vendor: update container-libs to latest

Signed-off-by: Byounguk Lee <nimdrak@gmail.com>

go.mod

@@ -65,9 +65,9 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	go.etcd.io/bbolt v1.4.3
 	go.podman.io/buildah v1.42.1-0.20260501153811-377cf64e213b
-	go.podman.io/common v0.67.2-0.20260511131139-020a2274da88
-	go.podman.io/image/v5 v5.39.3-0.20260511131139-020a2274da88
-	go.podman.io/storage v1.62.1-0.20260511131139-020a2274da88
+	go.podman.io/common v0.67.2-0.20260515151312-e2c14667a598
+	go.podman.io/image/v5 v5.39.3-0.20260515151312-e2c14667a598
+	go.podman.io/storage v1.62.1-0.20260515151312-e2c14667a598
 	golang.org/x/crypto v0.51.0
 	golang.org/x/net v0.54.0
 	golang.org/x/sync v0.20.0
@@ -110,7 +110,7 @@ require (
 	github.com/digitalocean/go-libvirt v0.0.0-20220804181439-8648fbde413e // indirect
 	github.com/disiqueira/gotree/v3 v3.0.2 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/docker-credential-helpers v0.9.6 // indirect
+	github.com/docker/docker-credential-helpers v0.9.7 // indirect
 	github.com/ebitengine/purego v0.10.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
@@ -159,7 +159,7 @@ require (
 	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
 	github.com/sigstore/fulcio v1.8.5 // indirect
 	github.com/sigstore/protobuf-specs v0.5.0 // indirect
-	github.com/sigstore/sigstore v1.10.5 // indirect
+	github.com/sigstore/sigstore v1.10.6 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
 	github.com/smallstep/pkcs7 v0.1.1 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
@@ -188,9 +188,3 @@ require (
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	tags.cncf.io/container-device-interface/specs-go v1.1.0 // indirect
 )
-
-replace go.podman.io/common => github.com/Luap99/container-libs/common v0.0.0-20260507114201-8488036ffdbc
-
-replace go.podman.io/image/v5 => github.com/Luap99/container-libs/image/v5 v5.0.0-20260507114201-8488036ffdbc
-
-replace go.podman.io/storage => github.com/Luap99/container-libs/storage v0.0.0-20260507114201-8488036ffdbc

