From 5e74493e93a0a71c885005b99a1c0332e0fa9807 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 15:58:57 +0000 Subject: [PATCH] chore(deps): bump the sigstore group with 5 updates Bumps the sigstore group with 5 updates: | Package | From | To | | --- | --- | --- | | [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.9` | `1.10.10` | | [github.com/sigstore/sigstore/pkg/signature/kms/aws](https://github.com/sigstore/sigstore) | `1.10.9` | `1.10.10` | | [github.com/sigstore/sigstore/pkg/signature/kms/azure](https://github.com/sigstore/sigstore) | `1.10.9` | `1.10.10` | | [github.com/sigstore/sigstore/pkg/signature/kms/gcp](https://github.com/sigstore/sigstore) | `1.10.9` | `1.10.10` | | [github.com/sigstore/sigstore/pkg/signature/kms/hashivault](https://github.com/sigstore/sigstore) | `1.10.9` | `1.10.10` | Updates `github.com/sigstore/sigstore` from 1.10.9 to 1.10.10 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.10.9...v1.10.10) Updates `github.com/sigstore/sigstore/pkg/signature/kms/aws` from 1.10.9 to 1.10.10 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.10.9...v1.10.10) Updates `github.com/sigstore/sigstore/pkg/signature/kms/azure` from 1.10.9 to 1.10.10 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.10.9...v1.10.10) Updates `github.com/sigstore/sigstore/pkg/signature/kms/gcp` from 1.10.9 to 1.10.10 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.10.9...v1.10.10) Updates `github.com/sigstore/sigstore/pkg/signature/kms/hashivault` from 1.10.9 to 1.10.10 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](https://github.com/sigstore/sigstore/compare/v1.10.9...v1.10.10) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-version: 1.10.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: sigstore - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/aws dependency-version: 1.10.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: sigstore - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/azure dependency-version: 1.10.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: sigstore - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/gcp dependency-version: 1.10.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: sigstore - dependency-name: github.com/sigstore/sigstore/pkg/signature/kms/hashivault dependency-version: 1.10.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: sigstore ... Signed-off-by: dependabot[bot] --- go.mod | 90 +- go.sum | 184 ++-- vendor/cloud.google.com/go/auth/CHANGES.md | 41 + .../go/auth/credentials/detect.go | 16 +- .../go/auth/credentials/filetypes.go | 46 +- .../go/auth/credentials/idtoken/file.go | 84 +- .../go/auth/credentials/idtoken/idtoken.go | 6 +- .../internal/externalaccount/x509_provider.go | 68 +- .../go/auth/grpctransport/directpath.go | 4 +- .../go/auth/grpctransport/grpctransport.go | 4 +- .../go/auth/httptransport/transport.go | 5 + .../go/auth/internal/internal.go | 47 +- .../external_accounts_config_providers.go | 30 +- .../regional_access_boundary.go | 503 ++++++++++ .../go/auth/internal/retry/retry.go | 70 +- .../internal/retry/retry_linux.go} | 25 +- .../internal/transport/cert/workload_cert.go | 97 +- .../internal/transport/headers/headers.go | 35 +- .../internal/trustboundary/trust_boundary.go | 392 -------- .../go/auth/internal/version.go | 2 +- .../go/firestore/apiv1/firestore_client.go | 36 +- .../firestorepb/aggregation_result.pb.go | 2 +- .../apiv1/firestorepb/bloom_filter.pb.go | 2 +- .../firestore/apiv1/firestorepb/common.pb.go | 131 ++- .../apiv1/firestorepb/document.pb.go | 2 +- .../apiv1/firestorepb/explain_stats.pb.go | 2 +- .../apiv1/firestorepb/firestore.pb.go | 25 +- .../apiv1/firestorepb/firestore_grpc.pb.go | 2 +- .../apiv1/firestorepb/pipeline.pb.go | 2 +- .../firestore/apiv1/firestorepb/query.pb.go | 18 +- .../apiv1/firestorepb/query_profile.pb.go | 2 +- .../firestore/apiv1/firestorepb/write.pb.go | 2 +- .../go/firestore/internal/version.go | 2 +- .../apiv3/v2/alert_policy_client.go | 4 +- .../go/monitoring/apiv3/v2/group_client.go | 4 +- .../go/monitoring/apiv3/v2/metric_client.go | 4 +- .../apiv3/v2/notification_channel_client.go | 4 +- .../go/monitoring/apiv3/v2/query_client.go | 4 +- .../apiv3/v2/service_monitoring_client.go | 4 +- .../go/monitoring/apiv3/v2/snooze_client.go | 4 +- .../apiv3/v2/uptime_check_client.go | 4 +- .../go/monitoring/internal/version.go | 2 +- .../azure-sdk-for-go/sdk/azcore/CHANGELOG.md | 16 + .../Azure/azure-sdk-for-go/sdk/azcore/doc.go | 5 +- .../sdk/azcore/internal/exported/request.go | 109 +++ .../sdk/azcore/internal/shared/constants.go | 2 +- .../sdk/azcore/runtime/pager.go | 23 + .../sdk/azcore/runtime/policy_retry.go | 3 +- .../sdk/azcore/runtime/request.go | 61 +- .../sdk/azidentity/CHANGELOG.md | 6 + .../sdk/azidentity/version.go | 2 +- .../apps/confidential/confidential.go | 282 +++++- .../apps/internal/base/base.go | 96 +- .../base/storage/partitioned_storage.go | 12 +- .../apps/internal/exported/exported.go | 4 + .../apps/internal/json/json.go | 21 +- .../apps/internal/oauth/oauth.go | 12 + .../oauth/ops/accesstokens/accesstokens.go | 39 + .../internal/oauth/ops/accesstokens/tokens.go | 6 +- .../internal/oauth/ops/authority/authority.go | 138 ++- .../ops/authority/authorizetype_string.go | 12 +- .../oauth/ops/internal/grant/grant.go | 1 + .../apps/internal/oauth/resolvers.go | 64 +- .../apps/internal/version/version.go | 2 +- .../detectors/gcp/detector.go | 3 + .../detectors/gcp/faas.go | 32 +- .../aws-sdk-go-v2/aws/go_module_metadata.go | 2 +- .../aws-sdk-go-v2/aws/middleware/metadata.go | 17 +- .../aws/aws-sdk-go-v2/aws/retry/middleware.go | 3 + .../aws/signer/internal/v4/headers.go | 4 + .../aws/transport/http/client.go | 64 +- .../aws/transport/http/timeouts.go | 54 ++ .../aws/aws-sdk-go-v2/config/CHANGELOG.md | 59 ++ .../config/go_module_metadata.go | 2 +- .../aws-sdk-go-v2/credentials/CHANGELOG.md | 59 ++ .../endpointcreds/internal/client/client.go | 2 - .../internal/client/middleware.go | 10 +- .../credentials/go_module_metadata.go | 2 +- .../feature/ec2/imds/CHANGELOG.md | 55 ++ .../feature/ec2/imds/go_module_metadata.go | 2 +- .../internal/configsources/CHANGELOG.md | 55 ++ .../configsources/go_module_metadata.go | 2 +- .../internal/endpoints/v2/CHANGELOG.md | 55 ++ .../endpoints/v2/go_module_metadata.go | 2 +- .../internal/timeouts/awsinternal.go | 6 + .../internal/timeouts/timeouts.go | 39 + .../internal/timeouts/timeouts_services.go | 102 ++ .../aws-sdk-go-v2/internal/v4a/CHANGELOG.md | 55 ++ .../internal/v4a/go_module_metadata.go | 2 +- .../internal/accept-encoding/CHANGELOG.md | 24 + .../accept-encoding/go_module_metadata.go | 2 +- .../internal/presigned-url/CHANGELOG.md | 55 ++ .../presigned-url/go_module_metadata.go | 2 +- .../aws-sdk-go-v2/service/kms/CHANGELOG.md | 52 ++ .../aws-sdk-go-v2/service/kms/api_client.go | 61 +- .../service/kms/api_op_CancelKeyDeletion.go | 16 - .../kms/api_op_ConnectCustomKeyStore.go | 16 - .../service/kms/api_op_CreateAlias.go | 16 - .../kms/api_op_CreateCustomKeyStore.go | 16 - .../service/kms/api_op_CreateGrant.go | 16 - .../service/kms/api_op_CreateKey.go | 16 - .../service/kms/api_op_Decrypt.go | 16 - .../service/kms/api_op_DeleteAlias.go | 16 - .../kms/api_op_DeleteCustomKeyStore.go | 16 - .../kms/api_op_DeleteImportedKeyMaterial.go | 16 - .../service/kms/api_op_DeriveSharedSecret.go | 16 - .../kms/api_op_DescribeCustomKeyStores.go | 16 - .../service/kms/api_op_DescribeKey.go | 16 - .../service/kms/api_op_DisableKey.go | 16 - .../service/kms/api_op_DisableKeyRotation.go | 16 - .../kms/api_op_DisconnectCustomKeyStore.go | 16 - .../service/kms/api_op_EnableKey.go | 16 - .../service/kms/api_op_EnableKeyRotation.go | 16 - .../service/kms/api_op_Encrypt.go | 16 - .../service/kms/api_op_GenerateDataKey.go | 16 - .../service/kms/api_op_GenerateDataKeyPair.go | 16 - ..._op_GenerateDataKeyPairWithoutPlaintext.go | 16 - .../api_op_GenerateDataKeyWithoutPlaintext.go | 16 - .../service/kms/api_op_GenerateMac.go | 16 - .../service/kms/api_op_GenerateRandom.go | 16 - .../service/kms/api_op_GetKeyLastUsage.go | 16 - .../service/kms/api_op_GetKeyPolicy.go | 16 - .../kms/api_op_GetKeyRotationStatus.go | 16 - .../kms/api_op_GetParametersForImport.go | 16 - .../service/kms/api_op_GetPublicKey.go | 16 - .../service/kms/api_op_ImportKeyMaterial.go | 16 - .../service/kms/api_op_ListAliases.go | 16 - .../service/kms/api_op_ListGrants.go | 16 - .../service/kms/api_op_ListKeyPolicies.go | 16 - .../service/kms/api_op_ListKeyRotations.go | 16 - .../service/kms/api_op_ListKeys.go | 16 - .../service/kms/api_op_ListResourceTags.go | 16 - .../service/kms/api_op_ListRetirableGrants.go | 16 - .../service/kms/api_op_PutKeyPolicy.go | 16 - .../service/kms/api_op_ReEncrypt.go | 16 - .../service/kms/api_op_ReplicateKey.go | 16 - .../service/kms/api_op_RetireGrant.go | 16 - .../service/kms/api_op_RevokeGrant.go | 16 - .../service/kms/api_op_RotateKeyOnDemand.go | 16 - .../service/kms/api_op_ScheduleKeyDeletion.go | 16 - .../aws-sdk-go-v2/service/kms/api_op_Sign.go | 16 - .../service/kms/api_op_TagResource.go | 16 - .../service/kms/api_op_UntagResource.go | 16 - .../service/kms/api_op_UpdateAlias.go | 16 - .../kms/api_op_UpdateCustomKeyStore.go | 16 - .../kms/api_op_UpdateKeyDescription.go | 16 - .../service/kms/api_op_UpdatePrimaryRegion.go | 16 - .../service/kms/api_op_Verify.go | 16 - .../service/kms/api_op_VerifyMac.go | 16 - .../service/kms/deserializers.go | 598 +++++++----- .../service/kms/go_module_metadata.go | 2 +- .../aws-sdk-go-v2/service/signin/CHANGELOG.md | 61 ++ .../service/signin/api_client.go | 120 +-- .../signin/api_op_CreateOAuth2Token.go | 16 - .../signin/api_op_CreateOAuth2TokenWithIAM.go | 16 - ...DeleteConsoleAuthorizationConfiguration.go | 16 - ...pi_op_DeleteResourcePermissionStatement.go | 16 - ...op_GetConsoleAuthorizationConfiguration.go | 16 - .../signin/api_op_GetResourcePolicy.go | 16 - .../api_op_IntrospectOAuth2TokenWithIAM.go | 16 - ...api_op_ListResourcePermissionStatements.go | 16 - ...op_PutConsoleAuthorizationConfiguration.go | 16 - .../api_op_PutResourcePermissionStatement.go | 16 - .../signin/api_op_RevokeOAuth2TokenWithIAM.go | 16 - .../service/signin/deserializers.go | 121 ++- .../service/signin/go_module_metadata.go | 2 +- .../aws-sdk-go-v2/service/sso/CHANGELOG.md | 61 ++ .../aws-sdk-go-v2/service/sso/api_client.go | 120 +-- .../service/sso/api_op_GetRoleCredentials.go | 16 - .../service/sso/api_op_ListAccountRoles.go | 16 - .../service/sso/api_op_ListAccounts.go | 16 - .../service/sso/api_op_Logout.go | 16 - .../service/sso/deserializers.go | 44 +- .../service/sso/go_module_metadata.go | 2 +- .../service/ssooidc/CHANGELOG.md | 61 ++ .../service/ssooidc/api_client.go | 120 +-- .../service/ssooidc/api_op_CreateToken.go | 16 - .../ssooidc/api_op_CreateTokenWithIAM.go | 16 - .../service/ssooidc/api_op_RegisterClient.go | 16 - .../api_op_StartDeviceAuthorization.go | 16 - .../service/ssooidc/deserializers.go | 44 +- .../service/ssooidc/go_module_metadata.go | 2 +- .../aws-sdk-go-v2/service/sts/CHANGELOG.md | 61 ++ .../aws-sdk-go-v2/service/sts/api_client.go | 120 +-- .../service/sts/api_op_AssumeRole.go | 16 - .../service/sts/api_op_AssumeRoleWithSAML.go | 16 - .../sts/api_op_AssumeRoleWithWebIdentity.go | 16 - .../service/sts/api_op_AssumeRoot.go | 16 - .../sts/api_op_DecodeAuthorizationMessage.go | 16 - .../service/sts/api_op_GetAccessKeyInfo.go | 16 - .../service/sts/api_op_GetCallerIdentity.go | 16 - .../sts/api_op_GetDelegatedAccessToken.go | 16 - .../service/sts/api_op_GetFederationToken.go | 16 - .../service/sts/api_op_GetSessionToken.go | 16 - .../service/sts/api_op_GetWebIdentityToken.go | 16 - .../service/sts/deserializers.go | 121 ++- .../service/sts/go_module_metadata.go | 2 +- vendor/github.com/aws/smithy-go/AGENTS.md | 5 +- vendor/github.com/aws/smithy-go/CHANGELOG.md | 89 ++ vendor/github.com/aws/smithy-go/README.md | 8 +- .../aws/smithy-go/go_module_metadata.go | 2 +- vendor/github.com/aws/smithy-go/schema.go | 36 +- vendor/github.com/aws/smithy-go/schema_ext.go | 11 +- .../smithy-go/transport/http/eventstream.go | 12 +- .../http/middleware_close_response_body.go | 29 + .../http/middleware_content_length.go | 3 + .../aws/smithy-go/transport/http/request.go | 9 + .../github.com/aws/smithy-go/waiter/logger.go | 4 +- .../cli/cli/config/credentials/file_store.go | 43 +- .../v3/upstream_http_11_connect.pb.go | 146 +++ .../upstream_http_11_connect.pb.validate.go | 169 ++++ .../v3/upstream_http_11_connect_vtproto.pb.go | 95 ++ .../go-jose/go-jose/v4/asymmetric.go | 26 +- .../go-jose/go-jose/v4/cipher/cbc_hmac.go | 6 +- .../github.com/go-jose/go-jose/v4/crypter.go | 86 +- .../go-jose/go-jose/v4/json/scanner.go | 19 +- vendor/github.com/go-jose/go-jose/v4/jwe.go | 8 + vendor/github.com/go-jose/go-jose/v4/jwk.go | 213 ++++- vendor/github.com/go-jose/go-jose/v4/jws.go | 15 +- .../go-jose/go-jose/v4/jwt/claims.go | 15 + .../github.com/go-jose/go-jose/v4/opaque.go | 5 + .../github.com/go-jose/go-jose/v4/shared.go | 6 + .../github.com/go-jose/go-jose/v4/signing.go | 111 ++- .../go-jose/go-jose/v4/symmetric.go | 10 +- .../internal/ipaddr/ipaddr.go | 82 ++ .../internal/verify/verify.go | 9 +- .../go-containerregistry/pkg/authn/authn.go | 4 +- .../go-containerregistry/pkg/name/digest.go | 11 +- .../go-containerregistry/pkg/name/ref.go | 6 + .../pkg/name/repository.go | 2 +- .../pkg/registry/manifest.go | 2 + .../go-containerregistry/pkg/v1/hash.go | 6 + .../pkg/v1/mutate/index.go | 3 + .../pkg/v1/mutate/mutate.go | 87 +- .../pkg/v1/remote/check.go | 6 +- .../pkg/v1/remote/fetcher.go | 35 +- .../pkg/v1/remote/puller.go | 6 +- .../pkg/v1/remote/pusher.go | 6 +- .../pkg/v1/remote/transport/bearer.go | 7 +- .../pkg/v1/remote/write.go | 28 +- .../pkg/v1/types/types.go | 1 + .../gax-go/v2/.release-please-manifest.json | 2 +- .../googleapis/gax-go/v2/CHANGES.md | 7 + .../googleapis/gax-go/v2/internal/version.go | 2 +- .../googleapis/gax-go/v2/iterator/iterator.go | 2 - .../compress/huff0/decompress_amd64.go | 203 +--- .../compress/huff0/decompress_amd64.s | 4 +- .../compress/huff0/decompress_arm64.go | 37 + .../compress/huff0/decompress_arm64.s | 851 +++++++++++++++++ .../compress/huff0/decompress_asm.go | 193 ++++ .../compress/huff0/decompress_generic.go | 2 +- .../klauspost/compress/zstd/blockdec.go | 9 +- .../klauspost/compress/zstd/dict.go | 85 +- .../klauspost/compress/zstd/seqdec_amd64.s | 4 +- .../klauspost/compress/zstd/seqdec_arm64.s | 601 ++++++------ .../klauspost/compress/zstd/seqdec_asm.go | 33 +- .../gen/pb-go/bundle/v1/sigstore_bundle.pb.go | 4 +- .../gen/pb-go/common/v1/sigstore_common.pb.go | 4 +- .../gen/pb-go/dsse/envelope.pb.go | 7 +- .../gen/pb-go/rekor/v1/sigstore_rekor.pb.go | 4 +- .../trustroot/v1/sigstore_trustroot.pb.go | 10 +- .../sigstore/pkg/cryptoutils/publickey.go | 50 +- .../sigstore/pkg/fulcioroots/fulcioroots.go | 6 +- .../pkg/signature/algorithm_registry.go | 53 ++ .../sigstore/sigstore/pkg/signature/ecdsa.go | 9 +- .../sigstore/pkg/signature/ed25519.go | 4 + .../sigstore/pkg/signature/ed25519ph.go | 4 + .../sigstore/pkg/signature/kms/aws/client.go | 8 +- .../pkg/signature/kms/azure/client.go | 3 +- .../pkg/signature/kms/azure/signer.go | 23 +- .../pkg/signature/kms/hashivault/signer.go | 1 - .../sigstore/sigstore/pkg/signature/mldsa.go | 238 +++++ .../sigstore/sigstore/pkg/signature/signer.go | 6 +- .../sigstore/pkg/signature/signerverifier.go | 3 + .../sigstore/pkg/signature/verifier.go | 10 +- .../sigstore/sigstore/pkg/tuf/client.go | 3 +- .../v2/bundle/spiffebundle/bundle.go | 119 ++- .../go-spiffe/v2/bundle/spiffebundle/set.go | 15 + .../v2/exp/bundle/witbundle/bundle.go | 208 +++++ .../go-spiffe/v2/exp/bundle/witbundle/set.go | 106 +++ .../v2/exp/bundle/witbundle/source.go | 10 + .../go-spiffe/v2/exp/svid/witsvid/source.go | 9 + .../go-spiffe/v2/exp/svid/witsvid/svid.go | 227 +++++ .../v2/proto/spiffe/workload/workload.pb.go | 339 ++++++- .../v2/proto/spiffe/workload/workload.proto | 55 ++ .../proto/spiffe/workload/workload_grpc.pb.go | 94 ++ .../spiffe/go-spiffe/v2/svid/x509svid/svid.go | 4 + .../spiffe/go-spiffe/v2/workloadapi/client.go | 263 ++++++ .../go-spiffe/v2/workloadapi/convenience.go | 38 + .../spiffe/go-spiffe/v2/workloadapi/option.go | 22 + .../go-spiffe/v2/workloadapi/watcher.go | 114 ++- .../go-spiffe/v2/workloadapi/witsource.go | 217 +++++ .../contrib/detectors/gcp/cloud-function.go | 2 +- .../contrib/detectors/gcp/cloud-run.go | 2 +- .../contrib/detectors/gcp/detector.go | 2 +- .../contrib/detectors/gcp/gce.go | 2 +- .../contrib/detectors/gcp/gke.go | 2 +- .../contrib/detectors/gcp/version.go | 2 +- vendor/golang.org/x/net/http2/hpack/encode.go | 1 - vendor/golang.org/x/net/http2/hpack/hpack.go | 1 - vendor/golang.org/x/net/http2/hpack/tables.go | 51 +- .../golang.org/x/net/http2/transport_wrap.go | 49 +- .../passes/fieldalignment/fieldalignment.go | 141 ++- .../tools/go/analysis/passes/printf/printf.go | 9 - .../analysis/passes/stdversion/stdversion.go | 31 +- .../passes/unusedresult/unusedresult.go | 4 +- .../x/tools/go/ast/inspector/cursor.go | 41 + vendor/golang.org/x/tools/go/loader/loader.go | 2 + .../golang.org/x/tools/go/packages/visit.go | 33 +- vendor/golang.org/x/tools/go/ssa/builder.go | 5 +- vendor/golang.org/x/tools/go/ssa/methods.go | 12 +- vendor/golang.org/x/tools/go/ssa/util.go | 10 +- vendor/golang.org/x/tools/go/ssa/wrappers.go | 5 +- .../x/tools/go/types/typeutil/callee.go | 61 +- .../internal/analysis/analyzerutil/version.go | 2 +- .../x/tools/internal/moremaps/maps.go | 116 +++ .../tools/internal/packagepath/packagepath.go | 16 +- .../x/tools/internal/refactor/imports.go | 4 +- .../internal/typesinternal/assignedaddress.go | 128 +++ .../internal/typesinternal/classify_call.go | 77 +- .../x/tools/internal/typesinternal/element.go | 65 +- .../x/tools/internal/typesinternal/toonew.go | 44 +- .../x/tools/internal/typesinternal/types.go | 8 + .../x/tools/refactor/satisfy/find.go | 19 +- .../google.golang.org/api/internal/version.go | 2 +- .../api/storage/v1/storage-api.json | 358 ++++++- .../api/storage/v1/storage-gen.go | 875 +++++++++++++++++- .../api/transport/grpc/dial.go | 2 +- .../api/transport/http/dial.go | 2 +- vendor/google.golang.org/grpc/clientconn.go | 23 +- .../clientconn_disconnect_reason_noplan9.go | 48 + .../clientconn_disconnect_reason_plan9.go | 39 + .../credentials/alts/internal/conn/record.go | 3 + ...cp_service_account_identity_credentials.go | 278 ++++++ .../credentials/google/internal/internal.go | 35 + .../credentials/xds/handshake_info.go | 3 + .../grpc/internal/envconfig/envconfig.go | 12 +- .../grpc/internal/envconfig/xds.go | 7 +- .../internal/grpcsync/callback_serializer.go | 26 + .../grpc/internal/mem/buffer_pool.go | 14 + .../grpc/internal/resolver/config_selector.go | 78 +- .../grpc/internal/transport/client_stream.go | 5 +- .../grpc/internal/transport/handler_server.go | 2 +- .../grpc/internal/transport/http2_client.go | 6 +- .../grpc/internal/transport/http2_server.go | 2 +- .../grpc/internal/transport/transport.go | 112 ++- .../xds/balancer/cdsbalancer/configbuilder.go | 19 + .../xds/balancer/clustermanager/picker.go | 11 +- .../internal/xds/httpfilter/fault/fault.go | 11 +- .../internal/xds/httpfilter/httpfilter.go | 30 +- .../grpc/internal/xds/httpfilter/rbac/rbac.go | 122 ++- .../internal/xds/httpfilter/router/router.go | 4 +- .../internal/xds/resolver/serviceconfig.go | 13 +- .../internal/xds/resolver/xds_resolver.go | 19 +- .../internal/xds/server/listener_wrapper.go | 17 +- .../xds/xdsclient/xdsresource/matcher.go | 6 - .../xds/xdsclient/xdsresource/metadata.go | 46 +- .../xds/xdsclient/xdsresource/type_cds.go | 4 + .../xds/xdsclient/xdsresource/type_rds.go | 6 +- .../xdsclient/xdsresource/unmarshal_cds.go | 46 +- .../xdsclient/xdsresource/unmarshal_rds.go | 27 +- .../xdsclient/xdsresource/version/version.go | 19 +- .../xds/xdsdepmgr/xds_dependency_manager.go | 16 +- .../google.golang.org/grpc/mem/buffer_pool.go | 4 - vendor/google.golang.org/grpc/mem/buffers.go | 6 +- vendor/google.golang.org/grpc/stream.go | 35 +- vendor/google.golang.org/grpc/version.go | 2 +- .../grpc/xds/googledirectpath/googlec2p.go | 55 +- vendor/modules.txt | 111 +-- 369 files changed, 11638 insertions(+), 4494 deletions(-) rename vendor/cloud.google.com/go/auth/internal/{trustboundary => regionalaccessboundary}/external_accounts_config_providers.go (60%) create mode 100644 vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go rename vendor/cloud.google.com/go/{firestore/apiv1/info.go => auth/internal/retry/retry_linux.go} (59%) delete mode 100644 vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go create mode 100644 vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/timeouts.go create mode 100644 vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/awsinternal.go create mode 100644 vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/timeouts.go create mode 100644 vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/timeouts_services.go create mode 100644 vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.go create mode 100644 vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.validate.go create mode 100644 vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect_vtproto.pb.go create mode 100644 vendor/github.com/google/go-containerregistry/internal/ipaddr/ipaddr.go create mode 100644 vendor/github.com/klauspost/compress/huff0/decompress_arm64.go create mode 100644 vendor/github.com/klauspost/compress/huff0/decompress_arm64.s create mode 100644 vendor/github.com/klauspost/compress/huff0/decompress_asm.go create mode 100644 vendor/github.com/sigstore/sigstore/pkg/signature/mldsa.go create mode 100644 vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/bundle.go create mode 100644 vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/set.go create mode 100644 vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/source.go create mode 100644 vendor/github.com/spiffe/go-spiffe/v2/exp/svid/witsvid/source.go create mode 100644 vendor/github.com/spiffe/go-spiffe/v2/exp/svid/witsvid/svid.go create mode 100644 vendor/github.com/spiffe/go-spiffe/v2/workloadapi/witsource.go create mode 100644 vendor/golang.org/x/tools/internal/moremaps/maps.go create mode 100644 vendor/golang.org/x/tools/internal/typesinternal/assignedaddress.go create mode 100644 vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go create mode 100644 vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go create mode 100644 vendor/google.golang.org/grpc/credentials/google/gcp_service_account_identity_credentials.go create mode 100644 vendor/google.golang.org/grpc/credentials/google/internal/internal.go diff --git a/go.mod b/go.mod index 6ce796f6fa..869be8608c 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/tektoncd/chains -go 1.26.5 +go 1.27.0 require ( cloud.google.com/go/compute/metadata v0.9.0 @@ -9,7 +9,7 @@ require ( github.com/golangci/golangci-lint v1.64.8 github.com/google/addlicense v1.2.0 github.com/google/go-cmp v0.7.0 - github.com/google/go-containerregistry v0.21.9 + github.com/google/go-containerregistry v0.22.1 github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20260414223304-7a662782a11f github.com/google/go-licenses v1.6.0 github.com/grafeas/grafeas v0.2.3 @@ -23,12 +23,12 @@ require ( github.com/secure-systems-lab/go-securesystemslib v0.11.1 github.com/sigstore/cosign/v2 v2.6.5 github.com/sigstore/rekor v1.5.4 - github.com/sigstore/sigstore v1.10.9 - github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.9 - github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.9 - github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.9 - github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.9 - github.com/spiffe/go-spiffe/v2 v2.6.0 + github.com/sigstore/sigstore v1.10.10 + github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.10 + github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.10 + github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.10 + github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.10 + github.com/spiffe/go-spiffe/v2 v2.7.0 github.com/stretchr/testify v1.12.1 github.com/tektoncd/pipeline v1.12.2 github.com/tektoncd/plumbing v0.0.0-20250115133002-f515628dffea @@ -41,7 +41,7 @@ require ( gocloud.dev/pubsub/kafkapubsub v0.43.0 golang.org/x/crypto v0.55.0 golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 - google.golang.org/grpc v1.82.2 + google.golang.org/grpc v1.83.2 google.golang.org/protobuf v1.36.12 k8s.io/api v0.36.4 k8s.io/apimachinery v0.36.4 @@ -54,15 +54,15 @@ require ( require ( 4d63.com/gocheckcompilerdirectives v1.3.0 // indirect 4d63.com/gochecknoglobals v0.2.2 // indirect - cel.dev/expr v0.25.1 // indirect + cel.dev/expr v0.25.2 // indirect cloud.google.com/go v0.123.0 // indirect - cloud.google.com/go/auth v0.20.0 // indirect + cloud.google.com/go/auth v0.23.2 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect - cloud.google.com/go/firestore v1.22.0 // indirect + cloud.google.com/go/firestore v1.24.0 // indirect cloud.google.com/go/iam v1.13.0 // indirect cloud.google.com/go/kms v1.33.0 // indirect cloud.google.com/go/longrunning v1.2.0 // indirect - cloud.google.com/go/monitoring v1.29.0 // indirect + cloud.google.com/go/monitoring v1.30.0 // indirect filippo.io/edwards25519 v1.2.0 // indirect github.com/4meepo/tagalign v1.4.2 // indirect github.com/Abirdcfly/dupword v0.1.3 // indirect @@ -71,8 +71,8 @@ require ( github.com/Antonboom/nilnil v1.0.1 // indirect github.com/Antonboom/testifylint v1.5.2 // indirect github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 // indirect github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 // indirect @@ -86,12 +86,12 @@ require ( github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect github.com/Azure/go-autorest/logger v0.2.1 // indirect github.com/Azure/go-autorest/tracing v0.6.