From 656e6d88715ccbd9c1a525476d8a343493dd45d4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Feb 2025 09:44:19 +0800 Subject: [PATCH 01/35] build(deps): Bump ossf/scorecard-action from 2.4.0 to 2.4.1 (#1191) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.0 to 2.4.1.
Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.1

What's Changed

Docs

New Contributors

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ossf/scorecard-action&package-manager=github_actions&previous-version=2.4.0&new-version=2.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 7ce7bfac5..41615d010 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -46,7 +46,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # tag=v2.4.0 + uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # tag=v2.4.1 with: results_file: results.sarif results_format: sarif From bf07f1a1f4cb55e77b7fb5904a67f808e72f6aca Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Feb 2025 09:45:22 +0800 Subject: [PATCH 02/35] build(deps): Bump github/codeql-action from 3.28.9 to 3.28.10 (#1189) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.9 to 3.28.10.
Release notes

Sourced from github/codeql-action's releases.

v3.28.10

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.10 - 21 Feb 2025

  • Update default CodeQL bundle version to 2.20.5. #2772
  • Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.28.10 - 21 Feb 2025

  • Update default CodeQL bundle version to 2.20.5. #2772
  • Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

3.28.9 - 07 Feb 2025

  • Update default CodeQL bundle version to 2.20.4. #2753

3.28.8 - 29 Jan 2025

  • Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

3.28.7 - 29 Jan 2025

No user facing changes.

3.28.6 - 27 Jan 2025

  • Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

3.28.5 - 24 Jan 2025

  • Update default CodeQL bundle version to 2.20.3. #2717

3.28.4 - 23 Jan 2025

No user facing changes.

3.28.3 - 22 Jan 2025

  • Update default CodeQL bundle version to 2.20.2. #2707
  • Fix an issue downloading the CodeQL Bundle from a GitHub Enterprise Server instance which occurred when the CodeQL Bundle had been synced to the instance using the CodeQL Action sync tool and the Actions runner did not have Zstandard installed. #2710
  • Uploading debug artifacts for CodeQL analysis is temporarily disabled. #2712

3.28.2 - 21 Jan 2025

No user facing changes.

3.28.1 - 10 Jan 2025

  • CodeQL Action v2 is now deprecated, and is no longer updated or supported. For better performance, improved security, and new features, upgrade to v3. For more information, see this changelog post. #2677

... (truncated)

Commits
  • b56ba49 Merge pull request #2778 from github/update-v3.28.10-9856c48b1
  • 60c9c77 Update changelog for v3.28.10
  • 9856c48 Merge pull request #2773 from github/redsun82/rust
  • 9572e09 Rust: fix log string
  • 1a52936 Rust: special case default setup
  • cf7e909 Merge pull request #2772 from github/update-bundle/codeql-bundle-v2.20.5
  • b7006aa Merge branch 'main' into update-bundle/codeql-bundle-v2.20.5
  • cfedae7 Rust: throw configuration errors if requested and not correctly enabled
  • 3971ed2 Merge branch 'main' into redsun82/rust
  • d38c6e6 Merge pull request #2775 from github/angelapwen/bump-octokit
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.28.9&new-version=3.28.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1cff301fb..f12d47e35 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,8 +49,8 @@ jobs: go-version: ${{ matrix.go-version }} check-latest: true - name: Initialize CodeQL - uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9 + uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 with: languages: go - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9 + uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 41615d010..85cfa0467 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -61,6 +61,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9 + uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 with: sarif_file: results.sarif From fb3d417453fed2cb150df3d5b591daf8f288256e Mon Sep 17 00:00:00 2001 From: Junjie Gao Date: Thu, 6 Mar 2025 13:54:14 +0800 Subject: [PATCH 03/35] fix: notify context cancellation when SIGINT is received (#1198) When a process is killed with a SIGINT system call (Ctrl+c), start a context cancellation for a graceful shutdown. Signed-off-by: Junjie Gao Signed-off-by: Patrick Zheng --- cmd/notation/main.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cmd/notation/main.go b/cmd/notation/main.go index 712668a9f..ca5299423 100644 --- a/cmd/notation/main.go +++ b/cmd/notation/main.go @@ -14,7 +14,9 @@ package main import ( + "context" "os" + "os/signal" "github.com/notaryproject/notation-go/dir" "github.com/notaryproject/notation/cmd/notation/cert" @@ -63,7 +65,10 @@ func main() { versionCommand(), inspectCommand(nil), ) - if err := cmd.Execute(); err != nil { + + ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt) + defer cancel() + if err := cmd.ExecuteContext(ctx); err != nil { os.Exit(1) } } From 72c58b088819049213302825081daf40eb5c459c Mon Sep 17 00:00:00 2001 From: Junjie Gao Date: Thu, 6 Mar 2025 13:57:06 +0800 Subject: [PATCH 04/35] fix: goreleaser deprecated options (#1201) Release pipeline with **warnings**: https://github.com/notaryproject/notation/actions/runs/13489436510/job/37685202798 Fix: - locked goreleaser version to v2 - added configuration `version: 2`: https://goreleaser.com/errors/version/?h=configuration+version#unsupported-configuration-version - updated deprecated - `format` option: https://goreleaser.com/deprecations/#archivesformat - `overrides.format` option: https://goreleaser.com/deprecations/#archivesformat_overridesformat Test: - tested release pipeline in forked repo --------- Signed-off-by: Junjie Gao Signed-off-by: Patrick Zheng --- .github/workflows/release-github.yml | 2 +- .goreleaser.yml | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml index 35df27825..8b805f5ce 100644 --- a/.github/workflows/release-github.yml +++ b/.github/workflows/release-github.yml @@ -49,7 +49,7 @@ jobs: uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1 with: distribution: goreleaser - version: latest + version: v2 args: release --clean env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.goreleaser.yml b/.goreleaser.yml index 86dbc2453..219e26cab 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -11,6 +11,7 @@ # See the License for the specific language governing permissions and # limitations under the License. +version: 2 builds: - main: ./cmd/notation id: notation @@ -37,10 +38,10 @@ builds: ldflags: - -s -w -X {{.ModulePath}}/internal/version.Version={{.Version}} -X {{.ModulePath}}/internal/version.GitCommit={{.FullCommit}} -X {{.ModulePath}}/internal/version.BuildMetadata= archives: - - format: tar.gz + - formats: [ 'tar.gz' ] format_overrides: - goos: windows - format: zip + formats: [ 'zip' ] files: - LICENSE release: From 6e0104b06057004680abee59120fee62e38882db Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:07:48 +0800 Subject: [PATCH 05/35] build(deps): Bump actions/upload-artifact from 4.6.0 to 4.6.1 (#1190) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 85cfa0467..e95e820f2 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -54,7 +54,7 @@ jobs: publish_results: true - name: "Upload artifact" - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # tag=v4.6.0 + uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # tag=v4.6.1 with: name: SARIF file path: results.sarif From 585cf6a0088eb900e4282a8571d64cf12ff20542 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:08:26 +0800 Subject: [PATCH 06/35] build(deps): Bump actions/cache from 4.2.0 to 4.2.2 (#1199) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0960a6c7e..03e2fa6d6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -38,7 +38,7 @@ jobs: - name: Check out code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Cache Go modules - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 id: go-mod-cache with: path: ~/go/pkg/mod From 75fc338ea4355727a377d5ab3ec92bf97147591d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:09:53 +0800 Subject: [PATCH 07/35] build(deps): Bump codecov/codecov-action from 5.3.1 to 5.4.0 (#1200) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 03e2fa6d6..64c1e41fb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -59,6 +59,6 @@ jobs: make e2e-covdata fi - name: Upload coverage to codecov.io - uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1 + uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} From ee4918b261ac2feacfb4aaffc3ed390d064ebd2a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:10:31 +0800 Subject: [PATCH 08/35] build(deps): Bump github/codeql-action from 3.28.10 to 3.28.11 (#1207) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f12d47e35..1c9d512ff 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,8 +49,8 @@ jobs: go-version: ${{ matrix.go-version }} check-latest: true - name: Initialize CodeQL - uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 + uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11 with: languages: go - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 + uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e95e820f2..f3d4fa7c7 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -61,6 +61,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 + uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11 with: sarif_file: results.sarif From 1b9b7462e7bda74831d6500cddf3c4722f88bb51 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:11:58 +0800 Subject: [PATCH 09/35] build(deps): Bump golang.org/x/term from 0.29.0 to 0.30.0 (#1209) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 5b37c5b79..f4073933d 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.9.1 github.com/spf13/pflag v1.0.6 - golang.org/x/term v0.29.0 + golang.org/x/term v0.30.0 oras.land/oras-go/v2 v2.5.0 ) @@ -29,5 +29,5 @@ require ( golang.org/x/crypto v0.33.0 // indirect golang.org/x/mod v0.23.0 // indirect golang.org/x/sync v0.10.0 // indirect - golang.org/x/sys v0.30.0 // indirect + golang.org/x/sys v0.31.0 // indirect ) diff --git a/go.sum b/go.sum index 43c63a466..00d998450 100644 --- a/go.sum +++ b/go.sum @@ -121,8 +121,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= -golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik= +golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -132,8 +132,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM= -golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU= -golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s= +golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y= +golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= From e5fa441b0e284ce44f741351b812a55fe69c56bf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:12:57 +0800 Subject: [PATCH 10/35] build(deps): Bump github.com/onsi/ginkgo/v2 from 2.22.2 to 2.23.0 in /test/e2e (#1211) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- test/e2e/go.mod | 6 +++--- test/e2e/go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/test/e2e/go.mod b/test/e2e/go.mod index b8d0a1ed5..53dbb3cb7 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -5,7 +5,7 @@ go 1.23 require ( github.com/notaryproject/notation-core-go v1.2.0 github.com/notaryproject/notation-go v1.3.1 - github.com/onsi/ginkgo/v2 v2.22.2 + github.com/onsi/ginkgo/v2 v2.23.0 github.com/onsi/gomega v1.36.2 github.com/opencontainers/image-spec v1.1.0 oras.land/oras-go/v2 v2.5.0 @@ -22,11 +22,11 @@ require ( github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect golang.org/x/crypto v0.33.0 // indirect - golang.org/x/net v0.33.0 // indirect + golang.org/x/net v0.35.0 // indirect golang.org/x/sync v0.11.0 // indirect golang.org/x/sys v0.30.0 // indirect golang.org/x/text v0.22.0 // indirect - golang.org/x/tools v0.28.0 // indirect + golang.org/x/tools v0.30.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/test/e2e/go.sum b/test/e2e/go.sum index c8ae423b6..b41904ceb 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -16,8 +16,8 @@ github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAy github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1SDX8YNv4Dg4= github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs= -github.com/onsi/ginkgo/v2 v2.22.2 h1:/3X8Panh8/WwhU/3Ssa6rCKqPLuAkVY2I0RoyDLySlU= -github.com/onsi/ginkgo/v2 v2.22.2/go.mod h1:oeMosUL+8LtarXBHu/c0bx2D/K9zyQ6uX3cTyztHwsk= +github.com/onsi/ginkgo/v2 v2.23.0 h1:FA1xjp8ieYDzlgS5ABTpdUDB7wtngggONc8a7ku2NqQ= +github.com/onsi/ginkgo/v2 v2.23.0/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM= github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8= github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= @@ -34,16 +34,16 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus= golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= -golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I= -golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4= +golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8= +golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk= golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w= golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM= golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= -golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8= -golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw= +golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY= +golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY= google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk= google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= From 6d23fd042c67252c2f4fe9095deb440852ca42d8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:44:34 +0800 Subject: [PATCH 11/35] build(deps): Bump github.com/opencontainers/image-spec from 1.1.0 to 1.1.1 (#1208) Bumps [github.com/opencontainers/image-spec](https://github.com/opencontainers/image-spec) from 1.1.0 to 1.1.1.
Release notes

Sourced from github.com/opencontainers/image-spec's releases.

v1.1.1

Vote Passed [+5 -0 nv1] - https://groups.google.com/a/opencontainers.org/g/dev/c/T-olx0jdT18 Release PR : opencontainers/image-spec#1247 Full Changelog: https://github.com/opencontainers/image-spec/compare/v1.1.0...v1.1.1

Commits
  • 147f9c1 Release v1.1.1
  • fbb4662 Merge pull request #1238 from mkenigs/wording-nit
  • 81e457e Fix grammar nit
  • 92353b0 Merge pull request #1225 from sudo-bmitch/pr-doc-go-version
  • 1a0b9f9 Merge pull request #1230 from sudo-bmitch/pr-layout-extensibility
  • f272635 Merge pull request #1228 from sudo-bmitch/pr-mixed-digest-algo
  • e0462ab Merge pull request #1229 from tianon/setup-go
  • cf536e3 Merge pull request #1227 from sudo-bmitch/pr-rm-project-doc
  • 60acaac Document extensibility of the image layout
  • 4dcf962 Document Go version policy
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/opencontainers/image-spec&package-manager=go_modules&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f4073933d..0883c8abe 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/notaryproject/notation-go v1.3.1 github.com/notaryproject/tspclient-go v1.0.0 github.com/opencontainers/go-digest v1.0.0 - github.com/opencontainers/image-spec v1.1.0 + github.com/opencontainers/image-spec v1.1.1 github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.9.1 github.com/spf13/pflag v1.0.6 diff --git a/go.sum b/go.sum index 00d998450..b3c06dd0c 100644 --- a/go.sum +++ b/go.sum @@ -48,8 +48,8 @@ github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1 github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= -github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug= -github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM= +github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= +github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= From d453b6ae0a94180714f6b05f9c0c3c9e468d35a0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:45:01 +0800 Subject: [PATCH 12/35] build(deps): Bump github.com/opencontainers/image-spec from 1.1.0 to 1.1.1 in /test/e2e (#1210) Bumps [github.com/opencontainers/image-spec](https://github.com/opencontainers/image-spec) from 1.1.0 to 1.1.1.
Release notes

Sourced from github.com/opencontainers/image-spec's releases.

v1.1.1

Vote Passed [+5 -0 nv1] - https://groups.google.com/a/opencontainers.org/g/dev/c/T-olx0jdT18 Release PR : opencontainers/image-spec#1247 Full Changelog: https://github.com/opencontainers/image-spec/compare/v1.1.0...v1.1.1

