e358d9
From be1eb6f70fb40e45096b69aeb048d54c526a4a8f Mon Sep 17 00:00:00 2001
e358d9
From: Valentin Rothberg <rothberg@redhat.com>
e358d9
Date: Thu, 6 Feb 2020 09:49:15 +0100
e358d9
Subject: [PATCH] [1.11-rhel] update github.com/containers/image
e358d9
e358d9
Note that this includes fixes for
e358d9
https://access.redhat.com/security/cve/CVE-2020-1702.
e358d9
e358d9
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
e358d9
---
e358d9
 go.mod                                        |  2 +-
e358d9
 go.sum                                        |  2 +
e358d9
 .../image/v5/docker/docker_client.go          |  6 +-
e358d9
 .../image/v5/docker/docker_image_dest.go      |  3 +-
e358d9
 .../image/v5/docker/docker_image_src.go       | 10 ++--
e358d9
 .../image/v5/docker/tarfile/dest.go           |  3 +-
e358d9
 .../containers/image/v5/docker/tarfile/src.go |  9 +--
e358d9
 .../image/v5/image/docker_schema2.go          |  4 +-
e358d9
 .../containers/image/v5/image/oci.go          |  4 +-
e358d9
 .../image/v5/internal/iolimits/iolimits.go    | 60 +++++++++++++++++++
e358d9
 .../image/v5/openshift/openshift.go           |  4 +-
e358d9
 vendor/modules.txt                            |  3 +-
e358d9
 12 files changed, 89 insertions(+), 21 deletions(-)
e358d9
 create mode 100644 vendor/github.com/containers/image/v5/internal/iolimits/iolimits.go
e358d9
e358d9
diff --git a/go.mod b/go.mod
e358d9
index 684b00ff5..b94792238 100644
e358d9
--- a/go.mod
e358d9
+++ b/go.mod
e358d9
@@ -5,7 +5,7 @@ go 1.12
e358d9
 require (
e358d9
 	github.com/blang/semver v3.5.0+incompatible // indirect
e358d9
 	github.com/containernetworking/cni v0.7.1
e358d9
-	github.com/containers/image/v5 v5.0.0
e358d9
+	github.com/containers/image/v5 v5.0.1-0.20200205124631-82291c45f2b0
e358d9
 	github.com/containers/storage v1.14.0
e358d9
 	github.com/cyphar/filepath-securejoin v0.2.2
e358d9
 	github.com/docker/distribution v2.7.1+incompatible
e358d9
diff --git a/go.sum b/go.sum
e358d9
index 1cce3ff7e..ef8729952 100644
e358d9
--- a/go.sum
e358d9
+++ b/go.sum
e358d9
@@ -54,6 +54,8 @@ github.com/containers/image/v4 v4.0.1 h1:idNGHChj0Pyv3vLrxul2oSVMZLeFqpoq3CjLeVg
e358d9
 github.com/containers/image/v4 v4.0.1/go.mod h1:0ASJH1YgJiX/eqFZObqepgsvIA4XjCgpyfwn9pDGafA=
e358d9
 github.com/containers/image/v5 v5.0.0 h1:arnXgbt1ucsC/ndtSpiQY87rA0UjhF+/xQnPzqdBDn4=
e358d9
 github.com/containers/image/v5 v5.0.0/go.mod h1:MgiLzCfIeo8lrHi+4Lb8HP+rh513sm0Mlk6RrhjFOLY=
e358d9
+github.com/containers/image/v5 v5.0.1-0.20200205124631-82291c45f2b0 h1:iV4aHKRoPcHp5BISsuiPMyaCjGJfLKp/FUMAG1NeqvE=
e358d9
+github.com/containers/image/v5 v5.0.1-0.20200205124631-82291c45f2b0/go.mod h1:MgiLzCfIeo8lrHi+4Lb8HP+rh513sm0Mlk6RrhjFOLY=
e358d9
 github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b h1:Q8ePgVfHDplZ7U33NwHZkrVELsZP5fYj9pM5WBZB2GE=
e358d9
 github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
e358d9
 github.com/containers/storage v1.13.4 h1:j0bBaJDKbUHtAW1MXPFnwXJtqcH+foWeuXK1YaBV5GA=
e358d9
diff --git a/vendor/github.com/containers/image/v5/docker/docker_client.go b/vendor/github.com/containers/image/v5/docker/docker_client.go
e358d9
index 0b012c703..bff077a40 100644
e358d9
--- a/vendor/github.com/containers/image/v5/docker/docker_client.go
e358d9
+++ b/vendor/github.com/containers/image/v5/docker/docker_client.go
e358d9
@@ -6,7 +6,6 @@ import (
e358d9
 	"encoding/json"
e358d9
 	"fmt"
e358d9
 	"io"
e358d9
-	"io/ioutil"
e358d9
 	"net/http"
e358d9
 	"net/url"
e358d9
 	"os"
e358d9
@@ -17,6 +16,7 @@ import (
e358d9
 	"time"
e358d9
 
