, delta []byte) error {
 		default:
 			return ErrDeltaCmd
 		}
+	}
 
-		if remainingTargetSz <= 0 {
-			break
-		}
+	// Mirror upstream's `data != top` post-loop check: every byte of
+	// the delta payload must be consumed.
+	if len(delta) != 0 {
+		return ErrInvalidDelta
 	}
 
 	return nil
@@ -354,7 +369,7 @@ func patchDeltaWriter(dst io.Writer, base io.ReaderAt, delta io.Reader,
 	baselr := io.LimitReader(sr, 0).(*io.LimitedReader)
 	deltalr := io.LimitReader(deltaBuf, 0).(*io.LimitedReader)
 
-	for {
+	for remainingTargetSz > 0 {
 		buf := *bufp
 		cmd, err := deltaBuf.ReadByte()
 		if err == io.EOF {
@@ -374,9 +389,9 @@ func patchDeltaWriter(dst io.Writer, base io.ReaderAt, delta io.Reader,
 				return 0, plumbing.ZeroHash, err
 			}
 
-			if invalidSize(sz, targetSz) ||
+			if invalidSize(sz, remainingTargetSz) ||
 				invalidOffsetSize(offset, sz, srcSz) {
-				return 0, plumbing.ZeroHash, err
+				return 0, plumbing.ZeroHash, ErrInvalidDelta
 			}
 
 			if _, err := sr.Seek(int64(offset), io.SeekStart); err != nil {
@@ -389,7 +404,7 @@ func patchDeltaWriter(dst io.Writer, base io.ReaderAt, delta io.Reader,
 			remainingTargetSz -= sz
 		} else if isCopyFromDelta(cmd) {
 			sz := uint(cmd) // cmd is the size itself
-			if invalidSize(sz, targetSz) {
+			if invalidSize(sz, remainingTargetSz) {
 				return 0, plumbing.ZeroHash, ErrInvalidDelta
 			}
 			deltalr.N = int64(sz)
@@ -399,30 +414,41 @@ func patchDeltaWriter(dst io.Writer, base io.ReaderAt, delta io.Reader,
 
 			remainingTargetSz -= sz
 		} else {
-			return 0, plumbing.ZeroHash, err
-		}
-		if remainingTargetSz <= 0 {
-			break
+			return 0, plumbing.ZeroHash, ErrDeltaCmd
 		}
 	}
 
+	// Mirror upstream's `data != top` post-loop check: every byte of
+	// the delta payload must be consumed.
+	if _, err := deltaBuf.ReadByte(); err == nil {
+		return 0, plumbing.ZeroHash, ErrInvalidDelta
+	} else if err != io.EOF {
+		return 0, plumbing.ZeroHash, err
+	}
+
 	return targetSz, hasher.Sum(), nil
 }
 
 // Decodes a number encoded as an unsigned LEB128 at the start of some
-// binary data and returns the decoded number and the rest of the
-// stream.
+// binary data and returns the decoded number, the rest of the stream,
+// and an error if the encoded value does not fit in a uint.
 //
 // This must be called twice on the delta data buffer, first to get the
 // expected source buffer size, and again to get the target buffer size.
-func decodeLEB128(input []byte) (uint, []byte) {
+func decodeLEB128(input []byte) (uint, []byte, error) {
 	if len(input) == 0 {
-		return 0, input
+		return 0, input, nil
 	}
 
 	var num, sz uint
 	var b byte
 	for {
+		// A continuation byte at shift > uintBits-7 cannot contribute
+		// without overflowing the accumulator.
+		if sz*7 > uintBits-7 {
+			return 0, input, ErrLengthOverflow
+		}
+
 		b = input[sz]
 		num |= (uint(b) & payload) << (sz * 7) // concats 7 bits chunks
 		sz++
@@ -432,12 +458,16 @@ func decodeLEB128(input []byte) (uint, []byte) {
 		}
 	}
 
-	return num, input[sz:]
+	return num, input[sz:], nil
 }
 
 func decodeLEB128ByteReader(input io.ByteReader) (uint, error) {
 	var num, sz uint
 	for {
+		if sz*7 > uintBits-7 {
+			return 0, ErrLengthOverflow
+		}
+
 		b, err := input.ReadByte()
 		if err != nil {
 			return 0, err
@@ -529,8 +559,9 @@ func decodeSize(cmd byte, delta []byte) (uint, []byte, error) {
 	return sz, delta, nil
 }
 
-func invalidSize(sz, targetSz uint) bool {
-	return sz > targetSz
+// invalidSize reports whether sz exceeds the remaining target size.
+func invalidSize(sz, remaining uint) bool {
+	return sz > remaining
 }
 
 func invalidOffsetSize(offset, sz, srcSz uint) bool {

vendor/github.com/go-git/go-git/v5/plumbing/format/packfile/scanner.go

@@ -29,8 +29,100 @@ var (
 	ErrSeekNotSupported = NewError("not seek support")
 	// ErrMalformedPackFile is returned by the parser when the pack file is corrupted.
 	ErrMalformedPackFile = errors.New("malformed PACK file")
+	// ErrLengthOverflow is returned when a variable-length integer would not
+	// fit into its accumulator because the input declares more continuation
+	// bytes than the type can hold.
+	ErrLengthOverflow = errors.New("variable-length integer overflow")
+	// ErrInflatedSizeMismatch is returned when a packfile object inflates to
+	// more bytes than the size declared in its object header. A well-formed
+	// packfile never produces more data than the declared size; exceeding it
+	// indicates a structurally invalid entry.
+	ErrInflatedSizeMismatch = errors.New("packfile: inflated object exceeds declared size")
 )
 
+// boundedWriter passes writes through to w up to limit bytes total, then
+// returns ErrInflatedSizeMismatch. It is used to enforce that a packfile
+// object's inflated length does not exceed the size declared in its header.
+type boundedWriter struct {
+	w     io.Writer
+	limit int64
+	n     int64
+}
+
+// Write forwards p to the underlying writer while keeping the running total
+// at or below limit. On overrun it forwards the legal prefix and reports
+// the number of bytes actually consumed alongside ErrInflatedSizeMismatch,
+// matching the contract in io.Writer. A write error from the underlying
+// writer during overrun-handling is joined with ErrInflatedSizeMismatch so
+// it is not silently dropped.
+func (b *boundedWriter) Write(p []byte) (int, error) {
+	if b.n+int64(len(p)) > b.limit {
+		remain := int(b.limit - b.n)
+		err := error(ErrInflatedSizeMismatch)
+		if remain > 0 {
+			n, werr := b.w.Write(p[:remain])
+			b.n += int64(n)
+			if werr != nil {
+				err = errors.Join(ErrInflatedSizeMismatch, werr)
+			}
+			return n, err
+		}
+		return 0, err
+	}
+	n, err := b.w.Write(p)
+	b.n += int64(n)
+	return n, err
+}
+
+// boundedReadCloser wraps a ReadCloser and reports ErrInflatedSizeMismatch
+// once more than limit bytes have been read. It is used by the on-demand
+// object reader returned from FSObject.Reader so that a lazy Read of a
+// packfile object cannot stream past its declared inflated size.
+//
+// The implementation builds on io.LimitedReader with the standard
+// overrun-detection trick: request limit+1 bytes from the underlying so
+// that the moment the sentinel byte materializes (LimitedReader.N drops
+// to zero) we know the source produced more than limit bytes.
+type boundedReadCloser struct {
+	lr      io.LimitedReader
+	closer  io.Closer
+	overrun bool
+}
+
+// newBoundedReadCloser wraps rc so that the cumulative bytes returned from
+// Read never exceed limit. The first call that would have returned a byte
+// past limit instead returns ErrInflatedSizeMismatch; subsequent calls
+// keep returning the same error. A negative limit is treated as zero, so
+// the first byte produced by rc surfaces ErrInflatedSizeMismatch.
+func newBoundedReadCloser(rc io.ReadCloser, limit int64) *boundedReadCloser {
+	if limit < 0 {
+		limit = 0
+	}
+	return &boundedReadCloser{
+		lr:     io.LimitedReader{R: rc, N: limit + 1},
+		closer: rc,
+	}
+}
+
+// Read forwards Read up to the configured byte limit. When the underlying
+// stream produces the limit+1 sentinel byte, the legal prefix is returned
+// alongside ErrInflatedSizeMismatch; on subsequent calls only the error
+// is returned.
+func (b *boundedReadCloser) Read(p []byte) (int, error) {
+	if b.overrun {
+		return 0, ErrInflatedSizeMismatch
+	}
+	n, err := b.lr.Read(p)
+	if b.lr.N == 0 {
+		b.overrun = true
+		return n - 1, ErrInflatedSizeMismatch
+	}
+	return n, err
+}
+
+// Close closes the underlying ReadCloser.
+func (b *boundedReadCloser) Close() error { return b.closer.Close() }
+
 // ObjectHeader contains the information related to the object, this information
 // is collected from the previous bytes to the content of the object.
 type ObjectHeader struct {
@@ -220,6 +312,13 @@ func (s *Scanner) nextObjectHeader() (*ObjectHeader, error) {
 			return nil, err
 		}
 
+		// An OFS-delta references a base object that appears earlier
+		// in the pack; the negative offset must be strictly positive
+		// and not larger than the current object's offset.
+		if no <= 0 || no > h.Offset {
+			return nil, fmt.Errorf("%w: invalid OFS delta offset", ErrMalformedPackFile)
+		}
+
 		h.OffsetReference = h.Offset - no
 	case plumbing.REFDeltaObject:
 		var err error
@@ -303,6 +402,13 @@ func (s *Scanner) readLength(first byte) (int64, error) {
 	shift := firstLengthBits
 	var err error
 	for c&maskContinue > 0 {
+		// Mirrors unpack_object_header_buffer in canonical Git's
+		// packfile.c: a continuation byte at shift > 64-7 cannot
+		// contribute without overflowing an int64.
+		if shift > 64-lengthBits {
+			return 0, fmt.Errorf("%w: %w", ErrMalformedPackFile, ErrLengthOverflow)
+		}
+
 		if c, err = s.r.ReadByte(); err != nil {
 			return 0, err
 		}
@@ -315,10 +421,18 @@ func (s *Scanner) readLength(first byte) (int64, error) {
 }
 
 // NextObject writes the content of the next object into the reader, returns
-// the number of bytes written, the CRC32 of the content and an error, if any
+// the number of bytes written, the CRC32 of the content and an error, if any.
+//
+// When a prior NextObjectHeader has stashed the object header in
+// pendingObject, the inflated stream is bounded by the header's declared
+// length and surfaces ErrInflatedSizeMismatch on overrun.
 func (s *Scanner) NextObject(w io.Writer) (written int64, crc32 uint32, err error) {
+	declaredSize := int64(-1)
+	if s.pendingObject != nil {
+		declaredSize = s.pendingObject.Length
+	}
 	s.pendingObject = nil
-	written, err = s.copyObject(w)
+	written, err = s.copyObject(w, declaredSize)
 
 	s.r.Flush()
 	crc32 = s.crc.Sum32()
@@ -327,23 +441,39 @@ func (s *Scanner) NextObject(w io.Writer) (written int64, crc32 uint32, err erro
 	return
 }
 
-// ReadObject returns a reader for the object content and an error
+// ReadObject returns a reader for the object content and an error.
+//
+// When a prior NextObjectHeader has stashed the object header in
+// pendingObject, the returned reader is bounded by the header's declared
+// length so callers cannot stream past the declared inflated size; an
+// overrun surfaces ErrInflatedSizeMismatch on the byte just past the
+// limit.
 func (s *Scanner) ReadObject() (io.ReadCloser, error) {
+	declaredSize := int64(-1)
+	if s.pendingObject != nil {
+		declaredSize = s.pendingObject.Length
+	}
 	s.pendingObject = nil
 	zr, err := sync.GetZlibReader(s.r)
 	if err != nil {
 		return nil, fmt.Errorf("zlib reset error: %s", err)
 	}
 
-	return ioutil.NewReadCloserWithCloser(zr.Reader, func() error {
+	rc := ioutil.NewReadCloserWithCloser(zr.Reader, func() error {
 		sync.PutZlibReader(zr)
 		return nil
-	}), nil
+	})
+	if declaredSize >= 0 {
+		return newBoundedReadCloser(rc, declaredSize), nil
+	}
+	return rc, nil
 }
 
-// ReadRegularObject reads and write a non-deltified object
-// from it zlib stream in an object entry in the packfile.
-func (s *Scanner) copyObject(w io.Writer) (n int64, err error) {
+// copyObject inflates a non-deltified object's zlib stream into w. When
+// declaredSize is non-negative, the write sink is wrapped in a
+// boundedWriter so an overrun surfaces ErrInflatedSizeMismatch instead
+// of being silently appended.
+func (s *Scanner) copyObject(w io.Writer, declaredSize int64) (n int64, err error) {
 	zr, err := sync.GetZlibReader(s.r)
 	defer sync.PutZlibReader(zr)
 
@@ -352,8 +482,14 @@ func (s *Scanner) copyObject(w io.Writer) (n int64, err error) {
 	}
 
 	defer ioutil.CheckClose(zr.Reader, &err)
+
+	sink := w
+	if declaredSize >= 0 {
+		sink = &boundedWriter{w: w, limit: declaredSize}
+	}
+
 	buf := sync.GetByteSlice()
-	n, err = io.CopyBuffer(w, zr.Reader, *buf)
+	n, err = io.CopyBuffer(sink, zr.Reader, *buf)
 	sync.PutByteSlice(buf)
 	return
 }

vendor/github.com/go-git/go-git/v5/plumbing/object/commit.go

@@ -5,7 +5,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
+	"slices"
 	"strings"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
@@ -20,6 +20,7 @@ const (
 	beginpgp       string = "-----BEGIN PGP SIGNATURE-----"
 	endpgp         string = "-----END PGP SIGNATURE-----"
 	headerpgp      string = "gpgsig"
+	headerpgp256   string = "gpgsig-sha256"
 	headerencoding string = "encoding"
 