Commits
  • 147f9c1 Release v1.1.1
  • fbb4662 Merge pull request #1238 from mkenigs/wording-nit
  • 81e457e Fix grammar nit
  • 92353b0 Merge pull request #1225 from sudo-bmitch/pr-doc-go-version
  • 1a0b9f9 Merge pull request #1230 from sudo-bmitch/pr-layout-extensibility
  • f272635 Merge pull request #1228 from sudo-bmitch/pr-mixed-digest-algo
  • e0462ab Merge pull request #1229 from tianon/setup-go
  • cf536e3 Merge pull request #1227 from sudo-bmitch/pr-rm-project-doc
  • 60acaac Document extensibility of the image layout
  • 4dcf962 Document Go version policy
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/opencontainers/image-spec&package-manager=go_modules&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- test/e2e/go.mod | 2 +- test/e2e/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/test/e2e/go.mod b/test/e2e/go.mod index 53dbb3cb7..af4f09969 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -7,7 +7,7 @@ require ( github.com/notaryproject/notation-go v1.3.1 github.com/onsi/ginkgo/v2 v2.23.0 github.com/onsi/gomega v1.36.2 - github.com/opencontainers/image-spec v1.1.0 + github.com/opencontainers/image-spec v1.1.1 oras.land/oras-go/v2 v2.5.0 ) diff --git a/test/e2e/go.sum b/test/e2e/go.sum index b41904ceb..a3a7ff78d 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -22,8 +22,8 @@ github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8= github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= -github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug= -github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM= +github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= +github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= From 56d56a1707600f00f7ba98057e03308fdfee053c Mon Sep 17 00:00:00 2001 From: Patrick Zheng Date: Fri, 14 Mar 2025 15:56:38 +0800 Subject: [PATCH 13/35] fix: fix main function (#1223) Signed-off-by: Patrick Zheng --- cmd/notation/main.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/cmd/notation/main.go b/cmd/notation/main.go index ca5299423..395f0c201 100644 --- a/cmd/notation/main.go +++ b/cmd/notation/main.go @@ -25,7 +25,7 @@ import ( "github.com/spf13/cobra" ) -func main() { +func run() error { cmd := &cobra.Command{ Use: "notation", Short: "Notation - a tool to sign and verify artifacts", @@ -68,7 +68,11 @@ func main() { ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt) defer cancel() - if err := cmd.ExecuteContext(ctx); err != nil { + return cmd.ExecuteContext(ctx) +} + +func main() { + if err := run(); err != nil { os.Exit(1) } } From e28f460e560ea8cb3abe2e1a3a8142ba47f9f48d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 18 Mar 2025 10:23:28 +0800 Subject: [PATCH 14/35] build(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 in /test/e2e (#1220) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.35.0 to 0.36.0.
Commits
  • 85d1d54 go.mod: update golang.org/x dependencies
  • cde1dda proxy, http/httpproxy: do not mismatch IPv6 zone ids against hosts
  • fe7f039 publicsuffix: spruce up code gen and speed up PublicSuffix
  • 459513d internal/http3: move more common stream processing to genericConn
  • aad0180 http2: fix flakiness from t.Log when GOOS=js
  • b73e574 http2: don't log expected errors from writing invalid trailers
  • 5f45c77 internal/http3: make read-data tests usable for server handlers
  • 43c2540 http2, internal/httpcommon: reject userinfo in :authority
  • 1d78a08 http2, internal/httpcommon: factor out server header logic for h2/h3
  • 0d7dc54 quic: add Conn.ConnectionState
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/net&package-manager=go_modules&previous-version=0.35.0&new-version=0.36.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/notaryproject/notation/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- go.mod | 2 +- go.sum | 2 -- test/e2e/go.mod | 4 ++-- test/e2e/go.sum | 7 +++++++ 4 files changed, 10 insertions(+), 5 deletions(-) diff --git a/go.mod b/go.mod index 0883c8abe..4bac13956 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/notaryproject/notation -go 1.23 +go 1.23.0 require ( github.com/notaryproject/notation-core-go v1.2.0 diff --git a/go.sum b/go.sum index b3c06dd0c..555f0ddd5 100644 --- a/go.sum +++ b/go.sum @@ -12,8 +12,6 @@ github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl5 github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-ldap/ldap/v3 v3.4.10 h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJU= github.com/go-ldap/ldap/v3 v3.4.10/go.mod h1:JXh4Uxgi40P6E9rdsYqpUtbW46D9UTjJ9QSwGRznplY= -github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo= -github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= diff --git a/test/e2e/go.mod b/test/e2e/go.mod index af4f09969..aaaf3e2b0 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -21,8 +21,8 @@ require ( github.com/opencontainers/go-digest v1.0.0 // indirect github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect - golang.org/x/crypto v0.33.0 // indirect - golang.org/x/net v0.35.0 // indirect + golang.org/x/crypto v0.35.0 // indirect + golang.org/x/net v0.36.0 // indirect golang.org/x/sync v0.11.0 // indirect golang.org/x/sys v0.30.0 // indirect golang.org/x/text v0.22.0 // indirect diff --git a/test/e2e/go.sum b/test/e2e/go.sum index a3a7ff78d..3f8573bd1 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -32,10 +32,17 @@ github.com/veraison/go-cose v1.3.0 h1:2/H5w8kdSpQJyVtIhx8gmwPJ2uSz1PkyWFx0idbd7r github.com/veraison/go-cose v1.3.0/go.mod h1:df09OV91aHoQWLmy1KsDdYiagtXgyAwAl8vFeFn1gMc= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= +<<<<<<< HEAD golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus= golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8= golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk= +======= +golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs= +golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ= +golang.org/x/net v0.36.0 h1:vWF2fRbw4qslQsQzgFqZff+BItCvGFQqKzKIzx1rmoA= +golang.org/x/net v0.36.0/go.mod h1:bFmbeoIPfrw4sMHNhb4J9f6+tPziuGjq7Jk/38fxi1I= +>>>>>>> 3810ef3 (build(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 in /test/e2e (#1220)) golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w= golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= From 147f39baf63b1939c2e36feade857ee1af68edb0 Mon Sep 17 00:00:00 2001 From: Junjie Gao Date: Tue, 25 Mar 2025 08:23:01 +0800 Subject: [PATCH 15/35] fix: plugin error message (#1217) Examples: **When putting an arbitrary file into the plugin folder:** Before: ``` NAME DESCRIPTION VERSION CAPABILITIES ERROR azure-trustedsigning [] fork/exec /home/jj/.config/notation/plugins/azure-trustedsigning/notation-azure-trustedsigning: exec format error ``` After ``` NAME DESCRIPTION VERSION CAPABILITIES ERROR azure-trustedsigning [] plugin executable file `notation-azure-trustedsigning` is not executable. Use `notation plugin install` command to install the plugin. Please ensure that the plugin executable file is compatible with linux/amd64 ``` **When the plugin name is not followed the plugin spec:** Before ``` NAME DESCRIPTION VERSION CAPABILITIES ERROR azure-trustedsigning [] plugin executable file is either not found or inaccessible: stat /home/jj/.config/notation/plugins/azure-trustedsigning/notation-azure-trustedsigning: no such file or directory ``` After ``` NAME DESCRIPTION VERSION CAPABILITIES ERROR azure-trustedsigning [] plugin executable file `notation-azure-trustedsigning` not found. Use `notation plugin install` command to install the plugin. Each plugin executable must be placed in the $PLUGIN_DIRECTORY/{plugin-name} directory, with the executable named as 'notation-{plugin-name}'' ``` **When the notation plugin executable file is not executable:** Before/After are the same ``` NAME DESCRIPTION VERSION CAPABILITIES ERROR azure-trustedsigning [] fork/exec /home/jj/.config/notation/plugins/azure-trustedsigning/notation-azure-trustedsigning: permission denied ``` **When using an AMR64 arch of plugin file on an AMD64 machine:** Before: ``` NAME DESCRIPTION VERSION CAPABILITIES ERROR azure-trustedsigning [] fork/exec /home/jj/.config/notation/plugins/azure-trustedsigning/notation-azure-trustedsigning: exec format error ``` After: ``` NAME DESCRIPTION VERSION CAPABILITIES ERROR azure-trustedsigning [] plugin file `notation-azure-trustedsigning` is not executable. Use `notation plugin install` command to install the plugin. Please ensure that the plugin executable file is compatible with linux/amd64 ``` Resolves #704 --------- Signed-off-by: Junjie Gao Signed-off-by: Patrick Zheng --- cmd/notation/plugin/list.go | 35 +++++++++++++++++++++++++++--- go.mod | 2 +- go.sum | 5 +++++ test/e2e/suite/plugin/list.go | 40 +++++++++++++++++++++++++++++++++++ 4 files changed, 78 insertions(+), 4 deletions(-) diff --git a/cmd/notation/plugin/list.go b/cmd/notation/plugin/list.go index bfc3ebffe..95ddbd1bb 100644 --- a/cmd/notation/plugin/list.go +++ b/cmd/notation/plugin/list.go @@ -16,12 +16,16 @@ package plugin import ( "errors" "fmt" + "io/fs" "os" + "runtime" + "syscall" "text/tabwriter" "github.com/notaryproject/notation-go/dir" "github.com/notaryproject/notation-go/plugin" "github.com/notaryproject/notation-go/plugin/proto" + pluginFramework "github.com/notaryproject/notation-plugin-framework-go/plugin" "github.com/spf13/cobra" ) @@ -58,8 +62,8 @@ func listPlugins(command *cobra.Command) error { var pl plugin.Plugin var resp *proto.GetMetadataResponse - for _, n := range pluginNames { - pl, err = mgr.Get(command.Context(), n) + for _, pluginName := range pluginNames { + pl, err = mgr.Get(command.Context(), pluginName) metaData := &proto.GetMetadataResponse{} if err == nil { resp, err = pl.GetMetadata(command.Context(), &proto.GetMetadataRequest{}) @@ -68,7 +72,32 @@ func listPlugins(command *cobra.Command) error { } } fmt.Fprintf(tw, "%s\t%s\t%s\t%v\t%v\t\n", - n, metaData.Description, metaData.Version, metaData.Capabilities, err) + pluginName, metaData.Description, metaData.Version, metaData.Capabilities, userFriendlyError(pluginName, err)) } return tw.Flush() } + +// userFriendlyError optimizes the error message for the user. +func userFriendlyError(pluginName string, err error) error { + if err == nil { + return nil + } + var pathError *fs.PathError + if errors.As(err, &pathError) { + pluginFileName := pluginFramework.BinaryPrefix + pluginName + if runtime.GOOS == "windows" { + pluginFileName += ".exe" + } + + // for plugin does not exist + if errors.Is(pathError, fs.ErrNotExist) { + return fmt.Errorf("plugin executable file `%s` not found. Use `notation plugin install` command to install the plugin", pluginFileName) + } + + // for plugin is not executable + if pathError.Err == syscall.ENOEXEC { + return fmt.Errorf("plugin file `%s` is not executable. Use `notation plugin install` command to install the plugin. Please ensure that the plugin executable file is compatible with %s/%s", pluginFileName, runtime.GOOS, runtime.GOARCH) + } + } + return err +} diff --git a/go.mod b/go.mod index 4bac13956..dae53a6ff 100644 --- a/go.mod +++ b/go.mod @@ -5,6 +5,7 @@ go 1.23.0 require ( github.com/notaryproject/notation-core-go v1.2.0 github.com/notaryproject/notation-go v1.3.1 + github.com/notaryproject/notation-plugin-framework-go v1.0.0 github.com/notaryproject/tspclient-go v1.0.0 github.com/opencontainers/go-digest v1.0.0 github.com/opencontainers/image-spec v1.1.1 @@ -23,7 +24,6 @@ require ( github.com/golang-jwt/jwt/v4 v4.5.2 // indirect github.com/google/uuid v1.6.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/notaryproject/notation-plugin-framework-go v1.0.0 // indirect github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect golang.org/x/crypto v0.33.0 // indirect diff --git a/go.sum b/go.sum index 555f0ddd5..89281e265 100644 --- a/go.sum +++ b/go.sum @@ -38,8 +38,13 @@ github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZ github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc= github.com/notaryproject/notation-core-go v1.2.0 h1:WElMG9X0YXJhBd0A4VOxLNalTLrTjvqtIAj7JHr5X08= github.com/notaryproject/notation-core-go v1.2.0/go.mod h1:+y3L1dOs2/ZwJIU5Imo7BBvZ/M3CFjXkydGGdK09EtA= +<<<<<<< HEAD github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAylOKoFjTd6o= github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= +======= +github.com/notaryproject/notation-go v1.2.0-beta.1.0.20250310060348-fdcf9cc47604 h1:uw65pHgN+NXAqHssmlRJUkcl515AQgMIOdC6tbBHHXE= +github.com/notaryproject/notation-go v1.2.0-beta.1.0.20250310060348-fdcf9cc47604/go.mod h1:NXYZyzIawUSyv+C0Gs8bBYJ1q8a1gy78GEss8fPNZmY= +>>>>>>> b7a2f0c (fix: plugin error message (#1217)) github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4= github.com/notaryproject/notation-plugin-framework-go v1.0.0/go.mod h1:RqWSrTOtEASCrGOEffq0n8pSg2KOgKYiWqFWczRSics= github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1SDX8YNv4Dg4= diff --git a/test/e2e/suite/plugin/list.go b/test/e2e/suite/plugin/list.go index fb6931553..3a202a0f9 100644 --- a/test/e2e/suite/plugin/list.go +++ b/test/e2e/suite/plugin/list.go @@ -14,6 +14,9 @@ package plugin import ( + "os" + "runtime" + . "github.com/notaryproject/notation/test/e2e/internal/notation" "github.com/notaryproject/notation/test/e2e/internal/utils" . "github.com/onsi/ginkgo/v2" @@ -37,4 +40,41 @@ var _ = Describe("notation plugin list", func() { MatchKeyWords("ERROR", "") }) }) + + It("missing plugin binary", func() { + Host(nil, func(notation *utils.ExecOpts, _ *Artifact, vhost *utils.VirtualHost) { + // create azure-kv plugin directory + pluginDir := vhost.AbsolutePath(NotationDirName, "plugins", "azure-kv") + if err := os.MkdirAll(pluginDir, os.ModePerm); err != nil { + Fail(err.Error()) + } + + notation.Exec("plugin", "list"). + MatchKeyWords("azure-kv"). + MatchKeyWords("not found") + }) + }) + + It("with invalid binary file", func() { + Host(nil, func(notation *utils.ExecOpts, _ *Artifact, vhost *utils.VirtualHost) { + // create azure-kv plugin directory + pluginDir := vhost.AbsolutePath(NotationDirName, "plugins", "azure-kv") + if err := os.MkdirAll(pluginDir, os.ModePerm); err != nil { + Fail(err.Error()) + } + + // create invalid plugin binary + invalidPluginBinary := vhost.AbsolutePath(NotationDirName, "plugins", "azure-kv", "notation-azure-kv") + if runtime.GOOS == "windows" { + invalidPluginBinary += ".exe" + } + if err := os.WriteFile(invalidPluginBinary, []byte("invalid"), 0755); err != nil { + Fail(err.Error()) + } + + notation.Exec("plugin", "list"). + MatchKeyWords("azure-kv"). + MatchKeyWords("not executable") + }) + }) }) From a9e6e1c0952363ce2971efd5c7968d629488f74b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Mar 2025 09:41:31 +0800 Subject: [PATCH 16/35] build(deps): Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1237) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 4.6.2.
Release notes

Sourced from actions/upload-artifact's releases.

v4.6.2

What's Changed

New Contributors

Full Changelog: https://github.com/actions/upload-artifact/compare/v4...v4.6.2

Commits
  • ea165f8 Merge pull request #685 from salmanmkc/salmanmkc/3-new-upload-artifacts-release
  • 0839620 Prepare for new release of actions/upload-artifact with new toolkit cache ver...
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=4.6.1&new-version=4.6.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f3d4fa7c7..9180a6a38 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -54,7 +54,7 @@ jobs: publish_results: true - name: "Upload artifact" - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # tag=v4.6.1 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # tag=v4.6.2 with: name: SARIF file path: results.sarif From fb8cc8b01f0f2bd9a7847b07908822cc1d5f943f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Mar 2025 09:42:12 +0800 Subject: [PATCH 17/35] build(deps): Bump actions/cache from 4.2.2 to 4.2.3 (#1236) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/cache](https://github.com/actions/cache) from 4.2.2 to 4.2.3.
Release notes

Sourced from actions/cache's releases.

v4.2.3

What's Changed

  • Update to use @​actions/cache 4.0.3 package & prepare for new release by @​salmanmkc in actions/cache#1577 (SAS tokens for cache entries are now masked in debug logs)

New Contributors

Full Changelog: https://github.com/actions/cache/compare/v4.2.2...v4.2.3

Changelog

Sourced from actions/cache's changelog.

Releases

4.2.3

  • Bump @actions/cache to v4.0.3 (obfuscates SAS token in debug logs for cache entries)

4.2.2

  • Bump @actions/cache to v4.0.2

4.2.1

  • Bump @actions/cache to v4.0.1

4.2.0

TLDR; The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.

We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).

If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0

If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.

Upgrading to the recommended versions will not break your workflows.

4.1.2

  • Add GitHub Enterprise Cloud instances hostname filters to inform API endpoint choices - #1474
  • Security fix: Bump braces from 3.0.2 to 3.0.3 - #1475

4.1.1

  • Restore original behavior of cache-hit output - #1467

4.1.0

  • Ensure cache-hit output is set when a cache is missed - #1404
  • Deprecate save-always input - #1452

4.0.2

  • Fixed restore fail-on-cache-miss not working.

4.0.1

  • Updated isGhes check

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=4.2.2&new-version=4.2.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 64c1e41fb..6cf5110f8 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -38,7 +38,7 @@ jobs: - name: Check out code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Cache Go modules - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 id: go-mod-cache with: path: ~/go/pkg/mod From 453ce4a4260596eb6bb3edf5f0760faaa4bc9688 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Mar 2025 09:42:41 +0800 Subject: [PATCH 18/35] build(deps): Bump github/codeql-action from 3.28.11 to 3.28.12 (#1235) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.11 to 3.28.12.
Release notes

Sourced from github/codeql-action's releases.

v3.28.12

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.12 - 19 Mar 2025

  • Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.
  • Update default CodeQL bundle version to 2.20.7. #2810

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.28.12 - 19 Mar 2025

  • Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.
  • Update default CodeQL bundle version to 2.20.7. #2810

3.28.11 - 07 Mar 2025

  • Update default CodeQL bundle version to 2.20.6. #2793

3.28.10 - 21 Feb 2025

  • Update default CodeQL bundle version to 2.20.5. #2772
  • Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

3.28.9 - 07 Feb 2025

  • Update default CodeQL bundle version to 2.20.4. #2753

3.28.8 - 29 Jan 2025

  • Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

3.28.7 - 29 Jan 2025

No user facing changes.

3.28.6 - 27 Jan 2025

  • Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

3.28.5 - 24 Jan 2025

  • Update default CodeQL bundle version to 2.20.3. #2717

3.28.4 - 23 Jan 2025

No user facing changes.

3.28.3 - 22 Jan 2025

  • Update default CodeQL bundle version to 2.20.2. #2707
  • Fix an issue downloading the CodeQL Bundle from a GitHub Enterprise Server instance which occurred when the CodeQL Bundle had been synced to the instance using the CodeQL Action sync tool and the Actions runner did not have Zstandard installed. #2710

... (truncated)

Commits
  • 5f8171a Merge pull request #2814 from github/update-v3.28.12-6349095d1
  • bb59f77 Update changelog for v3.28.12
  • 6349095 Merge pull request #2810 from github/update-bundle/codeql-bundle-v2.20.7
  • d7d03fd Add changelog note
  • 4e3a534 Update default bundle to codeql-bundle-v2.20.7
  • 55f0237 Merge pull request #2802 from github/mbg/dependency-caching/java-buildless
  • 6a151cd Merge pull request #2811 from github/dependabot/github_actions/actions-c2c311...
  • 7866bcd Manually bump workflow to match autogenerated file
  • 611289e build(deps): bump ruby/setup-ruby in the actions group
  • 4c409a5 Remove temporary dependency directory in analyze post action
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.28.11&new-version=3.28.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1c9d512ff..bacfa759d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,8 +49,8 @@ jobs: go-version: ${{ matrix.go-version }} check-latest: true - name: Initialize CodeQL - uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11 + uses: github/codeql-action/init@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 with: languages: go - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11 + uses: github/codeql-action/analyze@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 9180a6a38..b26136a7e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -61,6 +61,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11 + uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 with: sarif_file: results.sarif From 18c44336b75009a25351efbc7f741a9b850cc307 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Mar 2025 09:43:21 +0800 Subject: [PATCH 19/35] build(deps): Bump actions/setup-go from 5.3.0 to 5.4.0 (#1234) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.3.0 to 5.4.0.
Release notes

Sourced from actions/setup-go's releases.

v5.4.0

What's Changed

Dependency updates :

New Contributors

Full Changelog: https://github.com/actions/setup-go/compare/v5...v5.4.0

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-go&package-manager=github_actions&previous-version=5.3.0&new-version=5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/build.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/release-github.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6cf5110f8..7e6ec8782 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -31,7 +31,7 @@ jobs: fail-fast: true steps: - name: Set up Go ${{ matrix.go-version }} - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0 + uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: go-version: ${{ matrix.go-version }} check-latest: true diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bacfa759d..93a25bbc7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -44,7 +44,7 @@ jobs: - name: Checkout repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set up Go ${{ matrix.go-version }} environment - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0 + uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: go-version: ${{ matrix.go-version }} check-latest: true diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml index 8b805f5ce..5351a242e 100644 --- a/.github/workflows/release-github.yml +++ b/.github/workflows/release-github.yml @@ -33,7 +33,7 @@ jobs: fail-fast: true steps: - name: Set up Go ${{ matrix.go-version }} - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0 + uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: go-version: ${{ matrix.go-version }} check-latest: true From e77f50df1cb2253fa47af7537d7e655232731c61 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Mar 2025 09:45:42 +0800 Subject: [PATCH 20/35] build(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 in /test/e2e/plugin (#1230) Bumps [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) from 4.5.1 to 4.5.2.
Release notes

Sourced from github.com/golang-jwt/jwt/v4's releases.

v4.5.2

See https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp

Full Changelog: https://github.com/golang-jwt/jwt/compare/v4.5.1...v4.5.2

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/golang-jwt/jwt/v4&package-manager=go_modules&previous-version=4.5.1&new-version=4.5.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/notaryproject/notation/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- test/e2e/plugin/go.mod | 2 +- test/e2e/plugin/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/test/e2e/plugin/go.mod b/test/e2e/plugin/go.mod index b5fc961d7..24a218b48 100644 --- a/test/e2e/plugin/go.mod +++ b/test/e2e/plugin/go.mod @@ -15,7 +15,7 @@ require ( github.com/fxamacker/cbor/v2 v2.7.0 // indirect github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect github.com/go-ldap/ldap/v3 v3.4.10 // indirect - github.com/golang-jwt/jwt/v4 v4.5.1 // indirect + github.com/golang-jwt/jwt/v4 v4.5.2 // indirect github.com/google/uuid v1.6.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/notaryproject/tspclient-go v1.0.0 // indirect diff --git a/test/e2e/plugin/go.sum b/test/e2e/plugin/go.sum index a76d57ed3..9bef4c963 100644 --- a/test/e2e/plugin/go.sum +++ b/test/e2e/plugin/go.sum @@ -14,8 +14,8 @@ github.com/go-ldap/ldap/v3 v3.4.10 h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJ github.com/go-ldap/ldap/v3 v3.4.10/go.mod h1:JXh4Uxgi40P6E9rdsYqpUtbW46D9UTjJ9QSwGRznplY= github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY= github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I= -github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo= -github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= +github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= +github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= From dba39a0188137cd68451a338cc80ebb4c16bb91b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Mar 2025 09:46:48 +0800 Subject: [PATCH 21/35] build(deps): Bump github.com/onsi/gomega from 1.36.2 to 1.36.3 in /test/e2e (#1233) Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.36.2 to 1.36.3.
Release notes

Sourced from github.com/onsi/gomega's releases.

v1.36.3

1.36.3

Maintenance

  • bump all the things [adb8b49]
  • chore: replace interface{} with any [7613216]
  • Bump google.golang.org/protobuf from 1.36.1 to 1.36.5 (#822) [9fe5259]
  • remove spurious "toolchain" from go.mod (#819) [a0e85b9]
  • Bump golang.org/x/net from 0.33.0 to 0.35.0 (#823) [604a8b1]
  • Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#772) [36fbc84]
  • Bump github-pages from 231 to 232 in /docs (#778) [ced70d7]
  • Bump rexml from 3.2.6 to 3.3.9 in /docs (#788) [c8b4a07]
  • Bump github.com/onsi/ginkgo/v2 from 2.22.1 to 2.22.2 (#812) [06431b9]
  • Bump webrick from 1.8.1 to 1.9.1 in /docs (#800) [b55a92d]
  • Fix typos (#813) [a1d518b]
Changelog

Sourced from github.com/onsi/gomega's changelog.