e358d9
 	"github.com/containers/image/v5/docker/reference"
e358d9
+	"github.com/containers/image/v5/internal/iolimits"
e358d9
 	"github.com/containers/image/v5/pkg/docker/config"
e358d9
 	"github.com/containers/image/v5/pkg/sysregistriesv2"
e358d9
 	"github.com/containers/image/v5/pkg/tlsclientconfig"
e358d9
@@ -597,7 +597,7 @@ func (c *dockerClient) getBearerToken(ctx context.Context, challenge challenge,
e358d9
 	default:
e358d9
 		return nil, errors.Errorf("unexpected http code: %d (%s), URL: %s", res.StatusCode, http.StatusText(res.StatusCode), authReq.URL)
e358d9
 	}
e358d9
-	tokenBlob, err := ioutil.ReadAll(res.Body)
e358d9
+	tokenBlob, err := iolimits.ReadAtMost(res.Body, iolimits.MaxAuthTokenBodySize)
e358d9
 	if err != nil {
e358d9
 		return nil, err
e358d9
 	}
e358d9
@@ -690,7 +690,7 @@ func (c *dockerClient) getExtensionsSignatures(ctx context.Context, ref dockerRe
e358d9
 		return nil, errors.Wrapf(clientLib.HandleErrorResponse(res), "Error downloading signatures for %s in %s", manifestDigest, ref.ref.Name())
e358d9
 	}
e358d9
 
e358d9
-	body, err := ioutil.ReadAll(res.Body)
e358d9
+	body, err := iolimits.ReadAtMost(res.Body, iolimits.MaxSignatureListBodySize)
e358d9
 	if err != nil {
e358d9
 		return nil, err
e358d9
 	}
e358d9
diff --git a/vendor/github.com/containers/image/v5/docker/docker_image_dest.go b/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
e358d9
index 417d97aec..ce8a1f357 100644
e358d9
--- a/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
e358d9
+++ b/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
e358d9
@@ -15,6 +15,7 @@ import (
e358d9
 	"strings"
e358d9
 
e358d9
 	"github.com/containers/image/v5/docker/reference"
e358d9
+	"github.com/containers/image/v5/internal/iolimits"
e358d9
 	"github.com/containers/image/v5/manifest"
e358d9
 	"github.com/containers/image/v5/pkg/blobinfocache/none"
e358d9
 	"github.com/containers/image/v5/types"
e358d9
@@ -620,7 +621,7 @@ sigExists:
e358d9
 		}
e358d9
 		defer res.Body.Close()
e358d9
 		if res.StatusCode != http.StatusCreated {
e358d9
-			body, err := ioutil.ReadAll(res.Body)
e358d9
+			body, err := iolimits.ReadAtMost(res.Body, iolimits.MaxErrorBodySize)
e358d9
 			if err == nil {
e358d9
 				logrus.Debugf("Error body %s", string(body))
e358d9
 			}
e358d9
diff --git a/vendor/github.com/containers/image/v5/docker/docker_image_src.go b/vendor/github.com/containers/image/v5/docker/docker_image_src.go
e358d9
index 35beb30e5..5436d9b7d 100644
e358d9
--- a/vendor/github.com/containers/image/v5/docker/docker_image_src.go
e358d9
+++ b/vendor/github.com/containers/image/v5/docker/docker_image_src.go
e358d9
@@ -12,6 +12,7 @@ import (
e358d9
 	"strconv"
e358d9
 