 	// https://github.com/git/git/blob/bcb6cae2966cc407ca1afc77413b3ef11103c175/Documentation/gitformat-signature.txt#L153
@@ -41,6 +42,11 @@ type MessageEncoding string
 // in time, such as a timestamp, the author of the changes since the last
 // commit, a pointer to the previous commit(s), etc.
 // http://shafiulazam.com/gitbook/1_the_git_object_model.html
+//
+// When a Commit is populated by Decode it retains a reference to the source
+// plumbing.EncodedObject so that EncodeWithoutSignature can reproduce the
+// exact bytes the signature was computed over. Refer to EncodeWithoutSignature
+// for more information.
 type Commit struct {
 	// Hash of the commit object.
 	Hash plumbing.Hash
@@ -66,6 +72,9 @@ type Commit struct {
 	ExtraHeaders []ExtraHeader
 
 	s storer.EncodedObjectStorer
+	// src holds the encoded object this Commit was decoded from, used by
+	// EncodeWithoutSignature to recover the canonical signed bytes.
+	src plumbing.EncodedObject
 }
 
 // ExtraHeader holds any non-standard header
@@ -98,8 +107,8 @@ func (h ExtraHeader) Format(f fmt.State, verb rune) {
 func parseExtraHeader(line []byte) (ExtraHeader, bool) {
 	split := bytes.SplitN(line, []byte{' '}, 2)
 
-	out := ExtraHeader {
-		Key: string(bytes.TrimRight(split[0], "\n")),
+	out := ExtraHeader{
+		Key:   string(bytes.TrimRight(split[0], "\n")),
 		Value: "",
 	}
 
@@ -181,6 +190,11 @@ func (c *Commit) NumParents() int {
 
 var ErrParentNotFound = errors.New("commit parent not found")
 
+// ErrMalformedCommit is returned when a commit object cannot be decoded
+// because its standard headers (tree, parent, author, committer) are missing,
+// duplicated, or out of order.
+var ErrMalformedCommit = errors.New("malformed commit")
+
 // Parent returns the ith parent of a commit.
 func (c *Commit) Parent(i int) (*Commit, error) {
 	if len(c.ParentHashes) == 0 || i > len(c.ParentHashes)-1 {
@@ -227,14 +241,23 @@ func (c *Commit) Type() plumbing.ObjectType {
 	return plumbing.CommitObject
 }
 
+func (c *Commit) reset() {
+	storer := c.s
+	*c = Commit{
+		Encoding: defaultUtf8CommitMessageEncoding,
+		s:        storer,
+	}
+}
+
 // Decode transforms a plumbing.EncodedObject into a Commit struct.
 func (c *Commit) Decode(o plumbing.EncodedObject) (err error) {
 	if o.Type() != plumbing.CommitObject {
 		return ErrUnsupportedObject
 	}
 
+	c.reset()
 	c.Hash = o.Hash()
-	c.Encoding = defaultUtf8CommitMessageEncoding
+	c.src = o
 
 	reader, err := o.Reader()
 	if err != nil {
@@ -245,97 +268,17 @@ func (c *Commit) Decode(o plumbing.EncodedObject) (err error) {
 	r := sync.GetBufioReader(reader)
 	defer sync.PutBufioReader(r)
 
-	var message bool
-	var mergetag bool
-	var pgpsig bool
-	var msgbuf bytes.Buffer
-	var extraheader *ExtraHeader = nil
-	for {
-		line, err := r.ReadBytes('\n')
-		if err != nil && err != io.EOF {
+	s := &commitScanner{r: r, c: c}
+	for state := scanTree; state != nil; {
+		state, err = state(s)
+		if err != nil {
 			return err
 		}
-
-		if mergetag {
-			if len(line) > 0 && line[0] == ' ' {
-				line = bytes.TrimLeft(line, " ")
-				c.MergeTag += string(line)
-				continue
-			} else {
-				mergetag = false
-			}
-		}
-
-		if pgpsig {
-			if len(line) > 0 && line[0] == ' ' {
-				line = bytes.TrimLeft(line, " ")
-				c.PGPSignature += string(line)
-				continue
-			} else {
-				pgpsig = false
-			}
-		}
-
-		if extraheader != nil {
-			if len(line) > 0 && line[0] == ' ' {
-				extraheader.Value += string(line[1:])
-				continue
-			} else {
-				extraheader.Value = strings.TrimRight(extraheader.Value, "\n")
-				c.ExtraHeaders = append(c.ExtraHeaders, *extraheader)
-				extraheader = nil
-			}
-		}
-
-		if !message {
-			original_line := line
-			line = bytes.TrimSpace(line)
-			if len(line) == 0 {
-				message = true
-				continue
-			}
-
-			split := bytes.SplitN(line, []byte{' '}, 2)
-
-			var data []byte
-			if len(split) == 2 {
-				data = split[1]
-			}
-
-			switch string(split[0]) {
-			case "tree":
-				c.TreeHash = plumbing.NewHash(string(data))
-			case "parent":
-				c.ParentHashes = append(c.ParentHashes, plumbing.NewHash(string(data)))
-			case "author":
-				c.Author.Decode(data)
-			case "committer":
-				c.Committer.Decode(data)
-			case headermergetag:
-				c.MergeTag += string(data) + "\n"
-				mergetag = true
-			case headerencoding:
-				c.Encoding = MessageEncoding(data)
-			case headerpgp:
-				c.PGPSignature += string(data) + "\n"
-				pgpsig = true
-			default:
-				h, maybecontinued := parseExtraHeader(original_line)
-				if maybecontinued {
-					extraheader = &h
-				} else {
-					c.ExtraHeaders = append(c.ExtraHeaders, h)
-				}
-			}
-		} else {
-			msgbuf.Write(line)
-		}
-
-		if err == io.EOF {
-			break
-		}
 	}
-	c.Message = msgbuf.String()
+	if !s.sawTree {
+		return fmt.Errorf("%w: missing tree header", ErrMalformedCommit)
+	}
+	c.Message = s.msgbuf.String()
 	return nil
 }
 
@@ -344,11 +287,73 @@ func (c *Commit) Encode(o plumbing.EncodedObject) error {
 	return c.encode(o, true)
 }
 
-// EncodeWithoutSignature export a Commit into a plumbing.EncodedObject without the signature (correspond to the payload of the PGP signature).
+// EncodeWithoutSignature exports a Commit into a plumbing.EncodedObject
+// without any signature headers, producing the payload that PGP/GPG
+// signatures are computed over.
+//
+// Behaviour depends on how the Commit was created:
+//
+//   - For Commits populated by Decode whose exported fields still match the
+//     source object, the payload is streamed from the raw source bytes with
+//     gpgsig and gpgsig-sha256 headers (and their continuation lines)
+//     stripped verbatim. This preserves the exact bytes the signature was
+//     computed over, regardless of any normalization performed by Decode.
+//
+//   - For Commits constructed in memory, or for decoded Commits whose
+//     exported fields have been mutated, the payload is derived from the
+//     current struct fields. Mutation is detected by re-decoding the source
+//     object and comparing exported fields; if any differ, the in-memory
+//     representation prevails.
 func (c *Commit) EncodeWithoutSignature(o plumbing.EncodedObject) error {
+	if c.matchesSource() {
+		return stripObjectSignatures(o, c.src, plumbing.CommitObject)
+	}
 	return c.encode(o, false)
 }
 
+// matchesSource reports whether c.src is set and re-decoding it produces a
+// Commit whose payload-affecting exported fields are identical to those of
+// c. It is the auto-detection used by EncodeWithoutSignature to decide
+// between the raw bytes and the struct-encoded payload.
+//
+// PGPSignature is intentionally excluded from the comparison: neither path
+// emits it, so mutating it must not trigger a switch to struct-encode (which
+// would change the byte layout the caller is trying to verify against).
+func (c *Commit) matchesSource() bool {
+	if c.src == nil {
+		return false
+	}
+	fresh := &Commit{}
+	if err := fresh.Decode(c.src); err != nil {
+		return false
+	}
+	return c.Hash == fresh.Hash &&
+		signatureEqual(c.Author, fresh.Author) &&
+		signatureEqual(c.Committer, fresh.Committer) &&
+		c.MergeTag == fresh.MergeTag &&
+		c.Message == fresh.Message &&
+		c.TreeHash == fresh.TreeHash &&
+		c.Encoding == fresh.Encoding &&
+		slices.Equal(c.ParentHashes, fresh.ParentHashes) &&
+		slices.Equal(c.ExtraHeaders, fresh.ExtraHeaders)
+}
+
+func signatureEqual(a, b Signature) bool {
+	return a.Name == b.Name &&
+		a.Email == b.Email &&
+		a.When.Unix() == b.When.Unix() &&
+		a.When.Format("-0700") == b.When.Format("-0700")
+}
+
+func isStandardHeader(key string) bool {
+	switch key {
+	case "tree", "parent", "author", "committer",
+		headerencoding, headermergetag, headerpgp, headerpgp256:
+		return true
+	}
+	return false
+}
+
 func (c *Commit) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	o.SetType(plumbing.CommitObject)
 	w, err := o.Writer()
@@ -407,7 +412,9 @@ func (c *Commit) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	}
 
 	for _, header := range c.ExtraHeaders {
-		
+		if isStandardHeader(header.Key) {
+			continue
+		}
 		if _, err = fmt.Fprintf(w, "\n%s", header); err != nil {
 			return err
 		}
@@ -478,9 +485,21 @@ func (c *Commit) String() string {
 	)
 }
 
+// ErrMultipleSignatures is returned by Verify when the commit carries more
+// than one armored signature block. Mirrors upstream's parse_gpg_output
+// rejection of GOODSIG/BADSIG status lines after the first
+// (gpg-interface.c:257-269): multi-signature commits are intentionally
+// unsupported because their provenance cannot be reduced to a single
+// authoritative signer.
+var ErrMultipleSignatures = errors.New("commit has multiple signatures")
+
 // Verify performs PGP verification of the commit with a provided armored
 // keyring and returns openpgp.Entity associated with verifying key on success.
 func (c *Commit) Verify(armoredKeyRing string) (*openpgp.Entity, error) {
+	if countSignatureBlocks([]byte(c.PGPSignature)) > 1 {
+		return nil, ErrMultipleSignatures
+	}
+
 	keyRingReader := strings.NewReader(armoredKeyRing)
 	keyring, err := openpgp.ReadArmoredKeyRing(keyRingReader)
 	if err != nil {