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect github.com/Crocmagnon/fatcontext v0.7.1 // indirect github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 // indirect - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect + github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect github.com/IBM/sarama v1.45.2 // indirect @@ -121,28 +121,28 @@ require ( github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect github.com/ashanbrown/forbidigo v1.6.0 // indirect github.com/ashanbrown/makezero v1.2.0 // indirect - github.com/aws/aws-sdk-go-v2 v1.43.0 // indirect - github.com/aws/aws-sdk-go-v2/config v1.32.31 // indirect - github.com/aws/aws-sdk-go-v2/credentials v1.19.30 // indirect + github.com/aws/aws-sdk-go-v2 v1.46.0 // indirect + github.com/aws/aws-sdk-go-v2/config v1.33.3 // indirect + github.com/aws/aws-sdk-go-v2/credentials v1.20.3 // indirect github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.35 // indirect github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.8.35 // indirect - github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 // indirect - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.31 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.31 // indirect - github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.32 // indirect + github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.19.2 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.2 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.2 // indirect + github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.2 // indirect github.com/aws/aws-sdk-go-v2/service/dynamodb v1.56.2 // indirect github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.32.13 // indirect github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3 // indirect github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.10 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.20 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.31 // indirect - github.com/aws/aws-sdk-go-v2/service/kms v1.55.0 // indirect - github.com/aws/aws-sdk-go-v2/service/signin v1.5.0 // indirect - github.com/aws/aws-sdk-go-v2/service/sso v1.33.0 // indirect - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.0 // indirect - github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 // indirect - github.com/aws/smithy-go v1.27.3 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.2 // indirect + github.com/aws/aws-sdk-go-v2/service/kms v1.57.1 // indirect + github.com/aws/aws-sdk-go-v2/service/signin v1.9.0 // indirect + github.com/aws/aws-sdk-go-v2/service/sso v1.37.0 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.42.0 // indirect + github.com/aws/aws-sdk-go-v2/service/sts v1.49.0 // indirect + github.com/aws/smithy-go v1.28.1 // indirect github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.12.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/bkielbasa/cyclop v1.2.3 // indirect @@ -184,7 +184,7 @@ require ( github.com/digitorus/pkcs7 v0.0.0-20250730155240-ffadbf3f398c // indirect github.com/digitorus/timestamp v0.0.0-20250524132541-c45532741eea // indirect github.com/dimchansky/utfbom v1.1.1 // indirect - github.com/docker/cli v29.6.2+incompatible // indirect + github.com/docker/cli v29.7.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.5 // indirect github.com/dustin/go-humanize v1.0.1 // indirect github.com/eapache/go-resiliency v1.7.0 // indirect @@ -207,7 +207,7 @@ require ( github.com/ghostiam/protogetter v0.3.9 // indirect github.com/go-chi/chi/v5 v5.3.1 // indirect github.com/go-critic/go-critic v0.12.0 // indirect - github.com/go-jose/go-jose/v4 v4.1.4 // indirect + github.com/go-jose/go-jose/v4 v4.1.5 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-logr/zapr v1.3.0 // indirect @@ -267,8 +267,8 @@ require ( github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect github.com/google/wire v0.7.0 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.18 // indirect - github.com/googleapis/gax-go/v2 v2.23.0 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect + github.com/googleapis/gax-go/v2 v2.24.0 // indirect github.com/gordonklaus/ineffassign v0.1.0 // indirect github.com/gostaticanalysis/analysisutil v0.7.1 // indirect github.com/gostaticanalysis/comment v1.5.0 // indirect @@ -309,7 +309,7 @@ require ( github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/kisielk/errcheck v1.9.0 // indirect github.com/kkHAIKE/contextcheck v1.1.6 // indirect - github.com/klauspost/compress v1.19.1 // indirect + github.com/klauspost/compress v1.19.2 // indirect github.com/kulti/thelper v0.6.3 // indirect github.com/kunwardeep/paralleltest v1.0.10 // indirect github.com/kylelemons/godebug v1.1.0 // indirect @@ -384,7 +384,7 @@ require ( github.com/sergi/go-diff v1.4.0 // indirect github.com/shibumi/go-pathspec v1.3.0 // indirect github.com/sigstore/fulcio v1.8.5 // indirect - github.com/sigstore/protobuf-specs v0.5.1 // indirect + github.com/sigstore/protobuf-specs v0.5.2 // indirect github.com/sigstore/rekor-tiles/v2 v2.2.2-0.20260601073857-5d098a2b6443 // indirect github.com/sigstore/sigstore-go v1.2.1 // indirect github.com/sigstore/timestamp-authority/v2 v2.1.2 // indirect @@ -437,7 +437,7 @@ require ( go.mongodb.org/mongo-driver v1.17.6 // indirect go.opencensus.io v0.24.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect + go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 // indirect @@ -457,21 +457,21 @@ require ( go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect - golang.org/x/mod v0.38.0 // indirect - golang.org/x/net v0.57.0 // indirect + golang.org/x/mod v0.39.0 // indirect + golang.org/x/net v0.58.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/term v0.45.0 // indirect golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.15.0 // indirect - golang.org/x/tools v0.48.0 // indirect + golang.org/x/tools v0.49.0 // indirect golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect - google.golang.org/api v0.290.0 // indirect - google.golang.org/genproto v0.0.0-20260622175928-b703f567277d // indirect + google.golang.org/api v0.295.0 // indirect + google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260720155508-bb71a54f79dc // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.67.3 // indirect diff --git a/go.sum b/go.sum index f3dc723d0e..a832fb57dd 100644 --- a/go.sum +++ b/go.sum @@ -4,8 +4,8 @@ 4d63.com/gochecknoglobals v0.2.2/go.mod h1:lLxwTQjL5eIesRbvnzIP3jZtG140FnTdz+AlMa+ogt0= al.essio.dev/pkg/shellescape v1.6.0 h1:NxFcEqzFSEVCGN2yq7Huv/9hyCEGVa/TncnOOBBeXHA= al.essio.dev/pkg/shellescape v1.6.0/go.mod h1:6sIqp7X2P6mThCQ7twERpZTuigpr6KbZWtls1U8I890= -cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4= -cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4= +cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs= +cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4= cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= @@ -40,8 +40,8 @@ cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+ cloud.google.com/go v0.102.1/go.mod h1:XZ77E9qnTEnrgEOvr4xzfdX5TRo7fB4T2F4O6+34hIU= cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= -cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA= -cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q= +cloud.google.com/go/auth v0.23.2 h1:pxSCpfiji41hpzpPdMCftEUCezpgpqmmDdYiAjCKXxo= +cloud.google.com/go/auth v0.23.2/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o= @@ -60,20 +60,20 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk= -cloud.google.com/go/firestore v1.22.0 h1:avooeboIq37vKXobrbPUFhFBxS/c3FqmWoX0xs8dO6E= -cloud.google.com/go/firestore v1.22.0/go.mod h1:PaM4i7i7ruALSKmlpHXXZaPObcZw0W7ie5UOPr72iTU= +cloud.google.com/go/firestore v1.24.0 h1:x0Z3hrgjYgo2wI9whuBRQcNc2hYwzZDQy/7pkUXbXcs= +cloud.google.com/go/firestore v1.24.0/go.mod h1:5aojyjN4olKUnBZDCRWwM+NsdrrCX3t1qfyERZGOonM= cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY= cloud.google.com/go/iam v0.4.0/go.mod h1:cbaZxyScUhxl7ZAkNWiALgihfP75wS/fUsVNaa1r3vA= cloud.google.com/go/iam v1.13.0 h1:ufT3FPT5rFFXu6UtLkNoxaOaV5EuA1dsSkmemCSTo6U= cloud.google.com/go/iam v1.13.0/go.mod h1:gHXdDEiPDvqd1q1KwBDGQlgZY/BwY760zU2LhOZS5w0= cloud.google.com/go/kms v1.33.0 h1:pG0X78m212b2pv9N4fdMoUO69LuZGQ9kSvn8sHBOFAo= cloud.google.com/go/kms v1.33.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA= -cloud.google.com/go/logging v1.18.0 h1:KhzZq+1cSkPH9YUaKLLhLtQxIHitVayBmk0sGfoM9+k= -cloud.google.com/go/logging v1.18.0/go.mod h1:ZGKnpBaURITh+g/uom2VhbiFoFWvejcrHPDhxFtU/gI= +cloud.google.com/go/logging v1.19.0 h1:NCqhdVUg3wQ8Cobdf16FDSuTGi3+6+hdSBHrY5TsR6Q= +cloud.google.com/go/logging v1.19.0/go.mod h1:i40NZCHC9Gqvod4yE+yQfDWwlgwW/SrshkkGibCHxcA= cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM= cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0= -cloud.google.com/go/monitoring v1.29.0 h1:AHhDsFaSax1/4k+qlIDX/SDGe6hggnfXJ9dkgD9qBPY= -cloud.google.com/go/monitoring v1.29.0/go.mod h1:72NOVjJXHY/HBfoLT0+qlCZBT059+9VXLeAnL2PeeVM= +cloud.google.com/go/monitoring v1.30.0 h1:r/d+JUbyKmJ8b07iznuKfzVzrIXTWxHQ3lBRm3x2LlY= +cloud.google.com/go/monitoring v1.30.0/go.mod h1:htlUR0QWVMrjFzZmN4LGnMAve9xB/eduwjmINxVZ8RM= cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I= cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw= cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA= @@ -119,10 +119,10 @@ github.com/Antonboom/testifylint v1.5.2 h1:4s3Xhuv5AvdIgbd8wOOEeo0uZG7PbDKQyKY5l github.com/Antonboom/testifylint v1.5.2/go.mod h1:vxy8VJ0bc6NavlYqjZfmp6EfqXMtBgQ4+mhCojwC1P8= github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU= github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 h1:zvXfGJCWvywnCA814d8ZiVyt+fm9nnTE8xSb99zRyfo= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1/go.mod h1:iptorS+VYKFL2N6PnebpS91dubG35eAOEERnT4PJbQU= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 h1:u93s+zU2JD62im61Bm5CZIc1ZrOJaIAWEg0WOrMVkEo= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1/go.mod h1:oXtinPO4OLj9d1DOTrqrL1oRwGhcqadvAmrl6wTeGlk= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 h1:ldKsKtEIblsgsr6mPwrd9yRntoX6uLz/K89wsldwx/k= @@ -160,8 +160,8 @@ github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUM github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 h1:Nljr4q1GRA/5vCrMONS+g4u4LRHNgOXVSh3O43J2CnI= +github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0/go.mod h1:Y33QHnf0FfdVewFFISOGe20mkZbxX4H839o955/PoeI= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c h1:pxW6RcqyfI9/kWtOwnv/G+AzdKuy2ZrqINhenH4HyNs= github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= @@ -172,8 +172,8 @@ github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 h1:sHglBQTwgx+rW github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs= github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 h1:Sz1JIXEcSfhz7fUi7xHnhpIE0thVASYjvosApmHuD2k= github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1/go.mod h1:n/LSCXNuIYqVfBlVXyHfMQkZDdp1/mmxfSjADd3z1Zg= -github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 h1:rIkQfkCOVKc1OiRCNcSDD8ml5RJlZbH/Xsq7lbpynwc= -github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0/go.mod h1:RD2SsorTmYhF6HkTmDw7KmPYQk8OBYwTkuasChwv7R4= +github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 h1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA= +github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM= github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8= github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc= github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ= @@ -266,24 +266,24 @@ github.com/ashanbrown/forbidigo v1.6.0 h1:D3aewfM37Yb3pxHujIPSpTf6oQk9sc9WZi8ger github.com/ashanbrown/forbidigo v1.6.0/go.mod h1:Y8j9jy9ZYAEHXdu723cUlraTqbzjKF1MUyfOKL+AjcU= github.com/ashanbrown/makezero v1.2.0 h1:/2Lp1bypdmK9wDIq7uWBlDF1iMUpIIS4A+pF6C9IEUU= github.com/ashanbrown/makezero v1.2.0/go.mod h1:dxlPhHbDMC6N6xICzFBSK+4njQDdK8euNO0qjQMtGY4= -github.com/aws/aws-sdk-go-v2 v1.43.0 h1:fharf/WhbRAVZ1du0QL7roNFxZ6T/sWr+4Ni617bwSI= -github.com/aws/aws-sdk-go-v2 v1.43.0/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM= -github.com/aws/aws-sdk-go-v2/config v1.32.31 h1:n4nY9O3QKoHIkL85EX+V8RcMFtOhlpTFhGArg915PXk= -github.com/aws/aws-sdk-go-v2/config v1.32.31/go.mod h1:PN0NYDCCoOpGGsZ2+elDUidmHfQBPyYzN2GCgl8HEBs= -github.com/aws/aws-sdk-go-v2/credentials v1.19.30 h1:TTCvvzFU6gXa4iJecNG/0F/B0oYTiazoRECr2XyLHrY= -github.com/aws/aws-sdk-go-v2/credentials v1.19.30/go.mod h1:jKxAp2AEncnliinzpgOSZDFv6+VjvWhjw/AtbfsWT9U= +github.com/aws/aws-sdk-go-v2 v1.46.0 h1:1kt7m/EKcEHt5mlyyxx9cSlMddRPIKbjb6DIQsu4HPk= +github.com/aws/aws-sdk-go-v2 v1.46.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU= +github.com/aws/aws-sdk-go-v2/config v1.33.3 h1:h090b3O5S17bF87/0ysHZuIT/7DCb4EBRFQX2PMVPCw= +github.com/aws/aws-sdk-go-v2/config v1.33.3/go.mod h1:YYDB1kTejxbfAbEVUqgCtkVp26xvNCHev9cLKABMGAk= +github.com/aws/aws-sdk-go-v2/credentials v1.20.3 h1:tToOYM/LXev4NpfWlIYGDvBvjHmJ3HXpRU9ppl+pM6k= +github.com/aws/aws-sdk-go-v2/credentials v1.20.3/go.mod h1:wfGneWyncO7p67wqXV2IQhPk14JqIc25woKlaArT3WI= github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.35 h1:CQ2kB9Q4xQ2PDBmn+KCr/pw1DvK7pH6NkR2nl2KV7ng= github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.35/go.mod h1:ypTMB9nZhpqfMeRVesGj4dEknIg0YS+aXGtLMidw/Ek= github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.8.35 h1:qxsbiWRtwChp/rrSHMfYoosVDVWRICoYXoDdczaLFiI= github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.8.35/go.mod h1:SomvXQRUKYBML53k4LqIgszKJKz8TdUwi/Zwig7JhfU= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 h1:kfVL5wAunCJycL6MOQ6aNh6PlAYEymflcjuKmrWUA0o= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31/go.mod h1:nWfRNDAppujCQgOUd43lKT4yeLv9z3nJ3bw1G3BgQKo= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.31 h1:Z8F3hfCY33IGpJjFAnv0wvtv1FIKj1GHmRDEYqy64tw= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.31/go.mod h1:aVyUoytEyOViR6jhq6jula0xkc5NfBE2hgeF6BvOrao= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.31 h1:hyOxUyXdh3AyjE93gBgsfziJag9ACwcs+ZpDBLzi8mw= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.31/go.mod h1:OERqI9k0draSLB8O8woxY3q25ZWTELRK4RRoLMuMZFo= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.32 h1:0MrUL35H/Y4kdFfItoR5jCgtDQ4Z/8LudAoIHRfA4hE= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.32/go.mod h1:2tNZkuWz54arj8mHVf+8Y7cKkcD8Wr/fBpENgEXpjLc= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.19.2 h1:Ldv7RPHs7qwwTscRjAl3YBud32f3BvdAGRmSvAx5L38= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.19.2/go.mod h1:XyK6UV8xbo66ysVqLd2783C09pBYHOm8aKTRV5DVJ30= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.2 h1:q/PSLGuRWCChWg+dLnb9dWOnrCxJtnboXbBtFoqqRrI= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.2/go.mod h1:TD1jvU2LvXkJexct5vBqcd8QlNXh5EmRUeL/Z32p0n4= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.2 h1:6fl86IPqKEXoySqiOWdfgbEp9OVbn44zTfEICNEBDhY= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.2/go.mod h1:63HDfhFkdzBpI8WGXTSKUHPKS6mqldj4u3LJW7RZtSU= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.2 h1:XMgIRS+uW9F3yFKnXGRrI9pkHi99CXTmoz2kz2/TGBA= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.2/go.mod h1:vorxDzK+n3jiv9a5ST/LG0Eu9cSv1CRdKTpG6pDMs+M= github.com/aws/aws-sdk-go-v2/service/dynamodb v1.56.2 h1:xi/ECwajy2mixviBD7bKAlGGSwzEaFKX2wIhrZt9NGw= github.com/aws/aws-sdk-go-v2/service/dynamodb v1.56.2/go.mod h1:dLREOeW66eVaaGIOi2ZlLHDgkR3nuJ02rd00j0YSlBE= github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.32.13 h1:xQ9dX2jxVm14uNVe0WomcCSza832ytYWt1ZBu2LrBLM= @@ -292,24 +292,24 @@ github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3 h1:RtGctYMmkTerGClvdY6bHXdtly4F github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3/go.mod h1:vBfBu24Ka3/5UZtepbTV0gnc9VPLT8ok+0oDDaYAzn4= github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.10 h1:1A/sI3LNMi3fhRI5TFLMwwo7ALAALSFVCSGvFlr1Iys= github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.10/go.mod h1:Diyyyz0b43X13pdi1mVMqlTwDjOmRbJMvDsqnduUYWM= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 h1:bAdDl/HkGCcGPoe25ToSHEw23VIxt6CT5fLcg111BKg= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19/go.mod h1:KaUzbLxv4CeSxh6ZCl9B4m7CuFenS8kUEaDs+f/DQr4= github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.20 h1:ru+seMuylHiNZlvgZei83eD8h37hRjm1XIMOEmcV0BU= github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.20/go.mod h1:ihZMtPTKoX/ugQRHbui6zNdSgVYN1KY2Dgwb2d3hXlc= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.31 h1:w2SIhW92DZPFrSL4ksVCr8IYff5OZwIcxg8+95tzvAI= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.31/go.mod h1:wAhpCQbkov+IcvjozJbd2xRCoZybUEHNkcFunssNACg= -github.com/aws/aws-sdk-go-v2/service/kms v1.55.0 h1:uB8ymkVosyourmGXCZHyWhJ4wuKA4xq3ii2dVMPtBZY= -github.com/aws/aws-sdk-go-v2/service/kms v1.55.0/go.mod h1:rK4RITSY/qJw3qVJ7p19fceOWuvrisqqOChFkX05n5I= -github.com/aws/aws-sdk-go-v2/service/signin v1.5.0 h1:OHH5iTQvVGmfHjX/5Q+vFuA/Rf2x6/95aJ/75QCQSm4= -github.com/aws/aws-sdk-go-v2/service/signin v1.5.0/go.mod h1:mCF3AK9PpL49oOrhniUXWAfhVBVQ/XbytoE5eccZUIs= -github.com/aws/aws-sdk-go-v2/service/sso v1.33.0 h1:CaJyYhxBE0M/HJX/YvSaSmQlsI91VHB0lKU8LtLxL3A= -github.com/aws/aws-sdk-go-v2/service/sso v1.33.0/go.mod h1:+e6BMRMPjBQoCw/WovYR9GLy2IU0z4Q77smOB1DraSg= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.0 h1:tC323YV77QdafeBr6LUhLDTsboyuyHLNRwAyCP44kGU= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.0/go.mod h1:SfLK1sgviHmbI+MozR9iDwDjL4cdCVZtahsjoR+z7wg= -github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 h1:Pd6PNlp4t8PTXxqzstICl52Wsy78vpjFZ7PRUj44mJc= -github.com/aws/aws-sdk-go-v2/service/sts v1.45.0/go.mod h1:rmQ0TnHzuLPmabgjPcsywhsSOmaBDgzR4zvDxSPsGdg= -github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY= -github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.2 h1:ZtHYnumr6QyxhzEzNZwzQTFJEXOswrZqTTkRxthwvr4= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.2/go.mod h1:a1NXrYpBd311gBzn1UI5UzJyyvXktM4xNh/ydPiPpqY= +github.com/aws/aws-sdk-go-v2/service/kms v1.57.1 h1:z0+ZRgFCZQzc5o4Ke9ni4zXGn/k7Hoy5JkbZPrXl9CI= +github.com/aws/aws-sdk-go-v2/service/kms v1.57.1/go.mod h1:EzyGQwPscu9Pwk4XJx5PrG0g8Wxtc2sv8ullQP1NIJA= +github.com/aws/aws-sdk-go-v2/service/signin v1.9.0 h1:c3k+k/CS4L+sAIH6fxikL+g5g2LpeNczaoyjjw1iMKI= +github.com/aws/aws-sdk-go-v2/service/signin v1.9.0/go.mod h1:AGIoQg99fBrOIQnF78TLx4lj18mc4gZ0hJx1UaLIFM4= +github.com/aws/aws-sdk-go-v2/service/sso v1.37.0 h1:+rqBaOq7jzInjY8M12hr+zEe85JpRll9BjMx38r33Ok= +github.com/aws/aws-sdk-go-v2/service/sso v1.37.0/go.mod h1:XFlVwUsw3sYh8Hw37umYVJnrcWrwXWRxbNw/JY0bblw= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.42.0 h1:hzM3GslEAOBcLn3DHH6ENToFi+vXP+n02W+x6zejAIM= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.42.0/go.mod h1:588e7skMkYIYkSUseT8E3WKFfbAfrA1bj3Zf+qxJtJY= +github.com/aws/aws-sdk-go-v2/service/sts v1.49.0 h1:N7Ey8obY3uSui+cxl0OUzFlFmkxSucoJnrniFhw+cLc= +github.com/aws/aws-sdk-go-v2/service/sts v1.49.0/go.mod h1:zMBwjSf4Pt8a1OHYiZ5rPD0PJRK1kQrUaxhS/Dbld8E= +github.com/aws/smithy-go v1.28.1 h1:R/nXH00c8qcfCzQVELtRw+eLQWtzv+VAIEFJ1/xxXlQ= +github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.12.0 h1:JFWXO6QPihCknDdnL6VaQE57km4ZKheHIGd9YiOGcTo= github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.12.0/go.mod h1:046/oLyFlYdAghYQE2yHXi/E//VM5Cf3/dFmA+3CZ0c= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= @@ -431,8 +431,8 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE= github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI= github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= -github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= -github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.7.2+incompatible h1:dlkwallR8XqfeVnA2ELEhdwvb4lsSwuB4IgsG8Q9cLY= +github.com/docker/cli v29.7.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY= github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c= github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= @@ -513,8 +513,8 @@ github.com/go-fed/httpsig v1.1.0/go.mod h1:RCMrTZvN1bJYtofsG4rd5NaO5obxQ5xBkdiS7 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= -github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= -github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA= +github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= @@ -703,8 +703,8 @@ github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs= -github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= +github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84= +github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20260414223304-7a662782a11f h1:31syNEUHTz7kt9AmH9SyXgV+Y6LMd62ZjaEcPWCy9z0= github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20260414223304-7a662782a11f/go.mod h1:iMEl9wsO8BHbAcfXcIFCN03G1odxdJXkdAaskB4pHxg= github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20250225234217-098045d5e61f h1:GJRzEBoJv/A/E7JbTekq1Q0jFtAfY7TIxUFAK89Mmic= @@ -765,8 +765,8 @@ github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4= github.com/google/wire v0.7.0/go.mod h1:n6YbUQD9cPKTnHXEBN2DXlOp/mVADhVErcMFb0v3J18= github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8= github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8= -github.com/googleapis/enterprise-certificate-proxy v0.3.18 h1:hvVi34VucdrV1IIsiWuqYM8kutw/92MxNEFxCJZEh0k= -github.com/googleapis/enterprise-certificate-proxy v0.3.18/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k= +github.com/googleapis/enterprise-certificate-proxy v0.3.20 h1:t/xL64VUoN69MuMRQuJETqYGOw4Z9mSRJK9epIEtwFk= +github.com/googleapis/enterprise-certificate-proxy v0.3.20/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w= github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0= @@ -774,8 +774,8 @@ github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0 github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM= github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99EXz9pXxye9YM= github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c= -github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE= -github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg= +github.com/googleapis/gax-go/v2 v2.24.0 h1:myMaPYyF9MecEmvQqMqomIwn9t/4KCZN9qnwsS76wlg= +github.com/googleapis/gax-go/v2 v2.24.0/go.mod h1:IaTHBDd7NHxSCiu0vEs8pQZu4dGZrWwuSoxCnk16OFM= github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= @@ -911,8 +911,8 @@ github.com/kisielk/errcheck v1.9.