e358d9
 	"github.com/containers/image/v5/docker/reference"
e358d9
+	"github.com/containers/image/v5/internal/iolimits"
e358d9
 	"github.com/containers/image/v5/manifest"
e358d9
 	"github.com/containers/image/v5/pkg/sysregistriesv2"
e358d9
 	"github.com/containers/image/v5/types"
e358d9
@@ -156,7 +157,8 @@ func (s *dockerImageSource) fetchManifest(ctx context.Context, tagOrDigest strin
e358d9
 	if res.StatusCode != http.StatusOK {
e358d9
 		return nil, "", errors.Wrapf(client.HandleErrorResponse(res), "Error reading manifest %s in %s", tagOrDigest, s.ref.ref.Name())
e358d9
 	}
e358d9
-	manblob, err := ioutil.ReadAll(res.Body)
e358d9
+
e358d9
+	manblob, err := iolimits.ReadAtMost(res.Body, iolimits.MaxManifestBodySize)
e358d9
 	if err != nil {
e358d9
 		return nil, "", err
e358d9
 	}
e358d9
@@ -342,7 +344,7 @@ func (s *dockerImageSource) getOneSignature(ctx context.Context, url *url.URL) (
e358d9
 		} else if res.StatusCode != http.StatusOK {
e358d9
 			return nil, false, errors.Errorf("Error reading signature from %s: status %d (%s)", url.String(), res.StatusCode, http.StatusText(res.StatusCode))
e358d9
 		}
e358d9
-		sig, err := ioutil.ReadAll(res.Body)
e358d9
+		sig, err := iolimits.ReadAtMost(res.Body, iolimits.MaxSignatureBodySize)
e358d9
 		if err != nil {
e358d9
 			return nil, false, err
e358d9
 		}
e358d9
@@ -401,7 +403,7 @@ func deleteImage(ctx context.Context, sys *types.SystemContext, ref dockerRefere
e358d9
 		return err
e358d9
 	}
e358d9
 	defer get.Body.Close()
e358d9
-	manifestBody, err := ioutil.ReadAll(get.Body)
e358d9
+	manifestBody, err := iolimits.ReadAtMost(get.Body, iolimits.MaxManifestBodySize)
e358d9
 	if err != nil {
e358d9
 		return err
e358d9
 	}
e358d9
@@ -424,7 +426,7 @@ func deleteImage(ctx context.Context, sys *types.SystemContext, ref dockerRefere
e358d9
 	}
e358d9
 	defer delete.Body.Close()
e358d9
 
e358d9
-	body, err := ioutil.ReadAll(delete.Body)
e358d9
+	body, err := iolimits.ReadAtMost(delete.Body, iolimits.MaxErrorBodySize)
e358d9
 	if err != nil {
e358d9
 		return err
e358d9
 	}
e358d9
diff --git a/vendor/github.com/containers/image/v5/docker/tarfile/dest.go b/vendor/github.com/containers/image/v5/docker/tarfile/dest.go
e358d9
index b02c60bb3..9748ca112 100644
e358d9
--- a/vendor/github.com/containers/image/v5/docker/tarfile/dest.go
e358d9
+++ b/vendor/github.com/containers/image/v5/docker/tarfile/dest.go
e358d9
@@ -13,6 +13,7 @@ import (
e358d9
 	"time"
e358d9
 
e358d9
 	"github.com/containers/image/v5/docker/reference"
e358d9
+	"github.com/containers/image/v5/internal/iolimits"
e358d9
 	"github.com/containers/image/v5/internal/tmpdir"
e358d9
 	"github.com/containers/image/v5/manifest"
e358d9
 	"github.com/containers/image/v5/types"
e358d9
@@ -135,7 +136,7 @@ func (d *Destination) PutBlob(ctx context.Context, stream io.Reader, inputInfo t
e358d9
 	}
e358d9
 
e358d9
 	if isConfig {
e358d9
-		buf, err := ioutil.ReadAll(stream)
e358d9
+		buf, err := iolimits.ReadAtMost(stream, iolimits.MaxConfigBodySize)
e358d9
 		if err != nil {
e358d9
 			return types.BlobInfo{}, errors.Wrap(err, "Error reading Config file stream")
e358d9
 		}
e358d9
diff --git a/vendor/github.com/containers/image/v5/docker/tarfile/src.go b/vendor/github.com/containers/image/v5/docker/tarfile/src.go
e358d9
index ad0a3d2cb..bbf604da6 100644
e358d9
--- a/vendor/github.com/containers/image/v5/docker/tarfile/src.go
e358d9
+++ b/vendor/github.com/containers/image/v5/docker/tarfile/src.go
e358d9
@@ -11,6 +11,7 @@ import (
e358d9
 	"path"
e358d9
 	"sync"
e358d9
 