go.sum

@@ -8,12 +8,6 @@ github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEK
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/Luap99/container-libs/common v0.0.0-20260507114201-8488036ffdbc h1:XmY0KOb6HkYOETGKD9fsTU65LgdZv4GbzEaVhTgIY5I=
-github.com/Luap99/container-libs/common v0.0.0-20260507114201-8488036ffdbc/go.mod h1:TYI+ocF4gfL8QCBo5GqOSUAOA3QnVgkjjg/nQZRG3o0=
-github.com/Luap99/container-libs/image/v5 v5.0.0-20260507114201-8488036ffdbc h1:36O4RycVrjqNeYHRBPCF2240RomNXBRlHKWUI8Sjlz0=
-github.com/Luap99/container-libs/image/v5 v5.0.0-20260507114201-8488036ffdbc/go.mod h1:D+09OPzsrFuzeKqsJEaaxtItkSd12+eZyOdFyuJF8TY=
-github.com/Luap99/container-libs/storage v0.0.0-20260507114201-8488036ffdbc h1:CvYOTQYMWI4zo43NuBwdLK9WRlC0CkzEMnrtsfLRxxY=
-github.com/Luap99/container-libs/storage v0.0.0-20260507114201-8488036ffdbc/go.mod h1:eZIqDigffFi9NlPezLvUVw/nsUIruaui436E5E4GmXs=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -104,12 +98,12 @@ github.com/disiqueira/gotree/v3 v3.0.2 h1:ik5iuLQQoufZBNPY518dXhiO5056hyNBIK9lWh
 github.com/disiqueira/gotree/v3 v3.0.2/go.mod h1:ZuyjE4+mUQZlbpkI24AmruZKhg3VHEgPLDY8Qk+uUu8=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v29.4.2+incompatible h1:nhxMY4v7wB0QMMc5ppeqV6FBMwzqv0n4t2gogu/R2DQ=
-github.com/docker/cli v29.4.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.5.0+incompatible h1:FPUvKJoKpeP4Njz8NrQdeUN8o247P7ndTiILtaP5/l4=
+github.com/docker/cli v29.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker-credential-helpers v0.9.6 h1:cT2PbRPSlnMmNTfT2TDMXRyQ1KMWHG7xoTLBcn1ZNv0=
-github.com/docker/docker-credential-helpers v0.9.6/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
+github.com/docker/docker-credential-helpers v0.9.7 h1:jaPIxEIDz5bQeghNAdzz0ETwMMnM4vzjZlxz3pWP4JA=
+github.com/docker/docker-credential-helpers v0.9.7/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
 github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-plugins-helpers v0.0.0-20240701071450-45e2431495c8 h1:IMfrF5LCzP2Vhw7j4IIH3HxPsCLuZYjDqFAM/C88ulg=
@@ -345,8 +339,8 @@ github.com/sigstore/fulcio v1.8.5 h1:HYTD1/L5wlBp8JxsWxUf8hmfaNBBF/x3r3p5l6tZwbA
 github.com/sigstore/fulcio v1.8.5/go.mod h1:tSLYK3JsKvJpDW1BsIsVHZgHj+f8TjXARzqIUWSsSPQ=
 github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
 github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
-github.com/sigstore/sigstore v1.10.5 h1:KqrOjDhNOVY+uOzQFat2FrGLClPPCb3uz8pK3wuI+ow=
-github.com/sigstore/sigstore v1.10.5/go.mod h1:k/mcVVXw3I87dYG/iCVTSW2xTrW7vPzxxGic4KqsqXs=
+github.com/sigstore/sigstore v1.10.6 h1:YWhMQfTrJSK80QB1pbxjYeAwGKx+5UwWPPAY9hrPPZg=
+github.com/sigstore/sigstore v1.10.6/go.mod h1:k/mcVVXw3I87dYG/iCVTSW2xTrW7vPzxxGic4KqsqXs=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
@@ -437,6 +431,12 @@ go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09
 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.podman.io/buildah v1.42.1-0.20260501153811-377cf64e213b h1:i8ntFzITajbJA3ojnA0ZdpbC+I+ccweZvZaGIhQb4i8=
 go.podman.io/buildah v1.42.1-0.20260501153811-377cf64e213b/go.mod h1:hPvgsjBU09C+15fKoIZJvKvNaxR+c0QvMg/n4NgBS7A=
+go.podman.io/common v0.67.2-0.20260515151312-e2c14667a598 h1:siUEt+Q/qN+1TI4/dem6kaI4x4hnanj0CPKIYLAA5x8=
+go.podman.io/common v0.67.2-0.20260515151312-e2c14667a598/go.mod h1:Zw3/xJw/PY5FERQykTNIWFAJzL9ism2LaWFrmvFlBjo=
+go.podman.io/image/v5 v5.39.3-0.20260515151312-e2c14667a598 h1:nHqODDlrwo33mxXf5qH7b7rjcc2ZVmR8xSTdvAApOrg=
+go.podman.io/image/v5 v5.39.3-0.20260515151312-e2c14667a598/go.mod h1:PehFFa+D1wGt+GL5PCm0BupwarWcFFnOpZyQkF0eGdw=
+go.podman.io/storage v1.62.1-0.20260515151312-e2c14667a598 h1:HtvnEpmKdzedYRDIBFIrVJummv3WnflKYEhK+3twZs0=
+go.podman.io/storage v1.62.1-0.20260515151312-e2c14667a598/go.mod h1:z4Z9K+7GhKjWL/Y1O17+4f8a1KGijVeC9hr3tymhSOs=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=

vendor/github.com/sigstore/sigstore/pkg/oauth/interactive.go

@@ -65,18 +65,12 @@ func GetInteractiveSuccessHTML(autoclose bool, timeout int) (string, error) {
 					<span class="sigstore">sigstore </span>
 					<span>authentication successful!</span>
 				</div>
-				{{ if .Autoclose -}}
 				<small name="autoclose"></small>
 				<noscript>
 					<div class="content">
 						<span>You may now close this page.</span>
 					</div>
 				</noscript>
-				{{- else -}}
-				<div class="content">
-					<span>You may now close this page.</span>
-				</div>
-				{{- end }}
 			</div>
 			<div class="anchor">
 				<div class="links">

vendor/go.podman.io/common/pkg/config/config_linux.go

@@ -1,14 +1,9 @@
 package config
 
 import (
-	selinux "github.com/opencontainers/selinux/go-selinux"
 	"go.podman.io/common/pkg/capabilities"
 )
 