1.36.3

Maintenance

  • bump all the things [adb8b49]
  • chore: replace interface{} with any [7613216]
  • Bump google.golang.org/protobuf from 1.36.1 to 1.36.5 (#822) [9fe5259]
  • remove spurious "toolchain" from go.mod (#819) [a0e85b9]
  • Bump golang.org/x/net from 0.33.0 to 0.35.0 (#823) [604a8b1]
  • Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#772) [36fbc84]
  • Bump github-pages from 231 to 232 in /docs (#778) [ced70d7]
  • Bump rexml from 3.2.6 to 3.3.9 in /docs (#788) [c8b4a07]
  • Bump github.com/onsi/ginkgo/v2 from 2.22.1 to 2.22.2 (#812) [06431b9]
  • Bump webrick from 1.8.1 to 1.9.1 in /docs (#800) [b55a92d]
  • Fix typos (#813) [a1d518b]
Commits
  • 2251143 v1.36.3
  • adb8b49 bump all the things
  • 7613216 chore: replace interface{} with any
  • 9fe5259 Bump google.golang.org/protobuf from 1.36.1 to 1.36.5 (#822)
  • a0e85b9 remove spurious "toolchain" from go.mod (#819)
  • 604a8b1 Bump golang.org/x/net from 0.33.0 to 0.35.0 (#823)
  • 36fbc84 Bump activesupport from 6.0.6.1 to 6.1.7.5 in /docs (#772)
  • ced70d7 Bump github-pages from 231 to 232 in /docs (#778)
  • c8b4a07 Bump rexml from 3.2.6 to 3.3.9 in /docs (#788)
  • 06431b9 Bump github.com/onsi/ginkgo/v2 from 2.22.1 to 2.22.2 (#812)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/onsi/gomega&package-manager=go_modules&previous-version=1.36.2&new-version=1.36.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- test/e2e/go.mod | 18 +++++++++--------- test/e2e/go.sum | 43 ++++++++++++++++++------------------------- 2 files changed, 27 insertions(+), 34 deletions(-) diff --git a/test/e2e/go.mod b/test/e2e/go.mod index aaaf3e2b0..b4381340e 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -1,12 +1,12 @@ module github.com/notaryproject/notation/test/e2e -go 1.23 +go 1.23.0 require ( github.com/notaryproject/notation-core-go v1.2.0 github.com/notaryproject/notation-go v1.3.1 - github.com/onsi/ginkgo/v2 v2.23.0 - github.com/onsi/gomega v1.36.2 + github.com/onsi/ginkgo/v2 v2.23.3 + github.com/onsi/gomega v1.36.3 github.com/opencontainers/image-spec v1.1.1 oras.land/oras-go/v2 v2.5.0 ) @@ -15,17 +15,17 @@ require ( github.com/fxamacker/cbor/v2 v2.7.0 // indirect github.com/go-logr/logr v1.4.2 // indirect github.com/go-task/slim-sprig/v3 v3.0.0 // indirect - github.com/google/go-cmp v0.6.0 // indirect + github.com/google/go-cmp v0.7.0 // indirect github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect github.com/notaryproject/tspclient-go v1.0.0 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect - golang.org/x/crypto v0.35.0 // indirect - golang.org/x/net v0.36.0 // indirect - golang.org/x/sync v0.11.0 // indirect - golang.org/x/sys v0.30.0 // indirect - golang.org/x/text v0.22.0 // indirect + golang.org/x/crypto v0.36.0 // indirect + golang.org/x/net v0.37.0 // indirect + golang.org/x/sync v0.12.0 // indirect + golang.org/x/sys v0.31.0 // indirect + golang.org/x/text v0.23.0 // indirect golang.org/x/tools v0.30.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/test/e2e/go.sum b/test/e2e/go.sum index 3f8573bd1..0bf7b62d7 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -6,8 +6,8 @@ github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= -github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= -github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= +github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg= github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144= github.com/notaryproject/notation-core-go v1.2.0 h1:WElMG9X0YXJhBd0A4VOxLNalTLrTjvqtIAj7JHr5X08= @@ -16,10 +16,10 @@ github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAy github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1SDX8YNv4Dg4= github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs= -github.com/onsi/ginkgo/v2 v2.23.0 h1:FA1xjp8ieYDzlgS5ABTpdUDB7wtngggONc8a7ku2NqQ= -github.com/onsi/ginkgo/v2 v2.23.0/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM= -github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8= -github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY= +github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0= +github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM= +github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU= +github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= @@ -32,27 +32,20 @@ github.com/veraison/go-cose v1.3.0 h1:2/H5w8kdSpQJyVtIhx8gmwPJ2uSz1PkyWFx0idbd7r github.com/veraison/go-cose v1.3.0/go.mod h1:df09OV91aHoQWLmy1KsDdYiagtXgyAwAl8vFeFn1gMc= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= -<<<<<<< HEAD -golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus= -golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= -golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8= -golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk= -======= -golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs= -golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ= -golang.org/x/net v0.36.0 h1:vWF2fRbw4qslQsQzgFqZff+BItCvGFQqKzKIzx1rmoA= -golang.org/x/net v0.36.0/go.mod h1:bFmbeoIPfrw4sMHNhb4J9f6+tPziuGjq7Jk/38fxi1I= ->>>>>>> 3810ef3 (build(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 in /test/e2e (#1220)) -golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w= -golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= -golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM= -golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= +golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34= +golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc= +golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c= +golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= +golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= +golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik= +golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY= +golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4= golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY= golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY= -google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk= -google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE= +google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM= +google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= From b89a1e4a10713a01cdb5703ccbb6f6638d11d82c Mon Sep 17 00:00:00 2001 From: Patrick Zheng Date: Tue, 25 Mar 2025 15:51:46 +0800 Subject: [PATCH 22/35] fix: quick fix on notation cert command help page (#1238) Signed-off-by: Patrick Zheng --- cmd/notation/cert/add.go | 2 +- cmd/notation/cert/delete.go | 2 +- cmd/notation/cert/list.go | 2 +- cmd/notation/cert/show.go | 2 +- specs/commandline/certificate.md | 30 ++++++++++++++++++------------ 5 files changed, 22 insertions(+), 16 deletions(-) diff --git a/cmd/notation/cert/add.go b/cmd/notation/cert/add.go index c4d489d31..ce4f4f00c 100644 --- a/cmd/notation/cert/add.go +++ b/cmd/notation/cert/add.go @@ -56,7 +56,7 @@ Example - Add a certificate to the "tsa" type of a named store "timestamp": return addCerts(opts) }, } - command.Flags().StringVarP(&opts.storeType, "type", "t", "", "specify trust store type, options: ca, signingAuthority") + command.Flags().StringVarP(&opts.storeType, "type", "t", "", "specify trust store type, options: ca, signingAuthority, tsa") command.Flags().StringVarP(&opts.namedStore, "store", "s", "", "specify named store") command.MarkFlagRequired("type") command.MarkFlagRequired("store") diff --git a/cmd/notation/cert/delete.go b/cmd/notation/cert/delete.go index 044f240c0..2849d4906 100644 --- a/cmd/notation/cert/delete.go +++ b/cmd/notation/cert/delete.go @@ -67,7 +67,7 @@ Example - Delete certificate "wabbit-networks-timestamp.pem" with "tsa" type fro return deleteCerts(opts) }, } - command.Flags().StringVarP(&opts.storeType, "type", "t", "", "specify trust store type, options: ca, signingAuthority") + command.Flags().StringVarP(&opts.storeType, "type", "t", "", "specify trust store type, options: ca, signingAuthority, tsa") command.Flags().StringVarP(&opts.namedStore, "store", "s", "", "specify named store") command.Flags().BoolVarP(&opts.all, "all", "a", false, "delete all certificates in the named store") command.Flags().BoolVarP(&opts.confirmed, "yes", "y", false, "do not prompt for confirmation") diff --git a/cmd/notation/cert/list.go b/cmd/notation/cert/list.go index 6321ff7b8..aeb145979 100644 --- a/cmd/notation/cert/list.go +++ b/cmd/notation/cert/list.go @@ -63,7 +63,7 @@ Example - List all certificate files from trust store of type "tsa" }, } opts.LoggingFlagOpts.ApplyFlags(command.Flags()) - command.Flags().StringVarP(&opts.storeType, "type", "t", "", "specify trust store type, options: ca, signingAuthority") + command.Flags().StringVarP(&opts.storeType, "type", "t", "", "specify trust store type, options: ca, signingAuthority, tsa") command.Flags().StringVarP(&opts.namedStore, "store", "s", "", "specify named store") return command } diff --git a/cmd/notation/cert/show.go b/cmd/notation/cert/show.go index cc0ff1464..92f606e23 100644 --- a/cmd/notation/cert/show.go +++ b/cmd/notation/cert/show.go @@ -66,7 +66,7 @@ Example - Show details of certificate "wabbit-networks-timestamp.pem" with type }, } opts.LoggingFlagOpts.ApplyFlags(command.Flags()) - command.Flags().StringVarP(&opts.storeType, "type", "t", "", "specify trust store type, options: ca, signingAuthority") + command.Flags().StringVarP(&opts.storeType, "type", "t", "", "specify trust store type, options: ca, signingAuthority, tsa") command.Flags().StringVarP(&opts.namedStore, "store", "s", "", "specify named store") command.MarkFlagRequired("type") command.MarkFlagRequired("store") diff --git a/specs/commandline/certificate.md b/specs/commandline/certificate.md index 2822d79e0..2d5167f4e 100644 --- a/specs/commandline/certificate.md +++ b/specs/commandline/certificate.md @@ -4,10 +4,11 @@ Use ```notation certificate``` command to add/list/delete certificates in notation's trust store. Updating an existing certificate is not allowed since the thumbprint will be inconsistent, which results in a new certificate. -The trust store is in the format of a directory in the filesystem as`x509///*.crt|*.cer|*.pem`. Currently two types of trust store are supported: +The trust store is in the format of a directory in the filesystem as`x509///*.crt|*.cer|*.pem`. Currently three types of trust store are supported: -* `Certificate Authority`: The directory name is `ca`. +* `Certificate Authority`: The directory name is `ca` * `Signing Authority`: The directory name is `signingAuthority` +* `Timestamping Authority`: The directory name is `tsa` There could be more trust store types introduced in the future. @@ -26,9 +27,13 @@ $XDG_CONFIG_HOME/notation/truststore /signingAuthority /wabbit-networks cert3.crt + + /tsa + /trusted-tsa + tsa.crt ``` -In this example, there are two certificates stored in trust store named `acme-rockets` of type `ca`. There is one certificate stored in trust store named `wabbit-networks` of type `signingAuthority`. +In this example, there are two certificates stored in trust store named `acme-rockets` of type `ca`. There is one certificate stored in trust store named `wabbit-networks` of type `signingAuthority`. And there is one certificate stored in trust store named `trusted-tsa` of type `tsa`. ## Outline @@ -65,7 +70,7 @@ Usage: Flags: -h, --help help for add -s, --store string specify named store - -t, --type string specify trust store type, options: ca, signingAuthority + -t, --type string specify trust store type, options: ca, signingAuthority, tsa ``` ### notation certificate list @@ -83,7 +88,7 @@ Flags: -d, --debug debug mode -h, --help help for list -s, --store string specify named store - -t, --type string specify trust store type, options: ca, signingAuthority + -t, --type string specify trust store type, options: ca, signingAuthority, tsa -v, --verbose verbose mode ``` @@ -99,7 +104,7 @@ Flags: -d, --debug debug mode -h, --help help for show -s, --store string specify named store - -t, --type string specify trust store type, options: ca, signingAuthority + -t, --type string specify trust store type, options: ca, signingAuthority, tsa -v, --verbose verbose mode ``` @@ -115,7 +120,7 @@ Flags: -a, --all delete all certificates in the named store -h, --help help for delete -s, --store string specify named store - -t, --type string specify trust store type, options: ca, signingAuthority + -t, --type string specify trust store type, options: ca, signingAuthority, tsa -y, --yes do not prompt for confirmation ``` @@ -155,11 +160,12 @@ Upon successful listing, all the certificate files in the trust store are printe An example of the output: ``` -STORE TYPE STORE NAME CERTIFICATE -ca myStore1 cert1.pem -ca myStore2 cert2.crt -signingAuthority myStore1 cert3.crt +STORE TYPE STORE NAME CERTIFICATE +ca myStore1 cert1.pem +ca myStore2 cert2.crt +signingAuthority myStore1 cert3.crt signingAuthority myStore2 cert4.pem +tsa myTSA tsa.crt ``` ### List all certificate files of a certain named store @@ -219,7 +225,7 @@ notation certificate delete --type --store A prompt is displayed, asking the user to confirm the deletion. Upon successful deletion, the specific certificate is deleted from the trust store named `` of type ``. The output message is printed out as following: ```text -Successfully deleted from the trust store. +Successfully deleted from the trust store. ``` If users execute the deletion without specifying required flags using `notation cert delete `, the deletion fails and the error output message is printed out as follows: From 8e83de2ea0ce5af93e532f723542f57e2dc8528a Mon Sep 17 00:00:00 2001 From: 7h3-3mp7y-m4n <115151332+7h3-3mp7y-m4n@users.noreply.github.com> Date: Thu, 27 Mar 2025 08:17:58 +0530 Subject: [PATCH 23/35] docs: add contributing guide link to README.md (#1225) Signed-off-by: 7h3-3mp7y-m4n Signed-off-by: Patrick Zheng --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index c50e9f564..411437c8f 100644 --- a/README.md +++ b/README.md @@ -37,6 +37,7 @@ Notary Project is a [CNCF Incubating project](https://www.cncf.io/projects/notar - [Build Notation from source code](/building.md) - [Governance for Notary Project](https://github.com/notaryproject/.github/blob/master/GOVERNANCE.md) - [Maintainers and reviewers list](https://github.com/notaryproject/notation/blob/main/CODEOWNERS) +- [Contributing Guide](https://github.com/notaryproject/.github/blob/main/CONTRIBUTING.md) - Regular conversations for Notary Project occur on the [Cloud Native Computing Slack](https://slack.cncf.io/) **notary-project** channel. ### Notary Project Community Meeting From 31e4c3c3724797f9112326c8d9df24e742bf0971 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Apr 2025 14:36:58 +0800 Subject: [PATCH 24/35] build(deps): Bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 (#1246) Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 6.2.1 to 6.3.0.
Release notes

Sourced from goreleaser/goreleaser-action's releases.

v6.3.0

Full Changelog: https://github.com/goreleaser/goreleaser-action/compare/v6.2.1...v6.3.0

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=goreleaser/goreleaser-action&package-manager=github_actions&previous-version=6.2.1&new-version=6.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/release-github.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml index 5351a242e..502e07945 100644 --- a/.github/workflows/release-github.yml +++ b/.github/workflows/release-github.yml @@ -46,7 +46,7 @@ jobs: pre_tag=`git tag --sort=-creatordate --list 'v*' | grep -v dev | head -2 | tail -1` echo "GORELEASER_PREVIOUS_TAG=$pre_tag" >> $GITHUB_ENV - name: Run GoReleaser - uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1 + uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0 with: distribution: goreleaser version: v2 From b31db0dad9fa63aa2b4f9cf6416de65b5b18fdf8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Apr 2025 14:37:26 +0800 Subject: [PATCH 25/35] build(deps): Bump github/codeql-action from 3.28.12 to 3.28.13 (#1245) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.12 to 3.28.13.
Release notes

Sourced from github/codeql-action's releases.

v3.28.13

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.13 - 24 Mar 2025

No user facing changes.

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.28.13 - 24 Mar 2025

No user facing changes.

3.28.12 - 19 Mar 2025

  • Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.
  • Update default CodeQL bundle version to 2.20.7. #2810

3.28.11 - 07 Mar 2025

  • Update default CodeQL bundle version to 2.20.6. #2793

3.28.10 - 21 Feb 2025

  • Update default CodeQL bundle version to 2.20.5. #2772
  • Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

3.28.9 - 07 Feb 2025

  • Update default CodeQL bundle version to 2.20.4. #2753

3.28.8 - 29 Jan 2025

  • Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

3.28.7 - 29 Jan 2025

No user facing changes.

3.28.6 - 27 Jan 2025

  • Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

3.28.5 - 24 Jan 2025

  • Update default CodeQL bundle version to 2.20.3. #2717

3.28.4 - 23 Jan 2025

No user facing changes.

... (truncated)

Commits
  • 1b549b9 Merge pull request #2819 from github/update-v3.28.13-e0ea14102
  • 82630c8 Update changelog for v3.28.13
  • e0ea141 Merge pull request #2818 from github/cklin/empty-pr-diff-range
  • b361a91 Diff-informed analysis: fix empty PR handling
  • bd1d9ab Merge pull request #2816 from github/cklin/overlay-file-list
  • b98ae6c Add overlay-database-utils tests
  • 9825184 Add getFileOidsUnderPath() tests
  • ac67cff Merge pull request #2817 from github/cklin/default-setup-diff-informed
  • 9c674ba build: refresh js files
  • d109dd5 Detect PR branches for Default Setup
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.28.12&new-version=3.28.13)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 93a25bbc7..7e37cc381 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,8 +49,8 @@ jobs: go-version: ${{ matrix.go-version }} check-latest: true - name: Initialize CodeQL - uses: github/codeql-action/init@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 + uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13 with: languages: go - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 + uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b26136a7e..f16a5655b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -61,6 +61,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 + uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13 with: sarif_file: results.sarif From 1ff788e20e08abc6328799cf71c5402627ea94ae Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 8 Apr 2025 16:31:40 +0800 Subject: [PATCH 26/35] build(deps): Bump github.com/onsi/gomega from 1.36.3 to 1.37.0 in /test/e2e (#1253) Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.36.3 to 1.37.0.
Release notes

Sourced from github.com/onsi/gomega's releases.

v1.37.0

1.37.0

Features

  • add To/ToNot/NotTo aliases for AsyncAssertion [5666f98]
Changelog

Sourced from github.com/onsi/gomega's changelog.

1.37.0

Features

  • add To/ToNot/NotTo aliases for AsyncAssertion [5666f98]
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/onsi/gomega&package-manager=go_modules&previous-version=1.36.3&new-version=1.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- test/e2e/go.mod | 2 +- test/e2e/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/test/e2e/go.mod b/test/e2e/go.mod index b4381340e..ec044e5b3 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -6,7 +6,7 @@ require ( github.com/notaryproject/notation-core-go v1.2.0 github.com/notaryproject/notation-go v1.3.1 github.com/onsi/ginkgo/v2 v2.23.3 - github.com/onsi/gomega v1.36.3 + github.com/onsi/gomega v1.37.0 github.com/opencontainers/image-spec v1.1.1 oras.land/oras-go/v2 v2.5.0 ) diff --git a/test/e2e/go.sum b/test/e2e/go.sum index 0bf7b62d7..2e369d92d 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -18,8 +18,8 @@ github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1 github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs= github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0= github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM= -github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU= -github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0= +github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y= +github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= From e8ba10228ecacf0fdfb7dbe0d7ea88437a3692dc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 8 Apr 2025 16:33:02 +0800 Subject: [PATCH 27/35] build(deps): Bump golang.org/x/term from 0.30.0 to 0.31.0 (#1251) Bumps [golang.org/x/term](https://github.com/golang/term) from 0.30.0 to 0.31.0.
Commits
  • 5d2308b go.mod: update golang.org/x dependencies
  • e770ddd x/term: disabling auto-completion around GetPassword()
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/term&package-manager=go_modules&previous-version=0.30.0&new-version=0.31.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index dae53a6ff..d998375d5 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/sirupsen/logrus v1.9.3 github.com/spf13/cobra v1.9.1 github.com/spf13/pflag v1.0.6 - golang.org/x/term v0.30.0 + golang.org/x/term v0.31.0 oras.land/oras-go/v2 v2.5.0 ) @@ -29,5 +29,5 @@ require ( golang.org/x/crypto v0.33.0 // indirect golang.org/x/mod v0.23.0 // indirect golang.org/x/sync v0.10.0 // indirect - golang.org/x/sys v0.31.0 // indirect + golang.org/x/sys v0.32.0 // indirect ) diff --git a/go.sum b/go.sum index 89281e265..a7fd1a327 100644 --- a/go.sum +++ b/go.sum @@ -124,8 +124,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik= -golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20= +golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -135,8 +135,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM= -golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y= -golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g= +golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o= +golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= From 34407278020b297a081099b4fcfdf785a3d4f1f0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 8 Apr 2025 16:33:36 +0800 Subject: [PATCH 28/35] build(deps): Bump github/codeql-action from 3.28.13 to 3.28.14 (#1250) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.13 to 3.28.14.
Release notes

Sourced from github/codeql-action's releases.

v3.28.14

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.14 - 07 Apr 2025

  • Update default CodeQL bundle version to 2.21.0. #2838

See the full CHANGELOG.md for more information.

Commits
  • fc7e4a0 Merge pull request #2844 from github/update-v3.28.14-362ef4ce2
  • be0175c Update changelog for v3.28.14
  • 362ef4c Merge pull request #2838 from github/update-bundle/codeql-bundle-v2.21.0
  • 2b85c00 Merge branch 'main' into update-bundle/codeql-bundle-v2.21.0
  • 41aa437 Merge pull request #2841 from github/angelapwen/log-init-post-telemetry
  • 92864f4 Add logs around status report telemetry in init-post step
  • e13fe0d Merge pull request #2833 from github/NlightNFotis/reclassify_upload_sarif_issues
  • 06703ce Merge branch 'main' into NlightNFotis/reclassify_upload_sarif_issues
  • 676a422 review-comments: nest validateSariFileSchema into try-catch block to better d...
  • 498c7f3 review-comments: unwrap error in upload-sarif-action and re-classify as Confi...
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.28.13&new-version=3.28.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7e37cc381..7cf6f90a1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,8 +49,8 @@ jobs: go-version: ${{ matrix.go-version }} check-latest: true - name: Initialize CodeQL - uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13 + uses: github/codeql-action/init@fc7e4a0fa01c3cca5fd6a1fddec5c0740c977aa2 # v3.28.14 with: languages: go - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13 + uses: github/codeql-action/analyze@fc7e4a0fa01c3cca5fd6a1fddec5c0740c977aa2 # v3.28.14 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f16a5655b..e36ba92df 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -61,6 +61,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13 + uses: github/codeql-action/upload-sarif@fc7e4a0fa01c3cca5fd6a1fddec5c0740c977aa2 # v3.28.14 with: sarif_file: results.sarif From 6bb6985645cc3789755a11a7b21e29005420e26f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 15 Apr 2025 10:13:02 +0800 Subject: [PATCH 29/35] build(deps): Bump github/codeql-action from 3.28.14 to 3.28.15 (#1257) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.14 to 3.28.15.
Release notes

Sourced from github/codeql-action's releases.

v3.28.15

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.15 - 07 Apr 2025

  • Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.28.15 - 07 Apr 2025

  • Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. #2842

3.28.14 - 07 Apr 2025

  • Update default CodeQL bundle version to 2.21.0. #2838

3.28.13 - 24 Mar 2025

No user facing changes.

3.28.12 - 19 Mar 2025

  • Dependency caching should now cache more dependencies for Java build-mode: none extractions. This should speed up workflows and avoid inconsistent alerts in some cases.
  • Update default CodeQL bundle version to 2.20.7. #2810

3.28.11 - 07 Mar 2025

  • Update default CodeQL bundle version to 2.20.6. #2793

3.28.10 - 21 Feb 2025

  • Update default CodeQL bundle version to 2.20.5. #2772
  • Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #2768

3.28.9 - 07 Feb 2025

  • Update default CodeQL bundle version to 2.20.4. #2753

3.28.8 - 29 Jan 2025

  • Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

3.28.7 - 29 Jan 2025

No user facing changes.

3.28.6 - 27 Jan 2025

  • Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

... (truncated)

Commits
  • 45775bd Merge pull request #2854 from github/update-v3.28.15-a35ae8c38
  • dd78aab Update CHANGELOG.md with bug fix details
  • e40af59 Update changelog for v3.28.15
  • a35ae8c Merge pull request #2843 from github/cklin/diff-informed-compat
  • bb59df6 Merge pull request #2842 from github/henrymercer/zip64
  • 4b508f5 Merge pull request #2845 from github/mergeback/v3.28.14-to-main-fc7e4a0f
  • ca00afb Update checked-in dependencies
  • 2969c78 Update changelog and version after v3.28.14
  • a8be43c Don't throw error for ENOENT
  • 94102d9 Set checkPresence in diff-range data extension
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.28.14&new-version=3.28.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7cf6f90a1..07ba6433f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,8 +49,8 @@ jobs: go-version: ${{ matrix.go-version }} check-latest: true - name: Initialize CodeQL - uses: github/codeql-action/init@fc7e4a0fa01c3cca5fd6a1fddec5c0740c977aa2 # v3.28.14 + uses: github/codeql-action/init@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15 with: languages: go - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@fc7e4a0fa01c3cca5fd6a1fddec5c0740c977aa2 # v3.28.14 + uses: github/codeql-action/analyze@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e36ba92df..53022d38e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -61,6 +61,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@fc7e4a0fa01c3cca5fd6a1fddec5c0740c977aa2 # v3.28.14 + uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15 with: sarif_file: results.sarif From fe84fd638e196811f5efdbdb1e5a2f87388590e3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 15 Apr 2025 10:14:02 +0800 Subject: [PATCH 30/35] build(deps): Bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 in /test/e2e (#1252) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.23.3 to 2.23.4.
Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.23.4

2.23.4

Prior to this release Ginkgo would compute the incorrect number of available CPUs when running with -p in a linux container. Thanks to @​emirot for the fix!