e358d9
+	"github.com/containers/image/v5/internal/iolimits"
e358d9
 	"github.com/containers/image/v5/internal/tmpdir"
e358d9
 	"github.com/containers/image/v5/manifest"
e358d9
 	"github.com/containers/image/v5/pkg/compression"
e358d9
@@ -187,13 +188,13 @@ func findTarComponent(inputFile io.Reader, path string) (*tar.Reader, *tar.Heade
e358d9
 }
e358d9
 
e358d9
 // readTarComponent returns full contents of componentPath.
e358d9
-func (s *Source) readTarComponent(path string) ([]byte, error) {
e358d9
+func (s *Source) readTarComponent(path string, limit int) ([]byte, error) {
e358d9
 	file, err := s.openTarComponent(path)
e358d9
 	if err != nil {
e358d9
 		return nil, errors.Wrapf(err, "Error loading tar component %s", path)
e358d9
 	}
e358d9
 	defer file.Close()
e358d9
-	bytes, err := ioutil.ReadAll(file)
e358d9
+	bytes, err := iolimits.ReadAtMost(file, limit)
e358d9
 	if err != nil {
e358d9
 		return nil, err
e358d9
 	}
e358d9
@@ -224,7 +225,7 @@ func (s *Source) ensureCachedDataIsPresentPrivate() error {
e358d9
 	}
e358d9
 
e358d9
 	// Read and parse config.
e358d9
-	configBytes, err := s.readTarComponent(tarManifest[0].Config)
e358d9
+	configBytes, err := s.readTarComponent(tarManifest[0].Config, iolimits.MaxConfigBodySize)
e358d9
 	if err != nil {
e358d9
 		return err
e358d9
 	}
e358d9
@@ -250,7 +251,7 @@ func (s *Source) ensureCachedDataIsPresentPrivate() error {
e358d9
 // loadTarManifest loads and decodes the manifest.json.
e358d9
 func (s *Source) loadTarManifest() ([]ManifestItem, error) {
e358d9
 	// FIXME? Do we need to deal with the legacy format?
e358d9
-	bytes, err := s.readTarComponent(manifestFileName)
e358d9
+	bytes, err := s.readTarComponent(manifestFileName, iolimits.MaxTarFileManifestSize)
e358d9
 	if err != nil {
e358d9
 		return nil, err
e358d9
 	}
e358d9
diff --git a/vendor/github.com/containers/image/v5/image/docker_schema2.go b/vendor/github.com/containers/image/v5/image/docker_schema2.go
e358d9
index 254c13f78..29c5047d7 100644
e358d9
--- a/vendor/github.com/containers/image/v5/image/docker_schema2.go
e358d9
+++ b/vendor/github.com/containers/image/v5/image/docker_schema2.go
e358d9
@@ -7,10 +7,10 @@ import (
e358d9
 	"encoding/hex"
e358d9
 	"encoding/json"
e358d9
 	"fmt"
e358d9
-	"io/ioutil"
e358d9
 	"strings"
e358d9
 
e358d9
 	"github.com/containers/image/v5/docker/reference"
e358d9
+	"github.com/containers/image/v5/internal/iolimits"
e358d9
 	"github.com/containers/image/v5/manifest"
e358d9
 	"github.com/containers/image/v5/pkg/blobinfocache/none"
e358d9
 	"github.com/containers/image/v5/types"
e358d9
@@ -102,7 +102,7 @@ func (m *manifestSchema2) ConfigBlob(ctx context.Context) ([]byte, error) {
e358d9
 			return nil, err
e358d9
 		}
e358d9
 		defer stream.Close()
e358d9
-		blob, err := ioutil.ReadAll(stream)
e358d9
+		blob, err := iolimits.ReadAtMost(stream, iolimits.MaxConfigBodySize)
e358d9
 		if err != nil {
e358d9
 			return nil, err
e358d9
 		}
e358d9
diff --git a/vendor/github.com/containers/image/v5/image/oci.go b/vendor/github.com/containers/image/v5/image/oci.go
e358d9
index 18a38d463..406da262f 100644
e358d9
--- a/vendor/github.com/containers/image/v5/image/oci.go
e358d9
+++ b/vendor/github.com/containers/image/v5/image/oci.go
e358d9
@@ -4,9 +4,9 @@ import (
e358d9
 	"context"
e358d9
 	"encoding/json"
e358d9
 	"fmt"
e358d9
-	"io/ioutil"
e358d9
 