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE= github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg= -github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= -github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8= +github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= @@ -1136,24 +1136,24 @@ github.com/sigstore/cosign/v2 v2.6.5 h1:D7kFSWS2HzfD+LpEuBO89D1KfOAODlkWuuhzXS8y github.com/sigstore/cosign/v2 v2.6.5/go.mod h1:g+P/LgYyJkC85WGGDho7yySl3C6xTJzzpLm21ZV+E6s= github.com/sigstore/fulcio v1.8.5 h1:HYTD1/L5wlBp8JxsWxUf8hmfaNBBF/x3r3p5l6tZwbA= github.com/sigstore/fulcio v1.8.5/go.mod h1:tSLYK3JsKvJpDW1BsIsVHZgHj+f8TjXARzqIUWSsSPQ= -github.com/sigstore/protobuf-specs v0.5.1 h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah1/+7Px7U= -github.com/sigstore/protobuf-specs v0.5.1/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats= +github.com/sigstore/protobuf-specs v0.5.2 h1:RSWWUY8QrVTxbYH00jY/jg2e7YnjzrpwP+PeHTMll0E= +github.com/sigstore/protobuf-specs v0.5.2/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats= github.com/sigstore/rekor v1.5.4 h1:A9zITTrkRwO+8lfq7L/gBR7rDHHcBQJRI+a0JQo4xDM= github.com/sigstore/rekor v1.5.4/go.mod h1:0bcUHhZPlG+RVW1dI/7sdBp0MiVWVzk9h0tgOH/o0Yc= github.com/sigstore/rekor-tiles/v2 v2.2.2-0.20260601073857-5d098a2b6443 h1:/CO8F6m3Bo/f59bZo5dv1sTIfUnQqVnepIdDV24KoDw= github.com/sigstore/rekor-tiles/v2 v2.2.2-0.20260601073857-5d098a2b6443/go.mod h1:w1h8wF8vq9lHjmtRdwJiEaoVxhP+WHIMpj4M39pkzp0= -github.com/sigstore/sigstore v1.10.9 h1:7Dcpt+ibnltHQZ8XhaU0dFmhHaf/T491eJfA9WDex4Y= -github.com/sigstore/sigstore v1.10.9/go.mod h1:LYW9+qH7bK8wZmLm6lPxIC5lkHtkJDCgkqjChzTAIBs= +github.com/sigstore/sigstore v1.10.10 h1:0hfpqcl1+UnzxuVT4//PzL3LQ8uOCzoF90Ofs5zzBwM= +github.com/sigstore/sigstore v1.10.10/go.mod h1:Q8tpy2X80KVswawYR0eTjWl3gM3AU+ak+h/NtPzRfWs= github.com/sigstore/sigstore-go v1.2.1 h1:YWP/rDbBaEBvtbkj6xtwsSj38ZCFEhTVVadNOXjVe3A= github.com/sigstore/sigstore-go v1.2.1/go.mod h1:I8BqVwAb/SaQJ5pBu5IDFY+ksq8O/1/kCag8XUgrsko= -github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.9 h1:2NWAU/utJRwzy1OrQurlY3wlDSynyH1rNJS5GgFchrg= -github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.9/go.mod h1:2shgYiPHTzeb5NNEu6okco+LOojMS5n9p/5Wdp0jhGI= -github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.9 h1:zcg/EG6JW/8RSx9T2g5j6zqxplaE4dymmhiFflDE6ks= -github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.9/go.mod h1:e7QngtHib0McuP1C/+Dt9f/7a8ic8FXvPB75OQzWgU4= -github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.9 h1:DG8R4orWDs3l9trp70fLRTgazedEDoAIo/cHEN7Qo0k= -github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.9/go.mod h1:d6oIwQ0YiYHMcFO4xqFcAx5njXwIf0dm5KfdytOar8A= -github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.9 h1:V+spyeSHypvLHSOvPMT+V72dxDlS0LDkDd6lwCsUOXM= -github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.9/go.mod h1:o7u5bQNLqpDQFaST29dpo6P6ihMV+wicwqfMmMW6H3c= +github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.10 h1:C1+Re7cReA1d/7wIsBYoYj/49eGSkGnUAIu31cz5JDo= +github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.10/go.mod h1:3RH9KTY323sU0gYg6QGK7kblF8HX+AnGEqpTZaCPgLY= +github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.10 h1:du2JEef/3xq8N/Q7+UwkiXQFe4OTDTXphbCg5GJ40AM= +github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.10/go.mod h1:7Ezdtpa3kYLZo2JWkyuXsqy+PikRIyWutzJ95xwOcR0= +github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.10 h1:j0fFWLsM3/5jKTvrJQJU3l/YnO0idLMCg+gXrZX0MWo= +github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.10/go.mod h1:3gngj4JSuMNXe0oxseFREX0T8dgh4SdxuhP9Wfgix7o= +github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.10 h1:pPbcwWtjdEncS8mDah/f2fTeR7qmOU+AfZRJE/MdhxY= +github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.10/go.mod h1:DmkPPrqAmxjlYK82K3NpuWM9wql/I9/b2S6gXDBBnYY= github.com/sigstore/timestamp-authority/v2 v2.1.2 h1:7DDhnknLL4w8VwomyvW2W8qblOS9LDR8oihna+jc7Ls= github.com/sigstore/timestamp-authority/v2 v2.1.2/go.mod h1:o6rAVZceFyejClIj/uStRNIemP16bVMZtbMmhk6pr0U= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= @@ -1184,8 +1184,8 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU= github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY= -github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo= -github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs= +github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4= +github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U= github.com/spiffe/spire-api-sdk v1.14.7 h1:dIloXcIxSGhGy5LnOCJUVjUj3QsRvuSb5L9goJZTloc= github.com/spiffe/spire-api-sdk v1.14.7/go.mod h1:9hXJcMzatM1KwAtBDO3s6HccDCic++/5c2yOc5Iln8Y= github.com/src-d/gcfg v1.4.0 h1:xXbNR5AlLSA315x2UO+fTSSAXCDf+Ar38/6oyGbDKQ4= @@ -1248,8 +1248,8 @@ github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0 h1:xpI5pnEQ0erFCS3JmcEl7Blluo8Zi github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0/go.mod h1:wDDAhjfd1t4TjeJCSsmFK7CARPUs/ITi16ZZ8kmAaFQ= github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0 h1:eXuNqgrcYelxU1MVikOJDP3wTS5lvihM4ntoAbAMfvs= github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0/go.mod h1:3RhcxAqek6xUlRFmJifvU4CYLZN60KMQdIKqpZAZJG0= -github.com/tink-crypto/tink-go/v2 v2.7.0 h1:k7QnUXJ1cRDpvoy/5l1FimZqMAArRff8vjUqzi5N04o= -github.com/tink-crypto/tink-go/v2 v2.7.0/go.mod h1:cWNpQ/yAT/QHzAV0kBGMOSJzzYTKofDZdJaUqOPPWCI= +github.com/tink-crypto/tink-go/v2 v2.8.0 h1:1zODq1bZDqOQdNPjhvwGYLDw9On7mDWPnQf+4xXlpAc= +github.com/tink-crypto/tink-go/v2 v2.8.0/go.mod h1:aNXZeyxjQU9iqAeARRNmbESXUW6Mao1HRCCTY8B1TFM= github.com/tjfoc/gmsm v1.3.2/go.mod h1:HaUcFuY0auTiaHB9MHFGCPx5IaLhTUd2atbCFBQXn9w= github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho= github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE= @@ -1337,8 +1337,8 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0= go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/detectors/gcp v1.43.0 h1:62yY3dT7/ShwOxzA0RsKRgshBmfElKI4d/Myu2OxDFU= -go.opentelemetry.io/contrib/detectors/gcp v1.43.0/go.mod h1:RyaZMFY7yi1kAs45S6mbFGz8O8rqB0dTY14uzvG4LCs= +go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw= +go.opentelemetry.io/contrib/detectors/gcp v1.44.0/go.mod h1:tNAsgd8avTGke1+MndXlU5Cru4PQ9Ai/cCNWQv/ZJ/s= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= @@ -1469,8 +1469,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= -golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74= +golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -1531,8 +1531,8 @@ golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -1767,8 +1767,8 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg= -golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= -golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= @@ -1827,8 +1827,8 @@ google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6r google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg= google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o= google.golang.org/api v0.93.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw= -google.golang.org/api v0.290.0 h1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A= -google.golang.org/api v0.290.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8= +google.golang.org/api v0.295.0 h1:SSqFeEVjnK5SKo6t7D0E0M7EfX8SP7K0+OJd2Ly5FzU= +google.golang.org/api v0.295.0/go.mod h1:02qB8+Ox1ZFzcaKFMguy1nQLJmSIyvV6Ff4txJEXtl4= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= @@ -1919,12 +1919,12 @@ google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljW google.golang.org/genproto v0.0.0-20220617124728-180714bec0ad/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA= google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA= google.golang.org/genproto v0.0.0-20220815135757-37a418bb8959/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk= -google.golang.org/genproto v0.0.0-20260622175928-b703f567277d h1:CP5omUq8AJTiWMrPKM1WRLJ7zZeXd9OPcQD3TbBNAyY= -google.golang.org/genproto v0.0.0-20260622175928-b703f567277d/go.mod h1:DrwuGJgFSEVNpv3S5Q5VxhRTvdnjauw9GtvwVOEARfA= +google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms= +google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU= google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772 h1:4namukbyF7JY83aWHQwi9J5ugNTnDReLJ9ZcpqOpRB4= google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772/go.mod h1:1brfde68Npq6+WA75c1EHWPijZEG1kMus61ygPZfn4A= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260720155508-bb71a54f79dc h1:3TtNq/QbJNrSY1nVdjcikfBw6ujnaNbdrd88wNr1OW4= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260720155508-bb71a54f79dc/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= @@ -1957,8 +1957,8 @@ google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACu google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk= google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk= google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk= -google.golang.org/grpc v1.82.2 h1:2+rCCTC8esfgjDFhN+rIok0FVsBLw/y5vHzNX2FjRLw= -google.golang.org/grpc v1.82.2/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= diff --git a/vendor/cloud.google.com/go/auth/CHANGES.md b/vendor/cloud.google.com/go/auth/CHANGES.md index 2c1f6ff8fa..51c2683efd 100644 --- a/vendor/cloud.google.com/go/auth/CHANGES.md +++ b/vendor/cloud.google.com/go/auth/CHANGES.md @@ -1,5 +1,46 @@ # Changes +## [0.23.2](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.1...auth/v0.23.2) (2026-08-20) + + +### Bug Fixes + +* **auth:** Eliminate timing race conditions in grpctransport otel tests ([#20175](https://github.com/googleapis/google-cloud-go/issues/20175)) ([#20382](https://github.com/googleapis/google-cloud-go/issues/20382)) ([637505e](https://github.com/googleapis/google-cloud-go/commit/637505e5d5f090eec020604c3702b6ace11dcd38)) + +## [0.23.1](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.0...auth/v0.23.1) (2026-08-13) + + +### Bug Fixes + +* **auth:** Fix OpenTelemetry test flake in grpctransport ([#20191](https://github.com/googleapis/google-cloud-go/issues/20191)) ([e43ce28](https://github.com/googleapis/google-cloud-go/commit/e43ce28d01ea80970e6373e1c4540cb470cdc4a6)) + +## [0.23.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.22.0...auth/v0.23.0) (2026-08-07) + + +### Features + +* X509 workload identity ecp support ([#20138](https://github.com/googleapis/google-cloud-go/issues/20138)) ([5fa474a](https://github.com/googleapis/google-cloud-go/commit/5fa474a10a3863a1bb34ecb27540e8a574d7a736)) + +## [0.22.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.21.0...auth/v0.22.0) (2026-07-13) + + +### Features + +* **auth:** Populate http.response.status_code in http transport ([#20053](https://github.com/googleapis/google-cloud-go/issues/20053)) ([bff5d7c](https://github.com/googleapis/google-cloud-go/commit/bff5d7c9bc7f8ea8c0059f7d8e2d4294ba92c5bc)) + +## [0.21.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.20.0...auth/v0.21.0) (2026-07-07) + + +### Features + +* **auth:** Implement updated design for regional access boundary ([#13417](https://github.com/googleapis/google-cloud-go/issues/13417)) ([fadb6c7](https://github.com/googleapis/google-cloud-go/commit/fadb6c764dbe869fca736d9f0446b5010f21d2f2)) + + +### Bug Fixes + +* **auth:** Avoid double impersonation in idtoken and clarify docs ([#14474](https://github.com/googleapis/google-cloud-go/issues/14474)) ([995bfc3](https://github.com/googleapis/google-cloud-go/commit/995bfc36199ba6ae1c88803c71f39a0b19fc8c0f)), closes [#11105](https://github.com/googleapis/google-cloud-go/issues/11105) +* **auth:** Correct go min version ([#20094](https://github.com/googleapis/google-cloud-go/issues/20094)) ([6bb4358](https://github.com/googleapis/google-cloud-go/commit/6bb4358dca69b803e52eb2af882fa5afc24d54e2)) + ## [0.20.0](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.20.0) (2026-04-06) ## [0.19.0](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.19.0) (2026-03-23) diff --git a/vendor/cloud.google.com/go/auth/credentials/detect.go b/vendor/cloud.google.com/go/auth/credentials/detect.go index c9d7600e03..9ce369d79f 100644 --- a/vendor/cloud.google.com/go/auth/credentials/detect.go +++ b/vendor/cloud.google.com/go/auth/credentials/detect.go @@ -27,7 +27,7 @@ import ( "cloud.google.com/go/auth" "cloud.google.com/go/auth/internal" "cloud.google.com/go/auth/internal/credsfile" - "cloud.google.com/go/auth/internal/trustboundary" + "cloud.google.com/go/auth/internal/regionalaccessboundary" "cloud.google.com/go/compute/metadata" "github.com/googleapis/gax-go/v2/internallog" ) @@ -138,11 +138,15 @@ func OnGCE() bool { // Google APIs can compromise the security of your systems and data. For // more information, refer to [Validate credential configurations from // external sources](https://cloud.google.com/docs/authentication/external/externally-sourced-credentials). +// +// Note: If the detected credential configuration file contains a +// `service_account_impersonation_url` field, the returned credentials will +// yield tokens that are already impersonated to that target service account. func DetectDefault(opts *DetectOptions) (*auth.Credentials, error) { if err := opts.validate(); err != nil { return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } @@ -175,12 +179,12 @@ func DetectDefault(opts *DetectOptions) (*auth.Credentials, error) { } tp := computeTokenProvider(opts, metadataClient) - if trustBoundaryEnabled { - gceConfigProvider := trustboundary.NewGCEConfigProvider(gceUniverseDomainProvider) + if regionalAccessBoundaryEnabled { + gceConfigProvider := regionalaccessboundary.NewGCEConfigProvider(gceUniverseDomainProvider) var err error - tp, err = trustboundary.NewProvider(opts.client(), gceConfigProvider, opts.logger(), tp) + tp, err = regionalaccessboundary.NewProvider(opts.client(), gceConfigProvider, opts.logger(), tp) if err != nil { - return nil, fmt.Errorf("credentials: failed to initialize GCE trust boundary provider: %w", err) + return nil, fmt.Errorf("credentials: failed to initialize GCE Regional Access Boundary provider: %w", err) } } diff --git a/vendor/cloud.google.com/go/auth/credentials/filetypes.go b/vendor/cloud.google.com/go/auth/credentials/filetypes.go index f3737a5e8c..a82995582c 100644 --- a/vendor/cloud.google.com/go/auth/credentials/filetypes.go +++ b/vendor/cloud.google.com/go/auth/credentials/filetypes.go @@ -25,7 +25,7 @@ import ( "cloud.google.com/go/auth/credentials/internal/impersonate" internalauth "cloud.google.com/go/auth/internal" "cloud.google.com/go/auth/internal/credsfile" - "cloud.google.com/go/auth/internal/trustboundary" + "cloud.google.com/go/auth/internal/regionalaccessboundary" ) const cloudPlatformScope = "https://www.googleapis.com/auth/cloud-platform" @@ -159,15 +159,15 @@ func handleServiceAccount(f *credsfile.ServiceAccountFile, opts *DetectOptions) return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } - if !trustBoundaryEnabled { + if !regionalAccessBoundaryEnabled { return tp, nil } - saConfig := trustboundary.NewServiceAccountConfigProvider(opts2LO.Email, opts2LO.UniverseDomain) - return trustboundary.NewProvider(opts.client(), saConfig, opts.logger(), tp) + saConfig := regionalaccessboundary.NewServiceAccountConfigProvider(opts2LO.Email, opts2LO.UniverseDomain) + return regionalaccessboundary.NewProvider(opts.client(), saConfig, opts.logger(), tp) } func handleUserCredential(f *credsfile.UserCredentialsFile, opts *DetectOptions) (auth.TokenProvider, error) { @@ -210,35 +210,35 @@ func handleExternalAccount(f *credsfile.ExternalAccountFile, opts *DetectOptions if err != nil { return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } - if !trustBoundaryEnabled { + if !regionalAccessBoundaryEnabled { return tp, nil } ud := resolveUniverseDomain(opts.UniverseDomain, f.UniverseDomain) - var configProvider trustboundary.ConfigProvider + var configProvider regionalaccessboundary.ConfigProvider if f.ServiceAccountImpersonationURL == "" { // No impersonation, this is a direct external account credential. - // The trust boundary is based on the workload/workforce pool. + // The Regional Access Boundary is based on the workload/workforce pool. var err error - configProvider, err = trustboundary.NewExternalAccountConfigProvider(f.Audience, ud) + configProvider, err = regionalaccessboundary.NewExternalAccountConfigProvider(f.Audience, ud) if err != nil { return nil, err } } else { - // Impersonation is used. The trust boundary is based on the target service account. + // Impersonation is used. The Regional Access Boundary is based on the target service account. targetSAEmail, err := impersonate.ExtractServiceAccountEmail(f.ServiceAccountImpersonationURL) if err != nil { - return nil, fmt.Errorf("credentials: could not extract target service account email for trust boundary: %w", err) + return nil, fmt.Errorf("credentials: could not extract target service account email for Regional Access Boundary: %w", err) } - configProvider = trustboundary.NewServiceAccountConfigProvider(targetSAEmail, ud) + configProvider = regionalaccessboundary.NewServiceAccountConfigProvider(targetSAEmail, ud) } - return trustboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp) + return regionalaccessboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp) } func handleExternalAccountAuthorizedUser(f *credsfile.ExternalAccountAuthorizedUserFile, opts *DetectOptions) (auth.TokenProvider, error) { @@ -257,20 +257,20 @@ func handleExternalAccountAuthorizedUser(f *credsfile.ExternalAccountAuthorizedU if err != nil { return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } - if !trustBoundaryEnabled { + if !regionalAccessBoundaryEnabled { return tp, nil } ud := resolveUniverseDomain(opts.UniverseDomain, f.UniverseDomain) - configProvider, err := trustboundary.NewExternalAccountConfigProvider(f.Audience, ud) + configProvider, err := regionalaccessboundary.NewExternalAccountConfigProvider(f.Audience, ud) if err != nil { return nil, err } - return trustboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp) + return regionalaccessboundary.NewProvider(opts.client(), configProvider, opts.logger(), tp) } func handleImpersonatedServiceAccount(f *credsfile.ImpersonatedServiceAccountFile, opts *DetectOptions) (auth.TokenProvider, error) { @@ -306,19 +306,19 @@ func handleImpersonatedServiceAccount(f *credsfile.ImpersonatedServiceAccountFil if err != nil { return nil, err } - trustBoundaryEnabled, err := trustboundary.IsEnabled() + regionalAccessBoundaryEnabled, err := regionalaccessboundary.IsEnabled() if err != nil { return nil, err } - if !trustBoundaryEnabled { + if !regionalAccessBoundaryEnabled { return tp, nil } targetSAEmail, err := impersonate.ExtractServiceAccountEmail(f.ServiceAccountImpersonationURL) if err != nil { - return nil, fmt.Errorf("credentials: could not extract target service account email for trust boundary: %w", err) + return nil, fmt.Errorf("credentials: could not extract target service account email for Regional Access Boundary: %w", err) } - targetSAConfig := trustboundary.NewServiceAccountConfigProvider(targetSAEmail, ud) - return trustboundary.NewProvider(opts.client(), targetSAConfig, opts.logger(), tp) + targetSAConfig := regionalaccessboundary.NewServiceAccountConfigProvider(targetSAEmail, ud) + return regionalaccessboundary.NewProvider(opts.client(), targetSAConfig, opts.logger(), tp) } func handleGDCHServiceAccount(f *credsfile.GDCHServiceAccountFile, opts *DetectOptions) (auth.TokenProvider, error) { return gdch.NewTokenProvider(f, &gdch.Options{ diff --git a/vendor/cloud.google.com/go/auth/credentials/idtoken/file.go b/vendor/cloud.google.com/go/auth/credentials/idtoken/file.go index ac242f9ae2..4ff7e5e4db 100644 --- a/vendor/cloud.google.com/go/auth/credentials/idtoken/file.go +++ b/vendor/cloud.google.com/go/auth/credentials/idtoken/file.go @@ -23,6 +23,7 @@ import ( "cloud.google.com/go/auth" "cloud.google.com/go/auth/credentials" "cloud.google.com/go/auth/credentials/impersonate" + intexternalaccount "cloud.google.com/go/auth/credentials/internal/externalaccount" intimpersonate "cloud.google.com/go/auth/credentials/internal/impersonate" "cloud.google.com/go/auth/internal" "cloud.google.com/go/auth/internal/credsfile" @@ -34,6 +35,13 @@ const ( iamCredAud = "https://iamcredentials.googleapis.com/" ) +// credsFromDefault takes the credentials detected from the environment or JSON +// and constructs appropriate ID token credentials. +// +// Note: For ExternalAccount and ImpersonatedServiceAccount types, this function +// will create a new, non-impersonated base credential to avoid double +// impersonation when generating the ID token. It does not use the provided +// 'creds' as-is for these types. func credsFromDefault(creds *auth.Credentials, opts *Options) (*auth.Credentials, error) { b := creds.JSON() t, err := credsfile.ParseFileType(b) @@ -82,12 +90,18 @@ func credsFromDefault(creds *auth.Credentials, opts *Options) (*auth.Credentials } account := filepath.Base(accountURL.ServiceAccountImpersonationURL) account = strings.Split(account, ":")[0] + + baseCreds, err := baseCredsForImpersonation(t, b, opts, creds) + if err != nil { + return nil, err + } + config := impersonate.IDTokenOptions{ Audience: opts.Audience, TargetPrincipal: account, IncludeEmail: true, Client: opts.client(), - Credentials: creds, + Credentials: baseCreds, // Use the non-impersonated base credentials! Logger: internallog.New(opts.Logger), } idTokenCreds, err := impersonate.NewIDTokenCredentials(&config) @@ -141,3 +155,71 @@ func resolveUniverseDomain(f *credsfile.ServiceAccountFile) string { } return internal.DefaultUniverseDomain } + +// baseCredsForImpersonation constructs a non-impersonated base credential +// provider to avoid double impersonation. The 'creds' object returned by +// DetectDefault is already impersonated because it faithfully fulfills the +// instructions in the configuration file. However, for the specific context of +// generating an ID token, we must bypass that first layer of impersonation and +// use the source principal directly to call the generateIdToken API. This +// maintains separation of concerns by letting DetectDefault act as a general +// loader while handling the specific needs of idtoken generation here, avoiding +// a leaky abstraction in core packages. +func baseCredsForImpersonation(t string, b []byte, opts *Options, creds *auth.Credentials) (*auth.Credentials, error) { + var baseCreds *auth.Credentials + if credentials.CredType(t) == credentials.ExternalAccount { + f, err := credsfile.ParseExternalAccount(b) + if err != nil { + return nil, err + } + externalOpts := &intexternalaccount.Options{ + Audience: f.Audience, + SubjectTokenType: f.SubjectTokenType, + TokenURL: f.TokenURL, + TokenInfoURL: f.TokenInfoURL, + ClientSecret: f.ClientSecret, + ClientID: f.ClientID, + CredentialSource: f.CredentialSource, + QuotaProjectID: f.QuotaProjectID, + Scopes: []string{"https://www.googleapis.com/auth/cloud-platform"}, + WorkforcePoolUserProject: f.WorkforcePoolUserProject, + Client: opts.client(), + Logger: opts.Logger, + IsDefaultClient: opts.Client == nil, + } + // Do NOT set ServiceAccountImpersonationURL here to avoid the first layer of impersonation! + baseTP, err := intexternalaccount.NewTokenProvider(externalOpts) + if err != nil { + return nil, err + } + baseCreds = auth.NewCredentials(&auth.CredentialsOptions{ + TokenProvider: baseTP, + JSON: b, + UniverseDomainProvider: auth.CredentialsPropertyFunc(creds.UniverseDomain), + }) + } else { + // For ImpersonatedServiceAccount + f, err := credsfile.ParseImpersonatedServiceAccount(b) + if err != nil { + return nil, err + } + // Extract source credentials + sourceOpts := &credentials.DetectOptions{ + Scopes: []string{"https://www.googleapis.com/auth/cloud-platform"}, + CredentialsJSON: f.CredSource, + Client: opts.client(), + UseSelfSignedJWT: true, + } + // Detect credentials for the source + sourceCreds, err := credentials.DetectDefault(sourceOpts) + if err != nil { + return nil, err + } + baseCreds = auth.NewCredentials(&auth.CredentialsOptions{ + TokenProvider: sourceCreds, + JSON: b, + UniverseDomainProvider: auth.CredentialsPropertyFunc(creds.UniverseDomain), + }) + } + return baseCreds, nil +} diff --git a/vendor/cloud.google.com/go/auth/credentials/idtoken/idtoken.go b/vendor/cloud.google.com/go/auth/credentials/idtoken/idtoken.go index 765bc8777b..db3d049887 100644 --- a/vendor/cloud.google.com/go/auth/credentials/idtoken/idtoken.go +++ b/vendor/cloud.google.com/go/auth/credentials/idtoken/idtoken.go @@ -176,7 +176,11 @@ func (o *Options) validate() error { // empty, an attempt will be made to detect credentials from the environment // (see [cloud.google.com/go/auth/credentials.DetectDefault]). Only service // account, impersonated service account, external account and Compute -// credentials are supported. +// credentials are supported. Note: If the provided external account +// configuration (e.g., Workload Identity Federation) is configured to +// impersonate a service account, the returned credentials will yield ID tokens +// representing that target service account, rather than the external workload +// principal that initiated the request. func NewCredentials(opts *Options) (*auth.Credentials, error) { if err := opts.validate(); err != nil { return nil, err diff --git a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go index d86ca593c8..d67f45f471 100644 --- a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go +++ b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go @@ -30,6 +30,7 @@ import ( "time" "cloud.google.com/go/auth/internal/transport/cert" + "github.com/googleapis/enterprise-certificate-proxy/client" ) // x509Provider implements the subjectTokenProvider type for x509 workload @@ -57,13 +58,13 @@ func (xp *x509Provider) providerType() string { // reads the certificate file, and parses the certificate data. func loadLeafCertificate(configFilePath string) (*x509.Certificate, error) { // Get the path to the certificate file from the configuration file. - path, err := cert.GetCertificatePath(configFilePath) + path, err := cert.GetFileBasedCertificatePath(configFilePath) if err != nil { - return nil, fmt.Errorf("failed to get certificate path from config file: %w", err) + return nil, fmt.Errorf("credentials: failed to get certificate path from config file: %w", err) } leafCertBytes, err := os.ReadFile(path) if err != nil { - return nil, fmt.Errorf("failed to read leaf certificate file: %w", err) + return nil, fmt.Errorf("credentials: failed to read leaf certificate file: %w", err) } // Parse the certificate bytes. return parseCertificate(leafCertBytes) @@ -78,20 +79,20 @@ func encodeCert(cert *x509.Certificate) string { // parseCertificate parses a PEM-encoded certificate from the given byte slice. func parseCertificate(certData []byte) (*x509.Certificate, error) { if len(certData) == 0 { - return nil, errors.New("invalid certificate data: empty input") + return nil, errors.New("credentials: invalid certificate data: empty input") } // Decode the PEM-encoded data. block, _ := pem.Decode(certData) if block == nil { - return nil, errors.New("invalid PEM-encoded certificate data: no PEM block found") + return nil, errors.New("credentials: invalid PEM-encoded certificate data: no PEM block found") } if block.Type != "CERTIFICATE" { - return nil, fmt.Errorf("invalid PEM-encoded certificate data: expected CERTIFICATE block type, got %s", block.Type) + return nil, fmt.Errorf("credentials: invalid PEM-encoded certificate data: expected CERTIFICATE block type, got %s", block.Type) } // Parse the DER-encoded certificate. certificate, err := x509.ParseCertificate(block.Bytes) if err != nil { - return nil, fmt.Errorf("failed to parse certificate: %w", err) + return nil, fmt.Errorf("credentials: failed to parse certificate: %w", err) } return certificate, nil } @@ -110,9 +111,9 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) { trustChainData, err := os.ReadFile(trustChainPath) if err != nil { if errors.Is(err, fs.ErrNotExist) { - return nil, fmt.Errorf("trust chain file not found: %w", err) + return nil, fmt.Errorf("credentials: trust chain file not found: %w", err) } - return nil, fmt.Errorf("failed to read trust chain file: %w", err) + return nil, fmt.Errorf("credentials: failed to read trust chain file: %w", err) } // Split the file content into PEM certificate blocks. @@ -130,7 +131,7 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) { // Parse the certificate data. cert, err := parseCertificate([]byte(certData)) if err != nil { - return nil, fmt.Errorf("error parsing certificate from trust chain file: %w", err) + return nil, fmt.Errorf("credentials: error parsing certificate from trust chain file: %w", err) } // Append the certificate to the trust chain. @@ -141,6 +142,35 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) { return certificateTrustChain, nil } +func (xp *x509Provider) ecpSubjectToken(configFilePath string) (string, error) { + key, err := client.Cred(configFilePath) + if err != nil { + return "", fmt.Errorf("credentials: failed to initialize ECP client: %w", err) + } + defer key.Close() + + rawChain := key.CertificateChain() + if len(rawChain) == 0 { + return "", errors.New("credentials: ECP returned an empty certificate chain") + } + + certChain := make([]string, 0, len(rawChain)) + for _, derBytes := range rawChain { + cert, err := x509.ParseCertificate(derBytes) + if err != nil { + return "", fmt.Errorf("credentials: failed to parse certificate from ECP chain: %w", err) + } + certChain = append(certChain, encodeCert(cert)) + } + + jsonChain, err := json.Marshal(certChain) + if err != nil { + return "", fmt.Errorf("credentials: failed to format certificate data: %w", err) + } + + return string(jsonChain), nil +} + // subjectToken retrieves the X.509 subject token. It loads the leaf // certificate and, if a trust chain path is configured, the trust chain // certificates. It then constructs a JSON array containing the base64-encoded @@ -148,16 +178,24 @@ func readTrustChain(trustChainPath string) ([]*x509.Certificate, error) { // The leaf certificate must be at the top of the trust chain file. This JSON // array is used as the subject token for mTLS authentication. func (xp *x509Provider) subjectToken(context.Context) (string, error) { + configFilePath := cert.GetConfigFilePath(xp.ConfigFilePath) + + // First check if it's ECP based cert config + if cert.IsECPConfig(configFilePath) { + return xp.ecpSubjectToken(configFilePath) + } + + // It's not ECP, do the normal file based cert config way. // Load the leaf certificate. - leafCert, err := loadLeafCertificate(xp.ConfigFilePath) + leafCert, err := loadLeafCertificate(configFilePath) if err != nil { - return "", fmt.Errorf("failed to load leaf certificate: %w", err) + return "", fmt.Errorf("credentials: failed to load leaf certificate: %w", err) } // Read the trust chain. trustChain, err := readTrustChain(xp.TrustChainPath) if err != nil { - return "", fmt.Errorf("failed to read trust chain: %w", err) + return "", fmt.Errorf("credentials: failed to read trust chain: %w", err) } // Initialize the certificate chain with the leaf certificate. @@ -178,7 +216,7 @@ func (xp *x509Provider) subjectToken(context.Context) (string, error) { // Return an error if the current certificate is the same as the leaf certificate. if encoded == certChain[0] { - return "", errors.New("the leaf certificate must be at the top of the trust chain file") + return "", errors.New("credentials: the leaf certificate must be at the top of the trust chain file") } // Add the current certificate to the chain. @@ -189,7 +227,7 @@ func (xp *x509Provider) subjectToken(context.Context) (string, error) { // Convert the certificate chain to a JSON array of base64-encoded strings. jsonChain, err := json.Marshal(certChain) if err != nil { - return "", fmt.Errorf("failed to format certificate data: %w", err) + return "", fmt.Errorf("credentials: failed to format certificate data: %w", err) } // Return the JSON-formatted certificate chain. diff --git a/vendor/cloud.google.com/go/auth/grpctransport/directpath.go b/vendor/cloud.google.com/go/auth/grpctransport/directpath.go index 69d6d0034e..c405e9f8ec 100644 --- a/vendor/cloud.google.com/go/auth/grpctransport/directpath.go +++ b/vendor/cloud.google.com/go/auth/grpctransport/directpath.go @@ -120,7 +120,7 @@ func configureDirectPath(grpcOpts []grpc.DialOption, opts *Options, endpoint str }) if isDirectPathEnabled(endpoint, opts) && compute.OnComputeEngine() && isTokenProviderDirectPathCompatible(creds, opts) { // Overwrite all of the previously specific DialOptions, DirectPath uses its own set of credentials and certificates. - defaultCredetialsOptions := grpcgoogle.DefaultCredentialsOptions{PerRPCCreds: &grpcCredentialsProvider{creds: creds}} + defaultCredetialsOptions := grpcgoogle.DefaultCredentialsOptions{PerRPCCreds: &grpcCredentialsProvider{creds: creds, endpoint: endpoint}} if isDirectPathBoundTokenEnabled(opts.InternalOptions) && isTokenProviderComputeEngine(creds) { optsClone := opts.resolveDetectOptions() optsClone.TokenBindingType = credentials.ALTSHardBinding @@ -128,7 +128,7 @@ func configureDirectPath(grpcOpts []grpc.DialOption, opts *Options, endpoint str if err != nil { return nil, "", err } - defaultCredetialsOptions.ALTSPerRPCCreds = &grpcCredentialsProvider{creds: altsCreds} + defaultCredetialsOptions.ALTSPerRPCCreds = &grpcCredentialsProvider{creds: altsCreds, endpoint: endpoint} } grpcOpts = []grpc.DialOption{ grpc.WithCredentialsBundle(grpcgoogle.NewDefaultCredentialsWithOptions(defaultCredetialsOptions))} diff --git a/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go b/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go index f77f6423c4..f76091b634 100644 --- a/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go +++ b/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go @@ -358,6 +358,7 @@ func dial(ctx context.Context, secure bool, opts *Options) (*grpc.ClientConn, er creds: creds, metadata: metadata, clientUniverseDomain: opts.UniverseDomain, + endpoint: transportCreds.Endpoint, }), ) // Attempt Direct Path @@ -405,6 +406,7 @@ type grpcCredentialsProvider struct { // Additional metadata attached as headers. metadata map[string]string clientUniverseDomain string + endpoint string } // getClientUniverseDomain returns the default service domain for a given Cloud @@ -447,7 +449,7 @@ func (c *grpcCredentialsProvider) GetRequestMetadata(ctx context.Context, uri .. } } metadata := make(map[string]string, len(c.metadata)+1) - headers.SetAuthMetadata(token, metadata) + headers.SetAuthMetadata(ctx, token, c.endpoint, metadata) for k, v := range c.metadata { metadata[k] = v } diff --git a/vendor/cloud.google.com/go/auth/httptransport/transport.go b/vendor/cloud.google.com/go/auth/httptransport/transport.go index 87b3fef218..be1945a986 100644 --- a/vendor/cloud.google.com/go/auth/httptransport/transport.go +++ b/vendor/cloud.google.com/go/auth/httptransport/transport.go @@ -284,6 +284,11 @@ func (t *otelAttributeTransport) RoundTrip(req *http.Request) (*http.Response, e } resp, err := t.base.RoundTrip(req) + if gax.IsFeatureEnabled("METRICS") { + if data != nil && resp != nil { + data.SetHTTPStatusCode(resp.StatusCode) + } + } var logger *slog.Logger if gax.IsFeatureEnabled("LOGGING") { diff --git a/vendor/cloud.google.com/go/auth/internal/internal.go b/vendor/cloud.google.com/go/auth/internal/internal.go index 48e9bd9ece..d79e0ffbe5 100644 --- a/vendor/cloud.google.com/go/auth/internal/internal.go +++ b/vendor/cloud.google.com/go/auth/internal/internal.go @@ -48,11 +48,8 @@ const ( // Universe domain is the default service domain for a given Cloud universe. DefaultUniverseDomain = "googleapis.com" - // TrustBoundaryNoOp is a constant indicating no trust boundary is enforced. - TrustBoundaryNoOp = "0x0" - - // TrustBoundaryDataKey is the key used to store trust boundary data in a token's metadata. - TrustBoundaryDataKey = "google.auth.trust_boundary_data" + // RegionalAccessBoundaryDataKey is the key used to store regional access boundary data in a token's metadata. + RegionalAccessBoundaryDataKey = "google.auth.regional_access_boundary_data" ) type clonableTransport interface { @@ -231,55 +228,35 @@ func FormatIAMServiceAccountResource(name string) string { return fmt.Sprintf("projects/-/serviceAccounts/%s", name) } -// TrustBoundaryData represents the trust boundary data associated with a token. +// RegionalAccessBoundaryData represents the regional access boundary data associated with a token. // It contains information about the regions or environments where the token is valid. -type TrustBoundaryData struct { +type RegionalAccessBoundaryData struct { // Locations is the list of locations that the token is allowed to be used in. Locations []string // EncodedLocations represents the locations in an encoded format. EncodedLocations string } -// NewTrustBoundaryData returns a new TrustBoundaryData with the specified locations and encoded locations. -func NewTrustBoundaryData(locations []string, encodedLocations string) *TrustBoundaryData { +// NewRegionalAccessBoundaryData returns a new RegionalAccessBoundaryData with the specified locations and encoded locations. +func NewRegionalAccessBoundaryData(locations []string, encodedLocations string) *RegionalAccessBoundaryData { // Ensure consistency by treating a nil slice as an empty slice. if locations == nil { locations = []string{} } locationsCopy := make([]string, len(locations)) copy(locationsCopy, locations) - return &TrustBoundaryData{ + return &RegionalAccessBoundaryData{ Locations: locationsCopy, EncodedLocations: encodedLocations, } } -// NewNoOpTrustBoundaryData returns a new TrustBoundaryData with no restrictions. -func NewNoOpTrustBoundaryData() *TrustBoundaryData { - return &TrustBoundaryData{ - Locations: []string{}, - EncodedLocations: TrustBoundaryNoOp, - } -} - -// TrustBoundaryHeader returns the value for the x-allowed-locations header and a bool -// indicating if the header should be set. The return values are structured to -// handle three distinct states required by the backend: -// 1. Header not set: (value="", present=false) -> data is empty. -// 2. Header set to an empty string: (value="", present=true) -> data is a no-op. -// 3. Header set to a value: (value="...", present=true) -> data has locations. -func (t TrustBoundaryData) TrustBoundaryHeader() (value string, present bool) { +// RegionalAccessBoundaryHeader returns the value for the x-allowed-locations header and a bool +// indicating if the header should be set. If EncodedLocations is empty, the header +// should not be present. Otherwise, it should be present with the value of EncodedLocations. +func (t RegionalAccessBoundaryData) RegionalAccessBoundaryHeader() (value string, present bool) { if t.EncodedLocations == "" { - // If the data is empty, the header should not be present. return "", false } - - // If data is not empty, the header should always be present. - present = true - value = "" - if t.EncodedLocations != TrustBoundaryNoOp { - value = t.EncodedLocations - } - // For a no-op, the backend requires an empty string. - return value, present + return t.EncodedLocations, true } diff --git a/vendor/cloud.google.com/go/auth/internal/trustboundary/external_accounts_config_providers.go b/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/external_accounts_config_providers.go similarity index 60% rename from vendor/cloud.google.com/go/auth/internal/trustboundary/external_accounts_config_providers.go rename to vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/external_accounts_config_providers.go index 8fa5600bdc..2c1189017f 100644 --- a/vendor/cloud.google.com/go/auth/internal/trustboundary/external_accounts_config_providers.go +++ b/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/external_accounts_config_providers.go @@ -12,7 +12,7 @@ // See the License for the specific language governing permissions and // limitations under the License. -package trustboundary +package regionalaccessboundary import ( "context" @@ -21,13 +21,13 @@ import ( ) const ( - workloadAllowedLocationsEndpoint = "https://iamcredentials.%s/v1/projects/%s/locations/global/workloadIdentityPools/%s/allowedLocations" - workforceAllowedLocationsEndpoint = "https://iamcredentials.%s/v1/locations/global/workforcePools/%s/allowedLocations" + workloadAllowedLocationsEndpoint = "https://iamcredentials.googleapis.com/v1/projects/%s/locations/global/workloadIdentityPools/%s/allowedLocations" + workforceAllowedLocationsEndpoint = "https://iamcredentials.googleapis.com/v1/locations/global/workforcePools/%s/allowedLocations" ) var ( - workforceAudiencePattern = regexp.MustCompile(`//iam\.([^/]+)/locations/global/workforcePools/([^/]+)`) - workloadAudiencePattern = regexp.MustCompile(`//iam\.([^/]+)/projects/([^/]+)/locations/global/workloadIdentityPools/([^/]+)`) + workforceAudiencePattern = regexp.MustCompile(`^//iam\.([^/]+)/locations/([^/]+)/workforcePools/([^/]+)/providers/[^/]+$`) + workloadAudiencePattern = regexp.MustCompile(`^//iam\.([^/]+)/projects/([^/]+)/locations/([^/]+)/workloadIdentityPools/([^/]+)/providers/[^/]+$`) ) // NewExternalAccountConfigProvider creates a new ConfigProvider for external accounts. @@ -36,19 +36,19 @@ func NewExternalAccountConfigProvider(audience, inputUniverseDomain string) (Con var isWorkload bool matches := workloadAudiencePattern.FindStringSubmatch(audience) - if len(matches) == 4 { // Expecting full match, domain, projectNumber, poolID + if len(matches) == 5 { // Expecting full match, domain, projectNumber, location, poolID audienceDomain = matches[1] projectNumber = matches[2] - poolID = matches[3] + poolID = matches[4] isWorkload = true } else { matches = workforceAudiencePattern.FindStringSubmatch(audience) - if len(matches) == 3 { // Expecting full match, domain, poolID + if len(matches) == 4 { // Expecting full match, domain, location, poolID audienceDomain = matches[1] - poolID = matches[2] + poolID = matches[3] isWorkload = false } else { - return nil, fmt.Errorf("trustboundary: unknown audience format: %q", audience) + return nil, fmt.Errorf("regionalaccessboundary: unknown audience format: %q", audience) } } @@ -56,7 +56,7 @@ func NewExternalAccountConfigProvider(audience, inputUniverseDomain string) (Con if effectiveUniverseDomain == "" { effectiveUniverseDomain = audienceDomain } else if audienceDomain != "" && effectiveUniverseDomain != audienceDomain { - return nil, fmt.Errorf("trustboundary: provided universe domain (%q) does not match domain in audience (%q)", inputUniverseDomain, audienceDomain) + return nil, fmt.Errorf("regionalaccessboundary: provided universe domain (%q) does not match domain in audience (%q)", inputUniverseDomain, audienceDomain) } if isWorkload { @@ -77,8 +77,8 @@ type workforcePoolConfigProvider struct { universeDomain string } -func (p *workforcePoolConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) { - return fmt.Sprintf(workforceAllowedLocationsEndpoint, p.universeDomain, p.poolID), nil +func (p *workforcePoolConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) { + return fmt.Sprintf(workforceAllowedLocationsEndpoint, p.poolID), nil } func (p *workforcePoolConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) { @@ -91,8 +91,8 @@ type workloadIdentityPoolConfigProvider struct { universeDomain string } -func (p *workloadIdentityPoolConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) { - return fmt.Sprintf(workloadAllowedLocationsEndpoint, p.universeDomain, p.projectNumber, p.poolID), nil +func (p *workloadIdentityPoolConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) { + return fmt.Sprintf(workloadAllowedLocationsEndpoint, p.projectNumber, p.poolID), nil } func (p *workloadIdentityPoolConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) { diff --git a/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go b/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go new file mode 100644 index 0000000000..a94d25ee03 --- /dev/null +++ b/vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go @@ -0,0 +1,503 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package regionalaccessboundary + +import ( + "context" + "encoding/json" + "errors" + "fmt" + "io" + "log/slog" + "maps" + "math/rand" + "net" + "net/http" + "net/url" + "os" + "strings" + "sync" + "time" + + "cloud.google.com/go/auth" + "cloud.google.com/go/auth/internal" + "cloud.google.com/go/auth/internal/retry" + "github.com/googleapis/gax-go/v2/internallog" +) + +// ProviderKey is the key to fetch the DataProvider from Token Metadata. +const ProviderKey = "regionalaccessboundary.ProviderKey" + +const ( + // serviceAccountAllowedLocationsEndpoint is the URL for fetching allowed locations for a given service account email. + serviceAccountAllowedLocationsEndpoint = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/%s/allowedLocations" + + // cacheTTL is the duration cached RAB data remains valid before hard expiry. + cacheTTL = 6 * time.Hour + // cacheSoftExpiry is the threshold before hard expiry where a background refresh is triggered. + cacheSoftExpiry = 1 * time.Hour + // baseCooldownDuration is the initial delay after a failed background fetch. + baseCooldownDuration = 15 * time.Minute +) + +var ( + // retryOptions configures the retry behavior for Regional Access Boundary lookups. + retryOptions = &retry.Options{ + Initial: 1 * time.Second, + Max: 60 * time.Second, + Multiplier: 2.0, + MaxAttempts: 6, + } +) + +// isEnabled wraps isRegionalAccessBoundaryEnabled with sync.OnceValues to ensure it's +// called only once. +var isEnabled = sync.OnceValues(isRegionalAccessBoundaryEnabled) + +// IsEnabled returns if the Regional Access Boundary feature is enabled and an error if +// the configuration is invalid. The underlying check is performed only once. +func IsEnabled() (bool, error) { + return isEnabled() +} + +// isRegionalAccessBoundaryEnabled checks if the Regional Access Boundary feature +// is enabled via the GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED environment variable. +// +// If the environment variable is not set or empty, it is considered false. +// +// The environment