vendor/github.com/go-git/go-git/v5/plumbing/object/commit_scanner.go

@@ -0,0 +1,377 @@
+package object
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+// commitScanner holds the working state of the commit decoder driven by the
+// stateFn loop in (*Commit).Decode. Each commitState reads one or more lines
+// from r, updates the in-progress *Commit and the scanner's bookkeeping, and
+// returns the state that should run next (or nil to stop).
+type commitScanner struct {
+	r      *bufio.Reader
+	c      *Commit
+	msgbuf bytes.Buffer
+
+	// pending holds a line that was read but the current state decided to
+	// hand back to the next state, paired with the io.EOF flag that was
+	// returned when the line was originally read.
+	pending    []byte
+	pendingErr error
+
+	// First-occurrence tracking: once the corresponding field has been
+	// decoded, subsequent occurrences are silently dropped (matches
+	// upstream's find_commit_header / first-wins semantics).
+	//
+	// gpgsig is not tracked here: upstream's parse_buffer_signed_by_header
+	// (commit.c:1186) accumulates every occurrence into one signature buffer,
+	// so we do the same on the scanner side to keep verification payloads
+	// byte-aligned. gpgsig-sha256 is recognized and skipped without exposing a
+	// new field in v5.
+	sawTree, sawAuthor, sawCommitter bool
+	sawEncoding, sawMergetag         bool
+
+	// extra is the multi-line ExtraHeader currently being assembled.
+	extra *ExtraHeader
+}
+
+// commitState is one step of the decoder state machine. Each function reads
+// the lines it needs, mutates *Commit via s.c, and returns the next state to
+// run (or nil to terminate the loop).
+type commitState func(*commitScanner) (commitState, error)
+
+// readLine returns the next line from the buffer, transparently consuming any
+// line that was previously pushed back by a state that decided not to handle
+// it.
+func (s *commitScanner) readLine() ([]byte, error) {
+	if s.pending != nil {
+		line, err := s.pending, s.pendingErr
+		s.pending, s.pendingErr = nil, nil
+		return line, err
+	}
+	line, err := s.r.ReadBytes('\n')
+	if err != nil && err != io.EOF {
+		return line, err
+	}
+	return line, err
+}
+
+// pushBack stashes an unconsumed line so the next state's readLine call sees
+// it. Only one line can be pushed back at a time.
+func (s *commitScanner) pushBack(line []byte, err error) {
+	s.pending = line
+	s.pendingErr = err
+}
+
+// scanTree expects the first non-empty header to be `tree HASH`. Anything
+// else (or an empty buffer) is rejected with ErrMalformedCommit, matching
+// upstream's `bogus commit object` check.
+func scanTree(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 || isBlankLine(line) {
+		return nil, fmt.Errorf("%w: missing tree header", ErrMalformedCommit)
+	}
+
+	key, data := splitHeader(line)
+	if key != "tree" {
+		return nil, fmt.Errorf("%w: tree header must be first", ErrMalformedCommit)
+	}
+	h, herr := parseObjectIDHex(data, ErrMalformedCommit, "tree")
+	if herr != nil {
+		return nil, herr
+	}
+	s.c.TreeHash = h
+	s.sawTree = true
+	if err == io.EOF {
+		return nil, nil
+	}
+	return scanParents, nil
+}
+
+// scanParents consumes contiguous `parent HASH` lines. The first non-parent
+// line ends the parent block and is handed off to scanAuthor; any later
+// `parent` line is silently dropped (matches upstream's parse_commit_buffer
+// exiting its parent loop at the first non-parent line and
+// read_commit_extra_header_lines filtering `parent` out of extras).
+func scanParents(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanMessage, nil
+	}
+
+	key, data := splitHeader(line)
+	if key == "parent" {
+		h, herr := parseObjectIDHex(data, ErrMalformedCommit, "parent")
+		if herr != nil {
+			return nil, herr
+		}
+		s.c.ParentHashes = append(s.c.ParentHashes, h)
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanParents, nil
+	}
+	s.pushBack(line, err)
+	return scanAuthor, nil
+}
+
+// scanAuthor accepts an `author` line at its canonical position immediately
+// after the parent block. Any other header here is pushed back for
+// scanCommitter; an out-of-place author is therefore silently dropped.
+// Mirrors upstream's parse_commit_date func.
+func scanAuthor(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanMessage, nil
+	}
+
+	key, data := splitHeader(line)
+	if key == "author" {
+		s.c.Author.Decode(data)
+		s.sawAuthor = true
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanCommitter, nil
+	}
+	s.pushBack(line, err)
+	return scanCommitter, nil
+}
+
+// scanCommitter accepts a `committer` line at its canonical position
+// immediately after the author. Any other header is pushed back for
+// scanHeaders. Same upstream rationale as scanAuthor.
+func scanCommitter(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanMessage, nil
+	}
+
+	key, data := splitHeader(line)
+	if key == "committer" {
+		s.c.Committer.Decode(data)
+		s.sawCommitter = true
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanHeaders, nil
+	}
+	s.pushBack(line, err)
+	return scanHeaders, nil
+}
+
+// scanHeaders dispatches one header line. Continuation-bearing headers
+// (mergetag, gpgsig, gpgsig-sha256, and unknown extras whose value is
+// continued on subsequent lines) hand off to a dedicated continuation state
+// that handles the `<space>...` lines and then returns here.
+func scanHeaders(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanMessage, nil
+	}
+
+	originalLine := line
+	key, data := splitHeader(line)
+
+	var next commitState = scanHeaders
+	switch key {
+	case "tree", "parent", "author", "committer":
+		// Anything reaching scanHeaders with one of these keys is out of
+		// canonical position: duplicate tree, parent past the contiguous
+		// block, or author/committer not at their expected slot. Drop them
+		// the same way upstream's standard_header_field filter excludes
+		// them from the extras list (read_commit_extra_header_lines,
+		// commit.c:1520-1522).
+	case headerencoding:
+		if !s.sawEncoding {
+			s.c.Encoding = MessageEncoding(data)
+			s.sawEncoding = true
+		}
+	case headermergetag:
+		if s.sawMergetag {
+			next = scanSkipCont
+		} else {
+			s.c.MergeTag += string(data) + "\n"
+			s.sawMergetag = true
+			next = scanMergetagCont
+		}
+	case headerpgp:
+		s.c.PGPSignature += string(data) + "\n"
+		next = scanPgpCont
+	case headerpgp256:
+		next = scanSkipCont
+	default:
+		h, multiline := parseExtraHeader(originalLine)
+		if multiline {
+			s.extra = &h
+			next = scanExtraCont
+		} else {
+			s.c.ExtraHeaders = append(s.c.ExtraHeaders, h)
+		}
+	}
+
+	if err == io.EOF {
+		return nil, nil
+	}
+	return next, nil
+}
+
+// scanMergetagCont accumulates continuation lines for the first mergetag
+// header. Continuations strip exactly one leading space, mirroring upstream's
+// `line + 1` (commit.c:1509). The first non-continuation line is pushed back
+// so scanHeaders can dispatch it.
+func scanMergetagCont(s *commitScanner) (commitState, error) {
+	return continuationCont(s, &s.c.MergeTag, scanMergetagCont)
+}
+
+// scanPgpCont accumulates continuation lines for a signature header.
+// Continuations strip exactly one leading space, mirroring upstream's
+// `line + 1` (commit.c:1509). The first non-continuation line is pushed back
+// so scanHeaders can dispatch it. Repeat occurrences of the same signature
+// header land back here and concatenate, matching upstream's
+// parse_buffer_signed_by_header (commit.c:1186).
+func scanPgpCont(s *commitScanner) (commitState, error) {
+	return continuationCont(s, &s.c.PGPSignature, scanPgpCont)
+}
+
+func continuationCont(s *commitScanner, dst *string, self commitState) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) > 0 && line[0] == ' ' {
+		*dst += string(line[1:])
+		if err == io.EOF {
+			return nil, nil
+		}
+		return self, nil
+	}
+	if len(line) > 0 {
+		s.pushBack(line, err)
+	}
+	return scanHeaders, nil
+}
+
+// scanSkipCont discards continuation lines that belong to a header scanHeaders
+// chose to drop.
+func scanSkipCont(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) > 0 && line[0] == ' ' {
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanSkipCont, nil
+	}
+	if len(line) > 0 {
+		s.pushBack(line, err)
+	}
+	return scanHeaders, nil
+}
+
+// scanExtraCont accumulates continuation lines for an unknown ExtraHeader
+// whose value spans multiple lines, then finalises the entry once the
+// continuation block ends.
+func scanExtraCont(s *commitScanner) (commitState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) > 0 && line[0] == ' ' {
+		s.extra.Value += string(line[1:])
+		if err == io.EOF {
+			s.finaliseExtra()
+			return nil, nil
+		}
+		return scanExtraCont, nil
+	}
+	s.finaliseExtra()
+	if len(line) > 0 {
+		s.pushBack(line, err)
+	}
+	return scanHeaders, nil
+}
+
+func (s *commitScanner) finaliseExtra() {
+	s.extra.Value = strings.TrimRight(s.extra.Value, "\n")
+	s.c.ExtraHeaders = append(s.c.ExtraHeaders, *s.extra)
+	s.extra = nil
+}
+
+// scanMessage drains the remaining bytes into the message buffer.
+func scanMessage(s *commitScanner) (commitState, error) {
+	for {
+		line, err := s.readLine()
+		if err != nil && err != io.EOF {
+			return nil, err
+		}
+		if len(line) > 0 {
+			s.msgbuf.Write(line)
+		}
+		if err == io.EOF {
+			return nil, nil
+		}
+	}
+}
+
+// isBlankLine reports whether line is the canonical header/body separator:
+// a single newline. Mirrors upstream's `*line == '\n'` test in
+// read_commit_extra_header_lines (commit.c:1502).
+func isBlankLine(line []byte) bool {
+	return len(line) == 1 && line[0] == '\n'
+}
+
+// splitHeader returns the header keyword (everything before the first space)
+// and the value (everything after, with the trailing newline stripped). If
+// the header has no value the returned data is nil.
+func splitHeader(line []byte) (string, []byte) {
+	trimmed := bytes.TrimRight(line, "\n")
+	key, value, ok := bytes.Cut(trimmed, []byte{' '})
+	if !ok {
+		return string(trimmed), nil
+	}
+	return string(key), value
+}
+
+func parseObjectIDHex(data []byte, malformedErr error, header string) (plumbing.Hash, error) {
+	id := string(data)
+	if !plumbing.IsHash(id) {
+		return plumbing.ZeroHash, fmt.Errorf("%w: bad %s hash", malformedErr, header)
+	}
+	return plumbing.NewHash(id), nil
+}

vendor/github.com/go-git/go-git/v5/plumbing/object/signature.go

@@ -1,6 +1,13 @@
 package object
 
-import "bytes"
+import (
+	"bytes"
+	"io"
+
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
+)
 
 const (
 	signatureTypeUnknown signatureType = iota
@@ -100,3 +107,116 @@ func parseSignedBytes(b []byte) (int, signatureType) {
 	}
 	return match, t
 }
+
+// countSignatureBlocks reports how many distinct armored signature blocks
+// start at a line boundary in b. Used by verification paths to reject
+// multi-signature payloads, matching upstream's check in gpg-interface.c
+// where parse_gpg_output bails out the first time it sees a second
+// exclusive status line (a second GOODSIG/BADSIG/etc.).
+func countSignatureBlocks(b []byte) int {
+	n, count := 0, 0
+	for n < len(b) {
+		i := b[n:]
+		if typeForSignature(i) != signatureTypeUnknown {
+			count++
+		}
+		if eol := bytes.IndexByte(i, '\n'); eol >= 0 {
+			n += eol + 1
+			continue
+		}
+		break
+	}
+	return count
+}
+
+// isSignatureHeader reports whether line is a canonical "gpgsig "/
+// "gpgsig-sha256 " header line. Other "gpgsig"-prefixed extra headers
+// are intentionally not matched.
+func isSignatureHeader(line []byte) bool {
+	return bytes.HasPrefix(line, []byte(headerpgp+" ")) ||
+		bytes.HasPrefix(line, []byte(headerpgp256+" "))
+}
+
+// stripObjectSignatures streams src into dst, producing the byte sequence
+// over which a PGP/GPG signature is computed:
+//
+//   - Canonical "gpgsig" and "gpgsig-sha256" headers (and their
+//     continuation lines) are dropped, mirroring upstream's
+//     remove_signature in commit.c.
+//   - For tag objects, the inline trailing PGP signature is additionally
+//     truncated, mirroring upstream's parse_signature in gpg-interface.c
+//     used by gpg_verify_tag.
+//
+// The returned object's type is set to objType. Used by both
+// Commit.EncodeWithoutSignature and Tag.EncodeWithoutSignature to
+// reproduce the exact bytes the signature was computed over.
+func stripObjectSignatures(dst, src plumbing.EncodedObject, objType plumbing.ObjectType) (err error) {
+	dst.SetType(objType)
+
+	r, err := src.Reader()
+	if err != nil {
+		return err
+	}
+	defer ioutil.CheckClose(r, &err)
+
+	var input io.Reader = r
+	if objType == plumbing.TagObject {
+		raw, err := io.ReadAll(r)
+		if err != nil {
+			return err
+		}
+		if sm, _ := parseSignedBytes(raw); sm >= 0 {
+			raw = raw[:sm]
+		}
+		input = bytes.NewReader(raw)
+	}
+
+	w, err := dst.Writer()
+	if err != nil {
+		return err
+	}
+	defer ioutil.CheckClose(w, &err)
+
+	return stripHeaderSignatures(w, input)
+}
+
+// stripHeaderSignatures copies r to w, dropping canonical signature header
+// lines (gpgsig and gpgsig-sha256) and their continuation lines. Lines
+// past the blank line that closes the header block are copied verbatim.
+func stripHeaderSignatures(w io.Writer, r io.Reader) error {
+	br := sync.GetBufioReader(r)
+	defer sync.PutBufioReader(br)
+
+	var inBody, skipping bool
+	for {
+		line, rerr := br.ReadBytes('\n')
+		if rerr != nil && rerr != io.EOF {
+			return rerr
+		}
+
+		write := true
+		if !inBody {
+			switch {
+			case skipping && len(line) > 0 && line[0] == ' ':
+				write = false
+			case isSignatureHeader(line):
+				skipping = true
+				write = false
+			case len(line) == 1 && line[0] == '\n':
+				skipping = false
+				inBody = true
+			default:
+				skipping = false
+			}
+		}
+
+		if write && len(line) > 0 {
+			if _, werr := w.Write(line); werr != nil {
+				return werr
+			}
+		}
+		if rerr == io.EOF {
+			return nil
+		}
+	}
+}

vendor/github.com/go-git/go-git/v5/plumbing/object/tag.go

@@ -1,9 +1,8 @@
 package object
 
 import (
-	"bytes"
+	"errors"
 	"fmt"
-	"io"
 	"strings"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
@@ -13,6 +12,10 @@ import (
 	"github.com/go-git/go-git/v5/utils/sync"
 )
 
+// ErrMalformedTag is returned when a tag object cannot be decoded because
+// its required headers (object, type, tag) are missing or out of order.
+var ErrMalformedTag = errors.New("malformed tag")
+
 // Tag represents an annotated tag object. It points to a single git object of
 // any type, but tags typically are applied to commit or blob objects. It
 // provides a reference that associates the target with a tag name. It also
@@ -39,6 +42,9 @@ type Tag struct {
 	Target plumbing.Hash
 
 	s storer.EncodedObjectStorer
+	// src holds the encoded object this Tag was decoded from, used by
+	// EncodeWithoutSignature to recover the canonical signed bytes.
+	src plumbing.EncodedObject
 }
 
 // GetTag gets a tag from an object storer and decodes it.
@@ -77,13 +83,20 @@ func (t *Tag) Type() plumbing.ObjectType {
 	return plumbing.TagObject
 }
 
+func (t *Tag) reset() {
+	storer := t.s
+	*t = Tag{s: storer}
+}
+
 // Decode transforms a plumbing.EncodedObject into a Tag struct.
 func (t *Tag) Decode(o plumbing.EncodedObject) (err error) {
 	if o.Type() != plumbing.TagObject {
 		return ErrUnsupportedObject
 	}
 
+	t.reset()
 	t.Hash = o.Hash()
+	t.src = o
 
 	reader, err := o.Reader()
 	if err != nil {
@@ -94,42 +107,15 @@ func (t *Tag) Decode(o plumbing.EncodedObject) (err error) {
 	r := sync.GetBufioReader(reader)
 	defer sync.PutBufioReader(r)
 
-	for {
-		var line []byte
-		line, err = r.ReadBytes('\n')
-		if err != nil && err != io.EOF {
+	scanner := &tagScanner{r: r, t: t}
+	for state := scanTagObject; state != nil; {
+		state, err = state(scanner)
+		if err != nil {
 			return err
 		}
-
-		line = bytes.TrimSpace(line)
-		if len(line) == 0 {
-			break // Start of message
-		}
-
-		split := bytes.SplitN(line, []byte{' '}, 2)
-		switch string(split[0]) {
-		case "object":
-			t.Target = plumbing.NewHash(string(split[1]))
-		case "type":
-			t.TargetType, err = plumbing.ParseObjectType(string(split[1]))
-			if err != nil {
-				return err
-			}
-		case "tag":
-			t.Name = string(split[1])
-		case "tagger":
-			t.Tagger.Decode(split[1])
-		}
-
-		if err == io.EOF {
-			return nil
-		}
 	}
 
-	data, err := io.ReadAll(r)
-	if err != nil {
-		return err
-	}
+	data := scanner.msgbuf.Bytes()
 	if sm, _ := parseSignedBytes(data); sm >= 0 {
 		t.PGPSignature = string(data[sm:])
 		data = data[:sm]
@@ -144,11 +130,54 @@ func (t *Tag) Encode(o plumbing.EncodedObject) error {
 	return t.encode(o, true)
 }
 