-func selinuxEnabled() bool {
-	return selinux.GetEnabled()
-}
-
 var defaultHelperBinariesDir = []string{
 	"/usr/local/libexec/podman",
 	"/usr/local/lib/podman",

vendor/go.podman.io/common/pkg/config/config_unsupported.go

@@ -2,10 +2,6 @@
 
 package config
 
-func selinuxEnabled() bool {
-	return false
-}
-
 // Capabilities returns the capabilities parses the Add and Drop capability
 // list from the default capabilities for the container.
 func (c *Config) Capabilities(user string, addCapabilities, dropCapabilities []string) ([]string, error) {

vendor/go.podman.io/common/pkg/config/default.go

@@ -220,7 +220,7 @@ func defaultConfig() (*Config, error) {
 			DefaultSysctls:      configfile.Slice{},
 			Devices:             configfile.Slice{},
 			EnableKeyring:       true,
-			EnableLabeling:      selinuxEnabled(),
+			EnableLabeling:      selinux.GetEnabled(),
 			Env:                 configfile.NewSlice(defaultContainerEnv),
 			EnvHost:             false,
 			HTTPProxy:           true,

vendor/go.podman.io/common/pkg/libartifact/store.go

@@ -94,6 +94,16 @@ func (as *ArtifactStore) EventChannel() chan *Event {
 	return as.eventChannel
 }
 
+// CloseEventChannel closes the event channel to signal listeners that
+// the artifact store has stopped emitting events.
+// WARNING: EventChannel and CloseEventChannel are not safe for concurrent use.
+func (as *ArtifactStore) CloseEventChannel() {
+	if as.eventChannel != nil {
+		close(as.eventChannel)
+		as.eventChannel = nil
+	}
+}
+
 // lookupArtifactLocked looks up an artifact by fully qualified name,
 // or name@digest, full ID, or partial ID.
 // note: lookupArtifactLocked must be called while under a store lock

vendor/go.podman.io/common/pkg/subscriptions/mounts.conf

@@ -1 +0,0 @@
-/usr/share/rhel/secrets:/run/secrets

vendor/go.podman.io/storage/layers.go

@@ -980,7 +980,9 @@ func (r *layerStore) load(lockedForWriting bool) (bool, error) {
 			tocsums[layer.TOCDigest] = append(tocsums[layer.TOCDigest], layer.ID)
 		}
 		if layer.MountLabel != "" {
-			selinux.ReserveLabel(layer.MountLabel)
+			if err := selinux.ReserveLabelV2(layer.MountLabel); err != nil && !errors.Is(err, selinux.ErrMCSAlreadyExists) {
+				return false, fmt.Errorf("unable to reserve SELinux label: %w", err)
+			}
 		}
 		layer.ReadOnly = !r.lockfile.IsReadWrite()
 		// The r.lockfile.IsReadWrite() condition maintains past practice:
@@ -1574,7 +1576,9 @@ func (r *layerStore) create(id string, parentLayer *Layer, names []string, mount
 		templateIDMappings = &idtools.IDMappings{}
 	}
 	if mountLabel != "" {
-		selinux.ReserveLabel(mountLabel)
+		if err := selinux.ReserveLabelV2(mountLabel); err != nil && !errors.Is(err, selinux.ErrMCSAlreadyExists) {
+			return nil, -1, fmt.Errorf("unable to reserve SELinux label: %w", err)
+		}
 	}
 
 	// Before actually creating the layer, make a persistent record of it

vendor/go.podman.io/storage/pkg/configfile/parse.go

@@ -400,26 +400,32 @@ func readDropInsFromPaths(paths []string, suffix string) ([]string, error) {
 
 func getDropInPathsUnderMain(mainPath, suffix string, uid int) []string {
 	paths := make([]string, 0, 3)
-	paths = append(paths, mainPath+dropInSuffix)
 