e358d9
 	"github.com/containers/image/v5/docker/reference"
e358d9
+	"github.com/containers/image/v5/internal/iolimits"
e358d9
 	"github.com/containers/image/v5/manifest"
e358d9
 	"github.com/containers/image/v5/pkg/blobinfocache/none"
e358d9
 	"github.com/containers/image/v5/types"
e358d9
@@ -67,7 +67,7 @@ func (m *manifestOCI1) ConfigBlob(ctx context.Context) ([]byte, error) {
e358d9
 			return nil, err
e358d9
 		}
e358d9
 		defer stream.Close()
e358d9
-		blob, err := ioutil.ReadAll(stream)
e358d9
+		blob, err := iolimits.ReadAtMost(stream, iolimits.MaxConfigBodySize)
e358d9
 		if err != nil {
e358d9
 			return nil, err
e358d9
 		}
e358d9
diff --git a/vendor/github.com/containers/image/v5/internal/iolimits/iolimits.go b/vendor/github.com/containers/image/v5/internal/iolimits/iolimits.go
e358d9
new file mode 100644
e358d9
index 000000000..3fed1995c
e358d9
--- /dev/null
e358d9
+++ b/vendor/github.com/containers/image/v5/internal/iolimits/iolimits.go
e358d9
@@ -0,0 +1,60 @@
e358d9
+package iolimits
e358d9
+
e358d9
+import (
e358d9
+	"io"
e358d9
+	"io/ioutil"
e358d9
+
e358d9
+	"github.com/pkg/errors"
e358d9
+)
e358d9
+
e358d9
+// All constants below are intended to be used as limits for `ReadAtMost`. The
e358d9
+// immediate use-case for limiting the size of in-memory copied data is to
e358d9
+// protect against OOM DOS attacks as described inCVE-2020-1702. Instead of
e358d9
+// copying data until running out of memory, we error out after hitting the
e358d9
+// specified limit.
e358d9
+const (
e358d9
+	// megaByte denotes one megabyte and is intended to be used as a limit in
e358d9
+	// `ReadAtMost`.
e358d9
+	megaByte = 1 << 20
e358d9
+	// MaxManifestBodySize is the maximum allowed size of a manifest. The limit
e358d9
+	// of 4 MB aligns with the one of a Docker registry:
e358d9
+	// https://github.com/docker/distribution/blob/a8371794149d1d95f1e846744b05c87f2f825e5a/registry/handlers/manifests.go#L30
e358d9
+	MaxManifestBodySize = 4 * megaByte
e358d9
+	// MaxAuthTokenBodySize is the maximum allowed size of an auth token.
e358d9
+	// The limit of 1 MB is considered to be greatly sufficient.
e358d9
+	MaxAuthTokenBodySize = megaByte
e358d9
+	// MaxSignatureListBodySize is the maximum allowed size of a signature list.
e358d9
+	// The limit of 4 MB is considered to be greatly sufficient.
e358d9
+	MaxSignatureListBodySize = 4 * megaByte
e358d9
+	// MaxSignatureBodySize is the maximum allowed size of a signature.
e358d9
+	// The limit of 4 MB is considered to be greatly sufficient.
e358d9
+	MaxSignatureBodySize = 4 * megaByte
e358d9
+	// MaxErrorBodySize is the maximum allowed size of an error-response body.
e358d9
+	// The limit of 1 MB is considered to be greatly sufficient.
e358d9
+	MaxErrorBodySize = megaByte
e358d9
+	// MaxConfigBodySize is the maximum allowed size of a config blob.
e358d9
+	// The limit of 4 MB is considered to be greatly sufficient.
e358d9
+	MaxConfigBodySize = 4 * megaByte
e358d9
+	// MaxOpenShiftStatusBody is the maximum allowed size of an OpenShift status body.
e358d9
+	// The limit of 4 MB is considered to be greatly sufficient.
e358d9
+	MaxOpenShiftStatusBody = 4 * megaByte
e358d9
+	// MaxTarFileManifestSize is the maximum allowed size of a (docker save)-like manifest (which may contain multiple images)
e358d9
+	// The limit of 1 MB is considered to be greatly sufficient.
e358d9
+	MaxTarFileManifestSize = megaByte
e358d9
+)
e358d9
+
e358d9
+// ReadAtMost reads from reader and errors out if the specified limit (in bytes) is exceeded.
e358d9
+func ReadAtMost(reader io.Reader, limit int) ([]byte, error) {
e358d9
+	limitedReader := io.LimitReader(reader, int64(limit+1))
e358d9
+
e358d9
+	res, err := ioutil.ReadAll(limitedReader)
e358d9
+	if err != nil {
e358d9
+		return nil, err
e358d9
+	}
e358d9
+
e358d9
+	if len(res) > limit {
e358d9
+		return nil, errors.Errorf("exceeded maximum allowed size of %d bytes", limit)
e358d9
+	}
e358d9
+
e358d9
+	return res, nil
e358d9
+}
e358d9
diff --git a/vendor/github.com/containers/image/v5/openshift/openshift.go b/vendor/github.com/containers/image/v5/openshift/openshift.go
e358d9
index 016de4803..c37e1b751 100644
e358d9
--- a/vendor/github.com/containers/image/v5/openshift/openshift.go
e358d9
+++ b/vendor/github.com/containers/image/v5/openshift/openshift.go
e358d9
@@ -7,13 +7,13 @@ import (
e358d9
 	"encoding/json"
e358d9
 	"fmt"
e358d9
 	"io"
e358d9
-	"io/ioutil"
e358d9
 	"net/http"
e358d9
 	"net/url"
e358d9
 	"strings"
e358d9
 