-// EncodeWithoutSignature export a Tag into a plumbing.EncodedObject without the signature (correspond to the payload of the PGP signature).
+// EncodeWithoutSignature exports a Tag into a plumbing.EncodedObject without
+// any signature data, producing the payload that PGP/GPG signatures are
+// computed over.
+//
+// Behaviour mirrors Commit.EncodeWithoutSignature:
+//
+//   - For Tags populated by Decode whose exported fields still match the
+//     source object, the payload is streamed from the raw source bytes with
+//     the inline trailing signature truncated and gpgsig/gpgsig-sha256
+//     headers (and their continuation lines) stripped verbatim. This
+//     preserves the exact bytes the signature was computed over, regardless
+//     of any normalization performed by Decode.
+//
+//   - For Tags constructed in memory, or for decoded Tags whose exported
+//     fields have been mutated, the payload is derived from the current
+//     struct fields. Mutation is detected by re-decoding the source object
+//     and comparing exported fields; if any differ, the in-memory
+//     representation prevails.
 func (t *Tag) EncodeWithoutSignature(o plumbing.EncodedObject) error {
+	if t.matchesSource() {
+		return stripObjectSignatures(o, t.src, plumbing.TagObject)
+	}
 	return t.encode(o, false)
 }
 
+// matchesSource reports whether t.src is set and re-decoding it produces a
+// Tag whose payload-affecting exported fields are identical to those of t.
+//
+// PGPSignature is intentionally excluded from the comparison: neither path
+// emits it as part of the verification payload, so mutating it must not
+// trigger a switch to struct-encode (which would change the byte layout the
+// caller is trying to verify against).
+func (t *Tag) matchesSource() bool {
+	if t.src == nil {
+		return false
+	}
+	fresh := &Tag{}
+	if err := fresh.Decode(t.src); err != nil {
+		return false
+	}
+	return t.Hash == fresh.Hash &&
+		t.Name == fresh.Name &&
+		signatureEqual(t.Tagger, fresh.Tagger) &&
+		t.Message == fresh.Message &&
+		t.TargetType == fresh.TargetType &&
+		t.Target == fresh.Target
+}
+
 func (t *Tag) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	o.SetType(plumbing.TagObject)
 	w, err := o.Writer()
@@ -158,16 +187,26 @@ func (t *Tag) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	defer ioutil.CheckClose(w, &err)
 
 	if _, err = fmt.Fprintf(w,
-		"object %s\ntype %s\ntag %s\ntagger ",
+		"object %s\ntype %s\ntag %s\n",
 		t.Target.String(), t.TargetType.Bytes(), t.Name); err != nil {
 		return err
 	}
 
-	if err = t.Tagger.Encode(w); err != nil {
-		return err
+	if !isZeroSignature(t.Tagger) {
+		if _, err = fmt.Fprint(w, "tagger "); err != nil {
+			return err
+		}
+
+		if err = t.Tagger.Encode(w); err != nil {
+			return err
+		}
+
+		if _, err = fmt.Fprint(w, "\n"); err != nil {
+			return err
+		}
 	}
 
-	if _, err = fmt.Fprint(w, "\n\n"); err != nil {
+	if _, err = fmt.Fprint(w, "\n"); err != nil {
 		return err
 	}
 
@@ -175,11 +214,12 @@ func (t *Tag) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 		return err
 	}
 
-	// Note that this is highly sensitive to what it sent along in the message.
-	// Message *always* needs to end with a newline, or else the message and the
-	// signature will be concatenated into a corrupt object. Since this is a
-	// lower-level method, we assume you know what you are doing and have already
-	// done the needful on the message in the caller.
+	// Note that this is highly sensitive to what is sent along in the
+	// message. Message *always* needs to end with a newline, or else the
+	// message and the trailing signature will be concatenated into a
+	// corrupt object. Since this is a lower-level method, we assume you
+	// know what you are doing and have already done the needful on the
+	// message in the caller.
 	if includeSig {
 		if _, err = fmt.Fprint(w, t.PGPSignature); err != nil {
 			return err
@@ -189,6 +229,10 @@ func (t *Tag) encode(o plumbing.EncodedObject, includeSig bool) (err error) {
 	return err
 }
 
+func isZeroSignature(s Signature) bool {
+	return s.Name == "" && s.Email == "" && s.When.IsZero()
+}
+
 // Commit returns the commit pointed to by the tag. If the tag points to a
 // different type of object ErrUnsupportedObject will be returned.
 func (t *Tag) Commit() (*Commit, error) {
@@ -256,7 +300,8 @@ func (t *Tag) String() string {
 }
 
 // Verify performs PGP verification of the tag with a provided armored
-// keyring and returns openpgp.Entity associated with verifying key on success.
+// keyring and returns openpgp.Entity associated with verifying key on
+// success.
 func (t *Tag) Verify(armoredKeyRing string) (*openpgp.Entity, error) {
 	keyRingReader := strings.NewReader(armoredKeyRing)
 	keyring, err := openpgp.ReadArmoredKeyRing(keyRingReader)

vendor/github.com/go-git/go-git/v5/plumbing/object/tag_scanner.go

@@ -0,0 +1,237 @@
+package object
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+// tagScanner holds the working state of the tag decoder driven by the
+// stateFn loop in (*Tag).Decode. Each tagState reads one or more lines
+// from r, updates the in-progress *Tag and the scanner's bookkeeping,
+// and returns the state that should run next (or nil to stop).
+type tagScanner struct {
+	r      *bufio.Reader
+	t      *Tag
+	msgbuf bytes.Buffer
+
+	// pending holds a line that was read but the current state decided to
+	// hand back to the next state, paired with the io.EOF flag returned
+	// when the line was originally read.
+	pending    []byte
+	pendingErr error
+
+	// First-occurrence tracking: once the corresponding canonical
+	// header has been decoded at its expected position, subsequent
+	// occurrences (or out-of-position lines) are silently dropped,
+	// matching the strict layout enforced by upstream's
+	// parse_tag_buffer (tag.c:130).
+	//
+	// gpgsig-sha256 is recognized and skipped without exposing a new field
+	// in v5.
+	sawObject, sawType, sawName, sawTagger bool
+}
+
+// tagState is one step of the decoder state machine. Each function reads
+// the lines it needs, mutates *Tag via s.t, and returns the next state
+// to run (or nil to terminate the loop).
+type tagState func(*tagScanner) (tagState, error)
+
+// readLine returns the next line from the buffer, transparently
+// consuming any line that was previously pushed back by a state that
+// decided not to handle it.
+func (s *tagScanner) readLine() ([]byte, error) {
+	if s.pending != nil {
+		line, err := s.pending, s.pendingErr
+		s.pending, s.pendingErr = nil, nil
+		return line, err
+	}
+	return s.r.ReadBytes('\n')
+}
+
+// pushBack stashes an unconsumed line so the next state's readLine call
+// sees it. Only one line can be pushed back at a time.
+func (s *tagScanner) pushBack(line []byte, err error) {
+	s.pending = line
+	s.pendingErr = err
+}
+
+// scanTagObject requires the first line to be `object HASH`, mirroring
+// upstream's strict parse_tag_buffer (tag.c:151-156). Anything else
+// returns ErrMalformedTag.
+func scanTagObject(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 || isBlankLine(line) {
+		return nil, fmt.Errorf("%w: missing object header", ErrMalformedTag)
+	}
+
+	key, data := splitHeader(line)
+	if key != "object" {
+		return nil, fmt.Errorf("%w: object header must be first", ErrMalformedTag)
+	}
+	h, herr := parseObjectIDHex(data, ErrMalformedTag, "object")
+	if herr != nil {
+		return nil, herr
+	}
+	s.t.Target = h
+	s.sawObject = true
+	if err == io.EOF {
+		return nil, nil
+	}
+	return scanTagType, nil
+}
+
+// scanTagType requires a `type` line immediately after the object header,
+// mirroring upstream's parse_tag_buffer (tag.c:158-166).
+func scanTagType(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 || isBlankLine(line) {
+		return nil, fmt.Errorf("%w: missing type header", ErrMalformedTag)
+	}
+
+	key, data := splitHeader(line)
+	if key != "type" {
+		return nil, fmt.Errorf("%w: type header must follow object", ErrMalformedTag)
+	}
+	ot, perr := plumbing.ParseObjectType(string(data))
+	if perr != nil {
+		return nil, perr
+	}
+	s.t.TargetType = ot
+	s.sawType = true
+	if err == io.EOF {
+		return nil, nil
+	}
+	return scanTagName, nil
+}
+
+// scanTagName requires a `tag` line immediately after the type header,
+// mirroring upstream's parse_tag_buffer (tag.c:186-194).
+func scanTagName(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 || isBlankLine(line) {
+		return nil, fmt.Errorf("%w: missing tag header", ErrMalformedTag)
+	}
+
+	key, data := splitHeader(line)
+	if key != "tag" {
+		return nil, fmt.Errorf("%w: tag header must follow type", ErrMalformedTag)
+	}
+	s.t.Name = string(data)
+	s.sawName = true
+	if err == io.EOF {
+		return nil, nil
+	}
+	return scanTagTagger, nil
+}
+
+// scanTagTagger accepts a `tagger` line at its canonical position. Any
+// other header is pushed back for scanTagHeaders.
+func scanTagTagger(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanTagMessage, nil
+	}
+
+	key, data := splitHeader(line)
+	if key == "tagger" {
+		s.t.Tagger.Decode(data)
+		s.sawTagger = true
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanTagHeaders, nil
+	}
+	s.pushBack(line, err)
+	return scanTagHeaders, nil
+}
+
+// scanTagHeaders dispatches one header line. gpgsig-sha256 hands off to
+// scanTagSkipCont so the continuation block can be consumed; out-of-position
+// canonical fields and unknown headers are silently dropped.
+func scanTagHeaders(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) == 0 {
+		return nil, nil
+	}
+	if isBlankLine(line) {
+		return scanTagMessage, nil
+	}
+
+	key, _ := splitHeader(line)
+	next := scanTagHeaders
+	switch key {
+	case "object", "type", "tag", "tagger":
+		// Out-of-canonical-position duplicates are dropped, mirroring the
+		// strict ordering of upstream's parse_tag_buffer.
+	case headerpgp256:
+		next = scanTagSkipCont
+	default:
+		// Unknown header: silently dropped (the Tag struct does not
+		// expose ExtraHeaders).
+	}
+
+	if err == io.EOF {
+		return nil, nil
+	}
+	return next, nil
+}
+
+// scanTagSkipCont discards continuation lines for a header scanTagHeaders chose
+// to drop. The first non-continuation line is pushed back so scanTagHeaders can
+// dispatch it.
+func scanTagSkipCont(s *tagScanner) (tagState, error) {
+	line, err := s.readLine()
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(line) > 0 && line[0] == ' ' {
+		if err == io.EOF {
+			return nil, nil
+		}
+		return scanTagSkipCont, nil
+	}
+	if len(line) > 0 {
+		s.pushBack(line, err)
+	}
+	return scanTagHeaders, nil
+}
+
+// scanTagMessage drains the remaining bytes into the message buffer.
+// (*Tag).Decode then runs parseSignedBytes over those bytes to peel off
+// the optional inline trailing PGP signature.
+func scanTagMessage(s *tagScanner) (tagState, error) {
+	for {
+		line, err := s.readLine()
+		if err != nil && err != io.EOF {
+			return nil, err
+		}
+		if len(line) > 0 {
+			s.msgbuf.Write(line)
+		}
+		if err == io.EOF {
+			return nil, nil
+		}
+	}
+}

vendor/github.com/go-git/go-git/v5/plumbing/object/tree.go

@@ -10,6 +10,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/go-git/go-git/v5/internal/pathutil"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/storer"
@@ -29,6 +30,7 @@ var (
 	ErrDirectoryNotFound = errors.New("directory not found")
 	ErrEntryNotFound     = errors.New("entry not found")
 	ErrEntriesNotSorted  = errors.New("entries in tree are not sorted")
+	ErrMalformedTree     = errors.New("malformed tree")
 )
 
 // Tree is basically like a directory - it references a bunch of other trees
@@ -37,9 +39,9 @@ type Tree struct {
 	Entries []TreeEntry
 	Hash    plumbing.Hash
 
-	s storer.EncodedObjectStorer
-	m map[string]*TreeEntry
-	t map[string]*Tree // tree path cache
+	s             storer.EncodedObjectStorer
+	t             map[string]*Tree // tree path cache
+	entriesSorted bool
 }
 
 // GetTree gets a tree from an object storer and decodes it.
@@ -117,7 +119,16 @@ func (t *Tree) Tree(path string) (*Tree, error) {
 }
 
 // TreeEntryFile returns the *File for a given *TreeEntry.
+//
+// The entry's name is validated against pathutil.ValidTreePath for
+// the same reason FindEntry validates: TreeEntryFile is a boundary
+// where attacker-controlled tree data leaves the trusted store as a
+// *File whose Name a caller can hand to filesystem ops.
 func (t *Tree) TreeEntryFile(e *TreeEntry) (*File, error) {
+	if err := pathutil.ValidTreePath(e.Name); err != nil {
+		return nil, err
+	}
+
 	blob, err := GetBlob(t.s, e.Hash)
 	if err != nil {
 		return nil, err
@@ -127,7 +138,16 @@ func (t *Tree) TreeEntryFile(e *TreeEntry) (*File, error) {
 }
 
 // FindEntry search a TreeEntry in this tree or any subtree.
+//
+// The lookup path is validated against pathutil.ValidTreePath to
+// prevent attacker-controlled tree contents from leaking past this
+// boundary as `.git`-shaped or path-traversal-shaped names. Callers
+// that legitimately need to look up unsafe paths should walk the
+// tree manually.
 func (t *Tree) FindEntry(path string) (*TreeEntry, error) {
+	if err := pathutil.ValidTreePath(path); err != nil {
+		return nil, err
+	}
 	if t.t == nil {
 		t.t = make(map[string]*Tree)
 	}
@@ -182,16 +202,43 @@ func (t *Tree) dir(baseName string) (*Tree, error) {
 }
 
 func (t *Tree) entry(baseName string) (*TreeEntry, error) {
-	if t.m == nil {
-		t.buildMap()
-	}
-
-	entry, ok := t.m[baseName]
-	if !ok {
+	if t.entriesSorted {
+		if entry := t.searchEntry(baseName); entry != nil {
+			return entry, nil
+		}
 		return nil, ErrEntryNotFound
 	}
 