Features

  • Add automaxprocs for using CPUQuota [2b9c428]

Fixes

  • clarify gotchas about -vet flag [1f59d07]

Maintenance

  • bump dependencies [2d134d5]
Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.23.4

Prior to this release Ginkgo would compute the incorrect number of available CPUs when running with -p in a linux container. Thanks to @​emirot for the fix!

Features

  • Add automaxprocs for using CPUQuota [2b9c428]

Fixes

  • clarify gotchas about -vet flag [1f59d07]

Maintenance

  • bump dependencies [2d134d5]
Commits
  • 229c981 v2.23.4
  • 2d134d5 bump dependencies
  • 2b9c428 Add automaxprocs for using CPUQuota
  • 31137de Revert "Add automaxprocs to automatically match the linux container CPU Quota"
  • 91b11b8 Add automaxprocs to automatically match the linux container CPU Quota
  • cdfddb6 maybe escape quotes when you put them in a quoted string.
  • 1f59d07 clarify gotchas about -vet flag
  • 7ab7d10 bump all the things
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/onsi/ginkgo/v2&package-manager=go_modules&previous-version=2.23.3&new-version=2.23.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- test/e2e/go.mod | 12 +++++++++--- test/e2e/go.sum | 32 +++++++++++++++++++++++++++----- 2 files changed, 36 insertions(+), 8 deletions(-) diff --git a/test/e2e/go.mod b/test/e2e/go.mod index ec044e5b3..10f452f3e 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -5,7 +5,7 @@ go 1.23.0 require ( github.com/notaryproject/notation-core-go v1.2.0 github.com/notaryproject/notation-go v1.3.1 - github.com/onsi/ginkgo/v2 v2.23.3 + github.com/onsi/ginkgo/v2 v2.23.4 github.com/onsi/gomega v1.37.0 github.com/opencontainers/image-spec v1.1.1 oras.land/oras-go/v2 v2.5.0 @@ -16,17 +16,23 @@ require ( github.com/go-logr/logr v1.4.2 // indirect github.com/go-task/slim-sprig/v3 v3.0.0 // indirect github.com/google/go-cmp v0.7.0 // indirect +<<<<<<< HEAD github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect github.com/notaryproject/tspclient-go v1.0.0 // indirect +======= + github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect + github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 // indirect +>>>>>>> 2af2853 (build(deps): Bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 in /test/e2e (#1252)) github.com/opencontainers/go-digest v1.0.0 // indirect github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect + go.uber.org/automaxprocs v1.6.0 // indirect golang.org/x/crypto v0.36.0 // indirect golang.org/x/net v0.37.0 // indirect golang.org/x/sync v0.12.0 // indirect - golang.org/x/sys v0.31.0 // indirect + golang.org/x/sys v0.32.0 // indirect golang.org/x/text v0.23.0 // indirect - golang.org/x/tools v0.30.0 // indirect + golang.org/x/tools v0.31.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/test/e2e/go.sum b/test/e2e/go.sum index 2e369d92d..e5ff9ced4 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -8,6 +8,7 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +<<<<<<< HEAD github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg= github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144= github.com/notaryproject/notation-core-go v1.2.0 h1:WElMG9X0YXJhBd0A4VOxLNalTLrTjvqtIAj7JHr5X08= @@ -18,6 +19,22 @@ github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1 github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs= github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0= github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM= +======= +github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8= +github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= +github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= +github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/notaryproject/notation-core-go v1.2.1-0.20250325094510-4d7353253409 h1:UakQ5ASMDmDVWyRvVnl2h5ecjABvakCIJmJQgGsio/E= +github.com/notaryproject/notation-core-go v1.2.1-0.20250325094510-4d7353253409/go.mod h1:w2jtfaWSn3w+x86o2AaWiImyXH18+u2ohLVaHW1tAs8= +github.com/notaryproject/notation-go v1.2.0-beta.1.0.20250325093958-3bd0ac92b2ba h1:UlkFxK3IUPoV9OHyEV6Z6qzVJSgTPavE1fwnMIc1WsI= +github.com/notaryproject/notation-go v1.2.0-beta.1.0.20250325093958-3bd0ac92b2ba/go.mod h1:M2qB0+yI2KlpdBo66ZfSti3jvCVYYS+jIsdaj8M2fac= +github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 h1:Ay72jBeHKqBFk6TbJWywfwzefN3Ei7Py2OzCiWU/7nk= +github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01/go.mod h1:3ZJPmpmdwufY23BkS+JPNktOVb5DXJ8Ik5zxvN7h670= +github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus= +github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8= +>>>>>>> 2af2853 (build(deps): Bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 in /test/e2e (#1252)) github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y= github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= @@ -26,28 +43,33 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g= +github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U= github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/veraison/go-cose v1.3.0 h1:2/H5w8kdSpQJyVtIhx8gmwPJ2uSz1PkyWFx0idbd7rk= github.com/veraison/go-cose v1.3.0/go.mod h1:df09OV91aHoQWLmy1KsDdYiagtXgyAwAl8vFeFn1gMc= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= +go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs= +go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8= golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34= golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc= golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c= golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= -golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik= -golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20= +golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY= golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4= -golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY= -golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY= +golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU= +golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ= google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM= google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY= +gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= oras.land/oras-go/v2 v2.5.0 h1:o8Me9kLY74Vp5uw07QXPiitjsw7qNXi8Twd+19Zf02c= From e0a8964e6589449f2a4af736189808cd404497f0 Mon Sep 17 00:00:00 2001 From: Junjie Gao Date: Tue, 15 Apr 2025 12:58:16 +0800 Subject: [PATCH 31/35] fix: E2E test data identified as malicious file by antivirus software (#1255) Fix: - encode the original `zip_bomb.zip` file as `zip_bomb.zip.base64`, and decode the file on the fly to avoid it being identified as a malicious file. --------- Signed-off-by: Junjie Gao Signed-off-by: Patrick Zheng --- test/e2e/suite/plugin/install.go | 21 +++++++++++++++++- .../testdata/malicious-plugin/zip_bomb.zip | Bin 42374 -> 0 bytes .../malicious-plugin/zip_bomb.zip.base64 | 1 + 3 files changed, 21 insertions(+), 1 deletion(-) delete mode 100644 test/e2e/testdata/malicious-plugin/zip_bomb.zip create mode 100644 test/e2e/testdata/malicious-plugin/zip_bomb.zip.base64 diff --git a/test/e2e/suite/plugin/install.go b/test/e2e/suite/plugin/install.go index 746babf6a..66e828522 100644 --- a/test/e2e/suite/plugin/install.go +++ b/test/e2e/suite/plugin/install.go @@ -14,6 +14,9 @@ package plugin import ( + "encoding/base64" + "fmt" + "os" "path/filepath" . "github.com/notaryproject/notation/test/e2e/internal/notation" @@ -78,7 +81,23 @@ var _ = Describe("notation plugin install", func() { It("with zip bomb total file size exceeds 256 MiB size limit", func() { Host(nil, func(notation *utils.ExecOpts, _ *Artifact, vhost *utils.VirtualHost) { - notation.ExpectFailure().Exec("plugin", "install", "--file", filepath.Join(NotationE2EMaliciousPluginArchivePath, "zip_bomb.zip"), "-v"). + encodedFilePath := filepath.Join(NotationE2EMaliciousPluginArchivePath, "zip_bomb.zip.base64") + encoded, err := os.ReadFile(encodedFilePath) + if err != nil { + Fail(fmt.Sprintf("failed to read file %s: %v", encodedFilePath, err)) + } + // decode base64 + decoded, err := base64.StdEncoding.DecodeString(string(encoded)) + if err != nil { + Fail(fmt.Sprintf("failed to decode file %s: %v", encodedFilePath, err)) + } + targetPath := vhost.AbsolutePath(NotationDirName, "zip_bomb.zip") + err = os.WriteFile(targetPath, decoded, 0644) + if err != nil { + Fail(fmt.Sprintf("failed to write file %s: %v", targetPath, err)) + } + + notation.ExpectFailure().Exec("plugin", "install", "--file", targetPath, "-v"). MatchErrContent("Error: plugin installation failed: total file size reached the 256 MiB size limit\n") }) }) diff --git a/test/e2e/testdata/malicious-plugin/zip_bomb.zip b/test/e2e/testdata/malicious-plugin/zip_bomb.zip deleted file mode 100644 index b4d00682f287342d9afab1d70c03075d9a48eed1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 42374 zcmeI*>35B17Y6WiM2ZqqVitAUYE2~(391z*A|WJ^Nd{96shX!!%1fODZwwVm+D56K z)?85~rKZ+VltyZ%R9h!ngruZ3)%fmvdG58>yZ8PRp7?Ud`hCdSAFgXH&dSxNmsdqU zi^Wpe^697^-VajZujamOu?)8YW0EUFHUOd4nk)^7Q9vFPMtMV>)>zSuEchCRi}dk3T%W2h1wN zgb1ci*2;c)U}hVpgJ3d_=B7*nGt@901!D`dUycJ4X_!ueSv00BMSFkymOb723`KPOr&*9JemPdCB*(IBpy8%&{L!UeNse!-*_U^W`2yI``@?*zO9 z<~_qi2xfboq2Wnj#uz42FpIp3(gMN68m5O}j;5{e>;opiFg*oxZOo-NO5Uon zJs%9_ZNtP0=E9e)2iF3VY?wZR`S@|2_sS+%EFBFKCzzL;jfgl5rh#GN1+#XpcgSim z_tT%=CqXb5(?j<-!Te&FM8WKIT?iWhX18II1e5*Ms_#32Sz(yIf*CPBdO;m9GYpd~ znB%R={maK&EQ1V_BAD9unhz=h)73Dkg2~&MTD%^N%`j<}rk3AH)@?m~=c8F*tY9jr zJPZ)f<|n>01_AO6GEks^s;%tV`Bgw}joJyQe%oCobpW|E3KGz)tsSb}9A~jOHEJ)Q zzYiv!DFo!uC|E#~CX7s31IVsXh=3wKZZ^~j$fi*T0aY7ZeOP}$R*gCeXxY`KIUN9b z1{!zjB%t|oBK>Ova%*H4(51FnpO=k=J82Xqps-<0dmIAf)To<)wmb69eh$c?QMiCw zO^zQm1CU*#?gHAqx!d+sKsJpc1oVCSgJ$gkSv86jP=$LbpVt878DQM0hk$CQcBpY} z4BSbho&t*LQ|HSAfLt0y3CLbGY{#d7oEr5KP=ld|rc49m(5Sb7)^2{B+!v5tqi6w@ z9rO7r5Rgry7yk3Lu+CeFd~P zE8)T)qu@>&B@5`ok6xeh9UxCX<4!38^6hlSWczwrl%A>TW<*jik&x z?>}_rhk!h3Pwx~cW#+^+UvHfN$gPo-nScIt#wQw(OCu>Wht9uwx;Y@HMp9-L7MD-) z0_4z0%FG$X|MC581l&m@DKkTD4O;I2WYb8>%x7PJv1lnEt4300ZpbN%8w<#jYTQZ6 z%+SMp9;$9uBx*0p!$3%FNw6_on|c9PXr%l$qa*Pingj zkX<7wGqW;_r!59#(@4t9Ltifq9tFs%k(8O6LN*0Q0`jC7cak!*YQ;I>&jWI6BxUCO zm~$5%4TC#rBxPppm-~158IV&WDKp>yV1DLSKn{(h%=~Lg_D2f=*)@_fGs70NWH=z3 zMp9;;xKm|pI3TM=Qf4mM-Z=0%K%QjdPEuwzJLO(-|4q1)Mp9-TC_P{KG$5BoQfB)7 zFssXEKu(RM%#1lade)Vf(Kvn~_ zlQMInWlW8`L*Y(+pWdmRl$jf54{v<}kXs`uGdI<+|CQf3aC9#EkRAiG9VW^VL3u&Dtcn?_P*hBV&T=hho=Cyk`ce5=v$w4;DL zNyeR|%-k?JztaXlZjGeOta))rh1q~y8cCV?Nv*=0>42OXNtyXf!87|i19E62WoFm+ zPXyKlWYxo2UWO-BG(HIgzjeZViv)&lY*8h4U1^TeZToihQs zHIgzj&~NU!0f1Z@NttB?k}|W?iTy9N z1>}i)dZ!>MGw)CKsr)P;w?-4JIWb%cZxOcBxUBQPhXDM3COLHl$qn=rjlW6k(8O1dqw|w36NbQDKp<~{$QXLkWC{gGvgaA zoqAya+({!TGvB=4v;B5Jo*3g!Qf7YltN+pW0l77jGP7_?T+7jbTpCH4xvk>5(>(w= zHIgzj(6aXU3xFINNtxMXVbp-f{ozg;NtyYm)}b%Y0kUZ%WoEbGk&6ldSq;=)%FMzl zxxI1#d7_`*slAk$Uz|9$d;}o3Mp9$VU2 z!JRacGILMB;}K^7*)@_fGvVr~IbQ*?X(VN4zR!Rz3jkR)k}~tvtM@*96OgC3aVIG= z$Mg%m76!r?)