e358d9
 	"github.com/containers/image/v5/docker"
e358d9
 	"github.com/containers/image/v5/docker/reference"
e358d9
+	"github.com/containers/image/v5/internal/iolimits"
e358d9
 	"github.com/containers/image/v5/manifest"
e358d9
 	"github.com/containers/image/v5/types"
e358d9
 	"github.com/containers/image/v5/version"
e358d9
@@ -102,7 +102,7 @@ func (c *openshiftClient) doRequest(ctx context.Context, method, path string, re
e358d9
 		return nil, err
e358d9
 	}
e358d9
 	defer res.Body.Close()
e358d9
-	body, err := ioutil.ReadAll(res.Body)
e358d9
+	body, err := iolimits.ReadAtMost(res.Body, iolimits.MaxOpenShiftStatusBody)
e358d9
 	if err != nil {
e358d9
 		return nil, err
e358d9
 	}
e358d9
diff --git a/vendor/modules.txt b/vendor/modules.txt
e358d9
index 840dae067..3f72f3f34 100644
e358d9
--- a/vendor/modules.txt
e358d9
+++ b/vendor/modules.txt
e358d9
@@ -48,7 +48,7 @@ github.com/containernetworking/cni/pkg/types
e358d9
 github.com/containernetworking/cni/pkg/types/020
e358d9
 github.com/containernetworking/cni/pkg/types/current
e358d9
 github.com/containernetworking/cni/pkg/version
e358d9
-# github.com/containers/image/v5 v5.0.0
e358d9
+# github.com/containers/image/v5 v5.0.1-0.20200205124631-82291c45f2b0
e358d9
 github.com/containers/image/v5/copy
e358d9
 github.com/containers/image/v5/directory
e358d9
 github.com/containers/image/v5/directory/explicitfilepath
e358d9
@@ -59,6 +59,7 @@ github.com/containers/image/v5/docker/policyconfiguration
e358d9
 github.com/containers/image/v5/docker/reference
e358d9
 github.com/containers/image/v5/docker/tarfile
e358d9
 github.com/containers/image/v5/image
e358d9
+github.com/containers/image/v5/internal/iolimits
e358d9
 github.com/containers/image/v5/internal/pkg/keyctl
e358d9
 github.com/containers/image/v5/internal/tmpdir
e358d9
 github.com/containers/image/v5/manifest