-	return entry, nil
+	pastName := baseName + "/"
+	for i := range t.Entries {
+		entry := &t.Entries[i]
+		if entry.Name == baseName {
+			return entry, nil
+		}
+		if treeEntrySortName(entry) > pastName {
+			break
+		}
+	}
+
+	return nil, ErrEntryNotFound
+}
+
+func (t *Tree) searchEntry(baseName string) *TreeEntry {
+	if i := t.searchEntryIndex(baseName); i < len(t.Entries) && t.Entries[i].Name == baseName {
+		return &t.Entries[i]
+	}
+
+	if i := t.searchEntryIndex(baseName + "/"); i < len(t.Entries) && t.Entries[i].Name == baseName {
+		return &t.Entries[i]
+	}
+
+	return nil
+}
+
+func (t *Tree) searchEntryIndex(name string) int {
+	return sort.Search(len(t.Entries), func(i int) bool {
+		return treeEntrySortName(&t.Entries[i]) >= name
+	})
 }
 
 // Files returns a FileIter allowing to iterate over the Tree
@@ -212,20 +259,25 @@ func (t *Tree) Type() plumbing.ObjectType {
 	return plumbing.TreeObject
 }
 
+func (t *Tree) reset() {
+	storer := t.s
+	*t = Tree{s: storer}
+}
+
 // Decode transform an plumbing.EncodedObject into a Tree struct
 func (t *Tree) Decode(o plumbing.EncodedObject) (err error) {
 	if o.Type() != plumbing.TreeObject {
 		return ErrUnsupportedObject
 	}
 
+	t.reset()
 	t.Hash = o.Hash()
+	// assume tree is sorted as a valid tree should always be sorted.
+	t.entriesSorted = true
 	if o.Size() == 0 {
 		return nil
 	}
 
-	t.Entries = nil
-	t.m = nil
-
 	reader, err := o.Reader()
 	if err != nil {
 		return err
@@ -235,10 +287,14 @@ func (t *Tree) Decode(o plumbing.EncodedObject) (err error) {
 	r := sync.GetBufioReader(reader)
 	defer sync.PutBufioReader(r)
 
+	var prevSortName string
 	for {
 		str, err := r.ReadString(' ')
 		if err != nil {
 			if err == io.EOF {
+				if len(str) != 0 {
+					return fmt.Errorf("%w: missing mode terminator", ErrMalformedTree)
+				}
 				break
 			}
 
@@ -248,25 +304,41 @@ func (t *Tree) Decode(o plumbing.EncodedObject) (err error) {
 
 		mode, err := filemode.New(str)
 		if err != nil {
-			return err
+			return fmt.Errorf("%w: malformed mode", ErrMalformedTree)
 		}
+		mode = canonicalTreeMode(mode)
 
 		name, err := r.ReadString(0)
-		if err != nil && err != io.EOF {
+		if err != nil {
+			if err == io.EOF {
+				return fmt.Errorf("%w: missing filename terminator", ErrMalformedTree)
+			}
 			return err
 		}
+		if len(name) == 1 {
+			return fmt.Errorf("%w: empty filename", ErrMalformedTree)
+		}
 
 		var hash plumbing.Hash
 		if _, err = io.ReadFull(r, hash[:]); err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+				return fmt.Errorf("%w: truncated object id", ErrMalformedTree)
+			}
 			return err
 		}
 
 		baseName := name[:len(name)-1]
-		t.Entries = append(t.Entries, TreeEntry{
+		entry := TreeEntry{
 			Hash: hash,
 			Mode: mode,
 			Name: baseName,
-		})
+		}
+		sortName := treeEntrySortName(&entry)
+		if len(t.Entries) != 0 && prevSortName > sortName {
+			t.entriesSorted = false
+		}
+		prevSortName = sortName
+		t.Entries = append(t.Entries, entry)
 	}
 
 	return nil
@@ -279,21 +351,37 @@ func (s TreeEntrySorter) Len() int {
 }
 
 func (s TreeEntrySorter) Less(i, j int) bool {
-	name1 := s[i].Name
-	name2 := s[j].Name
-	if s[i].Mode == filemode.Dir {
-		name1 += "/"
-	}
-	if s[j].Mode == filemode.Dir {
-		name2 += "/"
-	}
-	return name1 < name2
+	return treeEntrySortName(&s[i]) < treeEntrySortName(&s[j])
 }
 
 func (s TreeEntrySorter) Swap(i, j int) {
 	s[i], s[j] = s[j], s[i]
 }
 
+// Git compares tree entries as if directory names had a trailing slash.
+func treeEntrySortName(e *TreeEntry) string {
+	if e.Mode == filemode.Dir {
+		return e.Name + "/"
+	}
+	return e.Name
+}
+
+func canonicalTreeMode(mode filemode.FileMode) filemode.FileMode {
+	switch mode & 0o170000 {
+	case 0o040000:
+		return filemode.Dir
+	case 0o100000:
+		if mode&0o111 != 0 {
+			return filemode.Executable
+		}
+		return filemode.Regular
+	case 0o120000:
+		return filemode.Symlink
+	default:
+		return filemode.Submodule
+	}
+}
+
 // Encode transforms a Tree into a plumbing.EncodedObject.
 // The tree entries must be sorted by name.
 func (t *Tree) Encode(o plumbing.EncodedObject) (err error) {
@@ -329,13 +417,6 @@ func (t *Tree) Encode(o plumbing.EncodedObject) (err error) {
 	return err
 }
 
-func (t *Tree) buildMap() {
-	t.m = make(map[string]*TreeEntry)
-	for i := 0; i < len(t.Entries); i++ {
-		t.m[t.Entries[i].Name] = &t.Entries[i]
-	}
-}
-
 // Diff returns a list of changes between this tree and the provided one
 func (t *Tree) Diff(to *Tree) (Changes, error) {
 	return t.DiffContext(context.Background(), to)
@@ -455,6 +536,10 @@ func (w *TreeWalker) Next() (name string, entry TreeEntry, err error) {
 			continue
 		}
 
+		if err := pathutil.ValidTreePath(entry.Name); err != nil {
+			return name, entry, err
+		}
+
 		if entry.Mode == filemode.Dir {
 			obj, err = GetTree(w.s, entry.Hash)
 		}

vendor/github.com/go-git/go-git/v5/plumbing/transport/ssh/common.go

@@ -252,7 +252,39 @@ func (c *command) setAuthFromEndpoint() error {
 }
 
 func endpointToCommand(cmd string, ep *transport.Endpoint) string {
-	return fmt.Sprintf("%s '%s'", cmd, ep.Path)
+	var b strings.Builder
+	b.WriteString(cmd)
+	b.WriteByte(' ')
+	writeShellQuote(&b, ep.Path)
+	return b.String()
+}
+
+// writeShellQuote writes s to b, wrapped in single quotes with
+// embedded single quotes and exclamation marks escaped using the
+// POSIX close-escape-reopen idiom:
+//
+//	' becomes '\''
+//	! becomes '\!'
+//
+// It is a direct port of canonical Git's sq_quote_buf (quote.c).
+// The bang escape keeps the result safe when re-evaluated under
+// csh-derived shells that perform history expansion. The output is
+// safe to pass as a single argument through any POSIX shell and
+// round-trips through git-shell's sq_dequote_to_argv.
+func writeShellQuote(b *strings.Builder, s string) {
+	b.Grow(len(s) + 2)
+	b.WriteByte('\'')
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		if c == '\'' || c == '!' {
+			b.WriteString(`'\`)
+			b.WriteByte(c)
+			b.WriteByte('\'')
+			continue
+		}
+		b.WriteByte(c)
+	}
+	b.WriteByte('\'')
 }
 
 func overrideConfig(overrides *ssh.ClientConfig, c *ssh.ClientConfig) {

vendor/github.com/go-git/go-git/v5/repository.go

@@ -1530,7 +1530,18 @@ func (r *Repository) Worktree() (*Worktree, error) {
 		return nil, ErrIsBareRepository
 	}
 
-	return &Worktree{r: r, Filesystem: r.wt}, nil
+	protectNTFS := defaultProtectNTFS()
+	protectHFS := defaultProtectHFS()
+	if cfg, err := r.Config(); err == nil {
+		if cfg.Core.ProtectNTFS.IsSet() {
+			protectNTFS = cfg.Core.ProtectNTFS.IsTrue()
+		}
+		if cfg.Core.ProtectHFS.IsSet() {
+			protectHFS = cfg.Core.ProtectHFS.IsTrue()
+		}
+	}
+
+	return &Worktree{r: r, Filesystem: newWorktreeFilesystem(r.wt, protectNTFS, protectHFS)}, nil
 }
 
 func expand_ref(s storer.ReferenceStorer, ref plumbing.ReferenceName) (*plumbing.Reference, error) {

vendor/github.com/go-git/go-git/v5/storage/filesystem/dotgit/dotgit.go

@@ -75,6 +75,10 @@ var (
 	// ErrEmptyRefFile is returned when a reference file is attempted to be read,
 	// but the file is empty
 	ErrEmptyRefFile = errors.New("ref file is empty")
+	// ErrModuleNameEscape is returned when a submodule name would
+	// resolve outside the modules/ subtree, mirroring canonical Git's
+	// "ignoring suspicious submodule name" defence.
+	ErrModuleNameEscape = errors.New("submodule name escapes modules/ directory")
 )
 
 // Options holds configuration for the storage.
@@ -1127,9 +1131,20 @@ func (d *DotGit) PackRefs() (err error) {
 	return nil
 }
 
-// Module return a billy.Filesystem pointing to the module folder
+// Module returns a billy.Filesystem pointing to the module folder.
+//
+// As a defence in depth against submodule name path traversal,
+// refuse names whose joined path leaves the modules/ subtree once
+// cleaned. The config-layer parser also validates submodule names,
+// but Module may be reached from any caller that constructs a
+// Submodule struct programmatically and so bypasses the parser.
 func (d *DotGit) Module(name string) (billy.Filesystem, error) {
-	return d.fs.Chroot(d.fs.Join(modulePath, name))
+	p := d.fs.Join(modulePath, name)
+	cleaned := path.Clean(filepath.ToSlash(p))
+	if cleaned != modulePath && !strings.HasPrefix(cleaned, modulePath+"/") {
+		return nil, ErrModuleNameEscape
+	}
+	return d.fs.Chroot(p)
 }
 
 func (d *DotGit) AddAlternate(remote string) error {

vendor/github.com/go-git/go-git/v5/submodule.go

@@ -6,9 +6,12 @@ import (
 	"errors"
 	"fmt"
 	"path"
+	"path/filepath"
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-git/v5/config"
+	"github.com/go-git/go-git/v5/internal/pathutil"
+	giturl "github.com/go-git/go-git/v5/internal/url"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/index"
 	"github.com/go-git/go-git/v5/plumbing/transport"
@@ -119,6 +122,16 @@ func (s *Submodule) Repository() (*Repository, error) {
 		exists = true
 	}
 
+	// s.c.Path is sourced from the worktree's .gitmodules and is
+	// therefore tree-controlled. Apply the strict tree-path validator
+	// before chroot — the wrapper's tolerant validPath would let a
+	// final-position .git component through (e.g. "submodule/.git"),
+	// which a malicious .gitmodules could use to chroot the submodule
+	// worktree into the repository's actual .git directory.
+	if err := pathutil.ValidTreePath(s.c.Path); err != nil {
+		return nil, err
+	}
+
 	var worktree billy.Filesystem
 	if worktree, err = s.w.Filesystem.Chroot(s.c.Path); err != nil {
 		return nil, err
@@ -138,18 +151,25 @@ func (s *Submodule) Repository() (*Repository, error) {
 		return nil, err
 	}
 
-	if !path.IsAbs(moduleEndpoint.Path) && moduleEndpoint.Protocol == "file" {
-		remotes, err := s.w.r.Remotes()
+	// A relative submodule URL such as "../X.git" must resolve against
+	// the parent repository's remote URL, not against the process CWD.
+	// Detect relativity from the raw configured URL because
+	// transport.NewEndpoint normalizes local paths to absolute form via
+	// filepath.Abs, which would otherwise mask the relative form here.
+	if giturl.IsLocalEndpoint(s.c.URL) &&
+		!path.IsAbs(s.c.URL) && !filepath.IsAbs(s.c.URL) {
+
+		base, err := defaultRemote(s.w.r)
+		if err != nil {
+			return nil, fmt.Errorf("resolving relative submodule URL: %w", err)
+		}
+
+		rootEndpoint, err := transport.NewEndpoint(base.URLs[0])
 		if err != nil {
 			return nil, err
 		}
 
-		rootEndpoint, err := transport.NewEndpoint(remotes[0].c.URLs[0])
-		if err != nil {
-			return nil, err
-		}
-
-		rootEndpoint.Path = path.Join(rootEndpoint.Path, moduleEndpoint.Path)
+		rootEndpoint.Path = path.Join(rootEndpoint.Path, s.c.URL)
 		*moduleEndpoint = *rootEndpoint
 	}
 
@@ -161,6 +181,52 @@ func (s *Submodule) Repository() (*Repository, error) {
 	return r, err
 }
 