variable is interpreted as a boolean with the following +// (case-insensitive) rules: +// - "true", "1" are considered true. +// - All other values (including "false", "0", or invalid strings) are considered false. +func isRegionalAccessBoundaryEnabled() (bool, error) { + val := strings.ToLower(os.Getenv("GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED")) + return val == "true" || val == "1", nil +} + +// ConfigProvider provides specific configuration for Regional Access Boundary lookups. +type ConfigProvider interface { + // GetRegionalAccessBoundaryEndpoint returns the endpoint URL for the Regional Access Boundary lookup. + GetRegionalAccessBoundaryEndpoint(ctx context.Context) (url string, err error) + // GetUniverseDomain returns the universe domain associated with the credential. + // It may return an error if the universe domain cannot be determined. + GetUniverseDomain(ctx context.Context) (string, error) +} + +// AllowedLocationsResponse is the structure of the response from the Regional Access Boundary API. +type AllowedLocationsResponse struct { + // Locations is the list of allowed locations. + Locations []string `json:"locations"` + // EncodedLocations is the encoded representation of the allowed locations. + EncodedLocations string `json:"encodedLocations"` +} + +// fetchRegionalAccessBoundaryData fetches the Regional Access Boundary data from the API. +func fetchRegionalAccessBoundaryData(ctx context.Context, client *http.Client, url string, token *auth.Token, logger *slog.Logger) (*internal.RegionalAccessBoundaryData, error) { + if logger == nil { + logger = slog.New(slog.NewTextHandler(io.Discard, nil)) + } + if client == nil { + return nil, errors.New("regionalaccessboundary: HTTP client is required") + } + + if url == "" { + return nil, errors.New("regionalaccessboundary: URL cannot be empty") + } + + req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil) + if err != nil { + return nil, fmt.Errorf("regionalaccessboundary: failed to create Regional Access Boundary request: %w", err) + } + + if token == nil || token.Value == "" { + return nil, errors.New("regionalaccessboundary: access token required for lookup API authentication") + } + typ := token.Type + if typ == "" { + typ = internal.TokenTypeBearer + } + req.Header.Set("Authorization", typ+" "+token.Value) + logger.DebugContext(ctx, "Regional Access Boundary request", "request", internallog.HTTPRequest(req, nil)) + + retryer := retry.NewWithOptions(retryOptions) + startTime := time.Now() + var response *http.Response + for { + response, err = client.Do(req) + + var statusCode int + if response != nil { + statusCode = response.StatusCode + } + pause, shouldRetry := retryer.Retry(statusCode, err) + + // Enforce a maximum 1 minute retry window for specific server errors. + if shouldRetry && (statusCode == 500 || statusCode == 502 || statusCode == 503 || statusCode == 504) { + if time.Since(startTime)+pause > 1*time.Minute { + shouldRetry = false + } + } + + if !shouldRetry { + break + } + + if response != nil { + // Drain and close the body to reuse the connection + io.Copy(io.Discard, response.Body) + response.Body.Close() + } + + if err := retry.Sleep(ctx, pause); err != nil { + return nil, err + } + } + + if err != nil { + return nil, fmt.Errorf("regionalaccessboundary: failed to fetch Regional Access Boundary: %w", err) + } + defer response.Body.Close() + + body, err := io.ReadAll(response.Body) + if err != nil { + return nil, fmt.Errorf("regionalaccessboundary: failed to read Regional Access Boundary response: %w", err) + } + + logger.DebugContext(ctx, "Regional Access Boundary response", "response", internallog.HTTPResponse(response, body)) + + if response.StatusCode != http.StatusOK { + return nil, fmt.Errorf("regionalaccessboundary: Regional Access Boundary request failed with status: %s, body: %s", response.Status, string(body)) + } + + apiResponse := AllowedLocationsResponse{} + if err := json.Unmarshal(body, &apiResponse); err != nil { + return nil, fmt.Errorf("regionalaccessboundary: failed to unmarshal Regional Access Boundary response: %w", err) + } + + if apiResponse.EncodedLocations == "" { + return nil, errors.New("regionalaccessboundary: invalid API response: encodedLocations is empty") + } + + return internal.NewRegionalAccessBoundaryData(apiResponse.Locations, apiResponse.EncodedLocations), nil +} + +// DataProvider fetches and caches Regional Access Boundary Data. +// It implements the auth.TokenProvider interface and uses a ConfigProvider +// to get type-specific details for the lookup. +type DataProvider struct { + client *http.Client + configProvider ConfigProvider + logger *slog.Logger + base auth.TokenProvider + + mu sync.RWMutex + data *internal.RegionalAccessBoundaryData + dataExpiry time.Time + isFetching bool + cooldownExpiry time.Time + cooldownDuration time.Duration // tracks the current cooldown duration for exponential backoff +} + +// NewProvider wraps the provided base [auth.TokenProvider] and returns a new +// provider that fetches and caches the Regional Access Boundary data. It uses +// the provided HTTP client and configProvider. +func NewProvider(client *http.Client, configProvider ConfigProvider, logger *slog.Logger, base auth.TokenProvider) (*DataProvider, error) { + if client == nil { + return nil, errors.New("regionalaccessboundary: HTTP client cannot be nil for DataProvider") + } + if configProvider == nil { + return nil, errors.New("regionalaccessboundary: ConfigProvider cannot be nil for DataProvider") + } + p := &DataProvider{ + client: client, + configProvider: configProvider, + logger: internallog.New(logger), + base: base, + cooldownDuration: 15 * time.Minute, + } + return p, nil +} + +// Token retrieves a token from the base provider and injects the DataProvider +// instance into its metadata. +func (p *DataProvider) Token(ctx context.Context) (*auth.Token, error) { + token, err := p.base.Token(ctx) + if err != nil { + return nil, err + } + + // Clone the token and its metadata to avoid mutating shared/cached state. + newToken := *token + newToken.Metadata = maps.Clone(token.Metadata) + if newToken.Metadata == nil { + newToken.Metadata = make(map[string]interface{}) + } + newToken.Metadata[ProviderKey] = p + + return &newToken, nil +} + +// GetHeaderValue immediately returns a valid header if it's cached, or kicks off a background fetch +// if it is unpopulated or expired. +func (p *DataProvider) GetHeaderValue(ctx context.Context, reqURL string, accessToken *auth.Token) string { + if !strings.Contains(reqURL, "://") { + reqURL = "https://" + reqURL + } + if u, err := url.Parse(reqURL); err == nil { + host := u.Host + if host == "" && strings.HasPrefix(u.Path, "/") { + host = strings.TrimPrefix(u.Path, "/") + } + if h, _, err := net.SplitHostPort(host); err == nil { + host = h + } + // Skip lookup for regional endpoints. + if host == "rep.googleapis.com" || strings.HasSuffix(host, ".rep.googleapis.com") || + host == "rep.sandbox.googleapis.com" || strings.HasSuffix(host, ".rep.sandbox.googleapis.com") { + return "" + } + // Skip lookup for IAM and STS endpoints as they do not require RAB headers. + if host == "iam.googleapis.com" || host == "iamcredentials.googleapis.com" || + host == "sts.googleapis.com" { + return "" + } + } + + // Skip lookup for non-default universe domains. + uniDomain, err := p.configProvider.GetUniverseDomain(ctx) + if err != nil { + p.logger.WarnContext(ctx, "regionalaccessboundary: error getting universe domain", "error", err) + return "" + } + if uniDomain != "" && uniDomain != internal.DefaultUniverseDomain { + return "" + } + + // Return the cached data if present and not expired. + p.mu.RLock() + data := p.data + dataExpiry := p.dataExpiry + p.mu.RUnlock() + + now := time.Now() + if data != nil && now.Before(dataExpiry) { + val, _ := data.RegionalAccessBoundaryHeader() + + // Soft Expiry: if the cached data is within the soft expiration window, + // initiate a non-blocking background refresh to proactively fetch new data + // while continuing to serve the current valid cache block. + if now.After(dataExpiry.Add(-cacheSoftExpiry)) { + p.mu.Lock() + if !p.isFetching && now.After(p.cooldownExpiry) { + p.isFetching = true + go p.fetchAsync(context.Background(), accessToken) + } + p.mu.Unlock() + } + + return val + } + + p.mu.Lock() + defer p.mu.Unlock() + + // Skip lookup if in cooldown or another process is already fetching. + if p.isFetching || time.Now().Before(p.cooldownExpiry) { + return "" + } + + // Start async RAB lookup and return empty header. + p.isFetching = true + go p.fetchAsync(context.Background(), accessToken) + return "" +} + +// fetchAsync performs the background lookup for Regional Access Boundary data. +// It updates the provider's state based on the result (success or failure). +func (p *DataProvider) fetchAsync(ctx context.Context, accessToken *auth.Token) { + defer func() { + p.mu.Lock() + p.isFetching = false + p.mu.Unlock() + }() + + url, err := p.configProvider.GetRegionalAccessBoundaryEndpoint(ctx) + if err != nil { + p.logger.WarnContext(ctx, "regionalaccessboundary: error getting the lookup endpoint", "error", err) + p.handleFetchFailure(ctx) + return + } + + newData, fetchErr := fetchRegionalAccessBoundaryData(ctx, p.client, url, accessToken, p.logger) + + if fetchErr != nil { + p.logger.WarnContext(ctx, "regionalaccessboundary: async fetch failed", "error", fetchErr) + p.handleFetchFailure(ctx) + return + } + + p.handleFetchSuccess(newData) +} + +// handleFetchSuccess updates the cache with new data and clears any existing cooldown. +func (p *DataProvider) handleFetchSuccess(newData *internal.RegionalAccessBoundaryData) { + p.mu.Lock() + defer p.mu.Unlock() + p.data = newData + p.dataExpiry = time.Now().Add(cacheTTL) + p.cooldownExpiry = time.Time{} + p.cooldownDuration = baseCooldownDuration +} + +// handleFetchFailure triggers the cooldown period using exponential backoff. +func (p *DataProvider) handleFetchFailure(ctx context.Context) { + p.mu.Lock() + defer p.mu.Unlock() + + // Add random bounded jitter (between half of the base and the full base) to prevent thundering herds + jitter := p.cooldownDuration/2 + time.Duration(rand.Int63n(int64(p.cooldownDuration/2))) + p.cooldownExpiry = time.Now().Add(jitter) + + // Exponential backoff for the NEXT attempt, up to cacheTTL max (6 hours) + nextCooldown := p.cooldownDuration * 2 + if nextCooldown > cacheTTL { + nextCooldown = cacheTTL + } + p.cooldownDuration = nextCooldown +} + +// serviceAccountConfig holds configuration for SA Regional Access Boundary lookups. +// It implements the ConfigProvider interface. +type serviceAccountConfig struct { + ServiceAccountEmail string + UniverseDomain string +} + +// NewServiceAccountConfigProvider creates a new config for service accounts. +func NewServiceAccountConfigProvider(saEmail, universeDomain string) ConfigProvider { + return &serviceAccountConfig{ + ServiceAccountEmail: saEmail, + UniverseDomain: universeDomain, + } +} + +// GetRegionalAccessBoundaryEndpoint returns the formatted URL for fetching allowed locations +// for the configured service account. +func (sac *serviceAccountConfig) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (url string, err error) { + if sac.ServiceAccountEmail == "" { + return "", errors.New("regionalaccessboundary: service account email cannot be empty for config") + } + return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, sac.ServiceAccountEmail), nil +} + +// GetUniverseDomain returns the configured universe domain, defaulting to +// [internal.DefaultUniverseDomain] if not explicitly set. +func (sac *serviceAccountConfig) GetUniverseDomain(ctx context.Context) (string, error) { + if sac.UniverseDomain == "" { + return internal.DefaultUniverseDomain, nil + } + return sac.UniverseDomain, nil +} + +// GCEConfigProvider implements ConfigProvider for GCE environments. +// It lazily fetches and caches the necessary metadata (service account email, universe domain) +type GCEConfigProvider struct { + // universeDomainProvider provides the universe domain and underlying metadata client. + universeDomainProvider *internal.ComputeUniverseDomainProvider + + // Caching for service account email + saMu sync.Mutex + saEmail string + + // Caching for universe domain + udOnce sync.Once + ud string + udErr error +} + +// NewGCEConfigProvider creates a new GCEConfigProvider +// which uses the provided gceUDP to interact with the GCE metadata server. +func NewGCEConfigProvider(gceUDP *internal.ComputeUniverseDomainProvider) *GCEConfigProvider { + // The validity of gceUDP and its internal MetadataClient will be checked + // within the GetRegionalAccessBoundaryEndpoint and GetUniverseDomain methods. + return &GCEConfigProvider{ + universeDomainProvider: gceUDP, + } +} + +func (g *GCEConfigProvider) fetchSA(ctx context.Context) (string, error) { + if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil { + return "", errors.New("regionalaccessboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)") + } + mdClient := g.universeDomainProvider.MetadataClient + saEmail, err := mdClient.EmailWithContext(ctx, "default") + if err != nil { + return "", fmt.Errorf("regionalaccessboundary: GCE config: failed to get service account email: %w", err) + } + return saEmail, nil +} + +func (g *GCEConfigProvider) fetchUD(ctx context.Context) { + if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil { + g.udErr = errors.New("regionalaccessboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)") + return + } + ud, err := g.universeDomainProvider.GetProperty(ctx) + if err != nil { + g.udErr = fmt.Errorf("regionalaccessboundary: GCE config: failed to get universe domain: %w", err) + return + } + if ud == "" { + ud = internal.DefaultUniverseDomain + } + g.ud = ud +} + +// GetRegionalAccessBoundaryEndpoint constructs the Regional Access Boundary lookup URL for a GCE environment. +// It uses cached service account email after the first call. +func (g *GCEConfigProvider) GetRegionalAccessBoundaryEndpoint(ctx context.Context) (string, error) { + // Check if we already have a cached service account email. + g.saMu.Lock() + if g.saEmail != "" { + email := g.saEmail + g.saMu.Unlock() + return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, email), nil + } + g.saMu.Unlock() + + // Fetch the email from the metadata server. We do not hold the lock + // during this I/O operation to avoid blocking other goroutines. + email, err := g.fetchSA(ctx) + if err != nil { + return "", err + } + + // Cache the successful result. + g.saMu.Lock() + g.saEmail = email + g.saMu.Unlock() + + return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, email), nil +} + +// GetUniverseDomain retrieves the universe domain from the GCE metadata server. +// It uses a cached value after the first call. +func (g *GCEConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) { + g.udOnce.Do(func() { g.fetchUD(ctx) }) + if g.udErr != nil { + return "", g.udErr + } + return g.ud, nil +} diff --git a/vendor/cloud.google.com/go/auth/internal/retry/retry.go b/vendor/cloud.google.com/go/auth/internal/retry/retry.go index 276cc4a3e2..7cbd06a763 100644 --- a/vendor/cloud.google.com/go/auth/internal/retry/retry.go +++ b/vendor/cloud.google.com/go/auth/internal/retry/retry.go @@ -22,10 +22,6 @@ import ( "time" ) -const ( - maxRetryAttempts = 5 -) - var ( syscallRetryable = func(error) bool { return false } ) @@ -61,21 +57,69 @@ func Sleep(ctx context.Context, d time.Duration) error { // New returns a new Retryer with the default backoff strategy. func New() *Retryer { - return &Retryer{bo: &defaultBackoff{ - cur: 100 * time.Millisecond, - max: 30 * time.Second, - mul: 2, - }} + return NewWithOptions(&Options{ + Initial: 100 * time.Millisecond, + Max: 30 * time.Second, + Multiplier: 2, + MaxAttempts: 5, + }) +} + +// Options defines the configuration for the Retryer. +type Options struct { + // Initial is the initial backoff duration. + Initial time.Duration + // Max is the maximum backoff duration for a single retry attempt. + // It does not limit the total time of all retries. + Max time.Duration + // Multiplier is the factor by which the backoff duration is multiplied after each attempt. + Multiplier float64 + // MaxAttempts is the maximum number of attempts before giving up. + MaxAttempts int +} + +// NewWithOptions returns a new Retryer with the specified backoff strategy. +// If any option is not set (zero value), it defaults to the values used in New(). +func NewWithOptions(opts *Options) *Retryer { + initial := opts.Initial + if initial <= 0 { + initial = 100 * time.Millisecond + } + + max := opts.Max + if max <= 0 { + max = 30 * time.Second + } + + multiplier := opts.Multiplier + if multiplier < 1.0 { + multiplier = 2.0 + } + + maxAttempts := opts.MaxAttempts + if maxAttempts <= 0 { + maxAttempts = 5 + } + + return &Retryer{ + bo: &defaultBackoff{ + cur: initial, + max: max, + mul: multiplier, + }, + maxAttempts: maxAttempts, + } } type backoff interface { Pause() time.Duration } -// Retryer is a retryer for HTTP requests. +// Retryer handles retry logic for HTTP requests using a configurable backoff strategy. type Retryer struct { - bo backoff - attempts int + bo backoff + attempts int + maxAttempts int } // Retry determines if a request should be retried. @@ -87,7 +131,7 @@ func (r *Retryer) Retry(status int, err error) (time.Duration, bool) { if !retryOk { return 0, false } - if r.attempts == maxRetryAttempts { + if r.attempts == r.maxAttempts { return 0, false } r.attempts++ diff --git a/vendor/cloud.google.com/go/firestore/apiv1/info.go b/vendor/cloud.google.com/go/auth/internal/retry/retry_linux.go similarity index 59% rename from vendor/cloud.google.com/go/firestore/apiv1/info.go rename to vendor/cloud.google.com/go/auth/internal/retry/retry_linux.go index 2aa77f6e85..8f0a78c577 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/info.go +++ b/vendor/cloud.google.com/go/auth/internal/retry/retry_linux.go @@ -1,4 +1,4 @@ -// Copyright 2020 Google LLC +// Copyright 2026 Google LLC // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. @@ -12,13 +12,20 @@ // See the License for the specific language governing permissions and // limitations under the License. -package firestore +//go:build linux +// +build linux -// SetGoogleClientInfo sets the name and version of the application in -// the `x-goog-api-client` header passed on each request. Also passes any -// provided key-value pairs. Intended for use by Google-written clients. -// -// Internal use only. -func (c *Client) SetGoogleClientInfo(keyval ...string) { - c.setGoogleClientInfo(keyval...) +package retry + +import ( + "errors" + "syscall" +) + +func init() { + // Initialize syscallRetryable to return true on transient socket-level + // errors. These errors are specific to Linux. + syscallRetryable = func(err error) bool { + return errors.Is(err, syscall.ECONNRESET) || errors.Is(err, syscall.ECONNREFUSED) + } } diff --git a/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go b/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go index b2a3be23c7..ddb0c3809c 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go @@ -37,11 +37,21 @@ type certificateConfig struct { CertConfigs certConfigs `json:"cert_configs"` } -// getconfigFilePath determines the path to the certificate configuration file. +type certConfigInfo struct { + certPath string // path to the certificate file + keyPath string // path to the private key file + useECP bool // whether to use Enterprise Certificate Proxy +} + +// GetConfigFilePath determines the path to the certificate configuration file. // It first checks for the presence of an environment variable that specifies // the file path. If the environment variable is not set, it falls back to -// a default configuration file path. -func getconfigFilePath() string { +// a default configuration file path. If a non-empty configFilePath is provided, +// it is returned. +func GetConfigFilePath(configFilePath string) string { + if configFilePath != "" { + return configFilePath + } envFilePath := util.GetConfigFilePathFromEnv() if envFilePath != "" { return envFilePath @@ -50,21 +60,32 @@ func getconfigFilePath() string { } -// GetCertificatePath retrieves the certificate file path from the provided +// GetFileBasedCertificatePath retrieves the certificate file path from the provided // configuration file. If the configFilePath is empty, it attempts to load // the configuration from a well-known gcloud location. // This function is exposed to allow other packages, such as the // externalaccount package, to retrieve the certificate path without needing // to load the entire certificate configuration. -func GetCertificatePath(configFilePath string) (string, error) { - if configFilePath == "" { - configFilePath = getconfigFilePath() - } - certFile, _, err := getCertAndKeyFiles(configFilePath) +func GetFileBasedCertificatePath(configFilePath string) (string, error) { + configFilePath = GetConfigFilePath(configFilePath) + info, err := parseCertConfig(configFilePath) if err != nil { return "", err } - return certFile, nil + if info.useECP { + return "", errors.New("enterprise certificate proxy is enabled, certificate path is not available") + } + return info.certPath, nil +} + +// IsECPConfig checks if the given configuration is an ECP certificate configuration. +func IsECPConfig(configFilePath string) bool { + configFilePath = GetConfigFilePath(configFilePath) + info, err := parseCertConfig(configFilePath) + if err != nil { + return false + } + return info.useECP } // NewWorkloadX509CertProvider creates a certificate source @@ -76,17 +97,19 @@ func GetCertificatePath(configFilePath string) (string, error) { // If configFilePath is empty, the client will attempt to load the config from // a well-known gcloud location. func NewWorkloadX509CertProvider(configFilePath string) (Provider, error) { - if configFilePath == "" { - configFilePath = getconfigFilePath() - } - certFile, keyFile, err := getCertAndKeyFiles(configFilePath) + configFilePath = GetConfigFilePath(configFilePath) + info, err := parseCertConfig(configFilePath) if err != nil { return nil, err } + if info.useECP { + return NewEnterpriseCertificateProxyProvider(configFilePath) + } + source := &workloadSource{ - CertPath: certFile, - KeyPath: keyFile, + CertPath: info.certPath, + KeyPath: info.keyPath, } return source.getClientCertificate, nil } @@ -101,38 +124,60 @@ func (s *workloadSource) getClientCertificate(info *tls.CertificateRequestInfo) return &cert, nil } -// getCertAndKeyFiles attempts to read the provided config file and return the certificate and private -// key file paths. -func getCertAndKeyFiles(configFilePath string) (string, string, error) { +// parseCertConfig attempts to read the provided config file and return the certificate, private +// key file paths, and a boolean indicating whether to use ECP inside a certConfigInfo struct. +func parseCertConfig(configFilePath string) (certConfigInfo, error) { jsonFile, err := os.Open(configFilePath) if err != nil { - return "", "", errSourceUnavailable + return certConfigInfo{}, errSourceUnavailable } + defer jsonFile.Close() byteValue, err := io.ReadAll(jsonFile) if err != nil { - return "", "", err + return certConfigInfo{}, err } var config certificateConfig if err := json.Unmarshal(byteValue, &config); err != nil { - return "", "", err + return certConfigInfo{}, err } if config.CertConfigs.Workload == nil { - return "", "", errSourceUnavailable + // If 'workload' field is absent, it is an ECP config. + // Validate that the config file is a valid ECP file. + var rawMap map[string]any + if err := json.Unmarshal(byteValue, &rawMap); err != nil { + return certConfigInfo{}, err + } + certConfigs, ok := rawMap["cert_configs"].