`2asJODKkfPToUF0WYb8> zO#43nnXdt|Y9wXmx;J)&*8}87O$bkkdfHQf6MtznRq! zkV7LWGiNW_btwdpT_Y(oulSu`TMLj)BPla~{VnTiXgJ4u;2pnXpMR6uTxq|DrY ztMj2GKrW4>%)Ay;HY5O$QzI!ex1Y-ktqRDYk(8OsN_}r!PJ}yYBxUA|rPa&bfNUB` znOQmS*xluTtQtv~xzKOR;K_hI5yqXQ%yb2Mt%(QZ)=0|Cc?qkEUIFCNNXpC=)k}V_ z49KaGl$niudTzLs0C&w!C>CIYf*BxUA5 zO)5Q%1?1^&+)2vJ*s%-dwFKnWNXpE@&>2g-0l74iGV@mJ%<_xza3_tV%#7QaR&N&| zhej!7d!3an7R%m%GY@+8&!`Gd^UJ(|c>(hR<^{|Pm=`cFU|ztyfO!G)0_FwG3z!!$ zFJNB4ynuND^8)4t%nO(oFfU+Uz`THY0rLXp1(hR<^{|Pm=`cF zU|ztyfO!G)0_FwG3z!!$FJNB4ynuND^8)4t%nO(oFfU+Uz`THY0rLXp1(hR<^{|Pm=`cFU|ztyfO!G)0_FwG3z!!$FJNB4ynwnudY@j_3Vs$pc*?7_ z|9_?c%ISbD@)zM5NIBiIMcxCR?I@?Sw#Z@0%o0R7UARTQ2%haJr(?Is3*Z?{Io-WQ z{xdv7D5n#+$REP91LbrL7kN`FY?D$>hjEdI1MfsR-N;2g47i2fae z&A_`+PDgZ+p8_6EIo;Dmeh+we%IUN&^2QY`mI%t}$}aM*z#}QAgS*HxfcK!BZto(` z2Hul$I>U>6Bk(B7=^`)kW59b+PRDtX-vZv7a=O!tyuO#k5=}Xs>_z?>@EFSJdN1;H z;IWj`Az$RPfcK%CZu%l$2Rx2)I`5182=I8y>C!Lqo4^w&r=!2f{VG~4iImg*U*sKu zCs9tPfRXnH-j{N^3XFUv@MOyAKrr%Ez*8uvTfxW=0Z*lz&IThd1)fGZT@XfI(_8Hc zQ%}c)(FZHf+KKK8qfb+w)f1fvx1_-!{`qy&l-wu5TpM~c~(($ zju^e~GvHZA(Pd)v9hGM#MMsL!4^W=96x}OEpQ${nDLP$@ey#GXr|60?`XkD-qN0Pw z=*yL7O+~kj(bug6o>di{IY!@EdDc~Q@fdx&@~o`r_%Zs~%CokjJILraD9`GOP9mc} zsyyo}x{i$gmh!By=uk5H2Jq|F16X6x&1CdllxLMi=abP7QJ!@cT~bD$tvo9&I;xC5 zUwPJAbYB_$3FTRB(Wzzhca>+oMOT;6H?9Jn6&D>~MsHW1H5c7tMn6<}R$X+K8U1|a zS$ENeX7rntXXQo5n$e$Dp0yXn}POjefE6tiR}XH2Q7Iv;Lwp(&&Ftp7j@9ltyo<2A=g79hXMmOnKH{ zbY~iUl=7^<=;So|vC6alqU+P>mnzTtiw;qv-=RF~FS<#M{x{`Wf6;kr^j<#TS%1-` zYV^&OXZ=M-tI z|4eo8tiR~&HTqV{v;LwB*y#Hx&-#mwVWXd`2^uT~R0>n}RUjXqF$)?aj+8+~8pS%1-)ZuHZXXZ=MNyU~BD zJnJty-i`i%@~pq;jyL*i%Cr8WliuiS)B?}?i>`a4Z?8P-FFN#%K2>?vUv%>u{S4(< zf6@7G^q(uw`im}sqd%lP>n}PAj=oHJ)?aiV9DVKD;8}mssc`filxO`#SHscwSDy73 z9S}$FRG#%0-4aK?MtRm>bXFXFq4KQ1=)ySqo658PqGRLe>-d6a{Y7`j(Z8xZ>n}P% zj((8xtiR|QIr>@3v;LyPo2;rj((W(tiR~!I{NpNXZ=O@*U@iLp7j@n}PTkN#!lS%1+LdGx)NXZ=M7<(PI!JnJtyUyuHh@~pq;l0Ev$jli@1qNDccUs0a*7u~l< zAFn*?FFJLPezNkczv${c`sK>A{@Usv9C|VhhHi~Tdh~APS%2NFn|pZ^csui#m1q66 zeB{wvbHUq~ui6+q>#ymzD&=N?w=y4~JnOHEuAHb)@E&6+9)JEM#i!_Ve` zw=-YeA3W=?Q5~0rIl$YP4^p1>mwliA%-6tMnNLxk_1C&Lc7)dh?=cqW@&415XZ_VO z`N?~Kr@;N0|4ez-UkQoRbBn;cnEyd})?Xb;7PeUj-pPEa@~pphZ0WK&3%rB*T1~*S z{<`gbxL_c7JM$sRv;KOpzVu=z@HXcADbM=rt&nPy{lHt9pQ$|SuLBt+6K*8K{f%XN zy#H$DS$}0t+t%_&@NVXRRG#%$x5q^_SA%yke?xiJUn5%j=gb7}WZv&N_`n_OuS@wi zv-*K|FyBde)?c$1?Ya~K-p>3$-map7qzm zp`#c40N&H%>3BKbzesu3UuF3b<30oLX8v#GS%0k<7O-qOco*~anu2Hjb*3m|aSC`R z^RFq-`YZ49oRT2$4(1)ov;NxlBr~i!csuiRlxO|rjz8O~Bnj@%{1?iz{%YXUqHsTW zEAz*cXZ^LI((zU+!FwX<{ckJJ`fEV@ocyWa-OM+%foJ`-{Z{8gN#I?~hbqtd>sn0N zkO1&b<};LM{k8pEUT9VD4(8`7&-!awsqc-;iEw}BH!08hYsS**DE8tzszo|Uy zuNBoxeyAB%j0^FbZuasx~HPS0`>bKzS%%4%7_1BL91*`MG+n9f# zJnOI419wDC1aD=&=?malfBn;>(!*Hrp6>Mi-IZtk6+3ppyq4hI%#To>^;co&j3wUS zUCiew&-&|D>&)_t@o<0U3zTR56}L03-Y)PC=Fce){pAgx!?IZJ!=K%4ES7?|)p!2` DBG6lk diff --git a/test/e2e/testdata/malicious-plugin/zip_bomb.zip.base64 b/test/e2e/testdata/malicious-plugin/zip_bomb.zip.base64 new file mode 100644 index 000000000..ba4fc2e30 --- /dev/null +++ b/test/e2e/testdata/malicious-plugin/zip_bomb.zip.base64 @@ -0,0 +1 @@ +UEsDBBQAAAAIAKBsSAX7WFLolXYAAF5kTQEBAAAAMAAfAOD/UEsDBBQAAAAIAKBsSAV6KVY+cXYAAD9kTQEBAAAAMQAfAOD/UEsDBBQAAAAIAKBsSAVYPil7TXYAACBkTQEBAAAAMgAfAOD/UEsDBBQAAAAIAKBsSAV42tlMKXYAAAFkTQEBAAAAMwAfAOD/UEsDBBQAAAAIAKBsSAU+iTADBXYAAOJjTQEBAAAANAAfAOD/UEsDBBQAAAAIAKBsSAUEaU454XUAAMNjTQEBAAAANQAfAOD/UEsDBBQAAAAIAKBsSAUo0fzavXUAAKRjTQEBAAAANgAfAOD/UEsDBBQAAAAIAKBsSAUVg59bmXUAAIVjTQEBAAAANwAfAOD/UEsDBBQAAAAIAKBsSAVkz5VYdXUAAGZjTQEBAAAAOAAfAOD/UEsDBBQAAAAIAKBsSAUhQkHmUXUAAEdjTQEBAAAAOQAfAOD/UEsDBBQAAAAIAKBsSAWQbu02LXUAAChjTQEBAAAAQQAfAOD/UEsDBBQAAAAIAKBsSAUj9vjiCXUAAAljTQEBAAAAQgAfAOD/UEsDBBQAAAAIAKBsSAWmxcTP5XQAAOpiTQEBAAAAQwAfAOD/UEsDBBQAAAAIAKBsSAXkGVFDwXQAAMtiTQEBAAAARAAfAOD/UEsDBBQAAAAIAKBsSAWyi7R1nXQAAKxiTQEBAAAARQAfAOD/UEsDBBQAAAAIAKBsSAWIYPYweXQAAI1iTQEBAAAARgAfAOD/UEsDBBQAAAAIAKBsSAW3FWZEVXQAAG5iTQEBAAAARwAfAOD/UEsDBBQAAAAIAKBsSAWQA81aMXQAAE9iTQEBAAAASAAfAOD/UEsDBBQAAAAIAKBsSAXPWqk7DXQAADBiTQEBAAAASQAfAOD/UEsDBBQAAAAIAKBsSAXqbuNl6XMAABFiTQEBAAAASgAfAOD/UEsDBBQAAAAIAKBsSAW6fyycxXMAAPJhTQEBAAAASwAfAOD/UEsDBBQAAAAIAKBsSAWV+jOMoXMAANNhTQEBAAAATAAfAOD/UEsDBBQAAAAIAKBsSAW8LrC+fXMAALRhTQEBAAAATQAfAOD/UEsDBBQAAAAIAKBsSAVp0VyIWXMAAJVhTQEBAAAATgAfAOD/UEsDBBQAAAAIAKBsSAUNhMDaNXMAAHZhTQEBAAAATwAfAOD/UEsDBBQAAAAIAKBsSAXcryxiEXMAAFdhTQEBAAAAUAAfAOD/UEsDBBQAAAAIAKBsSAWb/hWN7XIAADhhTQEBAAAAUQAfAOD/UEsDBBQAAAAIAKBsSAUnJWpGyXIAABlhTQEBAAAAUgAfAOD/UEsDBBQAAAAIAKBsSAWniQU2pXIAAPpgTQEBAAAAUwAfAOD/UEsDBBQAAAAIAKBsSAXgYD+9gXIAANtgTQEBAAAAVAAfAOD/UEsDBBQAAAAIAKBsSAW6odxCXXIAALxgTQEBAAAAVQAfAOD/UEsDBBQAAAAIAKBsSAWIsaTDOXIAAJ1gTQEBAAAAVgAfAOD/UEsDBBQAAAAIAKBsSAVqcU2MFXIAAH5gTQEBAAAAVwAfAOD/UEsDBBQAAAAIAKBsSAXRK/Ed8XEAAF9gTQEBAAAAWAAfAOD/UEsDBBQAAAAIAKBsSAUS+ChfzXEAAEBgTQEBAAAAWQAfAOD/UEsDBBQAAAAIAKBsSAWZrFniqXEAACFgTQEBAAAAWgAgAN//UEsDBBQAAAAIAKBsSAWz1faYhHEAAAFgTQECAAAAMDAAIADf/1BLAwQUAAAACACgbEgFsP8Tfl9xAADhX00BAgAAADAxACAA3/9QSwMEFAAAAAgAoGxIBQyfSTs6cQAAwV9NAQIAAAAwMgAgAN//UEsDBBQAAAAIAKBsSAUYL7vpFXEAAKFfTQECAAAAMDMAIADf/1BLAwQUAAAACACgbEgFhLM3DPBwAACBX00BAgAAADA0ACAA3/9QSwMEFAAAAAgAoGxIBfLGVNbLcAAAYV9NAQIAAAAwNQAgAN//UEsDBBQAAAAIAKBsSAV1cmtYpnAAAEFfTQECAAAAMDYAIADf/1BLAwQUAAAACACgbEgFRpslZoFwAAAhX00BAgAAADA3ACAA3/9QSwMEFAAAAAgAoGxIBQxiDmhccAAAAV9NAQIAAAAwOAAgAN//UEsDBBQAAAAIAKBsSAWa6CCPN3AAAOFeTQECAAAAMDkAIADf/1BLAwQUAAAACACgbEgFi4ZHHRJwAADBXk0BAgAAADBBACAA3/9QSwMEFAAAAAgAoGxIBeMvg6PtbwAAoV5NAQIAAAAwQgAgAN//UEsDBBQAAAAIAKBsSAVCaCBIyG8AAIFeTQECAAAAMEMAIADf/1BLAwQUAAAACACgbEgFt2GZ16NvAABhXk0BAgAAADBEACAA3/9QSwMEFAAAAAgAoGxIBSt3Umx+bwAAQV5NAQIAAAAwRQAgAN//UEsDBBQAAAAIAKBsSAW8sEO3WW8AACFeTQECAAAAMEYAIADf/1BLAwQUAAAACACgbEgFw2D7JTRvAAABXk0BAgAAADBHACAA3/9QSwMEFAAAAAgAoGxIBQL4WKMPbwAA4V1NAQIAAAAwSAAgAN//UEsDBBQAAAAIAKBsSAUSWTcP6m4AAMFdTQECAAAAMEkAIADf/1BLAwQUAAAACACgbEgFTlAVr8VuAAChXU0BAgAAADBKACAA3/9QSwMEFAAAAAgAoGxIBUELQrmgbgAAgV1NAQIAAAAwSwAgAN//UEsDBBQAAAAIAKBsSAUZZsh4e24AAGFdTQECAAAAMEwAIADf/1BLAwQUAAAACACgbEgFp7D+V1ZuAABBXU0BAgAAADBNACAA3/9QSwMEFAAAAAgAoGxIBe3QDbExbgAAIV1NAQIAAAAwTgAgAN//UEsDBBQAAAAIAKBsSAUU67rxDG4AAAFdTQECAAAAME8AIADf/1BLAwQUAAAACACgbEgFnoVLzudtAADhXE0BAgAAADBQACAA3/9QSwMEFAAAAAgAoGxIBd/ndkLCbQAAwVxNAQIAAAAwUQAgAN//UEsDBBQAAAAIAKBsSAXBkgPHnW0AAKFcTQECAAAAMFIAIADf/1BLAwQUAAAACACgbEgFJdbiqHhtAACBXE0BAgAAADBTACAA3/9QSwMEFAAAAAgAoGxIBf2Ze2lTbQAAYVxNAQIAAAAwVAAgAN//UEsDBBQAAAAIAKBsSAUCBc81Lm0AAEFcTQECAAAAMFUAIADf/1BLAwQUAAAACACgbEgFFnWIIQltAAAhXE0BAgAAADBWACAA3/9QSwMEFAAAAAgAoGxIBcCDU9zkbAAAAVxNAQIAAAAwVwAgAN//UEsDBBQAAAAIAKBsSAWXmD14v2wAAOFbTQECAAAAMFgAIADf/1BLAwQUAAAACACgbEgFE0znqZpsAADBW00BAgAAADBZACAA3/9QSwMEFAAAAAgAoGxIBVQ5jtZ1bAAAoVtNAQIAAAAwWgAgAN//UEsDBBQAAAAIAKBsSAUWt6hYUGwAAIFbTQECAAAAMTAAIADf/1BLAwQUAAAACACgbEgF1EE1IStsAABhW00BAgAAADExACAA3/9QSwMEFAAAAAgAoGxIBRqnGoEGbAAAQVtNAQIAAAAxMgAgAN//UEsDBBQAAAAIAKBsSAV+/zom4WsAACFbTQECAAAAMTMAIADf/1BLAwQUAAAACACgbEgFMi+WWbxrAAABW00BAgAAADE0ACAA3/9QSwMEFAAAAAgAoGxIBdodZoCXawAA4VpNAQIAAAAxNQAgAN//UEsDBBQAAAAIAKBsSAV0prWzcmsAAMFaTQECAAAAMTYAIADf/1BLAwQUAAAACACgbEgF5c7WDU1rAAChWk0BAgAAADE3ACAA3/9QSwMEFAAAAAgAoGxIBWaL8NUoawAAgVpNAQIAAAAxOAAgAN//UEsDBBQAAAAIAKBsSAXL4vF4A2sAAGFaTQECAAAAMTkAIADf/1BLAwQUAAAACACgbEgFfuJ8E95qAABBWk0BAgAAADFBACAA3/9QSwMEFAAAAAgAoGxIBT8hGSy5agAAIVpNAQIAAAAxQgAgAN//UEsDBBQAAAAIAKBsSAUKPSTNlGoAAAFaTQECAAAAMUMAIADf/1BLAwQUAAAACACgbEgFqo/tUW9qAADhWU0BAgAAADFEACAA3/9QSwMEFAAAAAgAoGxIBaVoFuJKagAAwVlNAQIAAAAxRQAgAN//UEsDBBQAAAAIAKBsSAW2hyL7JWoAAKFZTQECAAAAMUYAIADf/1BLAwQUAAAACACgbEgF7Mkw3ABqAACBWU0BAgAAADFHACAA3/9QSwMEFAAAAAgAoGxIBby6wGDbaQAAYVlNAQIAAAAxSAAgAN//UEsDBBQAAAAIAKBsSAW4cVUvtmkAAEFZTQECAAAAMUkAIADf/1BLAwQUAAAACACgbEgFg4Lie5FpAAAhWU0BAgAAADFKACAA3/9QSwMEFAAAAAgAoGxIBci1lDVsaQAAAVlNAQIAAAAxSwAgAN//UEsDBBQAAAAIAKBsSAWuNq41R2kAAOFYTQECAAAAMUwAIADf/1BLAwQUAAAACACgbEgFCwSGRCJpAADBWE0BAgAAADFNACAA3/9QSwMEFAAAAAgAoGxIBYtO2dz9aAAAoVhNAQIAAAAxTgAgAN//UEsDBBQAAAAIAKBsSAUSJ1w+2GgAAIFYTQECAAAAMU8AIADf/1BLAwQUAAAACACgbEgFkpaLgrNoAABhWE0BAgAAADFQACAA3/9QSwMEFAAAAAgAoGxIBe54iJiOaAAAQVhNAQIAAAAxUQAgAN//UEsDBBQAAAAIAKBsSAVkITOTaWgAACFYTQECAAAAMVIAIADf/1BLAwQUAAAACACgbEgF0vYJb0RoAAABWE0BAgAAADFTACAA3/9QSwMEFAAAAAgAoGxIBZO3HDEfaAAA4VdNAQIAAAAxVAAgAN//UEsDBBQAAAAIAKBsSAUl1MGT+mcAAMFXTQECAAAAMVUAIADf/1BLAwQUAAAACACgbEgFxezaCNVnAAChV00BAgAAADFWACAA3/9QSwMEFAAAAAgAoGxIBRTHhD6wZwAAgVdNAQIAAAAxVwAgAN//UEsDBBQAAAAIAKBsSAVOyWOri2cAAGFXTQECAAAAMVgAIADf/1BLAwQUAAAACACgbEgFIA11qmZnAABBV00BAgAAADFZACAA3/9QSwMEFAAAAAgAoGxIBZRGYldBZwAAIVdNAQIAAAAxWgAgAN//UEsDBBQAAAAIAKBsSAXwMbHdHGcAAAFXTQECAAAAMjAAIADf/1BLAwQUAAAACACgbEgFdABuD/dmAADhVk0BAgAAADIxACAA3/9QSwMEFAAAAAgAoGxIBaqFaSzSZgAAwVZNAQIAAAAyMgAgAN//UEsDBBQAAAAIAKBsSAWuD0H5rWYAAKFWTQECAAAAMjMAIADf/1BLAwQUAAAACACgbEgFvB75hIhmAACBVk0BAgAAADI0ACAA3/9QSwMEFAAAAAgAoGxIBS6YakdjZgAAYVZNAQIAAAAyNQAgAN//UEsDBBQAAAAIAKBsSAVffTACPmYAAEFWTQECAAAAMjYAIADf/1BLAwQUAAAACACgbEgFrA3FrhlmAAAhVk0BAgAAADI3ACAA3/9QSwMEFAAAAAgAoGxIBTYcrFD0ZQAAAVZNAQIAAAAyOAAgAN//UEsDBBQAAAAIAKBsSAVzG2laz2UAAOFVTQECAAAAMjkAIADf/1BLAwQUAAAACACgbEgFqnetOaplAADBVU0BAgAAADJBACAA3/9QSwMEFAAAAAgAoGxIBRDgYwKFZQAAoVVNAQIAAAAyQgAgAN//UEsDBBQAAAAIAKBsSAWeEcvwYGUAAIFVTQECAAAAMkMAIADf/1BLAwQUAAAACACgbEgFBrQGxDtlAABhVU0BAgAAADJEACAA3/9QSwMEFAAAAAgAoGxIBUCS0jEWZQAAQVVNAQIAAAAyRQAgAN//UEsDBBQAAAAIAKBsSAUZhUat8WQAACFVTQECAAAAMkYAIADf/1BLAwQUAAAACACgbEgFvY4VrsxkAAABVU0BAgAAADJHACAA3/9QSwMEFAAAAAgAoGxIBWBd25qnZAAA4VRNAQIAAAAySAAgAN//UEsDBBQAAAAIAKBsSAXS/eo7gmQAAMFUTQECAAAAMkkAIADf/1BLAwQUAAAACACgbEgFMRSJ2V1kAAChVE0BAgAAADJKACAA3/9QSwMEFAAAAAgAoGxIBdq2YeQ4ZAAAgVRNAQIAAAAySwAgAN//UEsDBBQAAAAIAKBsSAVWLXf3E2QAAGFUTQECAAAAMkwAIADf/1BLAwQUAAAACACgbEgFzOklsO5jAABBVE0BAgAAADJNACAA3/9QSwMEFAAAAAgAoGxIBVRSrczJYwAAIVRNAQIAAAAyTgAgAN//UEsDBBQAAAAIAKBsSAViWMYApGMAAAFUTQECAAAAMk8AIADf/1BLAwQUAAAACACgbEgFbBvVEX9jAADhU00BAgAAADJQACAA3/9QSwMEFAAAAAgAoGxIBR0nfepaYwAAwVNNAQIAAAAyUQAgAN//UEsDBBQAAAAIAKBsSAX/4s/XNWMAAKFTTQECAAAAMlIAIADf/1BLAwQUAAAACACgbEgFPbr9mxBjAACBU00BAgAAADJTACAA3/9QSwMEFAAAAAgAoGxIBZYR4JXrYgAAYVNNAQIAAAAyVAAgAN//UEsDBBQAAAAIAKBsSAUXBMYExmIAAEFTTQECAAAAMlUAIADf/1BLAwQUAAAACACgbEgFvRXMKKFiAAAhU00BAgAAADJWACAA3/9QSwMEFAAAAAgAoGxIBWD2T/t8YgAAAVNNAQIAAAAyVwAgAN//UEsDBBQAAAAIAKBsSAVpQOHFV2IAAOFSTQECAAAAMlgAIADf/1BLAwQUAAAACACgbEgFcrDW9TJiAADBUk0BAgAAADJZACAA3/9QSwMEFAAAAAgAoGxIBR7SoPsNYgAAoVJNAQIAAAAyWgAgAN//UEsDBBQAAAAIAKBsSAXRy9vi6GEAAIFSTQECAAAAMzAAIADf/1BLAwQUAAAACACgbEgF+S7udcNhAABhUk0BAgAAADMxACAA3/9QSwMEFAAAAAgAoGxIBTO0yKGeYQAAQVJNAQIAAAAzMgAgAN//UEsDBBQAAAAIAKBsSAW1we9aeWEAACFSTQECAAAAMzMAIADf/1BLAwQUAAAACACgbEgFQAJRnVRhAAABUk0BAgAAADM0ACAA3/9QSwMEFAAAAAgAoGxIBTnSxCYvYQAA4VFNAQIAAAAzNQAgAN//UEsDBBQAAAAIAKBsSAX6dw0ICmEAAMFRTQECAAAAMzYAIADf/1BLAwQUAAAACACgbEgF7bS0a+VgAAChUU0BAgAAADM3ACAA3/9QSwMEFAAAAAgAoGxIBTaPENPAYAAAgVFNAQIAAAAzOAAgAN//UEsDBBQAAAAIAKBsSAVfglLMm2AAAGFRTQECAAAAMzkAIADf/1BLAwQUAAAACACgbEgF123EyXZgAABBUU0BAgAAADNBACAA3/9QSwMEFAAAAAgAoGxIBfZ1eYpRYAAAIVFNAQIAAAAzQgAgAN//UEsDBBQAAAAIAKBsSAW4cDHPLGAAAAFRTQECAAAAM0MAIADf/1BLAwQUAAAACACgbEgFVXDAQAdgAADhUE0BAgAAADNEACAA3/9QSwMEFAAAAAgAoGxIBexPALPiXwAAwVBNAQIAAAAzRQAgAN//UEsDBBQAAAAIAKBsSAUQnxKRvV8AAKFQTQECAAAAM0YAIADf/1BLAwQUAAAACACgbEgFK7yjiJhfAACBUE0BAgAAADNHACAA3/9QSwMEFAAAAAgAoGxIBWGdTelzXwAAYVBNAQIAAAAzSAAgAN//UEsDBBQAAAAIAKBsSAXpOAIvTl8AAEFQTQECAAAAM0kAIADf/1BLAwQUAAAACACgbEgFdxSM5ilfAAAhUE0BAgAAADNKACAA3/9QSwMEFAAAAAgAoGxIBdBFA2wEXwAAAVBNAQIAAAAzSwAgAN//UEsDBBQAAAAIAKBsSAXxtOuu314AAOFPTQECAAAAM0wAIADf/1BLAwQUAAAACACgbEgF1KAnRrpeAADBT00BAgAAADNNACAA3/9QSwMEFAAAAAgAoGxIBXBSffGVXgAAoU9NAQIAAAAzTgAgAN//UEsDBBQAAAAIAKBsSAVN3qTscF4AAIFPTQECAAAAM08AIADf/1BLAwQUAAAACACgbEgFJvfrtkteAABhT00BAgAAADNQACAA3/9QSwMEFAAAAAgAoGxIBQD4zXwmXgAAQU9NAQIAAAAzUQAgAN//UEsDBBQAAAAIAKBsSAV/KPteAV4AACFPTQECAAAAM1IAIADf/1BLAwQUAAAACACgbEgFUhuUetxdAAABT00BAgAAADNTACAA3/9QSwMEFAAAAAgAoGxIBWfrSTS3XQAA4U5NAQIAAAAzVAAgAN//UEsDBBQAAAAIAKBsSAW/3R3Pkl0AAMFOTQECAAAAM1UAIADf/1BLAwQUAAAACACgbEgFy7JRKm1dAAChTk0BAgAAADNWACAA3/9QSwMEFAAAAAgAoGxIBbYEqNVIXQAAgU5NAQIAAAAzVwAgAN//UEsDBBQAAAAIAKBsSAUxAKfRI10AAGFOTQECAAAAM1gAIADf/1BLAwQUAAAACACgbEgFHo5KXf5cAABBTk0BAgAAADNZACAA3/9QSwMEFAAAAAgAoGxIBf0RyK/ZXAAAIU5NAQIAAAAzWgAgAN//UEsDBBQAAAAIAKBsSAVDaUeQtFwAAAFOTQECAAAANDAAIADf/1BLAwQUAAAACACgbEgFywmVS49cAADhTU0BAgAAADQxACAA3/9QSwMEFAAAAAgAoGxIBavS0JxqXAAAwU1NAQIAAAA0MgAgAN//UEsDBBQAAAAIAKBsSAUQGhjTRVwAAKFNTQECAAAANDMAIADf/1BLAwQUAAAACACgbEgFkLWGxiBcAACBTU0BAgAAADQ0ACAA3/9QSwMEFAAAAAgAoGxIBcWZLC/7WwAAYU1NAQIAAAA0NQAgAN//UEsDBBQAAAAIAKBsSAW9MP5q1lsAAEFNTQECAAAANDYAIADf/1BLAwQUAAAACACgbEgFU+jUhrFbAAAhTU0BAgAAADQ3ACAA3/9QSwMEFAAAAAgAoGxIBa0NXT6MWwAAAU1NAQIAAAA0OAAgAN//UEsDBBQAAAAIAKBsSAU66PiXZ1sAAOFMTQECAAAANDkAIADf/1BLAwQUAAAACACgbEgFbls/6kJbAADBTE0BAgAAADRBACAA3/9QSwMEFAAAAAgAoGxIBSkqbZcdWwAAoUxNAQIAAAA0QgAgAN//UEsDBBQAAAAIAKBsSAU1zFPG+FoAAIFMTQECAAAANEMAIADf/1BLAwQUAAAACACgbEgFsx01P9NaAABhTE0BAgAAADREACAA3/9QSwMEFAAAAAgAoGxIBfcWleauWgAAQUxNAQIAAAA0RQAgAN//UEsDBBQAAAAIAKBsSAWca8/0iVoAACFMTQECAAAANEYAIADf/1BLAwQUAAAACACgbEgFffQHlWRaAAABTE0BAgAAADRHACAA3/9QSwMEFAAAAAgAoGxIBeChj0o/WgAA4UtNAQIAAAA0SAAgAN//UEsDBBQAAAAIAKBsSAUY6xzCGloAAMFLTQECAAAANEkAIADf/1BLAwQUAAAACACgbEgFRJFZvPVZAAChS00BAgAAADRKACAA3/9QSwMEFAAAAAgAoGxIBZTizbrQWQAAgUtNAQIAAAA0SwAgAN//UEsDBBQAAAAIAKBsSAUWE4hxq1kAAGFLTQECAAAANEwAIADf/1BLAwQUAAAACACgbEgFvxP8ooZZAABBS00BAgAAADRNACAA3/9QSwMEFAAAAAgAoGxIBWw4k0JhWQAAIUtNAQIAAAA0TgAgAN//UEsDBBQAAAAIAKBsSAVBwh2APFkAAAFLTQECAAAANE8AIADf/1BLAwQUAAAACACgbEgFqGW5RBdZAADhSk0BAgAAADRQACAA3/9QSwMEFAAAAAgAoGxIBSpX/43yWAAAwUpNAQIAAAA0UQAgAN//UEsDBBQAAAAIAKBsSAVTVH2VzVgAAKFKTQECAAAANFIAIADf/1BLAwQUAAAACACgbEgFN+mOLqhYAACBSk0BAgAAADRTACAA3/9QSwMEFAAAAAgAoGxIBbmyPrCDWAAAYUpNAQIAAAA0VAAgAN//UEsDBBQAAAAIAKBsSAX1Bcm0XlgAAEFKTQECAAAANFUAIADf/1BLAwQUAAAACACgbEgF+6ns4DlYAAAhSk0BAgAAADRWACAA3/9QSwMEFAAAAAgAoGxIBXM2DHcUWAAAAUpNAQIAAAA0VwAgAN//UEsDBBQAAAAIAKBsSAXFZOly71cAAOFJTQECAAAANFgAIADf/1BLAwQUAAAACACgbEgFgnu2KspXAADBSU0BAgAAADRZACAA3/9QSwMEFAAAAAgAoGxIBUP+zRClVwAAoUlNAQIAAAA0WgAgAN//UEsDBBQAAAAIAKBsSAVqKh2PgFcAAIFJTQECAAAANTAAIADf/1BLAwQUAAAACACgbEgF463wg1tXAABhSU0BAgAAADUxACAA3/9QSwMEFAAAAAgAoGxIBYWQu+M2VwAAQUlNAQIAAAA1MgAgAN//UEsDBBQAAAAIAKBsSAXnFNqnEVcAACFJTQECAAAANTMAIADf/1BLAwQUAAAACACgbEgF3d6D6OxWAAABSU0BAgAAADU0ACAA3/9QSwMEFAAAAAgAoGxIBfxmbYzHVgAA4UhNAQIAAAA1NQAgAN//UEsDBBQAAAAIAKBsSAXtrUZwolYAAMFITQECAAAANTYAIADf/1BLAwQUAAAACACgbEgFnWgwmn1WAAChSE0BAgAAADU3ACAA3/9QSwMEFAAAAAgAoGxIBdbNZJFYVgAAgUhNAQIAAAA1OAAgAN//UEsDBBQAAAAIAKBsSAWZ5obpM1YAAGFITQECAAAANTkAIADf/1BLAwQUAAAACACgbEgFtv+CQg5WAABBSE0BAgAAADVBACAA3/9QSwMEFAAAAAgAoGxIBcFS1yvpVQAAIUhNAQIAAAA1QgAgAN//UEsDBBQAAAAIAKBsSAUZDSnLxFUAAAFITQECAAAANUMAIADf/1BLAwQUAAAACACgbEgFqgfRK59VAADhR00BAgAAADVEACAA3/9QSwMEFAAAAAgAoGxIBV00j616VQAAwUdNAQIAAAA1RQAgAN//UEsDBBQAAAAIAKBsSAW39DvIVVUAAKFHTQECAAAANUYAIADf/1BLAwQUAAAACACgbEgF6k7tYzBVAACBR00BAgAAADVHACAA3/9QSwMEFAAAAAgAoGxIBbfZmT8LVQAAYUdNAQIAAAA1SAAgAN//UEsDBBQAAAAIAKBsSAWa7BPv5lQAAEFHTQECAAAANUkAIADf/1BLAwQUAAAACACgbEgFfpQO8cFUAAAhR00BAgAAADVKACAA3/9QSwMEFAAAAAgAoGxIBQiZ0PecVAAAAUdNAQIAAAA1SwAgAN//UEsDBBQAAAAIAKBsSAWOFLJid1QAAOFGTQECAAAANUwAIADf/1BLAwQUAAAACACgbEgFoTEDplJUAADBRk0BAgAAADVNACAA3/9QSwMEFAAAAAgAoGxIBYpTpM0tVAAAoUZNAQIAAAA1TgAgAN//UEsDBBQAAAAIAKBsSAWdDunfCFQAAIFGTQECAAAANU8AIADf/1BLAwQUAAAACACgbEgFGw1JquNTAABhRk0BAgAAADVQACAA3/9QSwMEFAAAAAgAoGxIBWsDR3q+UwAAQUZNAQIAAAA1UQAgAN//UEsDBBQAAAAIAKBsSAXKMLSlmVMAACFGTQECAAAANVIAIADf/1BLAwQUAAAACACgbEgFLF65SnRTAAABRk0BAgAAADVTACAA3/9QSwMEFAAAAAgAoGxIBfMeB/xPUwAA4UVNAQIAAAA1VAAgAN//UEsDBBQAAAAIAKBsSAVPb4yKKlMAAMFFTQECAAAANVUAIADf/1BLAwQUAAAACACgbEgFyz9+kwVTAAChRU0BAgAAADVWACAA3/9QSwMEFAAAAAgAoGxIBfQsgvHgUgAAgUVNAQIAAAA1VwAgAN//UEsDBBQAAAAIAKBsSAVRuloXu1IAAGFFTQECAAAANVjtwIEIAAAAwDDW+0tcZAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYFBLAQIUABQAAAAIAKBsSAX7WFLolXYAAF5kTQEBAAAAAAAAAAAAAAAAAAAAAAAwUEsBAhQAFAAAAAgAoGxIBXopVj5xdgAAP2RNAQEAAAAAAAAAAAAAAAAAJAAAADFQSwECFAAUAAAACACgbEgFWD4pe012AAAgZE0BAQAAAAAAAAAAAAAAAABIAAAAMlBLAQIUABQAAAAIAKBsSAV42tlMKXYAAAFkTQEBAAAAAAAAAAAAAAAAAGwAAAAzUEsBAhQAFAAAAAgAoGxIBT6JMAMFdgAA4mNNAQEAAAAAAAAAAAAAAAAAkAAAADRQSwECFAAUAAAACACgbEgFBGlOOeF1AADDY00BAQAAAAAAAAAAAAAAAAC0AAAANVBLAQIUABQAAAAIAKBsSAUo0fzavXUAAKRjTQEBAAAAAAAAAAAAAAAAANgAAAA2UEsBAhQAFAAAAAgAoGxIBRWDn1uZdQAAhWNNAQEAAAAAAAAAAAAAAAAA/AAAADdQSwECFAAUAAAACACgbEgFZM+VWHV1AABmY00BAQAAAAAAAAAAAAAAAAAgAQAAOFBLAQIUABQAAAAIAKBsSAUhQkHmUXUAAEdjTQEBAAAAAAAAAAAAAAAAAEQBAAA5UEsBAhQAFAAAAAgAoGxIBZBu7TYtdQAAKGNNAQEAAAAAAAAAAAAAAAAAaAEAAEFQSwECFAAUAAAACACgbEgFI/b44gl1AAAJY00BAQAAAAAAAAAAAAAAAACMAQAAQlBLAQIUABQAAAAIAKBsSAWmxcTP5XQAAOpiTQEBAAAAAAAAAAAAAAAAALABAABDUEsBAhQAFAAAAAgAoGxIBeQZUUPBdAAAy2JNAQEAAAAAAAAAAAAAAAAA1AEAAERQSwECFAAUAAAACACgbEgFsou0dZ10AACsYk0BAQAAAAAAAAAAAAAAAAD4AQAARVBLAQIUABQAAAAIAKBsSAWIYPYweXQAAI1iTQEBAAAAAAAAAAAAAAAAABwCAABGUEsBAhQAFAAAAAgAoGxIBbcVZkRVdAAAbmJNAQEAAAAAAAAAAAAAAAAAQAIAAEdQSwECFAAUAAAACACgbEgFkAPNWjF0AABPYk0BAQAAAAAAAAAAAAAAAABkAgAASFBLAQIUABQAAAAIAKBsSAXPWqk7DXQAADBiTQEBAAAAAAAAAAAAAAAAAIgCAABJUEsBAhQAFAAAAAgAoGxIBepu42XpcwAAEWJNAQEAAAAAAAAAAAAAAAAArAIAAEpQSwECFAAUAAAACACgbEgFun8snMVzAADyYU0BAQAAAAAAAAAAAAAAAADQAgAAS1BLAQIUABQAAAAIAKBsSAWV+jOMoXMAANNhTQEBAAAAAAAAAAAAAAAAAPQCAABMUEsBAhQAFAAAAAgAoGxIBbwusL59cwAAtGFNAQEAAAAAAAAAAAAAAAAAGAMAAE1QSwECFAAUAAAACACgbEgFadFciFlzAACVYU0BAQAAAAAAAAAAAAAAAAA8AwAATlBLAQIUABQAAAAIAKBsSAUNhMDaNXMAAHZhTQEBAAAAAAAAAAAAAAAAAGADAABPUEsBAhQAFAAAAAgAoGxIBdyvLGIRcwAAV2FNAQEAAAAAAAAAAAAAAAAAhAMAAFBQSwECFAAUAAAACACgbEgFm/4Vje1yAAA4YU0BAQAAAAAAAAAAAAAAAACoAwAAUVBLAQIUABQAAAAIAKBsSAUnJWpGyXIAABlhTQEBAAAAAAAAAAAAAAAAAMwDAABSUEsBAhQAFAAAAAgAoGxIBaeJBTalcgAA+mBNAQEAAAAAAAAAAAAAAAAA8AMAAFNQSwECFAAUAAAACACgbEgF4GA/vYFyAADbYE0BAQAAAAAAAAAAAAAAAAAUBAAAVFBLAQIUABQAAAAIAKBsSAW6odxCXXIAALxgTQEBAAAAAAAAAAAAAAAAADgEAABVUEsBAhQAFAAAAAgAoGxIBYixpMM5cgAAnWBNAQEAAAAAAAAAAAAAAAAAXAQAAFZQSwECFAAUAAAACACgbEgFanFNjBVyAAB+YE0BAQAAAAAAAAAAAAAAAACABAAAV1BLAQIUABQAAAAIAKBsSAXRK/Ed8XEAAF9gTQEBAAAAAAAAAAAAAAAAAKQEAABYUEsBAhQAFAAAAAgAoGxIBRL4KF/NcQAAQGBNAQEAAAAAAAAAAAAAAAAAyAQAAFlQSwECFAAUAAAACACgbEgFmaxZ4qlxAAAhYE0BAQAAAAAAAAAAAAAAAADsBAAAWlBLAQIUABQAAAAIAKBsSAWz1faYhHEAAAFgTQECAAAAAAAAAAAAAAAAABAFAAAwMFBLAQIUABQAAAAIAKBsSAWw/xN+X3EAAOFfTQECAAAAAAAAAAAAAAAAADUFAAAwMVBLAQIUABQAAAAIAKBsSAUMn0k7OnEAAMFfTQECAAAAAAAAAAAAAAAAAFoFAAAwMlBLAQIUABQAAAAIAKBsSAUYL7vpFXEAAKFfTQECAAAAAAAAAAAAAAAAAH8FAAAwM1BLAQIUABQAAAAIAKBsSAWEszcM8HAAAIFfTQECAAAAAAAAAAAAAAAAAKQFAAAwNFBLAQIUABQAAAAIAKBsSAXyxlTWy3AAAGFfTQECAAAAAAAAAAAAAAAAAMkFAAAwNVBLAQIUABQAAAAIAKBsSAV1cmtYpnAAAEFfTQECAAAAAAAAAAAAAAAAAO4FAAAwNlBLAQIUABQAAAAIAKBsSAVGmyVmgXAAACFfTQECAAAAAAAAAAAAAAAAABMGAAAwN1BLAQIUABQAAAAIAKBsSAUMYg5oXHAAAAFfTQECAAAAAAAAAAAAAAAAADgGAAAwOFBLAQIUABQAAAAIAKBsSAWa6CCPN3AAAOFeTQECAAAAAAAAAAAAAAAAAF0GAAAwOVBLAQIUABQAAAAIAKBsSAWLhkcdEnAAAMFeTQECAAAAAAAAAAAAAAAAAIIGAAAwQVBLAQIUABQAAAAIAKBsSAXjL4Oj7W8AAKFeTQECAAAAAAAAAAAAAAAAAKcGAAAwQlBLAQIUABQAAAAIAKBsSAVCaCBIyG8AAIFeTQECAAAAAAAAAAAAAAAAAMwGAAAwQ1BLAQIUABQAAAAIAKBsSAW3YZnXo28AAGFeTQECAAAAAAAAAAAAAAAAAPEGAAAwRFBLAQIUABQAAAAIAKBsSAUrd1Jsfm8AAEFeTQECAAAAAAAAAAAAAAAAABYHAAAwRVBLAQIUABQAAAAIAKBsSAW8sEO3WW8AACFeTQECAAAAAAAAAAAAAAAAADsHAAAwRlBLAQIUABQAAAAIAKBsSAXDYPslNG8AAAFeTQECAAAAAAAAAAAAAAAAAGAHAAAwR1BLAQIUABQAAAAIAKBsSAUC+FijD28AAOFdTQECAAAAAAAAAAAAAAAAAIUHAAAwSFBLAQIUABQAAAAIAKBsSAUSWTcP6m4AAMFdTQECAAAAAAAAAAAAAAAAAKoHAAAwSVBLAQIUABQAAAAIAKBsSAVOUBWvxW4AAKFdTQECAAAAAAAAAAAAAAAAAM8HAAAwSlBLAQIUABQAAAAIAKBsSAVBC0K5oG4AAIFdTQECAAAAAAAAAAAAAAAAAPQHAAAwS1BLAQIUABQAAAAIAKBsSAUZZsh4e24AAGFdTQECAAAAAAAAAAAAAAAAABkIAAAwTFBLAQIUABQAAAAIAKBsSAWnsP5XVm4AAEFdTQECAAAAAAAAAAAAAAAAAD4IAAAwTVBLAQIUABQAAAAIAKBsSAXt0A2xMW4AACFdTQECAAAAAAAAAAAAAAAAAGMIAAAwTlBLAQIUABQAAAAIAKBsSAUU67rxDG4AAAFdTQECAAAAAAAAAAAAAAAAAIgIAAAwT1BLAQIUABQAAAAIAKBsSAWehUvO520AAOFcTQECAAAAAAAAAAAAAAAAAK0IAAAwUFBLAQIUABQAAAAIAKBsSAXf53ZCwm0AAMFcTQECAAAAAAAAAAAAAAAAANIIAAAwUVBLAQIUABQAAAAIAKBsSAXBkgPHnW0AAKFcTQECAAAAAAAAAAAAAAAAAPcIAAAwUlBLAQIUABQAAAAIAKBsSAUl1uKoeG0AAIFcTQECAAAAAAAAAAAAAAAAABwJAAAwU1BLAQIUABQAAAAIAKBsSAX9mXtpU20AAGFcTQECAAAAAAAAAAAAAAAAAEEJAAAwVFBLAQIUABQAAAAIAKBsSAUCBc81Lm0AAEFcTQECAAAAAAAAAAAAAAAAAGYJAAAwVVBLAQIUABQAAAAIAKBsSAUWdYghCW0AACFcTQECAAAAAAAAAAAAAAAAAIsJAAAwVlBLAQIUABQAAAAIAKBsSAXAg1Pc5GwAAAFcTQECAAAAAAAAAAAAAAAAALAJAAAwV1BLAQIUABQAAAAIAKBsSAWXmD14v2wAAOFbTQECAAAAAAAAAAAAAAAAANUJAAAwWFBLAQIUABQAAAAIAKBsSAUTTOepmmwAAMFbTQECAAAAAAAAAAAAAAAAAPoJAAAwWVBLAQIUABQAAAAIAKBsSAVUOY7WdWwAAKFbTQECAAAAAAAAAAAAAAAAAB8KAAAwWlBLAQIUABQAAAAIAKBsSAUWt6hYUGwAAIFbTQECAAAAAAAAAAAAAAAAAEQKAAAxMFBLAQIUABQAAAAIAKBsSAXUQTUhK2wAAGFbTQECAAAAAAAAAAAAAAAAAGkKAAAxMVBLAQIUABQAAAAIAKBsSAUapxqBBmwAAEFbTQECAAAAAAAAAAAAAAAAAI4KAAAxMlBLAQIUABQAAAAIAKBsSAV+/zom4WsAACFbTQECAAAAAAAAAAAAAAAAALMKAAAxM1BLAQIUABQAAAAIAKBsSAUyL5ZZvGsAAAFbTQECAAAAAAAAAAAAAAAAANgKAAAxNFBLAQIUABQAAAAIAKBsSAXaHWaAl2sAAOFaTQECAAAAAAAAAAAAAAAAAP0KAAAxNVBLAQIUABQAAAAIAKBsSAV0prWzcmsAAMFaTQECAAAAAAAAAAAAAAAAACILAAAxNlBLAQIUABQAAAAIAKBsSAXlztYNTWsAAKFaTQECAAAAAAAAAAAAAAAAAEcLAAAxN1BLAQIUABQAAAAIAKBsSAVmi/DVKGsAAIFaTQECAAAAAAAAAAAAAAAAAGwLAAAxOFBLAQIUABQAAAAIAKBsSAXL4vF4A2sAAGFaTQECAAAAAAAAAAAAAAAAAJELAAAxOVBLAQIUABQAAAAIAKBsSAV+4nwT3moAAEFaTQECAAAAAAAAAAAAAAAAALYLAAAxQVBLAQIUABQAAAAIAKBsSAU/IRksuWoAACFaTQECAAAAAAAAAAAAAAAAANsLAAAxQlBLAQIUABQAAAAIAKBsSAUKPSTNlGoAAAFaTQECAAAAAAAAAAAAAAAAAAAMAAAxQ1BLAQIUABQAAAAIAKBsSAWqj+1Rb2oAAOFZTQECAAAAAAAAAAAAAAAAACUMAAAxRFBLAQIUABQAAAAIAKBsSAWlaBbiSmoAAMFZTQECAAAAAAAAAAAAAAAAAEoMAAAxRVBLAQIUABQAAAAIAKBsSAW2hyL7JWoAAKFZTQECAAAAAAAAAAAAAAAAAG8MAAAxRlBLAQIUABQAAAAIAKBsSAXsyTDcAGoAAIFZTQECAAAAAAAAAAAAAAAAAJQMAAAxR1BLAQIUABQAAAAIAKBsSAW8usBg22kAAGFZTQECAAAAAAAAAAAAAAAAALkMAAAxSFBLAQIUABQAAAAIAKBsSAW4cVUvtmkAAEFZTQECAAAAAAAAAAAAAAAAAN4MAAAxSVBLAQIUABQAAAAIAKBsSAWDguJ7kWkAACFZTQECAAAAAAAAAAAAAAAAAAMNAAAxSlBLAQIUABQAAAAIAKBsSAXItZQ1bGkAAAFZTQECAAAAAAAAAAAAAAAAACgNAAAxS1BLAQIUABQAAAAIAKBsSAWuNq41R2kAAOFYTQECAAAAAAAAAAAAAAAAAE0NAAAxTFBLAQIUABQAAAAIAKBsSAULBIZEImkAAMFYTQECAAAAAAAAAAAAAAAAAHINAAAxTVBLAQIUABQAAAAIAKBsSAWLTtnc/WgAAKFYTQECAAAAAAAAAAAAAAAAAJcNAAAxTlBLAQIUABQAAAAIAKBsSAUSJ1w+2GgAAIFYTQECAAAAAAAAAAAAAAAAALwNAAAxT1BLAQIUABQAAAAIAKBsSAWSlouCs2gAAGFYTQECAAAAAAAAAAAAAAAAAOENAAAxUFBLAQIUABQAAAAIAKBsSAXueIiYjmgAAEFYTQECAAAAAAAAAAAAAAAAAAYOAAAxUVBLAQIUABQAAAAIAKBsSAVkITOTaWgAACFYTQECAAAAAAAAAAAAAAAAACsOAAAxUlBLAQIUABQAAAAIAKBsSAXS9glvRGgAAAFYTQECAAAAAAAAAAAAAAAAAFAOAAAxU1BLAQIUABQAAAAIAKBsSAWTtxwxH2gAAOFXTQECAAAAAAAAAAAAAAAAAHUOAAAxVFBLAQIUABQAAAAIAKBsSAUl1MGT+mcAAMFXTQECAAAAAAAAAAAAAAAAAJoOAAAxVVBLAQIUABQAAAAIAKBsSAXF7NoI1WcAAKFXTQECAAAAAAAAAAAAAAAAAL8OAAAxVlBLAQIUABQAAAAIAKBsSAUUx4Q+sGcAAIFXTQECAAAAAAAAAAAAAAAAAOQOAAAxV1BLAQIUABQAAAAIAKBsSAVOyWOri2cAAGFXTQECAAAAAAAAAAAAAAAAAAkPAAAxWFBLAQIUABQAAAAIAKBsSAUgDXWqZmcAAEFXTQECAAAAAAAAAAAAAAAAAC4PAAAxWVBLAQIUABQAAAAIAKBsSAWURmJXQWcAACFXTQECAAAAAAAAAAAAAAAAAFMPAAAxWlBLAQIUABQAAAAIAKBsSAXwMbHdHGcAAAFXTQECAAAAAAAAAAAAAAAAAHgPAAAyMFBLAQIUABQAAAAIAKBsSAV0AG4P92YAAOFWTQECAAAAAAAAAAAAAAAAAJ0PAAAyMVBLAQIUABQAAAAIAKBsSAWqhWks0mYAAMFWTQECAAAAAAAAAAAAAAAAAMIPAAAyMlBLAQIUABQAAAAIAKBsSAWuD0H5rWYAAKFWTQECAAAAAAAAAAAAAAAAAOcPAAAyM1BLAQIUABQAAAAIAKBsSAW8HvmEiGYAAIFWTQECAAAAAAAAAAAAAAAAAAwQAAAyNFBLAQIUABQAAAAIAKBsSAUumGpHY2YAAGFWTQECAAAAAAAAAAAAAAAAADEQAAAyNVBLAQIUABQAAAAIAKBsSAVffTACPmYAAEFWTQECAAAAAAAAAAAAAAAAAFYQAAAyNlBLAQIUABQAAAAIAKBsSAWsDcWuGWYAACFWTQECAAAAAAAAAAAAAAAAAHsQAAAyN1BLAQIUABQAAAAIAKBsSAU2HKxQ9GUAAAFWTQECAAAAAAAAAAAAAAAAAKAQAAAyOFBLAQIUABQAAAAIAKBsSAVzG2laz2UAAOFVTQECAAAAAAAAAAAAAAAAAMUQAAAyOVBLAQIUABQAAAAIAKBsSAWqd605qmUAAMFVTQECAAAAAAAAAAAAAAAAAOoQAAAyQVBLAQIUABQAAAAIAKBsSAUQ4GMChWUAAKFVTQECAAAAAAAAAAAAAAAAAA8RAAAyQlBLAQIUABQAAAAIAKBsSAWeEcvwYGUAAIFVTQECAAAAAAAAAAAAAAAAADQRAAAyQ1BLAQIUABQAAAAIAKBsSAUGtAbEO2UAAGFVTQECAAAAAAAAAAAAAAAAAFkRAAAyRFBLAQIUABQAAAAIAKBsSAVAktIxFmUAAEFVTQECAAAAAAAAAAAAAAAAAH4RAAAyRVBLAQIUABQAAAAIAKBsSAUZhUat8WQAACFVTQECAAAAAAAAAAAAAAAAAKMRAAAyRlBLAQIUABQAAAAIAKBsSAW9jhWuzGQAAAFVTQECAAAAAAAAAAAAAAAAAMgRAAAyR1BLAQIUABQAAAAIAKBsSAVgXduap2QAAOFUTQECAAAAAAAAAAAAAAAAAO0RAAAySFBLAQIUABQAAAAIAKBsSAXS/eo7gmQAAMFUTQECAAAAAAAAAAAAAAAAABISAAAySVBLAQIUABQAAAAIAKBsSAUxFInZXWQAAKFUTQECAAAAAAAAAAAAAAAAADcSAAAySlBLAQIUABQAAAAIAKBsSAXatmHkOGQAAIFUTQECAAAAAAAAAAAAAAAAAFwSAAAyS1BLAQIUABQAAAAIAKBsSAVWLXf3E2QAAGFUTQECAAAAAAAAAAAAAAAAAIESAAAyTFBLAQIUABQAAAAIAKBsSAXM6SWw7mMAAEFUTQECAAAAAAAAAAAAAAAAAKYSAAAyTVBLAQIUABQAAAAIAKBsSAVUUq3MyWMAACFUTQECAAAAAAAAAAAAAAAAAMsSAAAyTlBLAQIUABQAAAAIAKBsSAViWMYApGMAAAFUTQECAAAAAAAAAAAAAAAAAPASAAAyT1BLAQIUABQAAAAIAKBsSAVsG9URf2MAAOFTTQECAAAAAAAAAAAAAAAAABUTAAAyUFBLAQIUABQAAAAIAKBsSAUdJ33qWmMAAMFTTQECAAAAAAAAAAAAAAAAADoTAAAyUVBLAQIUABQAAAAIAKBsSAX/4s/XNWMAAKFTTQECAAAAAAAAAAAAAAAAAF8TAAAyUlBLAQIUABQAAAAIAKBsSAU9uv2bEGMAAIFTTQECAAAAAAAAAAAAAAAAAIQTAAAyU1BLAQIUABQAAAAIAKBsSAWWEeCV62IAAGFTTQECAAAAAAAAAAAAAAAAAKkTAAAyVFBLAQIUABQAAAAIAKBsSAUXBMYExmIAAEFTTQECAAAAAAAAAAAAAAAAAM4TAAAyVVBLAQIUABQAAAAIAKBsSAW9FcwooWIAACFTTQECAAAAAAAAAAAAAAAAAPMTAAAyVlBLAQIUABQAAAAIAKBsSAVg9k/7fGIAAAFTTQECAAAAAAAAAAAAAAAAABgUAAAyV1BLAQIUABQAAAAIAKBsSAVpQOHFV2IAAOFSTQECAAAAAAAAAAAAAAAAAD0UAAAyWFBLAQIUABQAAAAIAKBsSAVysNb1MmIAAMFSTQECAAAAAAAAAAAAAAAAAGIUAAAyWVBLAQIUABQAAAAIAKBsSAUe0qD7DWIAAKFSTQECAAAAAAAAAAAAAAAAAIcUAAAyWlBLAQIUABQAAAAIAKBsSAXRy9vi6GEAAIFSTQECAAAAAAAAAAAAAAAAAKwUAAAzMFBLAQIUABQAAAAIAKBsSAX5Lu51w2EAAGFSTQECAAAAAAAAAAAAAAAAANEUAAAzMVBLAQIUABQAAAAIAKBsSAUztMihnmEAAEFSTQECAAAAAAAAAAAAAAAAAPYUAAAzMlBLAQIUABQAAAAIAKBsSAW1we9aeWEAACFSTQECAAAAAAAAAAAAAAAAABsVAAAzM1BLAQIUABQAAAAIAKBsSAVAAlGdVGEAAAFSTQECAAAAAAAAAAAAAAAAAEAVAAAzNFBLAQIUABQAAAAIAKBsSAU50sQmL2EAAOFRTQECAAAAAAAAAAAAAAAAAGUVAAAzNVBLAQIUABQAAAAIAKBsSAX6dw0ICmEAAMFRTQECAAAAAAAAAAAAAAAAAIoVAAAzNlBLAQIUABQAAAAIAKBsSAXttLRr5WAAAKFRTQECAAAAAAAAAAAAAAAAAK8VAAAzN1BLAQIUABQAAAAIAKBsSAU2jxDTwGAAAIFRTQECAAAAAAAAAAAAAAAAANQVAAAzOFBLAQIUABQAAAAIAKBsSAVfglLMm2AAAGFRTQECAAAAAAAAAAAAAAAAAPkVAAAzOVBLAQIUABQAAAAIAKBsSAXXbcTJdmAAAEFRTQECAAAAAAAAAAAAAAAAAB4WAAAzQVBLAQIUABQAAAAIAKBsSAX2dXmKUWAAACFRTQECAAAAAAAAAAAAAAAAAEMWAAAzQlBLAQIUABQAAAAIAKBsSAW4cDHPLGAAAAFRTQECAAAAAAAAAAAAAAAAAGgWAAAzQ1BLAQIUABQAAAAIAKBsSAVVcMBAB2AAAOFQTQECAAAAAAAAAAAAAAAAAI0WAAAzRFBLAQIUABQAAAAIAKBsSAXsTwCz4l8AAMFQTQECAAAAAAAAAAAAAAAAALIWAAAzRVBLAQIUABQAAAAIAKBsSAUQnxKRvV8AAKFQTQECAAAAAAAAAAAAAAAAANcWAAAzRlBLAQIUABQAAAAIAKBsSAUrvKOImF8AAIFQTQECAAAAAAAAAAAAAAAAAPwWAAAzR1BLAQIUABQAAAAIAKBsSAVhnU3pc18AAGFQTQECAAAAAAAAAAAAAAAAACEXAAAzSFBLAQIUABQAAAAIAKBsSAXpOAIvTl8AAEFQTQECAAAAAAAAAAAAAAAAAEYXAAAzSVBLAQIUABQAAAAIAKBsSAV3FIzmKV8AACFQTQECAAAAAAAAAAAAAAAAAGsXAAAzSlBLAQIUABQAAAAIAKBsSAXQRQNsBF8AAAFQTQECAAAAAAAAAAAAAAAAAJAXAAAzS1BLAQIUABQAAAAIAKBsSAXxtOuu314AAOFPTQECAAAAAAAAAAAAAAAAALUXAAAzTFBLAQIUABQAAAAIAKBsSAXUoCdGul4AAMFPTQECAAAAAAAAAAAAAAAAANoXAAAzTVBLAQIUABQAAAAIAKBsSAVwUn3xlV4AAKFPTQECAAAAAAAAAAAAAAAAAP8XAAAzTlBLAQIUABQAAAAIAKBsSAVN3qTscF4AAIFPTQECAAAAAAAAAAAAAAAAACQYAAAzT1BLAQIUABQAAAAIAKBsSAUm9+u2S14AAGFPTQECAAAAAAAAAAAAAAAAAEkYAAAzUFBLAQIUABQAAAAIAKBsSAUA+M18Jl4AAEFPTQECAAAAAAAAAAAAAAAAAG4YAAAzUVBLAQIUABQAAAAIAKBsSAV/KPteAV4AACFPTQECAAAAAAAAAAAAAAAAAJMYAAAzUlBLAQIUABQAAAAIAKBsSAVSG5R63F0AAAFPTQECAAAAAAAAAAAAAAAAALgYAAAzU1BLAQIUABQAAAAIAKBsSAVn60k0t10AAOFOTQECAAAAAAAAAAAAAAAAAN0YAAAzVFBLAQIUABQAAAAIAKBsSAW/3R3Pkl0AAMFOTQECAAAAAAAAAAAAAAAAAAIZAAAzVVBLAQIUABQAAAAIAKBsSAXLslEqbV0AAKFOTQECAAAAAAAAAAAAAAAAACcZAAAzVlBLAQIUABQAAAAIAKBsSAW2BKjVSF0AAIFOTQECAAAAAAAAAAAAAAAAAEwZAAAzV1BLAQIUABQAAAAIAKBsSAUxAKfRI10AAGFOTQECAAAAAAAAAAAAAAAAAHEZAAAzWFBLAQIUABQAAAAIAKBsSAUejkpd/lwAAEFOTQECAAAAAAAAAAAAAAAAAJYZAAAzWVBLAQIUABQAAAAIAKBsSAX9Eciv2VwAACFOTQECAAAAAAAAAAAAAAAAALsZAAAzWlBLAQIUABQAAAAIAKBsSAVDaUeQtFwAAAFOTQECAAAAAAAAAAAAAAAAAOAZAAA0MFBLAQIUABQAAAAIAKBsSAXLCZVLj1wAAOFNTQECAAAAAAAAAAAAAAAAAAUaAAA0MVBLAQIUABQAAAAIAKBsSAWr0tCcalwAAMFNTQECAAAAAAAAAAAAAAAAACoaAAA0MlBLAQIUABQAAAAIAKBsSAUQGhjTRVwAAKFNTQECAAAAAAAAAAAAAAAAAE8aAAA0M1BLAQIUABQAAAAIAKBsSAWQtYbGIFwAAIFNTQECAAAAAAAAAAAAAAAAAHQaAAA0NFBLAQIUABQAAAAIAKBsSAXFmSwv+1sAAGFNTQECAAAAAAAAAAAAAAAAAJkaAAA0NVBLAQIUABQAAAAIAKBsSAW9MP5q1lsAAEFNTQECAAAAAAAAAAAAAAAAAL4aAAA0NlBLAQIUABQAAAAIAKBsSAVT6NSGsVsAACFNTQECAAAAAAAAAAAAAAAAAOMaAAA0N1BLAQIUABQAAAAIAKBsSAWtDV0+jFsAAAFNTQECAAAAAAAAAAAAAAAAAAgbAAA0OFBLAQIUABQAAAAIAKBsSAU66PiXZ1sAAOFMTQECAAAAAAAAAAAAAAAAAC0bAAA0OVBLAQIUABQAAAAIAKBsSAVuWz/qQlsAAMFMTQECAAAAAAAAAAAAAAAAAFIbAAA0QVBLAQIUABQAAAAIAKBsSAUpKm2XHVsAAKFMTQECAAAAAAAAAAAAAAAAAHcbAAA0QlBLAQIUABQAAAAIAKBsSAU1zFPG+FoAAIFMTQECAAAAAAAAAAAAAAAAAJwbAAA0Q1BLAQIUABQAAAAIAKBsSAWzHTU/01oAAGFMTQECAAAAAAAAAAAAAAAAAMEbAAA0RFBLAQIUABQAAAAIAKBsSAX3FpXmrloAAEFMTQECAAAAAAAAAAAAAAAAAOYbAAA0RVBLAQIUABQAAAAIAKBsSAWca8/0iVoAACFMTQECAAAAAAAAAAAAAAAAAAscAAA0RlBLAQIUABQAAAAIAKBsSAV99AeVZFoAAAFMTQECAAAAAAAAAAAAAAAAADAcAAA0R1BLAQIUABQAAAAIAKBsSAXgoY9KP1oAAOFLTQECAAAAAAAAAAAAAAAAAFUcAAA0SFBLAQIUABQAAAAIAKBsSAUY6xzCGloAAMFLTQECAAAAAAAAAAAAAAAAAHocAAA0SVBLAQIUABQAAAAIAKBsSAVEkVm89VkAAKFLTQECAAAAAAAAAAAAAAAAAJ8cAAA0SlBLAQIUABQAAAAIAKBsSAWU4s260FkAAIFLTQECAAAAAAAAAAAAAAAAAMQcAAA0S1BLAQIUABQAAAAIAKBsSAUWE4hxq1kAAGFLTQECAAAAAAAAAAAAAAAAAOkcAAA0TFBLAQIUABQAAAAIAKBsSAW/E/yihlkAAEFLTQECAAAAAAAAAAAAAAAAAA4dAAA0TVBLAQIUABQAAAAIAKBsSAVsOJNCYVkAACFLTQECAAAAAAAAAAAAAAAAADMdAAA0TlBLAQIUABQAAAAIAKBsSAVBwh2APFkAAAFLTQECAAAAAAAAAAAAAAAAAFgdAAA0T1BLAQIUABQAAAAIAKBsSAWoZblEF1kAAOFKTQECAAAAAAAAAAAAAAAAAH0dAAA0UFBLAQIUABQAAAAIAKBsSAUqV/+N8lgAAMFKTQECAAAAAAAAAAAAAAAAAKIdAAA0UVBLAQIUABQAAAAIAKBsSAVTVH2VzVgAAKFKTQECAAAAAAAAAAAAAAAAAMcdAAA0UlBLAQIUABQAAAAIAKBsSAU36Y4uqFgAAIFKTQECAAAAAAAAAAAAAAAAAOwdAAA0U1BLAQIUABQAAAAIAKBsSAW5sj6wg1gAAGFKTQECAAAAAAAAAAAAAAAAABEeAAA0VFBLAQIUABQAAAAIAKBsSAX1Bcm0XlgAAEFKTQECAAAAAAAAAAAAAAAAADYeAAA0VVBLAQIUABQAAAAIAKBsSAX7qezgOVgAACFKTQECAAAAAAAAAAAAAAAAAFseAAA0VlBLAQIUABQAAAAIAKBsSAVzNgx3FFgAAAFKTQECAAAAAAAAAAAAAAAAAIAeAAA0V1BLAQIUABQAAAAIAKBsSAXFZOly71cAAOFJTQECAAAAAAAAAAAAAAAAAKUeAAA0WFBLAQIUABQAAAAIAKBsSAWCe7YqylcAAMFJTQECAAAAAAAAAAAAAAAAAMoeAAA0WVBLAQIUABQAAAAIAKBsSAVD/s0QpVcAAKFJTQECAAAAAAAAAAAAAAAAAO8eAAA0WlBLAQIUABQAAAAIAKBsSAVqKh2PgFcAAIFJTQECAAAAAAAAAAAAAAAAABQfAAA1MFBLAQIUABQAAAAIAKBsSAXjrfCDW1cAAGFJTQECAAAAAAAAAAAAAAAAADkfAAA1MVBLAQIUABQAAAAIAKBsSAWFkLvjNlcAAEFJTQECAAAAAAAAAAAAAAAAAF4fAAA1MlBLAQIUABQAAAAIAKBsSAXnFNqnEVcAACFJTQECAAAAAAAAAAAAAAAAAIMfAAA1M1BLAQIUABQAAAAIAKBsSAXd3oPo7FYAAAFJTQECAAAAAAAAAAAAAAAAAKgfAAA1NFBLAQIUABQAAAAIAKBsSAX8Zm2Mx1YAAOFITQECAAAAAAAAAAAAAAAAAM0fAAA1NVBLAQIUABQAAAAIAKBsSAXtrUZwolYAAMFITQECAAAAAAAAAAAAAAAAAPIfAAA1NlBLAQIUABQAAAAIAKBsSAWdaDCafVYAAKFITQECAAAAAAAAAAAAAAAAABcgAAA1N1BLAQIUABQAAAAIAKBsSAXWzWSRWFYAAIFITQECAAAAAAAAAAAAAAAAADwgAAA1OFBLAQIUABQAAAAIAKBsSAWZ5obpM1YAAGFITQECAAAAAAAAAAAAAAAAAGEgAAA1OVBLAQIUABQAAAAIAKBsSAW2/4JCDlYAAEFITQECAAAAAAAAAAAAAAAAAIYgAAA1QVBLAQIUABQAAAAIAKBsSAXBUtcr6VUAACFITQECAAAAAAAAAAAAAAAAAKsgAAA1QlBLAQIUABQAAAAIAKBsSAUZDSnLxFUAAAFITQECAAAAAAAAAAAAAAAAANAgAAA1Q1BLAQIUABQAAAAIAKBsSAWqB9Ern1UAAOFHTQECAAAAAAAAAAAAAAAAAPUgAAA1RFBLAQIUABQAAAAIAKBsSAVdNI+telUAAMFHTQECAAAAAAAAAAAAAAAAABohAAA1RVBLAQIUABQAAAAIAKBsSAW39DvIVVUAAKFHTQECAAAAAAAAAAAAAAAAAD8hAAA1RlBLAQIUABQAAAAIAKBsSAXqTu1jMFUAAIFHTQECAAAAAAAAAAAAAAAAAGQhAAA1R1BLAQIUABQAAAAIAKBsSAW32Zk/C1UAAGFHTQECAAAAAAAAAAAAAAAAAIkhAAA1SFBLAQIUABQAAAAIAKBsSAWa7BPv5lQAAEFHTQECAAAAAAAAAAAAAAAAAK4hAAA1SVBLAQIUABQAAAAIAKBsSAV+lA7xwVQAACFHTQECAAAAAAAAAAAAAAAAANMhAAA1SlBLAQIUABQAAAAIAKBsSAUImdD3nFQAAAFHTQECAAAAAAAAAAAAAAAAAPghAAA1S1BLAQIUABQAAAAIAKBsSAWOFLJid1QAAOFGTQECAAAAAAAAAAAAAAAAAB0iAAA1TFBLAQIUABQAAAAIAKBsSAWhMQOmUlQAAMFGTQECAAAAAAAAAAAAAAAAAEIiAAA1TVBLAQIUABQAAAAIAKBsSAWKU6TNLVQAAKFGTQECAAAAAAAAAAAAAAAAAGciAAA1TlBLAQIUABQAAAAIAKBsSAWdDunfCFQAAIFGTQECAAAAAAAAAAAAAAAAAIwiAAA1T1BLAQIUABQAAAAIAKBsSAUbDUmq41MAAGFGTQECAAAAAAAAAAAAAAAAALEiAAA1UFBLAQIUABQAAAAIAKBsSAVrA0d6vlMAAEFGTQECAAAAAAAAAAAAAAAAANYiAAA1UVBLAQIUABQAAAAIAKBsSAXKMLSlmVMAACFGTQECAAAAAAAAAAAAAAAAAPsiAAA1UlBLAQIUABQAAAAIAKBsSAUsXrlKdFMAAAFGTQECAAAAAAAAAAAAAAAAACAjAAA1U1BLAQIUABQAAAAIAKBsSAXzHgf8T1MAAOFFTQECAAAAAAAAAAAAAAAAAEUjAAA1VFBLAQIUABQAAAAIAKBsSAVPb4yKKlMAAMFFTQECAAAAAAAAAAAAAAAAAGojAAA1VVBLAQIUABQAAAAIAKBsSAXLP36TBVMAAKFFTQECAAAAAAAAAAAAAAAAAI8jAAA1VlBLAQIUABQAAAAIAKBsSAX0LILx4FIAAIFFTQECAAAAAAAAAAAAAAAAALQjAAA1V1BLAQIUABQAAAAIAKBsSAVRuloXu1IAAGFFTQECAAAAAAAAAAAAAAAAANkjAAA1WFBLBQYAAAAA+gD6ALwuAAC0dgAAAAA= \ No newline at end of file From be482956d2ac968cf9aa3800f079c4a85c3a6ffe Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Apr 2025 10:03:03 +0800 Subject: [PATCH 32/35] build(deps): Bump golang.org/x/net from 0.37.0 to 0.38.0 in /test/e2e (#1258) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- test/e2e/go.mod | 2 +- test/e2e/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/test/e2e/go.mod b/test/e2e/go.mod index 10f452f3e..1285d0f34 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -28,7 +28,7 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.uber.org/automaxprocs v1.6.0 // indirect golang.org/x/crypto v0.36.0 // indirect - golang.org/x/net v0.37.0 // indirect + golang.org/x/net v0.38.0 // indirect golang.org/x/sync v0.12.0 // indirect golang.org/x/sys v0.32.0 // indirect golang.org/x/text v0.23.0 // indirect diff --git a/test/e2e/go.sum b/test/e2e/go.sum index e5ff9ced4..63cf3555d 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -55,8 +55,8 @@ go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs= go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8= golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34= golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc= -golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c= -golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= +golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8= +golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20= From 59edf287083c5912ce8cc1420c1e9b35c0dffc48 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 23 Apr 2025 10:46:40 +0800 Subject: [PATCH 33/35] build(deps): Bump codecov/codecov-action from 5.4.0 to 5.4.2 (#1264) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.4.0 to 5.4.2.
Release notes