+// defaultRemote returns the remote that relative submodule URLs are
+// resolved against, mirroring canonical Git's repo_default_remote
+// (remote.c) and resolve_relative_url (builtin/submodule--helper.c):
+//
+//  1. if HEAD is on a branch with branch.<name>.remote configured,
+//     use that remote;
+//  2. else if exactly one remote is configured, use it;
+//  3. otherwise fall back to DefaultRemoteName ("origin").
+//
+// Each rule falls through unconditionally: a branch lookup that
+// finds the branch but with an empty Remote does not short-circuit
+// rule (2). Returns an error when the chosen remote is not configured.
+func defaultRemote(r *Repository) (*config.RemoteConfig, error) {
+	cfg, err := r.Config()
+	if err != nil {
+		return nil, err
+	}
+
+	if ref, err := r.Reference(plumbing.HEAD, false); err == nil &&
+		ref.Type() == plumbing.SymbolicReference &&
+		ref.Target().IsBranch() {
+		if b, ok := cfg.Branches[ref.Target().Short()]; ok && b.Remote != "" {
+			return lookupRemote(cfg, b.Remote)
+		}
+	}
+
+	if len(cfg.Remotes) == 1 {
+		for name := range cfg.Remotes {
+			return lookupRemote(cfg, name)
+		}
+	}
+
+	return lookupRemote(cfg, DefaultRemoteName)
+}
+
+func lookupRemote(cfg *config.Config, name string) (*config.RemoteConfig, error) {
+	rc, ok := cfg.Remotes[name]
+	if !ok {
+		return nil, fmt.Errorf("remote %q not found", name)
+	}
+	if len(rc.URLs) == 0 {
+		return nil, fmt.Errorf("remote %q has no configured URL", name)
+	}
+	return rc, nil
+}
+
 // Update the registered submodule to match what the superproject expects, the
 // submodule should be initialized first calling the Init method or setting in
 // the options SubmoduleUpdateOptions.Init equals true

vendor/github.com/go-git/go-git/v5/utils/binary/read.go

@@ -5,11 +5,18 @@ package binary
 import (
 	"bufio"
 	"encoding/binary"
+	"errors"
 	"io"
+	"math"
 
 	"github.com/go-git/go-git/v5/plumbing"
 )
 
+// ErrIntegerOverflow is returned when a Git-format variable-width integer
+// would not fit into an int64 because the input declares more continuation
+// bytes than the type can hold.
+var ErrIntegerOverflow = errors.New("variable-width integer overflow")
+
 // Read reads structured binary data from r into data. Bytes are read and
 // decoded in BigEndian order
 // https://golang.org/pkg/encoding/binary/#Read
@@ -92,6 +99,14 @@ func ReadVariableWidthInt(r io.Reader) (int64, error) {
 
 	var v = int64(c & maskLength)
 	for c&maskContinue > 0 {
+		// Reject input that, after the v++ and shift below, would
+		// not fit in an int64. With v < (MaxInt64-127)>>7, the
+		// post-increment v is at most (MaxInt64-127)>>7 and the
+		// final (v << 7) + (c & 0x7F) stays within int64.
+		if v >= (math.MaxInt64-int64(maskLength))>>lengthBits {
+			return 0, ErrIntegerOverflow
+		}
+
 		v++
 		if err := Read(r, &c); err != nil {
 			return 0, err

vendor/github.com/go-git/go-git/v5/worktree.go

@@ -7,7 +7,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 
 	"github.com/go-git/go-billy/v5"
@@ -458,10 +457,6 @@ func (w *Worktree) resetWorktree(t *object.Tree, files []string) error {
 
 	filesMap := buildFilePathMap(files)
 	for _, ch := range changes {
-		if err := w.validChange(ch); err != nil {
-			return err
-		}
-
 		if len(files) > 0 {
 			file := ""
 			if ch.From != nil {
@@ -489,108 +484,6 @@ func (w *Worktree) resetWorktree(t *object.Tree, files []string) error {
 	return w.r.Storer.SetIndex(idx)
 }
 
-// worktreeDeny is a list of paths that are not allowed
-// to be used when resetting the worktree.
-var worktreeDeny = map[string]struct{}{
-	// .git
-	GitDirName: {},
-
-	// For other historical reasons, file names that do not conform to the 8.3
-	// format (up to eight characters for the basename, three for the file
-	// extension, certain characters not allowed such as `+`, etc) are associated
-	// with a so-called "short name", at least on the `C:` drive by default.
-	// Which means that `git~1/` is a valid way to refer to `.git/`.
-	"git~1": {},
-}
-
-// validPath checks whether paths are valid.
-// The rules around invalid paths could differ from upstream based on how
-// filesystems are managed within go-git, but they are largely the same.
-//
-// For upstream rules:
-// https://github.com/git/git/blob/564d0252ca632e0264ed670534a51d18a689ef5d/read-cache.c#L946
-// https://github.com/git/git/blob/564d0252ca632e0264ed670534a51d18a689ef5d/path.c#L1383
-func validPath(paths ...string) error {
-	for _, p := range paths {
-		parts := strings.FieldsFunc(p, func(r rune) bool { return (r == '\\' || r == '/') })
-		if len(parts) == 0 {
-			return fmt.Errorf("invalid path: %q", p)
-		}
-
-		if _, denied := worktreeDeny[strings.ToLower(parts[0])]; denied {
-			return fmt.Errorf("invalid path prefix: %q", p)
-		}
-
-		if runtime.GOOS == "windows" {
-			// Volume names are not supported, in both formats: \\ and <DRIVE_LETTER>:.
-			if vol := filepath.VolumeName(p); vol != "" {
-				return fmt.Errorf("invalid path: %q", p)
-			}
-
-			if !windowsValidPath(parts[0]) {
-				return fmt.Errorf("invalid path: %q", p)
-			}
-		}
-
-		for _, part := range parts {
-			if part == ".." {
-				return fmt.Errorf("invalid path %q: cannot use '..'", p)
-			}
-		}
-	}
-	return nil
-}
-
-// windowsPathReplacer defines the chars that need to be replaced
-// as part of windowsValidPath.
-var windowsPathReplacer *strings.Replacer
-
-func init() {
-	windowsPathReplacer = strings.NewReplacer(" ", "", ".", "")
-}
-
-func windowsValidPath(part string) bool {
-	if len(part) > 3 && strings.EqualFold(part[:4], GitDirName) {
-		// For historical reasons, file names that end in spaces or periods are
-		// automatically trimmed. Therefore, `.git . . ./` is a valid way to refer
-		// to `.git/`.
-		if windowsPathReplacer.Replace(part[4:]) == "" {
-			return false
-		}
-
-		// For yet other historical reasons, NTFS supports so-called "Alternate Data
-		// Streams", i.e. metadata associated with a given file, referred to via
-		// `<filename>:<stream-name>:<stream-type>`. There exists a default stream
-		// type for directories, allowing `.git/` to be accessed via
-		// `.git::$INDEX_ALLOCATION/`.
-		//
-		// For performance reasons, _all_ Alternate Data Streams of `.git/` are
-		// forbidden, not just `::$INDEX_ALLOCATION`.
-		if len(part) > 4 && part[4:5] == ":" {
-			return false
-		}
-	}
-	return true
-}
-
-func (w *Worktree) validChange(ch merkletrie.Change) error {
-	action, err := ch.Action()
-	if err != nil {
-		return nil
-	}
-
-	switch action {
-	case merkletrie.Delete:
-		return validPath(ch.From.String())
-	case merkletrie.Insert:
-		return validPath(ch.To.String())
-	case merkletrie.Modify:
-		return validPath(ch.From.String(), ch.To.String())
-	}
-
-	return nil
-}
-
 func (w *Worktree) checkoutChange(ch merkletrie.Change, t *object.Tree, idx *indexBuilder) error {
 	a, err := ch.Action()
 	if err != nil {
@@ -763,10 +656,10 @@ func (w *Worktree) checkoutFile(f *object.File) (err error) {
 }
 
 func (w *Worktree) checkoutFileSymlink(f *object.File) (err error) {
-	// https://github.com/git/git/commit/10ecfa76491e4923988337b2e2243b05376b40de
-	if strings.EqualFold(f.Name, gitmodulesFile) {
-		return ErrGitModulesSymlink
-	}
+	// .gitmodules symlink rejection (and its NTFS / HFS variants) is
+	// enforced by the worktreeFilesystem wrapper's Symlink method via
+	// validSymlinkName. See https://github.com/git/git/commit/10ecfa7
+	// for the upstream rationale.
 
 	from, err := f.Reader()
 	if err != nil {

vendor/github.com/go-git/go-git/v5/worktree_fs.go

@@ -0,0 +1,264 @@
+package git
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/go-git/go-billy/v5"
+
+	"github.com/go-git/go-git/v5/internal/pathutil"
+)
+
+// defaultProtectHFS returns the default value for core.protectHFS
+// when not explicitly configured. Matches upstream Git's
+// PROTECT_HFS_DEFAULT[1], which the Makefile sets to 1 on Darwin
+// and leaves at 0 on every other platform.
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/config.mak.uname#L146
+func defaultProtectHFS() bool {
+	return runtime.GOOS == "darwin"
+}
+
+// defaultProtectNTFS returns the default value for core.protectNTFS
+// when not explicitly configured. Matches upstream Git's
+// PROTECT_NTFS_DEFAULT, which has been 1 on every platform since
+// 9102f958ee5 (CVE-2019-1353)[1]: WSL allows Linux processes to
+// reach NTFS-mounted worktrees on Windows hosts, so the
+// is_ntfs_dotgit guard cannot safely be gated on the runtime OS.
+//
+// [1]: https://github.com/git/git/commit/9102f958ee5
+func defaultProtectNTFS() bool {
+	return true
+}
+
+// worktreeFilesystem wraps a billy.Filesystem and validates every path passed
+// to a mutating operation. This prevents writing to, or deleting from,
+// dangerous locations (e.g. .git/*, ../) regardless of which worktree
+// code path triggers the operation.
+type worktreeFilesystem struct {
+	billy.Filesystem
+	protectNTFS bool
+	protectHFS  bool
+}
+
+func newWorktreeFilesystem(fs billy.Filesystem, protectNTFS, protectHFS bool) *worktreeFilesystem {
+	return &worktreeFilesystem{Filesystem: fs, protectNTFS: protectNTFS, protectHFS: protectHFS}
+}
+
+func (sfs *worktreeFilesystem) Create(filename string) (billy.File, error) {
+	if err := sfs.validPath(filename); err != nil {
+		return nil, fmt.Errorf("create: %w", err)
+	}
+	return sfs.Filesystem.Create(filename)
+}
+
+func (sfs *worktreeFilesystem) Open(filename string) (billy.File, error) {
+	if err := sfs.validReadPath(filename); err != nil {
+		return nil, fmt.Errorf("open: %w", err)
+	}
+	return sfs.Filesystem.Open(filename)
+}
+
+func (sfs *worktreeFilesystem) OpenFile(filename string, flag int, perm os.FileMode) (billy.File, error) {
+	if err := sfs.validPath(filename); err != nil {
+		return nil, fmt.Errorf("openfile: %w", err)
+	}
+	return sfs.Filesystem.OpenFile(filename, flag, perm)
+}
+
+func (sfs *worktreeFilesystem) Stat(filename string) (os.FileInfo, error) {
+	if err := sfs.validReadPath(filename); err != nil {
+		return nil, fmt.Errorf("stat: %w", err)
+	}
+	return sfs.Filesystem.Stat(filename)
+}
+
+func (sfs *worktreeFilesystem) Remove(filename string) error {
+	if err := sfs.validPath(filename); err != nil {
+		return fmt.Errorf("remove: %w", err)
+	}
+	return sfs.Filesystem.Remove(filename)
+}
+
+func (sfs *worktreeFilesystem) Rename(from, to string) error {
+	if err := sfs.validPath(from, to); err != nil {
+		return fmt.Errorf("rename: %w", err)
+	}
+	return sfs.Filesystem.Rename(from, to)
+}
+
+func (sfs *worktreeFilesystem) ReadDir(path string) ([]os.FileInfo, error) {
+	if err := sfs.validReadPath(path); err != nil {
+		return nil, fmt.Errorf("readdir: %w", err)
+	}
+	return sfs.Filesystem.ReadDir(path)
+}
+
+func (sfs *worktreeFilesystem) Lstat(filename string) (os.FileInfo, error) {
+	if err := sfs.validReadPath(filename); err != nil {
+		return nil, fmt.Errorf("lstat: %w", err)
+	}
+	return sfs.Filesystem.Lstat(filename)
+}
+
+func (sfs *worktreeFilesystem) Symlink(target, link string) error {
+	if err := sfs.validPath(link); err != nil {
+		return fmt.Errorf("symlink: %w", err)
+	}
+	if err := sfs.validSymlinkName(link); err != nil {
+		return fmt.Errorf("symlink: %w", err)
+	}
+	return sfs.Filesystem.Symlink(target, link)
+}
+
+func (sfs *worktreeFilesystem) Readlink(link string) (string, error) {
+	if err := sfs.validReadPath(link); err != nil {
+		return "", fmt.Errorf("readlink: %w", err)
+	}
+	return sfs.Filesystem.Readlink(link)
+}
+
+func (sfs *worktreeFilesystem) MkdirAll(path string, perm os.FileMode) error {
+	// MkdirAll on the worktree root is a no-op: the root always exists,
+	// so there is nothing to materialise. Mirroring the tolerance that
+	// validReadPath gives to read-side operations avoids breaking callers
+	// that walk a directory tree and pass the relative-to-root prefix
+	// ("") through to the worktree FS.
+	if path == "" || path == "." || path == "/" {
+		return nil
+	}
+	if err := sfs.validPath(path); err != nil {
+		return fmt.Errorf("mkdirall: %w", err)
+	}
+	return sfs.Filesystem.MkdirAll(path, perm)
+}
+
+func (sfs *worktreeFilesystem) TempFile(_, _ string) (billy.File, error) {
+	return nil, fmt.Errorf("tempfile: %w", errUnsupportedOperation)
+}
+
+func (sfs *worktreeFilesystem) Chroot(path string) (billy.Filesystem, error) {
+	if err := sfs.validReadPath(path); err != nil {
+		return nil, fmt.Errorf("chroot: %w", err)
+	}
+	return sfs.Filesystem.Chroot(path)
+}
+
+// validReadPath is like validPath but treats the empty string and "." as
+// valid references to the worktree root. Read-side operations on the root
+// (e.g. ReadDir(""), Lstat(".")) are legitimate; mutating the root itself
+// is not, so write-side operations continue to use validPath directly.
+func (sfs *worktreeFilesystem) validReadPath(p string) error {
+	if p == "" || p == "." || p == "/" {
+		return nil
+	}
+	return sfs.validPath(p)
+}
+
+var errUnsupportedOperation = errors.New("unsupported operation")
+
+// isDotGitVariant reports whether part is .git, git~1, or an HFS+
+// equivalent of .git (when protectHFS is true). NTFS variants of .git
+// (e.g. ".git " with trailing space, ".git::$INDEX_ALLOCATION") are
+// detected separately by pathutil.WindowsValidPath, which applies
+// regardless of position in the path. Both validators reuse this
+// helper.
+func isDotGitVariant(part string, protectHFS bool) bool {
+	if pathutil.IsDotGitName(part) {
+		return true
+	}
+	if protectHFS && pathutil.IsHFSDotGit(part) {
+		return true
+	}
+	return false
+}
+
+// validPath checks whether paths are valid for the worktree
+// filesystem abstraction. It is intentionally tolerant of .git as
+// the final path component of a multi-component path
+// (e.g. "submodule/.git"), so that legitimate gitlink pointer files
+// can still be Stat'd, Read, and Removed via the wrapper during
+// submodule cleanup. Attacker-controlled tree-entry paths are
+// validated separately by pathutil.ValidTreePath at the boundaries
+// where data leaves the trusted store (Tree.FindEntry, the explicit
+// callers in CherryPick and Submodule.Repository).
+//
+// For upstream rules:
+// https://github.com/git/git/blob/v2.54.0/read-cache.c#L987
+// https://github.com/git/git/blob/v2.54.0/path.c#L1419
+func (sfs *worktreeFilesystem) validPath(paths ...string) error {
+	for _, p := range paths {
+		for i := 0; i < len(p); i++ {
+			if p[i] < 0x20 || p[i] == 0x7f {
+				return fmt.Errorf("invalid path %q: contains control character", p)
+			}
+		}
+
+		parts := strings.FieldsFunc(p, func(r rune) bool { return (r == '\\' || r == '/') })
+		if len(parts) == 0 {
+			return fmt.Errorf("invalid path: %q", p)
+		}
+
+		if sfs.protectNTFS {
+			// Volume names are not supported, in both formats: \\ and <DRIVE_LETTER>:.
+			if vol := filepath.VolumeName(p); vol != "" {
+				return fmt.Errorf("invalid path: %q", p)
+			}
+		}
+
+		for i, part := range parts {
+			if part == "." || part == ".." {
+				return fmt.Errorf("invalid path %q: cannot use %q", p, part)
+			}
+
+			// Reject .git (and equivalents) as a path component when it is
+			// either the first component (root-level .git) or a non-final
+			// component (traversal into a .git directory, e.g. "a/.git/config").
+			// A final non-first .git component (e.g. "submodule/.git") is
+			// allowed because submodule worktrees contain a .git pointer file.
+			if isDotGitVariant(part, sfs.protectHFS) && (i == 0 || i < len(parts)-1) {
+				return fmt.Errorf("invalid path component: %q", p)
+			}
+
+			if sfs.protectNTFS && !pathutil.WindowsValidPath(part) {
+				return fmt.Errorf("invalid path: %q", p)
+			}
+		}
+	}
+	return nil
+}
+
+// validSymlinkName checks the per-component name of a symlink for
+// dotfile names that attackers can use to trick a checkout into
+// writing a dangerous symlink. Each path component is compared
+// against .gitmodules case-insensitively, against its NTFS variants
+// (e.g. ".gitmodules .", ".gitmodules::$INDEX_ALLOCATION", or 8.3
+// short-name forms) when protectNTFS is on, and against its HFS+
+// variants (Unicode ignored code points folded into ".gitmodules")
+// when protectHFS is on.
+//
+// Reference: upstream Git verify_path_internal at read-cache.c#L1004-L1024
+// in tag v2.54.0[1].
+//
+// [1]: https://github.com/git/git/blob/v2.54.0/read-cache.c#L1004-L1024
+func (sfs *worktreeFilesystem) validSymlinkName(name string) error {
+	parts := strings.FieldsFunc(name, func(r rune) bool {
+		return r == '/' || r == '\\'
+	})
+	for _, part := range parts {
+		if strings.EqualFold(part, gitmodulesFile) {
+			return ErrGitModulesSymlink
+		}
+		if sfs.protectNTFS && pathutil.IsNTFSDotGitmodules(part) {
+			return ErrGitModulesSymlink
+		}
+		if sfs.protectHFS && pathutil.IsHFSDotGitmodules(part) {
+			return ErrGitModulesSymlink
+		}
+	}
+	return nil
+}