(map[string]any) + if !ok { + return certConfigInfo{}, errSourceUnavailable + } + hasECPSection := false + for _, section := range []string{"pkcs11", "windows_store", "macos_keychain"} { + if _, exists := certConfigs[section]; exists { + hasECPSection = true + break + } + } + _, hasLibs := rawMap["libs"] + if !hasECPSection || !hasLibs { + return certConfigInfo{}, errSourceUnavailable + } + return certConfigInfo{useECP: true}, nil } certFile := config.CertConfigs.Workload.CertPath keyFile := config.CertConfigs.Workload.KeyPath if certFile == "" { - return "", "", errors.New("certificate configuration is missing the certificate file location") + return certConfigInfo{}, errors.New("certificate configuration is missing the certificate file location") } if keyFile == "" { - return "", "", errors.New("certificate configuration is missing the key file location") + return certConfigInfo{}, errors.New("certificate configuration is missing the key file location") } - return certFile, keyFile, nil + return certConfigInfo{certPath: certFile, keyPath: keyFile}, nil } diff --git a/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go b/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go index 5483a763c4..01c06e272a 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go @@ -15,14 +15,20 @@ package headers import ( + "context" "net/http" "cloud.google.com/go/auth" "cloud.google.com/go/auth/internal" + "cloud.google.com/go/auth/internal/regionalaccessboundary" ) -// SetAuthHeader uses the provided token to set the Authorization and trust -// boundary headers on a request. If the token.Type is empty, the type is +type regionalAccessBoundaryProvider interface { + GetHeaderValue(ctx context.Context, reqURL string, token *auth.Token) string +} + +// SetAuthHeader uses the provided token to set the Authorization and regional +// access boundary headers on a request. If the token.Type is empty, the type is // assumed to be Bearer. func SetAuthHeader(token *auth.Token, req *http.Request) { typ := token.Type @@ -31,31 +37,26 @@ func SetAuthHeader(token *auth.Token, req *http.Request) { } req.Header.Set("Authorization", typ+" "+token.Value) - if headerVal, setHeader := getTrustBoundaryHeader(token); setHeader { - req.Header.Set("x-allowed-locations", headerVal) + if provider, ok := token.Metadata[regionalaccessboundary.ProviderKey].(regionalAccessBoundaryProvider); ok { + if headerVal := provider.GetHeaderValue(req.Context(), req.URL.String(), token); headerVal != "" { + req.Header.Set("x-allowed-locations", headerVal) + } } } -// SetAuthMetadata uses the provided token to set the Authorization and trust -// boundary metadata. If the token.Type is empty, the type is assumed to be +// SetAuthMetadata uses the provided token to set the Authorization and regional +// access boundary metadata. If the token.Type is empty, the type is assumed to be // Bearer. -func SetAuthMetadata(token *auth.Token, m map[string]string) { +func SetAuthMetadata(ctx context.Context, token *auth.Token, reqURL string, m map[string]string) { typ := token.Type if typ == "" { typ = internal.TokenTypeBearer } m["authorization"] = typ + " " + token.Value - if headerVal, setHeader := getTrustBoundaryHeader(token); setHeader { - m["x-allowed-locations"] = headerVal - } -} - -func getTrustBoundaryHeader(token *auth.Token) (val string, present bool) { - if data, ok := token.Metadata[internal.TrustBoundaryDataKey]; ok { - if tbd, ok := data.(internal.TrustBoundaryData); ok { - return tbd.TrustBoundaryHeader() + if provider, ok := token.Metadata[regionalaccessboundary.ProviderKey].(regionalAccessBoundaryProvider); ok { + if headerVal := provider.GetHeaderValue(ctx, reqURL, token); headerVal != "" { + m["x-allowed-locations"] = headerVal } } - return "", false } diff --git a/vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go b/vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go deleted file mode 100644 index bf898fffd6..0000000000 --- a/vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go +++ /dev/null @@ -1,392 +0,0 @@ -// Copyright 2025 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package trustboundary - -import ( - "context" - "encoding/json" - "errors" - "fmt" - "io" - "log/slog" - "net/http" - "os" - "strings" - "sync" - - "cloud.google.com/go/auth" - "cloud.google.com/go/auth/internal" - "cloud.google.com/go/auth/internal/retry" - "cloud.google.com/go/auth/internal/transport/headers" - "github.com/googleapis/gax-go/v2/internallog" -) - -const ( - // serviceAccountAllowedLocationsEndpoint is the URL for fetching allowed locations for a given service account email. - serviceAccountAllowedLocationsEndpoint = "https://iamcredentials.%s/v1/projects/-/serviceAccounts/%s/allowedLocations" -) - -// isEnabled wraps isTrustBoundaryEnabled with sync.OnceValues to ensure it's -// called only once. -var isEnabled = sync.OnceValues(isTrustBoundaryEnabled) - -// IsEnabled returns if the trust boundary feature is enabled and an error if -// the configuration is invalid. The underlying check is performed only once. -func IsEnabled() (bool, error) { - return isEnabled() -} - -// isTrustBoundaryEnabled checks if the trust boundary feature is enabled via -// GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED environment variable. -// -// If the environment variable is not set, it is considered false. -// -// The environment variable is interpreted as a boolean with the following -// (case-insensitive) rules: -// - "true", "1" are considered true. -// - "false", "0" are considered false. -// -// Any other values will return an error. -func isTrustBoundaryEnabled() (bool, error) { - const envVar = "GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED" - val, ok := os.LookupEnv(envVar) - if !ok { - return false, nil - } - val = strings.ToLower(val) - switch val { - case "true", "1": - return true, nil - case "false", "0": - return false, nil - default: - return false, fmt.Errorf(`invalid value for %s: %q. Must be one of "true", "false", "1", or "0"`, envVar, val) - } -} - -// ConfigProvider provides specific configuration for trust boundary lookups. -type ConfigProvider interface { - // GetTrustBoundaryEndpoint returns the endpoint URL for the trust boundary lookup. - GetTrustBoundaryEndpoint(ctx context.Context) (url string, err error) - // GetUniverseDomain returns the universe domain associated with the credential. - // It may return an error if the universe domain cannot be determined. - GetUniverseDomain(ctx context.Context) (string, error) -} - -// AllowedLocationsResponse is the structure of the response from the Trust Boundary API. -type AllowedLocationsResponse struct { - // Locations is the list of allowed locations. - Locations []string `json:"locations"` - // EncodedLocations is the encoded representation of the allowed locations. - EncodedLocations string `json:"encodedLocations"` -} - -// fetchTrustBoundaryData fetches the trust boundary data from the API. -func fetchTrustBoundaryData(ctx context.Context, client *http.Client, url string, token *auth.Token, logger *slog.Logger) (*internal.TrustBoundaryData, error) { - if logger == nil { - logger = slog.New(slog.NewTextHandler(io.Discard, nil)) - } - if client == nil { - return nil, errors.New("trustboundary: HTTP client is required") - } - - if url == "" { - return nil, errors.New("trustboundary: URL cannot be empty") - } - - req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil) - if err != nil { - return nil, fmt.Errorf("trustboundary: failed to create trust boundary request: %w", err) - } - - if token == nil || token.Value == "" { - return nil, errors.New("trustboundary: access token required for lookup API authentication") - } - headers.SetAuthHeader(token, req) - logger.DebugContext(ctx, "trust boundary request", "request", internallog.HTTPRequest(req, nil)) - - retryer := retry.New() - var response *http.Response - for { - response, err = client.Do(req) - - var statusCode int - if response != nil { - statusCode = response.StatusCode - } - pause, shouldRetry := retryer.Retry(statusCode, err) - - if !shouldRetry { - break - } - - if response != nil { - // Drain and close the body to reuse the connection - io.Copy(io.Discard, response.Body) - response.Body.Close() - } - - if err := retry.Sleep(ctx, pause); err != nil { - return nil, err - } - } - - if err != nil { - return nil, fmt.Errorf("trustboundary: failed to fetch trust boundary: %w", err) - } - defer response.Body.Close() - - body, err := io.ReadAll(response.Body) - if err != nil { - return nil, fmt.Errorf("trustboundary: failed to read trust boundary response: %w", err) - } - - logger.DebugContext(ctx, "trust boundary response", "response", internallog.HTTPResponse(response, body)) - - if response.StatusCode != http.StatusOK { - return nil, fmt.Errorf("trustboundary: trust boundary request failed with status: %s, body: %s", response.Status, string(body)) - } - - apiResponse := AllowedLocationsResponse{} - if err := json.Unmarshal(body, &apiResponse); err != nil { - return nil, fmt.Errorf("trustboundary: failed to unmarshal trust boundary response: %w", err) - } - - if apiResponse.EncodedLocations == "" { - return nil, errors.New("trustboundary: invalid API response: encodedLocations is empty") - } - - return internal.NewTrustBoundaryData(apiResponse.Locations, apiResponse.EncodedLocations), nil -} - -// serviceAccountConfig holds configuration for SA trust boundary lookups. -// It implements the ConfigProvider interface. -type serviceAccountConfig struct { - ServiceAccountEmail string - UniverseDomain string -} - -// NewServiceAccountConfigProvider creates a new config for service accounts. -func NewServiceAccountConfigProvider(saEmail, universeDomain string) ConfigProvider { - return &serviceAccountConfig{ - ServiceAccountEmail: saEmail, - UniverseDomain: universeDomain, - } -} - -// GetTrustBoundaryEndpoint returns the formatted URL for fetching allowed locations -// for the configured service account and universe domain. -func (sac *serviceAccountConfig) GetTrustBoundaryEndpoint(ctx context.Context) (url string, err error) { - if sac.ServiceAccountEmail == "" { - return "", errors.New("trustboundary: service account email cannot be empty for config") - } - ud := sac.UniverseDomain - if ud == "" { - ud = internal.DefaultUniverseDomain - } - return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, ud, sac.ServiceAccountEmail), nil -} - -// GetUniverseDomain returns the configured universe domain, defaulting to -// [internal.DefaultUniverseDomain] if not explicitly set. -func (sac *serviceAccountConfig) GetUniverseDomain(ctx context.Context) (string, error) { - if sac.UniverseDomain == "" { - return internal.DefaultUniverseDomain, nil - } - return sac.UniverseDomain, nil -} - -// DataProvider fetches and caches trust boundary Data. -// It implements the DataProvider interface and uses a ConfigProvider -// to get type-specific details for the lookup. -type DataProvider struct { - client *http.Client - configProvider ConfigProvider - data *internal.TrustBoundaryData - logger *slog.Logger - base auth.TokenProvider -} - -// NewProvider wraps the provided base [auth.TokenProvider] to create a new -// provider that injects tokens with trust boundary data. It uses the provided -// HTTP client and configProvider to fetch the data and attach it to the token's -// metadata. -func NewProvider(client *http.Client, configProvider ConfigProvider, logger *slog.Logger, base auth.TokenProvider) (*DataProvider, error) { - if client == nil { - return nil, errors.New("trustboundary: HTTP client cannot be nil for DataProvider") - } - if configProvider == nil { - return nil, errors.New("trustboundary: ConfigProvider cannot be nil for DataProvider") - } - p := &DataProvider{ - client: client, - configProvider: configProvider, - logger: internallog.New(logger), - base: base, - } - return p, nil -} - -// Token retrieves a token from the base provider and injects it with trust -// boundary data. -func (p *DataProvider) Token(ctx context.Context) (*auth.Token, error) { - // Get the original token. - token, err := p.base.Token(ctx) - if err != nil { - return nil, err - } - - tbData, err := p.GetTrustBoundaryData(ctx, token) - if err != nil { - return nil, fmt.Errorf("trustboundary: error fetching the trust boundary data: %w", err) - } - if tbData != nil { - if token.Metadata == nil { - token.Metadata = make(map[string]interface{}) - } - token.Metadata[internal.TrustBoundaryDataKey] = *tbData - } - return token, nil -} - -// GetTrustBoundaryData retrieves the trust boundary data. -// It first checks the universe domain: if it's non-default, a NoOp is returned. -// Otherwise, it checks a local cache. If the data is not cached as NoOp, -// it fetches new data from the endpoint provided by its ConfigProvider, -// using the given accessToken for authentication. Results are cached. -// If fetching fails, it returns previously cached data if available, otherwise the fetch error. -func (p *DataProvider) GetTrustBoundaryData(ctx context.Context, token *auth.Token) (*internal.TrustBoundaryData, error) { - // Check the universe domain. - uniDomain, err := p.configProvider.GetUniverseDomain(ctx) - if err != nil { - return nil, fmt.Errorf("trustboundary: error getting universe domain: %w", err) - } - if uniDomain != "" && uniDomain != internal.DefaultUniverseDomain { - if p.data == nil || p.data.EncodedLocations != internal.TrustBoundaryNoOp { - p.data = internal.NewNoOpTrustBoundaryData() - } - return p.data, nil - } - - // Check cache for a no-op result from a previous API call. - cachedData := p.data - if cachedData != nil && cachedData.EncodedLocations == internal.TrustBoundaryNoOp { - return cachedData, nil - } - - // Get the endpoint - url, err := p.configProvider.GetTrustBoundaryEndpoint(ctx) - if err != nil { - return nil, fmt.Errorf("trustboundary: error getting the lookup endpoint: %w", err) - } - - // Proceed to fetch new data. - newData, fetchErr := fetchTrustBoundaryData(ctx, p.client, url, token, p.logger) - - if fetchErr != nil { - // Fetch failed. Fallback to cachedData if available. - if cachedData != nil { - return cachedData, nil // Successful fallback - } - // No cache to fallback to. - return nil, fmt.Errorf("trustboundary: failed to fetch trust boundary data for endpoint %s and no cache available: %w", url, fetchErr) - } - - // Fetch successful. Update cache. - p.data = newData - return newData, nil -} - -// GCEConfigProvider implements ConfigProvider for GCE environments. -// It lazily fetches and caches the necessary metadata (service account email, universe domain) -// from the GCE metadata server. -type GCEConfigProvider struct { - // universeDomainProvider provides the universe domain and underlying metadata client. - universeDomainProvider *internal.ComputeUniverseDomainProvider - - // Caching for service account email - saOnce sync.Once - saEmail string - saEmailErr error - - // Caching for universe domain - udOnce sync.Once - ud string - udErr error -} - -// NewGCEConfigProvider creates a new GCEConfigProvider -// which uses the provided gceUDP to interact with the GCE metadata server. -func NewGCEConfigProvider(gceUDP *internal.ComputeUniverseDomainProvider) *GCEConfigProvider { - // The validity of gceUDP and its internal MetadataClient will be checked - // within the GetTrustBoundaryEndpoint and GetUniverseDomain methods. - return &GCEConfigProvider{ - universeDomainProvider: gceUDP, - } -} - -func (g *GCEConfigProvider) fetchSA(ctx context.Context) { - if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil { - g.saEmailErr = errors.New("trustboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)") - return - } - mdClient := g.universeDomainProvider.MetadataClient - saEmail, err := mdClient.EmailWithContext(ctx, "default") - if err != nil { - g.saEmailErr = fmt.Errorf("trustboundary: GCE config: failed to get service account email: %w", err) - return - } - g.saEmail = saEmail -} - -func (g *GCEConfigProvider) fetchUD(ctx context.Context) { - if g.universeDomainProvider == nil || g.universeDomainProvider.MetadataClient == nil { - g.udErr = errors.New("trustboundary: GCEConfigProvider not properly initialized (missing ComputeUniverseDomainProvider or MetadataClient)") - return - } - ud, err := g.universeDomainProvider.GetProperty(ctx) - if err != nil { - g.udErr = fmt.Errorf("trustboundary: GCE config: failed to get universe domain: %w", err) - return - } - if ud == "" { - ud = internal.DefaultUniverseDomain - } - g.ud = ud -} - -// GetTrustBoundaryEndpoint constructs the trust boundary lookup URL for a GCE environment. -// It uses cached metadata (service account email, universe domain) after the first call. -func (g *GCEConfigProvider) GetTrustBoundaryEndpoint(ctx context.Context) (string, error) { - g.saOnce.Do(func() { g.fetchSA(ctx) }) - if g.saEmailErr != nil { - return "", g.saEmailErr - } - g.udOnce.Do(func() { g.fetchUD(ctx) }) - if g.udErr != nil { - return "", g.udErr - } - return fmt.Sprintf(serviceAccountAllowedLocationsEndpoint, g.ud, g.saEmail), nil -} - -// GetUniverseDomain retrieves the universe domain from the GCE metadata server. -// It uses a cached value after the first call. -func (g *GCEConfigProvider) GetUniverseDomain(ctx context.Context) (string, error) { - g.udOnce.Do(func() { g.fetchUD(ctx) }) - if g.udErr != nil { - return "", g.udErr - } - return g.ud, nil -} diff --git a/vendor/cloud.google.com/go/auth/internal/version.go b/vendor/cloud.google.com/go/auth/internal/version.go index d627069b57..146f6c768c 100644 --- a/vendor/cloud.google.com/go/auth/internal/version.go +++ b/vendor/cloud.google.com/go/auth/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "0.20.0" +const Version = "0.23.2" diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestore_client.go b/vendor/cloud.google.com/go/firestore/apiv1/firestore_client.go index 79fe7ad6cb..809febf57e 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestore_client.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestore_client.go @@ -222,7 +222,6 @@ func defaultCallOptions() *CallOptions { return gax.OnCodes([]codes.Code{ codes.Unavailable, codes.Internal, - codes.DeadlineExceeded, }, gax.Backoff{ Initial: 100 * time.Millisecond, Max: 60000 * time.Millisecond, @@ -452,8 +451,7 @@ func defaultRESTCallOptions() *CallOptions { Multiplier: 1.30, }, http.StatusServiceUnavailable, - http.StatusInternalServerError, - http.StatusGatewayTimeout) + http.StatusInternalServerError) }), }, RunAggregationQuery: []gax.CallOption{ @@ -594,7 +592,7 @@ type Client struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *Client) Close() error { return c.internalClient.Close() @@ -607,6 +605,16 @@ func (c *Client) setGoogleClientInfo(keyval ...string) { c.internalClient.setGoogleClientInfo(keyval...) } +// SetGoogleClientInfo sets the name and version of the application in +// the `x-goog-api-client` header passed on each request. Intended for +// use by Google-written clients. +// +// SetGoogleClientInfo is not concurrency-safe and should only be invoked +// sequentially before concurrent operations begin. +func (c *Client) SetGoogleClientInfo(keyval ...string) { + c.setGoogleClientInfo(keyval...) +} + // Connection returns a connection to the API service. // // Deprecated: Connections are now pooled so this method does not always @@ -872,7 +880,7 @@ func (c *gRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *gRPCClient) Close() error { return c.connPool.Close() @@ -992,7 +1000,7 @@ func (c *restClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *restClient) Close() error { // Replace httpClient with nil to force cleanup. @@ -1037,7 +1045,7 @@ func (c *gRPCClient) ListDocuments(ctx context.Context, req *firestorepb.ListDoc } opts = append((*c.CallOptions).ListDocuments[0:len((*c.CallOptions).ListDocuments):len((*c.CallOptions).ListDocuments)], opts...) it := &DocumentIterator{} - req = proto.Clone(req).(*firestorepb.ListDocumentsRequest) + req = proto.CloneOf(req) it.InternalFetch = func(pageSize int, pageToken string) ([]*firestorepb.Document, string, error) { resp := &firestorepb.ListDocumentsResponse{} if pageToken != "" { @@ -1292,7 +1300,7 @@ func (c *gRPCClient) PartitionQuery(ctx context.Context, req *firestorepb.Partit } opts = append((*c.CallOptions).PartitionQuery[0:len((*c.CallOptions).PartitionQuery):len((*c.CallOptions).PartitionQuery)], opts...) it := &CursorIterator{} - req = proto.Clone(req).(*firestorepb.PartitionQueryRequest) + req = proto.CloneOf(req) it.InternalFetch = func(pageSize int, pageToken string) ([]*firestorepb.Cursor, string, error) { resp := &firestorepb.PartitionQueryResponse{} if pageToken != "" { @@ -1381,7 +1389,7 @@ func (c *gRPCClient) ListCollectionIds(ctx context.Context, req *firestorepb.Lis } opts = append((*c.CallOptions).ListCollectionIds[0:len((*c.CallOptions).ListCollectionIds):len((*c.CallOptions).ListCollectionIds)], opts...) it := &StringIterator{} - req = proto.Clone(req).(*firestorepb.ListCollectionIdsRequest) + req = proto.CloneOf(req) it.InternalFetch = func(pageSize int, pageToken string) ([]string, string, error) { resp := &firestorepb.ListCollectionIdsResponse{} if pageToken != "" { @@ -1527,7 +1535,7 @@ func (c *gRPCClient) ListOperations(ctx context.Context, req *longrunningpb.List } opts = append((*c.CallOptions).ListOperations[0:len((*c.CallOptions).ListOperations):len((*c.CallOptions).ListOperations)], opts...) it := &OperationIterator{} - req = proto.Clone(req).(*longrunningpb.ListOperationsRequest) + req = proto.CloneOf(req) it.InternalFetch = func(pageSize int, pageToken string) ([]*longrunningpb.Operation, string, error) { resp := &longrunningpb.ListOperationsResponse{} if pageToken != "" { @@ -1638,7 +1646,7 @@ func (c *restClient) GetDocument(ctx context.Context, req *firestorepb.GetDocume // ListDocuments lists documents. func (c *restClient) ListDocuments(ctx context.Context, req *firestorepb.ListDocumentsRequest, opts ...gax.CallOption) *DocumentIterator { it := &DocumentIterator{} - req = proto.Clone(req).(*firestorepb.ListDocumentsRequest) + req = proto.CloneOf(req) unm := protojson.UnmarshalOptions{AllowPartial: true, DiscardUnknown: true} it.InternalFetch = func(pageSize int, pageToken string) ([]*firestorepb.Document, string, error) { resp := &firestorepb.ListDocumentsResponse{} @@ -2485,7 +2493,7 @@ func (c *runAggregationQueryRESTStreamClient) RecvMsg(m interface{}) error { // can be used by RunQuery as starting/end points for the query results. func (c *restClient) PartitionQuery(ctx context.Context, req *firestorepb.PartitionQueryRequest, opts ...gax.CallOption) *CursorIterator { it := &CursorIterator{} - req = proto.Clone(req).(*firestorepb.PartitionQueryRequest) + req = proto.CloneOf(req) m := protojson.MarshalOptions{AllowPartial: true, UseEnumNumbers: true} unm := protojson.UnmarshalOptions{AllowPartial: true, DiscardUnknown: true} it.InternalFetch = func(pageSize int, pageToken string) ([]*firestorepb.Cursor, string, error) { @@ -2579,7 +2587,7 @@ func (c *restClient) Listen(ctx context.Context, opts ...gax.CallOption) (firest // ListCollectionIds lists all the collection IDs underneath a document. func (c *restClient) ListCollectionIds(ctx context.Context, req *firestorepb.ListCollectionIdsRequest, opts ...gax.CallOption) *StringIterator { it := &StringIterator{} - req = proto.Clone(req).