-	rootless := uid > 0
-	var specialName string
-	if rootless {
-		specialName = "rootless"
-	} else {
-		specialName = "rootful"
-	}
-	// insert the name after the main config name but before the extension if it has one.
-	mainPath, cut := strings.CutSuffix(mainPath, suffix)
-	specialPath := mainPath + "." + specialName
-	if cut {
-		specialPath += suffix
-	}
-	specialPath += dropInSuffix
-	paths = append(paths, specialPath)
-	if rootless {
-		paths = append(paths, filepath.Join(specialPath, strconv.Itoa(uid)))
+	// Extra condition for windows where uid is always -1 per os.Getuid().
+	// In this case it makes no sense to give the rootful path, just ignore
+	// the special drop in locations.
+	if uid >= 0 {
+		rootless := uid > 0
+		var specialName string
+		if rootless {
+			specialName = "rootless"
+		} else {
+			specialName = "rootful"
+		}
+		// insert the name after the main config name but before the extension if it has one.
+		specialPrefix, cut := strings.CutSuffix(mainPath, suffix)
+		specialPath := specialPrefix + "." + specialName
+		if cut {
+			specialPath += suffix
+		}
+		specialPath += dropInSuffix
+		if rootless {
+			paths = append(paths, filepath.Join(specialPath, strconv.Itoa(uid)))
+		}
+		paths = append(paths, specialPath)
 	}
+
+	paths = append(paths, mainPath+dropInSuffix)
 	return paths
 }
 

vendor/modules.txt

@@ -186,7 +186,7 @@ github.com/distribution/reference
 ## explicit
 github.com/docker/distribution/registry/api/errcode
 github.com/docker/distribution/registry/api/v2
-# github.com/docker/docker-credential-helpers v0.9.6
+# github.com/docker/docker-credential-helpers v0.9.7
 ## explicit; go 1.21
 github.com/docker/docker-credential-helpers/client
 github.com/docker/docker-credential-helpers/credentials
@@ -582,7 +582,7 @@ github.com/sigstore/fulcio/pkg/certificate
 # github.com/sigstore/protobuf-specs v0.5.0
 ## explicit; go 1.22.0
 github.com/sigstore/protobuf-specs/gen/pb-go/common/v1
-# github.com/sigstore/sigstore v1.10.5
+# github.com/sigstore/sigstore v1.10.6
 ## explicit; go 1.25.0
 github.com/sigstore/sigstore/pkg/cryptoutils
 github.com/sigstore/sigstore/pkg/oauth
@@ -735,7 +735,7 @@ go.podman.io/buildah/pkg/sshagent
 go.podman.io/buildah/pkg/util
 go.podman.io/buildah/pkg/volumes
 go.podman.io/buildah/util
-# go.podman.io/common v0.67.2-0.20260511131139-020a2274da88 => github.com/Luap99/container-libs/common v0.0.0-20260507114201-8488036ffdbc
+# go.podman.io/common v0.67.2-0.20260515151312-e2c14667a598
 ## explicit; go 1.25.6
 go.podman.io/common/internal
 go.podman.io/common/libimage
@@ -801,7 +801,7 @@ go.podman.io/common/pkg/umask
 go.podman.io/common/pkg/util
 go.podman.io/common/pkg/version
 go.podman.io/common/version
-# go.podman.io/image/v5 v5.39.3-0.20260511131139-020a2274da88 => github.com/Luap99/container-libs/image/v5 v5.0.0-20260507114201-8488036ffdbc
+# go.podman.io/image/v5 v5.39.3-0.20260515151312-e2c14667a598
 ## explicit; go 1.25.6
 go.podman.io/image/v5/copy
 go.podman.io/image/v5/directory
@@ -878,7 +878,7 @@ go.podman.io/image/v5/transports
 go.podman.io/image/v5/transports/alltransports
 go.podman.io/image/v5/types
 go.podman.io/image/v5/version
-# go.podman.io/storage v1.62.1-0.20260511131139-020a2274da88 => github.com/Luap99/container-libs/storage v0.0.0-20260507114201-8488036ffdbc
+# go.podman.io/storage v1.62.1-0.20260515151312-e2c14667a598
 ## explicit; go 1.25.0
 go.podman.io/storage
 go.podman.io/storage/drivers
@@ -1182,6 +1182,3 @@ tags.cncf.io/container-device-interface/pkg/parser
 # tags.cncf.io/container-device-interface/specs-go v1.1.0
 ## explicit; go 1.19
 tags.cncf.io/container-device-interface/specs-go
-# go.podman.io/common => github.com/Luap99/container-libs/common v0.0.0-20260507114201-8488036ffdbc
-# go.podman.io/image/v5 => github.com/Luap99/container-libs/image/v5 v5.0.0-20260507114201-8488036ffdbc
-# go.podman.io/storage => github.com/Luap99/container-libs/storage v0.0.0-20260507114201-8488036ffdbc