vendor/github.com/go-git/go-git/v5/worktree_status.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/go-git/go-billy/v5/util"
+	"github.com/go-git/go-git/v5/internal/pathutil"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/format/gitignore"
@@ -545,6 +546,14 @@ func (w *Worktree) addOrUpdateFileToIndex(idx *index.Index, filename string, h p
 }
 
 func (w *Worktree) doAddFileToIndex(idx *index.Index, filename string, h plumbing.Hash) error {
+	// Mirror upstream's Index.Add gate at the v5 caller boundary: the
+	// index feeds future trees, so a name that the tree-side
+	// pathutil.ValidTreePath gate would reject must not enter the
+	// index in the first place. v5 keeps Index.Add's existing signature
+	// for API compatibility, so the validation happens here.
+	if err := pathutil.ValidTreePath(filename); err != nil {
+		return err
+	}
 	return w.doUpdateFileToIndex(idx.Add(filename), filename, h)
 }
 

vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go

@@ -71,7 +71,6 @@ type ServeMux struct {
 	streamErrorHandler        StreamErrorHandlerFunc
 	routingErrorHandler       RoutingErrorHandlerFunc
 	disablePathLengthFallback bool
-	disableHTTPMethodOverride bool
 	unescapingMode            UnescapingMode
 	writeContentLength        bool
 	disableChunkedEncoding    bool
@@ -272,19 +271,6 @@ func WithDisablePathLengthFallback() ServeMuxOption {
 	}
 }
 
-// WithDisableHTTPMethodOverride returns a ServeMuxOption that disables the
-// X-HTTP-Method-Override header handling.
-//
-// When this option is used, the mux will no longer allow POST requests with
-// the X-HTTP-Method-Override header to override the HTTP method. The path
-// length fallback (POST with application/x-www-form-urlencoded falling back
-// to a matching GET handler) is not affected by this option.
-func WithDisableHTTPMethodOverride() ServeMuxOption {
-	return func(serveMux *ServeMux) {
-		serveMux.disableHTTPMethodOverride = true
-	}
-}
-
 // WithWriteContentLength returns a ServeMuxOption to enable writing content length on non-streaming responses
 func WithWriteContentLength() ServeMuxOption {
 	return func(serveMux *ServeMux) {
@@ -419,7 +405,7 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		path = r.URL.RawPath
 	}
 
-	if override := r.Header.Get("X-HTTP-Method-Override"); override != "" && !s.disableHTTPMethodOverride && s.isPathLengthFallback(r) {
+	if override := r.Header.Get("X-HTTP-Method-Override"); override != "" && s.isPathLengthFallback(r) {
 		if err := r.ParseForm(); err != nil {
 			_, outboundMarshaler := MarshalerForRequest(s, r)
 			sterr := status.Error(codes.InvalidArgument, err.Error())
@@ -481,7 +467,6 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 					HTTPStatus: http.StatusBadRequest,
 					Err:        mse,
 				})
-				return
 			}
 			continue
 		}
@@ -524,7 +509,6 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 						HTTPStatus: http.StatusBadRequest,
 						Err:        mse,
 					})
-					return
 				}
 				continue
 			}

vendor/github.com/klauspost/compress/.gitattributes

@@ -1,3 +1,2 @@
 * -text
 *.bin -text -diff
-*.md text eol=lf

vendor/github.com/klauspost/compress/fse/README.md

@@ -1,79 +1,79 @@
-# Finite State Entropy
-
-This package provides Finite State Entropy encoding and decoding.
-            
-Finite State Entropy (also referenced as [tANS](https://en.wikipedia.org/wiki/Asymmetric_numeral_systems#tANS)) 
-encoding provides a fast near-optimal symbol encoding/decoding
-for byte blocks as implemented in [zstandard](https://github.com/facebook/zstd).
-
-This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
-This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
-but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
-
-* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/fse)
-
-## News
-
- * Feb 2018: First implementation released. Consider this beta software for now.
-
-# Usage
-
-This package provides a low level interface that allows to compress single independent blocks. 
-
-Each block is separate, and there is no built in integrity checks. 
-This means that the caller should keep track of block sizes and also do checksums if needed.  
-
-Compressing a block is done via the [`Compress`](https://godoc.org/github.com/klauspost/compress/fse#Compress) function.
-You must provide input and will receive the output and maybe an error.
-
-These error values can be returned:
-
-| Error               | Description                                                                 |
-|---------------------|-----------------------------------------------------------------------------|
-| `<nil>`             | Everything ok, output is returned                                           |
-| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
-| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
-| `(error)`           | An internal error occurred.                                                 |
-
-As can be seen above there are errors that will be returned even under normal operation so it is important to handle these.
-
-To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/fse#Scratch) object 
-that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
-object can be used for both.   
-
-Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
-you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
-
-Decompressing is done by calling the [`Decompress`](https://godoc.org/github.com/klauspost/compress/fse#Decompress) function.
-You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
-your input was likely corrupted. 
-
-It is important to note that a successful decoding does *not* mean your output matches your original input. 
-There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
-
-For more detailed usage, see examples in the [godoc documentation](https://godoc.org/github.com/klauspost/compress/fse#pkg-examples).
-
-# Performance
-
-A lot of factors are affecting speed. Block sizes and compressibility of the material are primary factors.  
-All compression functions are currently only running on the calling goroutine so only one core will be used per block.  
-
-The compressor is significantly faster if symbols are kept as small as possible. The highest byte value of the input
-is used to reduce some of the processing, so if all your input is above byte value 64 for instance, it may be 
-beneficial to transpose all your input values down by 64.   
-
-With moderate block sizes around 64k speed are typically 200MB/s per core for compression and 
-around 300MB/s decompression speed. 
-
-The same hardware typically does Huffman (deflate) encoding at 125MB/s and decompression at 100MB/s. 
-
-# Plans
-
-At one point, more internals will be exposed to facilitate more "expert" usage of the components. 
-
-A streaming interface is also likely to be implemented. Likely compatible with [FSE stream format](https://github.com/Cyan4973/FiniteStateEntropy/blob/dev/programs/fileio.c#L261).  
-
-# Contributing
-
-Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
+# Finite State Entropy
+
+This package provides Finite State Entropy encoding and decoding.
+            
+Finite State Entropy (also referenced as [tANS](https://en.wikipedia.org/wiki/Asymmetric_numeral_systems#tANS)) 
+encoding provides a fast near-optimal symbol encoding/decoding
+for byte blocks as implemented in [zstandard](https://github.com/facebook/zstd).
+
+This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
+This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
+but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
+
+* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/fse)
+
+## News
+
+ * Feb 2018: First implementation released. Consider this beta software for now.
+
+# Usage
+
+This package provides a low level interface that allows to compress single independent blocks. 
+
+Each block is separate, and there is no built in integrity checks. 
+This means that the caller should keep track of block sizes and also do checksums if needed.  
+
+Compressing a block is done via the [`Compress`](https://godoc.org/github.com/klauspost/compress/fse#Compress) function.
+You must provide input and will receive the output and maybe an error.
+
+These error values can be returned:
+
+| Error               | Description                                                                 |
+|---------------------|-----------------------------------------------------------------------------|
+| `<nil>`             | Everything ok, output is returned                                           |
+| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
+| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
+| `(error)`           | An internal error occurred.                                                 |
+
+As can be seen above there are errors that will be returned even under normal operation so it is important to handle these.
+
+To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/fse#Scratch) object 
+that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
+object can be used for both.   
+
+Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
+you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
+
+Decompressing is done by calling the [`Decompress`](https://godoc.org/github.com/klauspost/compress/fse#Decompress) function.
+You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
+your input was likely corrupted. 
+
+It is important to note that a successful decoding does *not* mean your output matches your original input. 
+There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
+
+For more detailed usage, see examples in the [godoc documentation](https://godoc.org/github.com/klauspost/compress/fse#pkg-examples).
+
+# Performance
+
+A lot of factors are affecting speed. Block sizes and compressibility of the material are primary factors.  
+All compression functions are currently only running on the calling goroutine so only one core will be used per block.  
+
+The compressor is significantly faster if symbols are kept as small as possible. The highest byte value of the input
+is used to reduce some of the processing, so if all your input is above byte value 64 for instance, it may be 
+beneficial to transpose all your input values down by 64.   
+
+With moderate block sizes around 64k speed are typically 200MB/s per core for compression and 
+around 300MB/s decompression speed. 
+
+The same hardware typically does Huffman (deflate) encoding at 125MB/s and decompression at 100MB/s. 
+
+# Plans
+
+At one point, more internals will be exposed to facilitate more "expert" usage of the components. 
+
+A streaming interface is also likely to be implemented. Likely compatible with [FSE stream format](https://github.com/Cyan4973/FiniteStateEntropy/blob/dev/programs/fileio.c#L261).  
+
+# Contributing
+
+Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
 changes will likely not be accepted. If in doubt open an issue before writing the PR.  