Sourced from codecov/codecov-action's releases.

v5.4.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1...v5.4.2

v5.4.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0...v5.4.1

v5.4.1-beta

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0...v5.4.1-beta

Changelog

Sourced from codecov/codecov-action's changelog.

v5.4.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2

v5.4.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0..v5.4.1

v5.4.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0

v5.3.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.0..v5.3.1

v5.3.0

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=codecov/codecov-action&package-manager=github_actions&previous-version=5.4.0&new-version=5.4.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Patrick Zheng --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7e6ec8782..9d13a0b71 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -59,6 +59,6 @@ jobs: make e2e-covdata fi - name: Upload coverage to codecov.io - uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0 + uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} From f1351b39fc74ec603d64195d10a20031f2cdef5b Mon Sep 17 00:00:00 2001 From: Patrick Zheng Date: Wed, 23 Apr 2025 13:13:46 +0800 Subject: [PATCH 34/35] bump: bump up dependencies (#1266) Signed-off-by: Patrick Zheng --- go.mod | 12 +++--- go.sum | 25 +++++-------- test/e2e/go.mod | 15 +++----- test/e2e/go.sum | 37 ++++++------------- test/e2e/plugin/go.mod | 10 ++--- test/e2e/plugin/go.sum | 16 ++++---- .../suite/trustpolicy/verification_level.go | 6 +-- 7 files changed, 49 insertions(+), 72 deletions(-) diff --git a/go.mod b/go.mod index d998375d5..bc636a57e 100644 --- a/go.mod +++ b/go.mod @@ -3,10 +3,10 @@ module github.com/notaryproject/notation go 1.23.0 require ( - github.com/notaryproject/notation-core-go v1.2.0 + github.com/notaryproject/notation-core-go v1.3.0 github.com/notaryproject/notation-go v1.3.1 - github.com/notaryproject/notation-plugin-framework-go v1.0.0 - github.com/notaryproject/tspclient-go v1.0.0 + github.com/notaryproject/notation-plugin-framework-go v1.0.0 + github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 github.com/opencontainers/go-digest v1.0.0 github.com/opencontainers/image-spec v1.1.1 github.com/sirupsen/logrus v1.9.3 @@ -18,7 +18,7 @@ require ( require ( github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect - github.com/fxamacker/cbor/v2 v2.7.0 // indirect + github.com/fxamacker/cbor/v2 v2.8.0 // indirect github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect github.com/go-ldap/ldap/v3 v3.4.10 // indirect github.com/golang-jwt/jwt/v4 v4.5.2 // indirect @@ -26,8 +26,8 @@ require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect - golang.org/x/crypto v0.33.0 // indirect - golang.org/x/mod v0.23.0 // indirect + golang.org/x/crypto v0.37.0 // indirect + golang.org/x/mod v0.24.0 // indirect golang.org/x/sync v0.10.0 // indirect golang.org/x/sys v0.32.0 // indirect ) diff --git a/go.sum b/go.sum index a7fd1a327..abfc0e88c 100644 --- a/go.sum +++ b/go.sum @@ -6,8 +6,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6N github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E= -github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ= +github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU= +github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk= github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-ldap/ldap/v3 v3.4.10 h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJU= @@ -36,19 +36,14 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs= github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY= github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc= -github.com/notaryproject/notation-core-go v1.2.0 h1:WElMG9X0YXJhBd0A4VOxLNalTLrTjvqtIAj7JHr5X08= -github.com/notaryproject/notation-core-go v1.2.0/go.mod h1:+y3L1dOs2/ZwJIU5Imo7BBvZ/M3CFjXkydGGdK09EtA= -<<<<<<< HEAD +github.com/notaryproject/notation-core-go v1.3.0 h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs= +github.com/notaryproject/notation-core-go v1.3.0/go.mod h1:hzvEOit5lXfNATGNBT8UQRx2J6Fiw/dq/78TQL8aE64= github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAylOKoFjTd6o= github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= -======= -github.com/notaryproject/notation-go v1.2.0-beta.1.0.20250310060348-fdcf9cc47604 h1:uw65pHgN+NXAqHssmlRJUkcl515AQgMIOdC6tbBHHXE= -github.com/notaryproject/notation-go v1.2.0-beta.1.0.20250310060348-fdcf9cc47604/go.mod h1:NXYZyzIawUSyv+C0Gs8bBYJ1q8a1gy78GEss8fPNZmY= ->>>>>>> b7a2f0c (fix: plugin error message (#1217)) github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4= github.com/notaryproject/notation-plugin-framework-go v1.0.0/go.mod h1:RqWSrTOtEASCrGOEffq0n8pSg2KOgKYiWqFWczRSics= -github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1SDX8YNv4Dg4= -github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs= +github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 h1:Ay72jBeHKqBFk6TbJWywfwzefN3Ei7Py2OzCiWU/7nk= +github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01/go.mod h1:3ZJPmpmdwufY23BkS+JPNktOVb5DXJ8Ik5zxvN7h670= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= @@ -83,15 +78,15 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= -golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus= -golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= +golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE= +golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM= -golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY= +golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU= +golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= diff --git a/test/e2e/go.mod b/test/e2e/go.mod index 1285d0f34..701083f01 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -3,7 +3,7 @@ module github.com/notaryproject/notation/test/e2e go 1.23.0 require ( - github.com/notaryproject/notation-core-go v1.2.0 + github.com/notaryproject/notation-core-go v1.3.0 github.com/notaryproject/notation-go v1.3.1 github.com/onsi/ginkgo/v2 v2.23.4 github.com/onsi/gomega v1.37.0 @@ -12,26 +12,21 @@ require ( ) require ( - github.com/fxamacker/cbor/v2 v2.7.0 // indirect + github.com/fxamacker/cbor/v2 v2.8.0 // indirect github.com/go-logr/logr v1.4.2 // indirect github.com/go-task/slim-sprig/v3 v3.0.0 // indirect github.com/google/go-cmp v0.7.0 // indirect -<<<<<<< HEAD - github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect - github.com/notaryproject/tspclient-go v1.0.0 // indirect -======= github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 // indirect ->>>>>>> 2af2853 (build(deps): Bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 in /test/e2e (#1252)) github.com/opencontainers/go-digest v1.0.0 // indirect github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect go.uber.org/automaxprocs v1.6.0 // indirect - golang.org/x/crypto v0.36.0 // indirect + golang.org/x/crypto v0.37.0 // indirect golang.org/x/net v0.38.0 // indirect - golang.org/x/sync v0.12.0 // indirect + golang.org/x/sync v0.13.0 // indirect golang.org/x/sys v0.32.0 // indirect - golang.org/x/text v0.23.0 // indirect + golang.org/x/text v0.24.0 // indirect golang.org/x/tools v0.31.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/test/e2e/go.sum b/test/e2e/go.sum index 63cf3555d..008dcf481 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -1,40 +1,27 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E= -github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ= +github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU= +github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -<<<<<<< HEAD -github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg= -github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144= -github.com/notaryproject/notation-core-go v1.2.0 h1:WElMG9X0YXJhBd0A4VOxLNalTLrTjvqtIAj7JHr5X08= -github.com/notaryproject/notation-core-go v1.2.0/go.mod h1:+y3L1dOs2/ZwJIU5Imo7BBvZ/M3CFjXkydGGdK09EtA= -github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAylOKoFjTd6o= -github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= -github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1SDX8YNv4Dg4= -github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs= -github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0= -github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM= -======= github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8= github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/notaryproject/notation-core-go v1.2.1-0.20250325094510-4d7353253409 h1:UakQ5ASMDmDVWyRvVnl2h5ecjABvakCIJmJQgGsio/E= -github.com/notaryproject/notation-core-go v1.2.1-0.20250325094510-4d7353253409/go.mod h1:w2jtfaWSn3w+x86o2AaWiImyXH18+u2ohLVaHW1tAs8= -github.com/notaryproject/notation-go v1.2.0-beta.1.0.20250325093958-3bd0ac92b2ba h1:UlkFxK3IUPoV9OHyEV6Z6qzVJSgTPavE1fwnMIc1WsI= -github.com/notaryproject/notation-go v1.2.0-beta.1.0.20250325093958-3bd0ac92b2ba/go.mod h1:M2qB0+yI2KlpdBo66ZfSti3jvCVYYS+jIsdaj8M2fac= +github.com/notaryproject/notation-core-go v1.3.0 h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs= +github.com/notaryproject/notation-core-go v1.3.0/go.mod h1:hzvEOit5lXfNATGNBT8UQRx2J6Fiw/dq/78TQL8aE64= +github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAylOKoFjTd6o= +github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 h1:Ay72jBeHKqBFk6TbJWywfwzefN3Ei7Py2OzCiWU/7nk= github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01/go.mod h1:3ZJPmpmdwufY23BkS+JPNktOVb5DXJ8Ik5zxvN7h670= github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus= github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8= ->>>>>>> 2af2853 (build(deps): Bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 in /test/e2e (#1252)) github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y= github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= @@ -53,16 +40,16 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs= go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8= -golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34= -golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc= +golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE= +golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8= golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= -golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= -golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610= +golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20= golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= -golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY= -golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4= +golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= +golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU= golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ= google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM= diff --git a/test/e2e/plugin/go.mod b/test/e2e/plugin/go.mod index 24a218b48..09b5656c9 100644 --- a/test/e2e/plugin/go.mod +++ b/test/e2e/plugin/go.mod @@ -1,10 +1,10 @@ module github.com/notaryproject/notation/test/e2e/plugin -go 1.23 +go 1.23.0 require ( github.com/golang-jwt/jwt v3.2.2+incompatible - github.com/notaryproject/notation-core-go v1.2.0 + github.com/notaryproject/notation-core-go v1.3.0 github.com/notaryproject/notation-go v1.3.1 github.com/notaryproject/notation-plugin-framework-go v1.0.0 github.com/spf13/cobra v1.9.1 @@ -12,7 +12,7 @@ require ( require ( github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect - github.com/fxamacker/cbor/v2 v2.7.0 // indirect + github.com/fxamacker/cbor/v2 v2.8.0 // indirect github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect github.com/go-ldap/ldap/v3 v3.4.10 // indirect github.com/golang-jwt/jwt/v4 v4.5.2 // indirect @@ -24,8 +24,8 @@ require ( github.com/spf13/pflag v1.0.6 // indirect github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect - golang.org/x/crypto v0.33.0 // indirect - golang.org/x/mod v0.23.0 // indirect + golang.org/x/crypto v0.37.0 // indirect + golang.org/x/mod v0.24.0 // indirect golang.org/x/sync v0.10.0 // indirect oras.land/oras-go/v2 v2.5.0 // indirect ) diff --git a/test/e2e/plugin/go.sum b/test/e2e/plugin/go.sum index 9bef4c963..ff806dc28 100644 --- a/test/e2e/plugin/go.sum +++ b/test/e2e/plugin/go.sum @@ -6,8 +6,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6N github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E= -github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ= +github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU= +github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk= github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-ldap/ldap/v3 v3.4.10 h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJU= @@ -38,8 +38,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs= github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY= github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc= -github.com/notaryproject/notation-core-go v1.2.0 h1:WElMG9X0YXJhBd0A4VOxLNalTLrTjvqtIAj7JHr5X08= -github.com/notaryproject/notation-core-go v1.2.0/go.mod h1:+y3L1dOs2/ZwJIU5Imo7BBvZ/M3CFjXkydGGdK09EtA= +github.com/notaryproject/notation-core-go v1.3.0 h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs= +github.com/notaryproject/notation-core-go v1.3.0/go.mod h1:hzvEOit5lXfNATGNBT8UQRx2J6Fiw/dq/78TQL8aE64= github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAylOKoFjTd6o= github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4= @@ -77,15 +77,15 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= -golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus= -golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= +golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE= +golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM= -golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY= +golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU= +golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= diff --git a/test/e2e/suite/trustpolicy/verification_level.go b/test/e2e/suite/trustpolicy/verification_level.go index 3f6c1197c..a383b6677 100644 --- a/test/e2e/suite/trustpolicy/verification_level.go +++ b/test/e2e/suite/trustpolicy/verification_level.go @@ -174,7 +174,7 @@ var _ = Describe("notation trust policy verification level test", func() { notation.Exec("verify", artifact.ReferenceWithDigest(), "-v"). MatchErrKeyWords("Warning: authenticity was set to \"log\"", - "signature is not produced by a trusted signer"). + "the signature's certificate chain does not contain any trusted certificate"). MatchKeyWords(VerifySuccessfully) }) }) @@ -244,7 +244,7 @@ var _ = Describe("notation trust policy verification level test", func() { notation.Exec("verify", artifact.ReferenceWithDigest(), "-v"). MatchErrKeyWords("Warning: authenticity was set to \"log\"", - "signature is not produced by a trusted signer"). + "the signature's certificate chain does not contain any trusted certificate"). MatchKeyWords(VerifySuccessfully) }) }) @@ -289,7 +289,7 @@ var _ = Describe("notation trust policy verification level test", func() { notation.Exec("verify", artifact.ReferenceWithDigest(), "-v"). MatchErrKeyWords("Warning: authenticity was set to \"log\"", - "signature is not produced by a trusted signer"). + "the signature's certificate chain does not contain any trusted certificate"). MatchKeyWords(VerifySuccessfully) }) }) From dfb0e93ec601c90b684c62854e7fa99f97205572 Mon Sep 17 00:00:00 2001 From: Patrick Zheng Date: Wed, 23 Apr 2025 14:34:08 +0800 Subject: [PATCH 35/35] bump up dependencies Signed-off-by: Patrick Zheng --- go.mod | 2 +- go.sum | 4 ++-- test/e2e/go.mod | 2 +- test/e2e/go.sum | 4 ++-- test/e2e/plugin/go.mod | 6 +++--- test/e2e/plugin/go.sum | 12 ++++++------ 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index bc636a57e..c2b5f841f 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.23.0 require ( github.com/notaryproject/notation-core-go v1.3.0 - github.com/notaryproject/notation-go v1.3.1 + github.com/notaryproject/notation-go v1.3.2 github.com/notaryproject/notation-plugin-framework-go v1.0.0 github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 github.com/opencontainers/go-digest v1.0.0 diff --git a/go.sum b/go.sum index abfc0e88c..4727de990 100644 --- a/go.sum +++ b/go.sum @@ -38,8 +38,8 @@ github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZ github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc= github.com/notaryproject/notation-core-go v1.3.0 h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs= github.com/notaryproject/notation-core-go v1.3.0/go.mod h1:hzvEOit5lXfNATGNBT8UQRx2J6Fiw/dq/78TQL8aE64= -github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAylOKoFjTd6o= -github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= +github.com/notaryproject/notation-go v1.3.2 h1:4223iLXOHhEV7ZPzIUJEwwMkhlgzoYFCsMJvSH1Chb8= +github.com/notaryproject/notation-go v1.3.2/go.mod h1:/1kuq5WuLF6Gaer5re0Z6HlkQRlKYO4EbWWT/L7J1Uw= github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4= github.com/notaryproject/notation-plugin-framework-go v1.0.0/go.mod h1:RqWSrTOtEASCrGOEffq0n8pSg2KOgKYiWqFWczRSics= github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 h1:Ay72jBeHKqBFk6TbJWywfwzefN3Ei7Py2OzCiWU/7nk= diff --git a/test/e2e/go.mod b/test/e2e/go.mod index 701083f01..5ec245654 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -4,7 +4,7 @@ go 1.23.0 require ( github.com/notaryproject/notation-core-go v1.3.0 - github.com/notaryproject/notation-go v1.3.1 + github.com/notaryproject/notation-go v1.3.2 github.com/onsi/ginkgo/v2 v2.23.4 github.com/onsi/gomega v1.37.0 github.com/opencontainers/image-spec v1.1.1 diff --git a/test/e2e/go.sum b/test/e2e/go.sum index 008dcf481..9a11a48af 100644 --- a/test/e2e/go.sum +++ b/test/e2e/go.sum @@ -16,8 +16,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/notaryproject/notation-core-go v1.3.0 h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs= github.com/notaryproject/notation-core-go v1.3.0/go.mod h1:hzvEOit5lXfNATGNBT8UQRx2J6Fiw/dq/78TQL8aE64= -github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAylOKoFjTd6o= -github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= +github.com/notaryproject/notation-go v1.3.2 h1:4223iLXOHhEV7ZPzIUJEwwMkhlgzoYFCsMJvSH1Chb8= +github.com/notaryproject/notation-go v1.3.2/go.mod h1:/1kuq5WuLF6Gaer5re0Z6HlkQRlKYO4EbWWT/L7J1Uw= github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 h1:Ay72jBeHKqBFk6TbJWywfwzefN3Ei7Py2OzCiWU/7nk= github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01/go.mod h1:3ZJPmpmdwufY23BkS+JPNktOVb5DXJ8Ik5zxvN7h670= github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus= diff --git a/test/e2e/plugin/go.mod b/test/e2e/plugin/go.mod index 09b5656c9..1f1d351d5 100644 --- a/test/e2e/plugin/go.mod +++ b/test/e2e/plugin/go.mod @@ -5,7 +5,7 @@ go 1.23.0 require ( github.com/golang-jwt/jwt v3.2.2+incompatible github.com/notaryproject/notation-core-go v1.3.0 - github.com/notaryproject/notation-go v1.3.1 + github.com/notaryproject/notation-go v1.3.2 github.com/notaryproject/notation-plugin-framework-go v1.0.0 github.com/spf13/cobra v1.9.1 ) @@ -18,9 +18,9 @@ require ( github.com/golang-jwt/jwt/v4 v4.5.2 // indirect github.com/google/uuid v1.6.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/notaryproject/tspclient-go v1.0.0 // indirect + github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect - github.com/opencontainers/image-spec v1.1.0 // indirect + github.com/opencontainers/image-spec v1.1.1 // indirect github.com/spf13/pflag v1.0.6 // indirect github.com/veraison/go-cose v1.3.0 // indirect github.com/x448/float16 v0.8.4 // indirect diff --git a/test/e2e/plugin/go.sum b/test/e2e/plugin/go.sum index ff806dc28..3d81726c5 100644 --- a/test/e2e/plugin/go.sum +++ b/test/e2e/plugin/go.sum @@ -40,16 +40,16 @@ github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZ github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc= github.com/notaryproject/notation-core-go v1.3.0 h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs= github.com/notaryproject/notation-core-go v1.3.0/go.mod h1:hzvEOit5lXfNATGNBT8UQRx2J6Fiw/dq/78TQL8aE64= -github.com/notaryproject/notation-go v1.3.1 h1:JLJ9HiwMwPAFNkJEBkF8iBdNazdEKrGAylOKoFjTd6o= -github.com/notaryproject/notation-go v1.3.1/go.mod h1:Qytzn2v8nYkA9G44fbXKh1Tnvz8ONmod2Tgtkrl5zYc= +github.com/notaryproject/notation-go v1.3.2 h1:4223iLXOHhEV7ZPzIUJEwwMkhlgzoYFCsMJvSH1Chb8= +github.com/notaryproject/notation-go v1.3.2/go.mod h1:/1kuq5WuLF6Gaer5re0Z6HlkQRlKYO4EbWWT/L7J1Uw= github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4= github.com/notaryproject/notation-plugin-framework-go v1.0.0/go.mod h1:RqWSrTOtEASCrGOEffq0n8pSg2KOgKYiWqFWczRSics= -github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1SDX8YNv4Dg4= -github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs= +github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01 h1:Ay72jBeHKqBFk6TbJWywfwzefN3Ei7Py2OzCiWU/7nk= +github.com/notaryproject/tspclient-go v1.0.1-0.20250306063739-4f55b14d9f01/go.mod h1:3ZJPmpmdwufY23BkS+JPNktOVb5DXJ8Ik5zxvN7h670= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= -github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug= -github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM= +github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= +github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=