vendor/github.com/klauspost/compress/huff0/README.md

@@ -1,89 +1,89 @@
-# Huff0 entropy compression
-
-This package provides Huff0 encoding and decoding as used in zstd.
-            
-[Huff0](https://github.com/Cyan4973/FiniteStateEntropy#new-generation-entropy-coders), 
-a Huffman codec designed for modern CPU, featuring OoO (Out of Order) operations on multiple ALU 
-(Arithmetic Logic Unit), achieving extremely fast compression and decompression speeds.
-
-This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
-This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
-but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
-
-* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/huff0)
-
-## News
-
-This is used as part of the [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression package.
-
-This ensures that most functionality is well tested.
-
-# Usage
-
-This package provides a low level interface that allows to compress single independent blocks. 
-
-Each block is separate, and there is no built in integrity checks. 
-This means that the caller should keep track of block sizes and also do checksums if needed.  
-
-Compressing a block is done via the [`Compress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress1X) and 
-[`Compress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress4X) functions.
-You must provide input and will receive the output and maybe an error.
-
-These error values can be returned:
-
-| Error               | Description                                                                 |
-|---------------------|-----------------------------------------------------------------------------|
-| `<nil>`             | Everything ok, output is returned                                           |
-| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
-| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
-| `ErrTooBig`         | Returned if the input block exceeds the maximum allowed size (128 Kib)      |
-| `(error)`           | An internal error occurred.                                                 |
-
-
-As can be seen above some of there are errors that will be returned even under normal operation so it is important to handle these.
-
-To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object 
-that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
-object can be used for both.   
-
-Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
-you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
-
-The `Scratch` object will retain state that allows to re-use previous tables for encoding and decoding.  
-
-## Tables and re-use
-
-Huff0 allows for reusing tables from the previous block to save space if that is expected to give better/faster results. 
-
-The Scratch object allows you to set a [`ReusePolicy`](https://godoc.org/github.com/klauspost/compress/huff0#ReusePolicy) 
-that controls this behaviour. See the documentation for details. This can be altered between each block.
-
-Do however note that this information is *not* stored in the output block and it is up to the users of the package to
-record whether [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable) should be called,
-based on the boolean reported back from the CompressXX call. 
-
-If you want to store the table separate from the data, you can access them as `OutData` and `OutTable` on the 
-[`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object.
-
-## Decompressing
-
-The first part of decoding is to initialize the decoding table through [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable).
-This will initialize the decoding tables. 
-You can supply the complete block to `ReadTable` and it will return the data part of the block 
-which can be given to the decompressor. 
-
-Decompressing is done by calling the [`Decompress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress1X) 
-or [`Decompress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress4X) function.
-
-For concurrently decompressing content with a fixed table a stateless [`Decoder`](https://godoc.org/github.com/klauspost/compress/huff0#Decoder) can be requested which will remain correct as long as the scratch is unchanged. The capacity of the provided slice indicates the expected output size.
-
-You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
-your input was likely corrupted. 
-
-It is important to note that a successful decoding does *not* mean your output matches your original input. 
-There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
-
-# Contributing
-
-Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
-changes will likely not be accepted. If in doubt open an issue before writing the PR.
+# Huff0 entropy compression
+
+This package provides Huff0 encoding and decoding as used in zstd.
+            
+[Huff0](https://github.com/Cyan4973/FiniteStateEntropy#new-generation-entropy-coders), 
+a Huffman codec designed for modern CPU, featuring OoO (Out of Order) operations on multiple ALU 
+(Arithmetic Logic Unit), achieving extremely fast compression and decompression speeds.
+
+This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
+This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
+but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
+
+* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/huff0)
+
+## News
+
+This is used as part of the [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression package.
+
+This ensures that most functionality is well tested.
+
+# Usage
+
+This package provides a low level interface that allows to compress single independent blocks. 
+
+Each block is separate, and there is no built in integrity checks. 
+This means that the caller should keep track of block sizes and also do checksums if needed.  
+
+Compressing a block is done via the [`Compress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress1X) and 
+[`Compress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress4X) functions.
+You must provide input and will receive the output and maybe an error.
+
+These error values can be returned:
+
+| Error               | Description                                                                 |
+|---------------------|-----------------------------------------------------------------------------|
+| `<nil>`             | Everything ok, output is returned                                           |
+| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
+| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
+| `ErrTooBig`         | Returned if the input block exceeds the maximum allowed size (128 Kib)      |
+| `(error)`           | An internal error occurred.                                                 |
+
+
+As can be seen above some of there are errors that will be returned even under normal operation so it is important to handle these.
+
+To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object 
+that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
+object can be used for both.   
+
+Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
+you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
+
+The `Scratch` object will retain state that allows to re-use previous tables for encoding and decoding.  
+
+## Tables and re-use
+
+Huff0 allows for reusing tables from the previous block to save space if that is expected to give better/faster results. 
+
+The Scratch object allows you to set a [`ReusePolicy`](https://godoc.org/github.com/klauspost/compress/huff0#ReusePolicy) 
+that controls this behaviour. See the documentation for details. This can be altered between each block.
+
+Do however note that this information is *not* stored in the output block and it is up to the users of the package to
+record whether [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable) should be called,
+based on the boolean reported back from the CompressXX call. 
+
+If you want to store the table separate from the data, you can access them as `OutData` and `OutTable` on the 
+[`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object.
+
+## Decompressing
+
+The first part of decoding is to initialize the decoding table through [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable).
+This will initialize the decoding tables. 
+You can supply the complete block to `ReadTable` and it will return the data part of the block 
+which can be given to the decompressor. 
+
+Decompressing is done by calling the [`Decompress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress1X) 
+or [`Decompress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress4X) function.
+
+For concurrently decompressing content with a fixed table a stateless [`Decoder`](https://godoc.org/github.com/klauspost/compress/huff0#Decoder) can be requested which will remain correct as long as the scratch is unchanged. The capacity of the provided slice indicates the expected output size.
+
+You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
+your input was likely corrupted. 
+
+It is important to note that a successful decoding does *not* mean your output matches your original input. 
+There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
+
+# Contributing
+
+Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
+changes will likely not be accepted. If in doubt open an issue before writing the PR.

vendor/github.com/mattn/go-runewidth/runewidth.go

@@ -3,7 +3,6 @@ package runewidth
 import (
 	"os"
 	"strings"
-	"unicode/utf8"
 
 	"github.com/clipperhouse/uax29/v2/graphemes"
 )
@@ -24,48 +23,10 @@ var (
 	}
 )
 
-var (
-	zerowidth table // combining + nonprint merged for faster zero-width lookup
-	widewidth table // ambiguous + doublewidth merged for EA path
-)
-
 func init() {
-	zerowidth = mergeIntervals(combining, nonprint)
-	widewidth = mergeIntervals(ambiguous, doublewidth)
 	handleEnv()
 }
 
-func mergeIntervals(t1, t2 table) table {
-	merged := make(table, 0, len(t1)+len(t2))
-	i, j := 0, 0
-	for i < len(t1) && j < len(t2) {
-		if t1[i].first <= t2[j].first {
-			merged = append(merged, t1[i])
-			i++
-		} else {
-			merged = append(merged, t2[j])
-			j++
-		}
-	}
-	merged = append(merged, t1[i:]...)
-	merged = append(merged, t2[j:]...)
-	if len(merged) == 0 {
-		return merged
-	}
-	result := merged[:1]
-	for _, iv := range merged[1:] {
-		last := &result[len(result)-1]
-		if iv.first <= last.last+1 {
-			if iv.last > last.last {
-				last.last = iv.last
-			}
-		} else {
-			result = append(result, iv)
-		}
-	}
-	return result
-}
-
 func handleEnv() {
 	env := os.Getenv("RUNEWIDTH_EASTASIAN")
 	if env == "" {
@@ -90,6 +51,15 @@ type interval struct {
 
 type table []interval
 
+func inTables(r rune, ts ...table) bool {
+	for _, t := range ts {
+		if inTable(r, t) {
+			return true
+		}
+	}
+	return false
+}
+
 func inTable(r rune, t table) bool {
 	if r < t[0].first {
 		return false
@@ -160,7 +130,9 @@ func (c *Condition) RuneWidth(r rune) int {
 			return 0
 		case r < 0x300:
 			return 1
-		case inTable(r, zerowidth):
+		case inTable(r, narrow):
+			return 1
+		case inTables(r, nonprint, combining):
 			return 0
 		case inTable(r, doublewidth):
 			return 2
@@ -169,13 +141,13 @@ func (c *Condition) RuneWidth(r rune) int {
 		}
 	} else {
 		switch {
-		case inTable(r, zerowidth):
+		case inTables(r, nonprint, combining):
 			return 0
 		case inTable(r, narrow):
 			return 1
-		case inTable(r, widewidth):
+		case inTables(r, ambiguous, doublewidth):
 			return 2
-		case !c.StrictEmojiNeutral && inTable(r, emoji):
+		case !c.StrictEmojiNeutral && inTables(r, ambiguous, emoji, narrow):
 			return 2
 		default:
 			return 1
@@ -206,22 +178,6 @@ func (c *Condition) CreateLUT() {
 
 // StringWidth return width as you can see
 func (c *Condition) StringWidth(s string) (width int) {
-	if len(s) > 0 && len(s) <= utf8.UTFMax {
-		r, size := utf8.DecodeRuneInString(s)
-		if size == len(s) {
-			return c.RuneWidth(r)
-		}
-	}
-	// ASCII fast path: no grapheme clustering needed for pure ASCII
-	if isAllASCII(s) {
-		for i := 0; i < len(s); i++ {
-			b := s[i]
-			if b >= 0x20 && b != 0x7F {
-				width++
-			}
-		}
-		return
-	}
 	g := graphemes.FromString(s)
 	for g.Next() {
 		var chWidth int
@@ -236,15 +192,6 @@ func (c *Condition) StringWidth(s string) (width int) {
 	return
 }
 
-func isAllASCII(s string) bool {
-	for i := 0; i < len(s); i++ {
-		if s[i] >= 0x80 {
-			return false
-		}
-	}
-	return true
-}
-
 // Truncate return string truncated with w cells
 func (c *Condition) Truncate(s string, w int, tail string) string {
 	if c.StringWidth(s) <= w {
@@ -310,25 +257,24 @@ func (c *Condition) TruncateLeft(s string, w int, prefix string) string {
 // Wrap return string wrapped with w cells
 func (c *Condition) Wrap(s string, w int) string {
 	width := 0
-	var out strings.Builder
-	out.Grow(len(s) + len(s)/w + 1)
+	out := ""
 	for _, r := range s {
 		cw := c.RuneWidth(r)
 		if r == '\n' {
-			out.WriteRune(r)
+			out += string(r)
 			width = 0
 			continue
 		} else if width+cw > w {
-			out.WriteByte('\n')
+			out += "\n"
 			width = 0
-			out.WriteRune(r)
+			out += string(r)
 			width += cw
 			continue
 		}
-		out.WriteRune(r)
+		out += string(r)
 		width += cw
 	}
-	return out.String()
+	return out
 }
 
 // FillLeft return string filled in left by spaces in w cells
@@ -367,7 +313,7 @@ func RuneWidth(r rune) int {
 
 // IsAmbiguousWidth returns whether is ambiguous width or not.
 func IsAmbiguousWidth(r rune) bool {
-	return inTable(r, private) || inTable(r, ambiguous)
+	return inTables(r, private, ambiguous)
 }
 
 // IsCombiningWidth returns whether is combining width or not.

vendor/github.com/moby/go-archive/archive.go

@@ -36,6 +36,10 @@ import (
 const ImpliedDirectoryMode = 0o755
 
 type (
+	// Compression is the state represents if compressed or not.
+	//
+	// Deprecated: use [compression.Compression].
+	Compression = compression.Compression
 	// WhiteoutFormat is the format of whiteouts unpacked
 	WhiteoutFormat int
 
@@ -91,6 +95,14 @@ func NewDefaultArchiver() *Archiver {
 // in order for the test to pass.
 type breakoutError error
 
+const (
+	Uncompressed = compression.None  // Deprecated: use [compression.None].
+	Bzip2        = compression.Bzip2 // Deprecated: use [compression.Bzip2].
+	Gzip         = compression.Gzip  // Deprecated: use [compression.Gzip].
+	Xz           = compression.Xz    // Deprecated: use [compression.Xz].
+	Zstd         = compression.Zstd  // Deprecated: use [compression.Zstd].
+)
+
 const (
 	AUFSWhiteoutFormat    WhiteoutFormat = 0 // AUFSWhiteoutFormat is the default format for whiteouts
 	OverlayWhiteoutFormat WhiteoutFormat = 1 // OverlayWhiteoutFormat formats whiteout according to the overlay standard.
@@ -114,6 +126,27 @@ func IsArchivePath(path string) bool {
 	return err == nil
 }
 
+// DetectCompression detects the compression algorithm of the source.
+//
+// Deprecated: use [compression.Detect].
+func DetectCompression(source []byte) compression.Compression {
+	return compression.Detect(source)
+}
+
+// DecompressStream decompresses the archive and returns a ReaderCloser with the decompressed archive.
+//
+// Deprecated: use [compression.DecompressStream].
+func DecompressStream(archive io.Reader) (io.ReadCloser, error) {
+	return compression.DecompressStream(archive)
+}
+
+// CompressStream compresses the dest with specified compression algorithm.
+//
+// Deprecated: use [compression.CompressStream].
+func CompressStream(dest io.Writer, comp compression.Compression) (io.WriteCloser, error) {
+	return compression.CompressStream(dest, comp)
+}
+
 // TarModifierFunc is a function that can be passed to ReplaceFileTarWrapper to
 // modify the contents or header of an entry in the archive. If the file already
 // exists in the archive the TarModifierFunc will be called with the Header and
@@ -202,6 +235,13 @@ func ReplaceFileTarWrapper(inputTarStream io.ReadCloser, mods map[string]TarModi
 	return pipeReader
 }
 
+// FileInfoHeaderNoLookups creates a partially-populated tar.Header from fi.
+//
+// Deprecated: use [tarheader.FileInfoHeaderNoLookups].
+func FileInfoHeaderNoLookups(fi os.FileInfo, link string) (*tar.Header, error) {
+	return tarheader.FileInfoHeaderNoLookups(fi, link)
+}
+
 // FileInfoHeader creates a populated Header from fi.
 //
 // Compared to the archive/tar package, this function fills in less information

vendor/github.com/moby/go-archive/xattr_supported_unix.go

@@ -1,4 +1,4 @@
-//go:build darwin || freebsd || netbsd
+//go:build !linux && !windows
 
 package archive
 

vendor/github.com/pjbgf/sha1cd/Dockerfile.arm

@@ -1,4 +1,4 @@
-FROM golang:1.25@sha256:31c1e53dfc1cc2d269deec9c83f58729fa3c53dc9a576f6426109d1e319e9e9a
+FROM golang:1.26@sha256:f96cc555eb8db430159a3aa6797cd5bae561945b7b0fe7d0e284c63a3b291609
 
 ENV GOOS=linux
 ENV GOARCH=arm