(*firestorepb.ListCollectionIdsRequest) + req = proto.CloneOf(req) m := protojson.MarshalOptions{AllowPartial: true, UseEnumNumbers: true} unm := protojson.UnmarshalOptions{AllowPartial: true, DiscardUnknown: true} it.InternalFetch = func(pageSize int, pageToken string) ([]string, string, error) { @@ -2933,7 +2941,7 @@ func (c *restClient) GetOperation(ctx context.Context, req *longrunningpb.GetOpe // ListOperations is a utility method from google.longrunning.Operations. func (c *restClient) ListOperations(ctx context.Context, req *longrunningpb.ListOperationsRequest, opts ...gax.CallOption) *OperationIterator { it := &OperationIterator{} - req = proto.Clone(req).(*longrunningpb.ListOperationsRequest) + req = proto.CloneOf(req) unm := protojson.UnmarshalOptions{AllowPartial: true, DiscardUnknown: true} it.InternalFetch = func(pageSize int, pageToken string) ([]*longrunningpb.Operation, string, error) { resp := &longrunningpb.ListOperationsResponse{} diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/aggregation_result.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/aggregation_result.pb.go index 98417cdeb9..efd5e789d9 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/aggregation_result.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/aggregation_result.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/aggregation_result.proto package firestorepb diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/bloom_filter.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/bloom_filter.pb.go index 3e1582a1f4..80aa5845d8 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/bloom_filter.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/bloom_filter.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/bloom_filter.proto package firestorepb diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/common.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/common.pb.go index 3f41fed30b..937455cfdb 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/common.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/common.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/common.proto package firestorepb @@ -25,6 +25,7 @@ import ( sync "sync" unsafe "unsafe" + _ "google.golang.org/genproto/googleapis/api/annotations" protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" timestamppb "google.golang.org/protobuf/types/known/timestamppb" @@ -37,6 +38,59 @@ const ( _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) ) +// The type of concurrency control mode for transactions. +type TransactionOptions_ConcurrencyMode int32 + +const ( + // Start the transaction with the database-level default concurrency mode. + TransactionOptions_CONCURRENCY_MODE_UNSPECIFIED TransactionOptions_ConcurrencyMode = 0 + // Use optimistic concurrency control for the new transaction. + TransactionOptions_OPTIMISTIC TransactionOptions_ConcurrencyMode = 1 + // Use pessimistic concurrency control for the new transaction. + TransactionOptions_PESSIMISTIC TransactionOptions_ConcurrencyMode = 2 +) + +// Enum value maps for TransactionOptions_ConcurrencyMode. +var ( + TransactionOptions_ConcurrencyMode_name = map[int32]string{ + 0: "CONCURRENCY_MODE_UNSPECIFIED", + 1: "OPTIMISTIC", + 2: "PESSIMISTIC", + } + TransactionOptions_ConcurrencyMode_value = map[string]int32{ + "CONCURRENCY_MODE_UNSPECIFIED": 0, + "OPTIMISTIC": 1, + "PESSIMISTIC": 2, + } +) + +func (x TransactionOptions_ConcurrencyMode) Enum() *TransactionOptions_ConcurrencyMode { + p := new(TransactionOptions_ConcurrencyMode) + *p = x + return p +} + +func (x TransactionOptions_ConcurrencyMode) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (TransactionOptions_ConcurrencyMode) Descriptor() protoreflect.EnumDescriptor { + return file_google_firestore_v1_common_proto_enumTypes[0].Descriptor() +} + +func (TransactionOptions_ConcurrencyMode) Type() protoreflect.EnumType { + return &file_google_firestore_v1_common_proto_enumTypes[0] +} + +func (x TransactionOptions_ConcurrencyMode) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use TransactionOptions_ConcurrencyMode.Descriptor instead. +func (TransactionOptions_ConcurrencyMode) EnumDescriptor() ([]byte, []int) { + return file_google_firestore_v1_common_proto_rawDescGZIP(), []int{2, 0} +} + // A set of field paths on a document. // Used to restrict a get or update operation on a document to a subset of its // fields. @@ -267,15 +321,21 @@ func (*TransactionOptions_ReadOnly_) isTransactionOptions_Mode() {} func (*TransactionOptions_ReadWrite_) isTransactionOptions_Mode() {} // Options for a transaction that can be used to read and write documents. -// -// Firestore does not allow 3rd party auth requests to create read-write. -// transactions. type TransactionOptions_ReadWrite struct { state protoimpl.MessageState `protogen:"open.v1"` // An optional transaction to retry. RetryTransaction []byte `protobuf:"bytes,1,opt,name=retry_transaction,json=retryTransaction,proto3" json:"retry_transaction,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Optional. The concurrency control mode to use for this transaction. + // + // A database is able to use different concurrency modes for different + // transactions simultaneously. + // + // 3rd party auth requests are only allowed to create optimistic + // read-write transactions and must specify that here even if the + // database-level setting is already configured to optimistic. + ConcurrencyMode TransactionOptions_ConcurrencyMode `protobuf:"varint,2,opt,name=concurrency_mode,json=concurrencyMode,proto3,enum=google.firestore.v1.TransactionOptions_ConcurrencyMode" json:"concurrency_mode,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *TransactionOptions_ReadWrite) Reset() { @@ -315,6 +375,13 @@ func (x *TransactionOptions_ReadWrite) GetRetryTransaction() []byte { return nil } +func (x *TransactionOptions_ReadWrite) GetConcurrencyMode() TransactionOptions_ConcurrencyMode { + if x != nil { + return x.ConcurrencyMode + } + return TransactionOptions_CONCURRENCY_MODE_UNSPECIFIED +} + // Options for a transaction that can only be used to read documents. type TransactionOptions_ReadOnly struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -394,7 +461,7 @@ var File_google_firestore_v1_common_proto protoreflect.FileDescriptor const file_google_firestore_v1_common_proto_rawDesc = "" + "\n" + - " google/firestore/v1/common.proto\x12\x13google.firestore.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"/\n" + + " google/firestore/v1/common.proto\x12\x13google.firestore.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"/\n" + "\fDocumentMask\x12\x1f\n" + "\vfield_paths\x18\x01 \x03(\tR\n" + "fieldPaths\"y\n" + @@ -402,16 +469,22 @@ const file_google_firestore_v1_common_proto_rawDesc = "" + "\x06exists\x18\x01 \x01(\bH\x00R\x06exists\x12=\n" + "\vupdate_time\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampH\x00R\n" + "updateTimeB\x10\n" + - "\x0econdition_type\"\xda\x02\n" + + "\x0econdition_type\"\x9a\x04\n" + "\x12TransactionOptions\x12O\n" + "\tread_only\x18\x02 \x01(\v20.google.firestore.v1.TransactionOptions.ReadOnlyH\x00R\breadOnly\x12R\n" + "\n" + - "read_write\x18\x03 \x01(\v21.google.firestore.v1.TransactionOptions.ReadWriteH\x00R\treadWrite\x1a8\n" + + "read_write\x18\x03 \x01(\v21.google.firestore.v1.TransactionOptions.ReadWriteH\x00R\treadWrite\x1a\xa1\x01\n" + "\tReadWrite\x12+\n" + - "\x11retry_transaction\x18\x01 \x01(\fR\x10retryTransaction\x1a]\n" + + "\x11retry_transaction\x18\x01 \x01(\fR\x10retryTransaction\x12g\n" + + "\x10concurrency_mode\x18\x02 \x01(\x0e27.google.firestore.v1.TransactionOptions.ConcurrencyModeB\x03\xe0A\x01R\x0fconcurrencyMode\x1a]\n" + "\bReadOnly\x129\n" + "\tread_time\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampH\x00R\breadTimeB\x16\n" + - "\x14consistency_selectorB\x06\n" + + "\x14consistency_selector\"T\n" + + "\x0fConcurrencyMode\x12 \n" + + "\x1cCONCURRENCY_MODE_UNSPECIFIED\x10\x00\x12\x0e\n" + + "\n" + + "OPTIMISTIC\x10\x01\x12\x0f\n" + + "\vPESSIMISTIC\x10\x02B\x06\n" + "\x04modeB\xc3\x01\n" + "\x17com.google.firestore.v1B\vCommonProtoP\x01Z;cloud.google.com/go/firestore/apiv1/firestorepb;firestorepb\xa2\x02\x04GCFS\xaa\x02\x19Google.Cloud.Firestore.V1\xca\x02\x19Google\\Cloud\\Firestore\\V1\xea\x02\x1cGoogle::Cloud::Firestore::V1b\x06proto3" @@ -427,25 +500,28 @@ func file_google_firestore_v1_common_proto_rawDescGZIP() []byte { return file_google_firestore_v1_common_proto_rawDescData } +var file_google_firestore_v1_common_proto_enumTypes = make([]protoimpl.EnumInfo, 1) var file_google_firestore_v1_common_proto_msgTypes = make([]protoimpl.MessageInfo, 5) var file_google_firestore_v1_common_proto_goTypes = []any{ - (*DocumentMask)(nil), // 0: google.firestore.v1.DocumentMask - (*Precondition)(nil), // 1: google.firestore.v1.Precondition - (*TransactionOptions)(nil), // 2: google.firestore.v1.TransactionOptions - (*TransactionOptions_ReadWrite)(nil), // 3: google.firestore.v1.TransactionOptions.ReadWrite - (*TransactionOptions_ReadOnly)(nil), // 4: google.firestore.v1.TransactionOptions.ReadOnly - (*timestamppb.Timestamp)(nil), // 5: google.protobuf.Timestamp + (TransactionOptions_ConcurrencyMode)(0), // 0: google.firestore.v1.TransactionOptions.ConcurrencyMode + (*DocumentMask)(nil), // 1: google.firestore.v1.DocumentMask + (*Precondition)(nil), // 2: google.firestore.v1.Precondition + (*TransactionOptions)(nil), // 3: google.firestore.v1.TransactionOptions + (*TransactionOptions_ReadWrite)(nil), // 4: google.firestore.v1.TransactionOptions.ReadWrite + (*TransactionOptions_ReadOnly)(nil), // 5: google.firestore.v1.TransactionOptions.ReadOnly + (*timestamppb.Timestamp)(nil), // 6: google.protobuf.Timestamp } var file_google_firestore_v1_common_proto_depIdxs = []int32{ - 5, // 0: google.firestore.v1.Precondition.update_time:type_name -> google.protobuf.Timestamp - 4, // 1: google.firestore.v1.TransactionOptions.read_only:type_name -> google.firestore.v1.TransactionOptions.ReadOnly - 3, // 2: google.firestore.v1.TransactionOptions.read_write:type_name -> google.firestore.v1.TransactionOptions.ReadWrite - 5, // 3: google.firestore.v1.TransactionOptions.ReadOnly.read_time:type_name -> google.protobuf.Timestamp - 4, // [4:4] is the sub-list for method output_type - 4, // [4:4] is the sub-list for method input_type - 4, // [4:4] is the sub-list for extension type_name - 4, // [4:4] is the sub-list for extension extendee - 0, // [0:4] is the sub-list for field type_name + 6, // 0: google.firestore.v1.Precondition.update_time:type_name -> google.protobuf.Timestamp + 5, // 1: google.firestore.v1.TransactionOptions.read_only:type_name -> google.firestore.v1.TransactionOptions.ReadOnly + 4, // 2: google.firestore.v1.TransactionOptions.read_write:type_name -> google.firestore.v1.TransactionOptions.ReadWrite + 0, // 3: google.firestore.v1.TransactionOptions.ReadWrite.concurrency_mode:type_name -> google.firestore.v1.TransactionOptions.ConcurrencyMode + 6, // 4: google.firestore.v1.TransactionOptions.ReadOnly.read_time:type_name -> google.protobuf.Timestamp + 5, // [5:5] is the sub-list for method output_type + 5, // [5:5] is the sub-list for method input_type + 5, // [5:5] is the sub-list for extension type_name + 5, // [5:5] is the sub-list for extension extendee + 0, // [0:5] is the sub-list for field type_name } func init() { file_google_firestore_v1_common_proto_init() } @@ -469,13 +545,14 @@ func file_google_firestore_v1_common_proto_init() { File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_google_firestore_v1_common_proto_rawDesc), len(file_google_firestore_v1_common_proto_rawDesc)), - NumEnums: 0, + NumEnums: 1, NumMessages: 5, NumExtensions: 0, NumServices: 0, }, GoTypes: file_google_firestore_v1_common_proto_goTypes, DependencyIndexes: file_google_firestore_v1_common_proto_depIdxs, + EnumInfos: file_google_firestore_v1_common_proto_enumTypes, MessageInfos: file_google_firestore_v1_common_proto_msgTypes, }.Build() File_google_firestore_v1_common_proto = out.File diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/document.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/document.pb.go index 4c4583ebd9..85eb608a10 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/document.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/document.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/document.proto package firestorepb diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/explain_stats.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/explain_stats.pb.go index d43f06c020..03ac8ef712 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/explain_stats.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/explain_stats.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/explain_stats.proto package firestorepb diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/firestore.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/firestore.pb.go index c649e57673..2e58c312a7 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/firestore.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/firestore.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/firestore.proto package firestorepb @@ -1580,8 +1580,12 @@ type ExecutePipelineRequest struct { // *ExecutePipelineRequest_NewTransaction // *ExecutePipelineRequest_ReadTime ConsistencySelector isExecutePipelineRequest_ConsistencySelector `protobuf_oneof:"consistency_selector"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Optional. Automatically commits the transaction after the pipeline has been + // executed. Only permitted in combination with `transaction` or + // `new_transaction`. + AutoCommitTransaction bool `protobuf:"varint,9,opt,name=auto_commit_transaction,json=autoCommitTransaction,proto3" json:"auto_commit_transaction,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ExecutePipelineRequest) Reset() { @@ -1671,6 +1675,13 @@ func (x *ExecutePipelineRequest) GetReadTime() *timestamppb.Timestamp { return nil } +func (x *ExecutePipelineRequest) GetAutoCommitTransaction() bool { + if x != nil { + return x.AutoCommitTransaction + } + return false +} + type isExecutePipelineRequest_PipelineType interface { isExecutePipelineRequest_PipelineType() } @@ -3073,6 +3084,9 @@ type ListCollectionIdsRequest struct { // `projects/{project_id}/databases/{database_id}/documents/{document_path}`. // For example: // `projects/my-project/databases/my-database/documents/chatrooms/my-chatroom` + // + // Use `projects/{project_id}/databases/{database_id}/documents` to list + // top-level collections. Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"` // The maximum number of results to return. PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"` @@ -3584,13 +3598,14 @@ const file_google_firestore_v1_firestore_proto_rawDesc = "" + "\x0fskipped_results\x18\x04 \x01(\x05R\x0eskippedResults\x12\x14\n" + "\x04done\x18\x06 \x01(\bH\x00R\x04done\x12L\n" + "\x0fexplain_metrics\x18\v \x01(\v2#.google.firestore.v1.ExplainMetricsR\x0eexplainMetricsB\x17\n" + - "\x15continuation_selector\"\xf1\x02\n" + + "\x15continuation_selector\"\xae\x03\n" + "\x16ExecutePipelineRequest\x12\x1f\n" + "\bdatabase\x18\x01 \x01(\tB\x03\xe0A\x02R\bdatabase\x12Z\n" + "\x13structured_pipeline\x18\x02 \x01(\v2'.google.firestore.v1.StructuredPipelineH\x00R\x12structuredPipeline\x12\"\n" + "\vtransaction\x18\x05 \x01(\fH\x01R\vtransaction\x12R\n" + "\x0fnew_transaction\x18\x06 \x01(\v2'.google.firestore.v1.TransactionOptionsH\x01R\x0enewTransaction\x129\n" + - "\tread_time\x18\a \x01(\v2\x1a.google.protobuf.TimestampH\x01R\breadTimeB\x0f\n" + + "\tread_time\x18\a \x01(\v2\x1a.google.protobuf.TimestampH\x01R\breadTime\x12;\n" + + "\x17auto_commit_transaction\x18\t \x01(\bB\x03\xe0A\x01R\x15autoCommitTransactionB\x0f\n" + "\rpipeline_typeB\x16\n" + "\x14consistency_selector\"\xff\x01\n" + "\x17ExecutePipelineResponse\x12 \n" + diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/firestore_grpc.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/firestore_grpc.pb.go index 8ed87fad68..2e20e2486b 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/firestore_grpc.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/firestore_grpc.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: // - protoc-gen-go-grpc v1.3.0 -// - protoc v6.31.0 +// - protoc v6.33.2 // source: google/firestore/v1/firestore.proto package firestorepb diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/pipeline.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/pipeline.pb.go index fdd4ea0523..9f8b288024 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/pipeline.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/pipeline.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/pipeline.proto package firestorepb diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/query.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/query.pb.go index 889f94fae4..0023c22e65 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/query.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/query.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/query.proto package firestorepb @@ -435,9 +435,12 @@ type StructuredQuery struct { Where *StructuredQuery_Filter `protobuf:"bytes,3,opt,name=where,proto3" json:"where,omitempty"` // The order to apply to the query results. // - // Firestore allows callers to provide a full ordering, a partial ordering, or - // no ordering at all. In all cases, Firestore guarantees a stable ordering - // through the following rules: + // Callers can provide a full ordering, a partial ordering, or no ordering at + // all. While Firestore will always respect the provided order, the behavior + // for queries without a full ordering is different per database edition: + // + // In Standard edition, Firestore guarantees a stable ordering through the + // following rules: // // - The `order_by` is required to reference all fields used with an // inequality filter. @@ -453,6 +456,13 @@ type StructuredQuery struct { // - `WHERE a > 1` becomes `WHERE a > 1 ORDER BY a ASC, __name__ ASC` // - `WHERE __name__ > ... AND a > 1` becomes // `WHERE __name__ > ... AND a > 1 ORDER BY a ASC, __name__ ASC` + // + // In Enterprise edition, Firestore does not guarantee a stable ordering. + // Instead it will pick the most efficient ordering based on the indexes + // available at the time of query execution. This will result in a different + // ordering for queries that are otherwise identical. To ensure a stable + // ordering, always include a unique field in the `order_by` clause, such as + // `__name__`. OrderBy []*StructuredQuery_Order `protobuf:"bytes,4,rep,name=order_by,json=orderBy,proto3" json:"order_by,omitempty"` // A potential prefix of a position in the result set to start the query at. // diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/query_profile.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/query_profile.pb.go index 245e1b4141..40724ce0d9 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/query_profile.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/query_profile.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/query_profile.proto package firestorepb diff --git a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/write.pb.go b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/write.pb.go index 774a2fc98d..40b8d3c8b8 100644 --- a/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/write.pb.go +++ b/vendor/cloud.google.com/go/firestore/apiv1/firestorepb/write.pb.go @@ -15,7 +15,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: // protoc-gen-go v1.36.11 -// protoc v6.31.0 +// protoc v6.33.2 // source: google/firestore/v1/write.proto package firestorepb diff --git a/vendor/cloud.google.com/go/firestore/internal/version.go b/vendor/cloud.google.com/go/firestore/internal/version.go index dcd9f62af8..49cf1531e0 100644 --- a/vendor/cloud.google.com/go/firestore/internal/version.go +++ b/vendor/cloud.google.com/go/firestore/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "1.22.0" +const Version = "1.24.0" diff --git a/vendor/cloud.google.com/go/monitoring/apiv3/v2/alert_policy_client.go b/vendor/cloud.google.com/go/monitoring/apiv3/v2/alert_policy_client.go index d960ceed22..72d871dc4d 100644 --- a/vendor/cloud.google.com/go/monitoring/apiv3/v2/alert_policy_client.go +++ b/vendor/cloud.google.com/go/monitoring/apiv3/v2/alert_policy_client.go @@ -144,7 +144,7 @@ type AlertPolicyClient struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *AlertPolicyClient) Close() error { return c.internalClient.Close() @@ -312,7 +312,7 @@ func (c *alertPolicyGRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *alertPolicyGRPCClient) Close() error { return c.connPool.Close() diff --git a/vendor/cloud.google.com/go/monitoring/apiv3/v2/group_client.go b/vendor/cloud.google.com/go/monitoring/apiv3/v2/group_client.go index fd134943e7..17fe3d14c7 100644 --- a/vendor/cloud.google.com/go/monitoring/apiv3/v2/group_client.go +++ b/vendor/cloud.google.com/go/monitoring/apiv3/v2/group_client.go @@ -171,7 +171,7 @@ type GroupClient struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *GroupClient) Close() error { return c.internalClient.Close() @@ -334,7 +334,7 @@ func (c *groupGRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *groupGRPCClient) Close() error { return c.connPool.Close() diff --git a/vendor/cloud.google.com/go/monitoring/apiv3/v2/metric_client.go b/vendor/cloud.google.com/go/monitoring/apiv3/v2/metric_client.go index 58aceafaaa..02544a1d80 100644 --- a/vendor/cloud.google.com/go/monitoring/apiv3/v2/metric_client.go +++ b/vendor/cloud.google.com/go/monitoring/apiv3/v2/metric_client.go @@ -184,7 +184,7 @@ type MetricClient struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *MetricClient) Close() error { return c.internalClient.Close() @@ -375,7 +375,7 @@ func (c *metricGRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *metricGRPCClient) Close() error { return c.connPool.Close() diff --git a/vendor/cloud.google.com/go/monitoring/apiv3/v2/notification_channel_client.go b/vendor/cloud.google.com/go/monitoring/apiv3/v2/notification_channel_client.go index 80462496d1..fc092f0375 100644 --- a/vendor/cloud.google.com/go/monitoring/apiv3/v2/notification_channel_client.go +++ b/vendor/cloud.google.com/go/monitoring/apiv3/v2/notification_channel_client.go @@ -198,7 +198,7 @@ type NotificationChannelClient struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *NotificationChannelClient) Close() error { return c.internalClient.Close() @@ -422,7 +422,7 @@ func (c *notificationChannelGRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *notificationChannelGRPCClient) Close() error { return c.connPool.Close() diff --git a/vendor/cloud.google.com/go/monitoring/apiv3/v2/query_client.go b/vendor/cloud.google.com/go/monitoring/apiv3/v2/query_client.go index 236a85b232..6d3030eb59 100644 --- a/vendor/cloud.google.com/go/monitoring/apiv3/v2/query_client.go +++ b/vendor/cloud.google.com/go/monitoring/apiv3/v2/query_client.go @@ -87,7 +87,7 @@ type QueryClient struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *QueryClient) Close() error { return c.internalClient.Close() @@ -215,7 +215,7 @@ func (c *queryGRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *queryGRPCClient) Close() error { return c.connPool.Close() diff --git a/vendor/cloud.google.com/go/monitoring/apiv3/v2/service_monitoring_client.go b/vendor/cloud.google.com/go/monitoring/apiv3/v2/service_monitoring_client.go index 6498d81992..a0023d2550 100644 --- a/vendor/cloud.google.com/go/monitoring/apiv3/v2/service_monitoring_client.go +++ b/vendor/cloud.google.com/go/monitoring/apiv3/v2/service_monitoring_client.go @@ -191,7 +191,7 @@ type ServiceMonitoringClient struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *ServiceMonitoringClient) Close() error { return c.internalClient.Close() @@ -369,7 +369,7 @@ func (c *serviceMonitoringGRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *serviceMonitoringGRPCClient) Close() error { return c.connPool.Close() diff --git a/vendor/cloud.google.com/go/monitoring/apiv3/v2/snooze_client.go b/vendor/cloud.google.com/go/monitoring/apiv3/v2/snooze_client.go index 1e325ecd34..3a45e85ffe 100644 --- a/vendor/cloud.google.com/go/monitoring/apiv3/v2/snooze_client.go +++ b/vendor/cloud.google.com/go/monitoring/apiv3/v2/snooze_client.go @@ -124,7 +124,7 @@ type SnoozeClient struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *SnoozeClient) Close() error { return c.internalClient.Close() @@ -269,7 +269,7 @@ func (c *snoozeGRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *snoozeGRPCClient) Close() error { return c.connPool.Close() diff --git a/vendor/cloud.google.com/go/monitoring/apiv3/v2/uptime_check_client.go b/vendor/cloud.google.com/go/monitoring/apiv3/v2/uptime_check_client.go index d120f4b4eb..12811e790e 100644 --- a/vendor/cloud.google.com/go/monitoring/apiv3/v2/uptime_check_client.go +++ b/vendor/cloud.google.com/go/monitoring/apiv3/v2/uptime_check_client.go @@ -157,7 +157,7 @@ type UptimeCheckClient struct { // Wrapper methods routed to the internal client. -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *UptimeCheckClient) Close() error { return c.internalClient.Close() @@ -321,7 +321,7 @@ func (c *uptimeCheckGRPCClient) setGoogleClientInfo(keyval ...string) { } } -// Close closes the connection to the API service. The user should invoke this when +// Close closes the connection to the API service. **Always** call Close() when // the client is no longer required. func (c *uptimeCheckGRPCClient) Close() error { return c.connPool.Close() diff --git a/vendor/cloud.google.com/go/monitoring/internal/version.go b/vendor/cloud.google.com/go/monitoring/internal/version.go index 6403eb8543..efd522bbae 100644 --- a/vendor/cloud.google.com/go/monitoring/internal/version.go +++ b/vendor/cloud.google.com/go/monitoring/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "1.29.0" +const Version = "1.30.0" diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md index ed56ac241b..f745dca9d6 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md @@ -1,5 +1,21 @@ # Release History +## 1.23.1 (2026-08-27) + +### Other Changes + +* Upgraded dependencies. + +## 1.23.0 (2026-08-11) + +### Features Added + +* Helper method `runtime.NewRequestForNextLink` for creating requests for pageable operations that uses a next link. It handles absolute and relative next links. + +### Bugs Fixed + +* Fixed an issue where `runtime.Pager[T].More` could return `true` indefinitely after `NextPage` failed to retrieve the first page, causing `for pager.More()` loops to spin. After a page fetch returns an error the `Pager` now enters a terminal state: `More` returns `false` and subsequent `NextPage` calls return the same error without invoking the fetcher again. + ## 1.22.0 (2026-06-04) ### Features Added diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go index 4862a9f688..299ed5e36f 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go @@ -190,7 +190,10 @@ and determining if there are more pages to fetch. No IO calls are made until th pager := widgetClient.NewListWidgetsPager(nil) for pager.More() { page, err := pager.NextPage(context.TODO()) - // handle err + if err != nil { + // process error + break + } for _, widget := range page.Values { // process widget } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go index 4bf722630a..2df0c7a97f 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go @@ -11,8 +11,11 @@ import ( "fmt" "io" "net/http" + "net/url" + "path" "reflect" "strconv" + "strings" "github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared" ) @@ -119,6 +122,26 @@ func NewRequest(ctx context.Context, httpMethod string, endpoint string) (*Reque return &Request{req: req, values: opValues{}}, nil } +// NewRequestForNextLink creates a new policy.Request with the specified input. +// This helper is for use in paged operations that use the "next link" pattern. +// - endpoint is the service endpoint (e.g. https://contoso.com) +// - nextLink the absolute or relative URL to the next page of items +// +// When nextLink is an absolute URL, its value is used to create the request to the next page. +// If nextLink is a relative URL, it will be joined with the specified endpoint. +// +// Exported as runtime.NewRequestForNextLink(). +func NewRequestForNextLink(ctx context.Context, httpMethod, endpoint, nextLink string) (*Request, error) { + nextLink, err := EncodeQueryParams(nextLink, true) + if err != nil { + return nil, err + } + if !hasScheme(nextLink) { + nextLink = JoinPaths(endpoint, nextLink) + } + return NewRequest(ctx, httpMethod, nextLink) +} + // Body returns the original body specified when the Request was created. func (req *Request) Body() io.ReadSeekCloser { return req.body @@ -257,3 +280,89 @@ func SetBody(req *Request, body io.ReadSeekCloser, contentType string, clobberCo } return nil } + +// JoinPaths concatenates multiple URL path segments into one path, +// inserting path separation characters as required. JoinPaths will preserve +// query parameters in the root path. +// Exported as runtime.JoinPaths +func JoinPaths(root string, paths ...string) string { + if len(paths) == 0 { + return root + } + + qps := "" + if strings.Contains(root, "?") { + splitPath := strings.Split(root, "?") + root, qps = splitPath[0], splitPath[1] + } + + p := path.Join(paths...) + // path.Join will remove any trailing slashes. + // if one was provided, preserve it. + if strings.HasSuffix(paths[len(paths)-1], "/") && !strings.HasSuffix(p, "/") { + p += "/" + } + + if qps != "" { + if strings.Contains(p, "?") { + p = p + "&" + qps + } else { + p = p + "?" + qps + } + } + + if strings.HasSuffix(root, "/") && strings.HasPrefix(p, "/") { + root = root[:len(root)-1] + } else if !strings.HasSuffix(root, "/") && !strings.HasPrefix(p, "/") && !strings.HasPrefix(p, "?") { + p = "/" + p + } + return root + p +} + +// EncodeQueryParams will parse and encode any query parameters in the specified URL. +// Any semicolons will automatically be escaped. +// When encodeSpaces is true all spaces that were form-encoded to + are replaced with %20. +// Exported as runtime.EncodeQueryParams +func EncodeQueryParams(u string, encodeSpaces bool) (string, error) { + before, after, found := strings.Cut(u, "?") + if !found { + return u, nil + } + // starting in Go 1.17, url.ParseQuery will reject semicolons in query params. + // so, we must escape them first. note that this assumes that semicolons aren't + // being used as query param separators which is per the current RFC. + // for more info: + // https://github.com/golang/go/issues/25192 + // https://github.com/golang/go/issues/50034 + qp, err := url.ParseQuery(strings.ReplaceAll(after, ";", "%3B")) + if err != nil { + return "", err + } + encoded := qp.Encode() + if encodeSpaces { + encoded = strings.ReplaceAll(encoded, "+", "%20") + } + return before + "?" + encoded, nil +} + +// hasScheme reports whether s begins with a URI scheme, i.e. is an absolute URI. +// Per RFC 3986: scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) ":". +// This avoids the allocations of url.Parse when we only need to know if the URI is absolute. +func hasScheme(s string) bool { + for i := 0; i < len(s); i++ { + c := s[i] + switch { + case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z': + // always valid + case c == ':': + return i > 0 + case i == 0: + return false + case c >= '0' && c <= '9', c == '+', c == '-', c == '.': + // valid after the first character + default: + return false + } + } + return false +} diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go index 4f7aa64349..fcbf011e7d 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go @@ -37,5 +37,5 @@ const ( Module = "azcore" // Version is the semantic version (see http://semver.org) of this module. - Version = "v1.22.0" + Version = "v1.23.1" ) diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go index 743513be4b..a05b0c34d6 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go @@ -35,6 +35,9 @@ type Pager[T any] struct { handler PagingHandler[T] tracer tracing.Tracer firstPage bool + // fetchErr is set when Fetcher returns an error, placing the Pager in a + // terminal state so that More returns false. + fetchErr error } // NewPager creates an instance of Pager using the specified PagingHandler. @@ -48,7 +51,16 @@ func NewPager[T any](handler PagingHandler[T]) *Pager[T] { } // More returns true if there are more pages to retrieve. +// +// If a prior call to [Pager.NextPage] returned an error while fetching a page, +// the Pager enters a terminal state and More returns false so that a for loop +// over the pager terminates instead of retrying indefinitely. func (p *Pager[T]) More() bool { + // a failed fetch puts the Pager in a terminal state; there are no more pages + // to retrieve regardless of whether it was the first or a subsequent page. + if p.fetchErr != nil { + return false + } if p.current != nil { return p.handler.More(*p.current) } @@ -56,7 +68,17 @@ func (p *Pager[T]) More() bool { } // NextPage advances the pager to the next page. +// +// If fetching the page returns an error, the Pager enters a terminal state: +// [Pager.More] returns false and every subsequent call to NextPage returns the +// same error without invoking the fetcher again. func (p *Pager[T]) NextPage(ctx context.Context) (T, error) { + if p.fetchErr != nil { + // a prior fetch failed; the Pager is in a terminal state. return the + // stored error rather than re-invoking the fetcher, which may not be + // safe to retry (e.g. stateful handlers that latch into a done state). + return *new(T), p.fetchErr + } if p.current != nil { if p.firstPage { // we get here if it's an LRO-pager, we already have the first page @@ -76,6 +98,7 @@ func (p *Pager[T]) NextPage(ctx context.Context) (T, error) { resp, err := p.handler.Fetcher(ctx, p.current) if err != nil { + p.fetchErr = err return *new(T), err } p.current = &resp diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go index 696e1d9f49..50c867914e 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go @@ -115,7 +115,8 @@ func (p *retryPolicy) Do(req *policy.Request) (resp *http.Response, err error) { // do this outside the for loop so defers don't accumulate. rwbody = &retryableRequestBody{body: req.Body()} defer func() { - // TODO: https://github.com/Azure/azure-sdk-for-go/issues/25649 + // Match net/http behavior: after a request has produced either a response + // or a transport error, request body close errors are not surfaced to callers. _ = rwbody.realClose() }() } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go index 20d86496d2..20ec6511c6 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go @@ -14,8 +14,6 @@ import ( "mime/multipart" "net/http" "net/textproto" - "net/url" - "path" "strings" "github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported" @@ -43,6 +41,17 @@ func NewRequest(ctx context.Context, httpMethod string, endpoint string) (*polic return exported.NewRequest(ctx, httpMethod, endpoint) } +// NewRequestForNextLink creates a new policy.Request with the specified input. +// This helper is for use in paged operations that use the "next link" pattern. +// - endpoint is the service endpoint (e.g. https://contoso.com) +// - nextLink the absolute or relative URL to the next page of items +// +// When nextLink is an absolute URL, its value is used to create the request to the next page. +// If nextLink is a relative URL, it will be joined with the specified endpoint. +func NewRequestForNextLink(ctx context.Context, httpMethod, endpoint, nextLink string) (*policy.Request, error) { + return exported.NewRequestForNextLink(ctx, httpMethod, endpoint, nextLink) +} + // NewRequestFromRequest creates a new policy.Request with an existing *http.Request func NewRequestFromRequest(req *http.Request) (*policy.Request, error) { return exported.NewRequestFromRequest(req) @@ -51,58 +60,14 @@ func NewRequestFromRequest(req *http.Request) (*policy.Request, error) { // EncodeQueryParams will parse and encode any query parameters in the specified URL. // Any semicolons will automatically be escaped. func EncodeQueryParams(u string) (string, error) { - before, after, found := strings.Cut(u, "?") - if !found { - return u, nil - } - // starting in Go 1.17, url.ParseQuery will reject semicolons in query params. - // so, we must escape them first. note that this assumes that semicolons aren't - // being used as query param separators which is per the current RFC. - // for more info: - // https://github.com/golang/go/issues/25192 - // https://github.com/golang/go/issues/50034 - qp, err := url.ParseQuery(strings.ReplaceAll(after, ";", "%3B")) - if err != nil { - return "", err - } - return before + "?" + qp.Encode(), nil + return exported.EncodeQueryParams(u, false) } // JoinPaths concatenates multiple URL path segments into one path, // inserting path separation characters as required. JoinPaths will preserve // query parameters in the root path func JoinPaths(root string, paths ...string) string { - if len(paths) == 0 { - return root - } - - qps := "" - if strings.Contains(root, "?") { - splitPath := strings.Split(root, "?") - root, qps = splitPath[0], splitPath[1] - } - - p := path.Join(paths...) - // path.Join will remove any trailing slashes. - // if one was provided, preserve it. - if strings.HasSuffix(paths[len(paths)-1], "/") && !strings.HasSuffix(p, "/") { - p += "/" - } - - if qps != "" { - if strings.Contains(p, "?") { - p = p + "&" + qps - } else { - p = p + "?" + qps - } - } - - if strings.HasSuffix(root, "/") && strings.HasPrefix(p, "/") { - root = root[:len(root)-1] - } else if !strings.HasSuffix(root, "/") && !strings.HasPrefix(p, "/") && !strings.HasPrefix(p, "?") { - p = "/" + p - } - return root + p + return exported.JoinPaths(root, paths...) } // EncodeByteArray will base-64 encode the byte slice v. diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md index ba360a30e3..3dea713ccf 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md @@ -1,5 +1,11 @@ # Release History +## 1.14.1 (2026-08-27) + +### Other Changes + +- Upgraded dependencies + ## 1.14.0 (2026-06-15) ### Breaking Changes diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go index f45f59697b..fb5014489d 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go @@ -11,5 +11,5 @@ const ( module = "github.com/Azure/azure-sdk-for-go/sdk/" + component // Version is the semantic version (see http://semver.org) of this module. - version = "v1.14.0" + version = "v1.14.1" ) diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go index 1b3e599b1a..fe4599e3df 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go @@ -57,6 +57,10 @@ As such I've put a PEM decoder into here. // TODO(msal): This should have example code for each method on client using Go's example doc framework. // base usage details should be include in the package documentation. +// clientClaimsCacheKey is the CacheKeyComponents key used to partition the token cache by +// client-originated claims (see WithClaimsFromClient). The component value is the raw claims string. +const clientClaimsCacheKey = "client_claims" + // AuthResult contains the results of one token acquisition operation. // For details see https://aka.ms/msal-net-authenticationresult type AuthResult = base.AuthResult @@ -465,6 +469,7 @@ func WithClaims(claims string) interface { AcquireByUsernamePasswordOption AcquireSilentOption AuthCodeURLOption + AcquireByUserFICOption options.CallOption } { return struct { @@ -474,6 +479,7 @@ func WithClaims(claims string) interface { AcquireByUsernamePasswordOption AcquireSilentOption AuthCodeURLOption + AcquireByUserFICOption options.CallOption }{ CallOption: options.NewCallOption( @@ -491,6 +497,84 @@ func WithClaims(claims string) interface { t.claims = claims case *authCodeURLOptions: t.claims = claims + case *acquireTokenByUserFICOptions: + t.claims = claims + default: + return fmt.Errorf("unexpected options type %T", a) + } + return nil + }, + ), + } +} + +// WithClaimsFromClient specifies client-originated claims (a JSON object) to include in the token +// request. +// +// Unlike [WithClaims] (for server-issued claims challenges, which bypass the token cache), tokens +// acquired with client claims ARE cached and the cache entry is keyed on the claims value. Different +// claims values produce separate cache entries, so callers should pass stable, non-dynamic values to +// avoid unbounded cache growth. The exact same string MUST be included on every request: the raw +// string is used verbatim as part of the cache key (MSAL does not normalize it), so omitting it or +// changing it on a later call silently moves to a different cache partition. +// +// The claims are sent to the authority as the standard OAuth "claims" body parameter (merged with any +// server-issued claims and client capabilities); they are not embedded in the client assertion JWT. +// +// The argument must be a JSON object, but the confidential client does not enforce this locally in all +// cases: the value is forwarded to the authority verbatim and is validated locally only when it is +// merged with server-issued claims or client capabilities. Otherwise a malformed or non-object value +// is not rejected locally and instead surfaces as a server-side error. An empty or whitespace-only +// value is ignored. +func WithClaimsFromClient(claims string) interface { + AcquireByAuthCodeOption + AcquireByCredentialOption + AcquireOnBehalfOfOption + AcquireByUsernamePasswordOption + AcquireSilentOption + AcquireByUserFICOption + options.CallOption +} { + return struct { + AcquireByAuthCodeOption + AcquireByCredentialOption + AcquireOnBehalfOfOption + AcquireByUsernamePasswordOption + AcquireSilentOption + AcquireByUserFICOption + options.CallOption + }{ + CallOption: options.NewCallOption( + func(a any) error { + if strings.TrimSpace(claims) == "" { + // Ignore empty/whitespace claims so callers can pass a value unconditionally. + return nil + } + addCacheKey := func(m *map[string]string) { + if *m == nil { + *m = make(map[string]string) + } + (*m)[clientClaimsCacheKey] = claims + } + switch t := a.(type) { + case *acquireTokenByAuthCodeOptions: + t.clientClaims = claims + addCacheKey(&t.cacheKeyComponents) + case *acquireTokenByCredentialOptions: + t.clientClaims = claims + addCacheKey(&t.cacheKeyComponents) + case *acquireTokenOnBehalfOfOptions: + t.clientClaims = claims + addCacheKey(&t.cacheKeyComponents) + case *acquireTokenByUsernamePasswordOptions: + t.clientClaims = claims + addCacheKey(&t.cacheKeyComponents) + case *acquireTokenSilentOptions: + t.clientClaims = claims + addCacheKey(&t.cacheKeyComponents) + case *acquireTokenByUserFICOptions: + t.clientClaims = claims + addCacheKey(&t.cacheKeyComponents) default: return fmt.Errorf("unexpected options type %T", a) } @@ -500,7 +584,6 @@ func WithClaims(claims string) interface { } } -// WithAuthenticationScheme is an extensibility mechanism designed to be used only by Azure Arc for proof of possession access tokens. func WithAuthenticationScheme(authnScheme AuthenticationScheme) interface { AcquireSilentOption AcquireByCredentialOption @@ -536,6 +619,7 @@ func WithTenantID(tenantID string) interface { AcquireByUsernamePasswordOption AcquireSilentOption AuthCodeURLOption + AcquireByUserFICOption options.CallOption } { return struct { @@ -545,6 +629,7 @@ func WithTenantID(tenantID string) interface { AcquireByUsernamePasswordOption AcquireSilentOption AuthCodeURLOption + AcquireByUserFICOption options.CallOption }{ CallOption: options.NewCallOption( @@ -562,6 +647,8 @@ func WithTenantID(tenantID string) interface { t.tenantID = tenantID case *authCodeURLOptions: t.tenantID = tenantID + case *acquireTokenByUserFICOptions: + t.tenantID = tenantID default: return fmt.Errorf("unexpected options type %T", a) } @@ -574,9 +661,11 @@ func WithTenantID(tenantID string) interface { // acquireTokenSilentOptions are all the optional settings to an AcquireTokenSilent() call. // These are set by using various AcquireTokenSilentOption functions. type acquireTokenSilentOptions struct { - account Account - claims, tenantID string - authnScheme AuthenticationScheme + account Account + claims, tenantID string + clientClaims string + authnScheme AuthenticationScheme + cacheKeyComponents map[string]string } // AcquireSilentOption is implemented by options for AcquireTokenSilent @@ -609,7 +698,7 @@ func WithSilentAccount(account Account) interface { // AcquireTokenSilent acquires a token from either the cache or using a refresh token. // -// Options: [WithClaims], [WithSilentAccount], [WithTenantID] +// Options: [WithClaims], [WithClaimsFromClient], [WithSilentAccount], [WithTenantID] func (cca Client) AcquireTokenSilent(ctx context.Context, scopes []string, opts ...AcquireSilentOption) (AuthResult, error) { o := acquireTokenSilentOptions{} if err := options.ApplyOptions(&o, opts); err != nil { @@ -626,14 +715,16 @@ func (cca Client) AcquireTokenSilent(ctx context.Context, scopes []string, opts } silentParameters := base.AcquireTokenSilentParameters{ - Scopes: scopes, - Account: o.account, - RequestType: accesstokens.ATConfidential, - Credential: cca.cred, - IsAppCache: o.account.IsZero(), - TenantID: o.tenantID, - AuthnScheme: o.authnScheme, - Claims: o.claims, + Scopes: scopes, + Account: o.account, + RequestType: accesstokens.ATConfidential, + Credential: cca.cred, + IsAppCache: o.account.IsZero(), + TenantID: o.tenantID, + AuthnScheme: o.authnScheme, + Claims: o.claims, + ClientClaims: o.clientClaims, + CacheKeyComponents: o.cacheKeyComponents, } return cca.acquireTokenSilentInternal(ctx, silentParameters) @@ -647,8 +738,10 @@ func (cca Client) acquireTokenSilentInternal(ctx context.Context, silentParamete // acquireTokenByUsernamePasswordOptions contains optional configuration for AcquireTokenByUsernamePassword type acquireTokenByUsernamePasswordOptions struct { - claims, tenantID string - authnScheme AuthenticationScheme + claims, tenantID string + clientClaims string + authnScheme AuthenticationScheme + cacheKeyComponents map[string]string } // AcquireByUsernamePasswordOption is implemented by options for AcquireTokenByUsernamePassword @@ -659,7 +752,7 @@ type AcquireByUsernamePasswordOption interface { // AcquireTokenByUsernamePassword acquires a security token from the authority, via Username/Password Authentication. // NOTE: this flow is NOT recommended. // -// Options: [WithClaims], [WithTenantID] +// Options: [WithClaims], [WithClaimsFromClient], [WithTenantID] func (cca Client) AcquireTokenByUsernamePassword(ctx context.Context, scopes []string, username, password string, opts ...AcquireByUsernamePasswordOption) (AuthResult, error) { o := acquireTokenByUsernamePasswordOptions{} if err := options.ApplyOptions(&o, opts); err != nil { @@ -672,8 +765,12 @@ func (cca Client) AcquireTokenByUsernamePassword(ctx context.Context, scopes []s authParams.Scopes = scopes authParams.AuthorizationType = authority.ATUsernamePassword authParams.Claims = o.claims + authParams.ClientClaims = o.clientClaims authParams.Username = username authParams.Password = password + if o.cacheKeyComponents != nil { + authParams.CacheKeyComponents = o.cacheKeyComponents + } if o.authnScheme != nil { authParams.AuthnScheme = o.authnScheme } @@ -688,6 +785,8 @@ func (cca Client) AcquireTokenByUsernamePassword(ctx context.Context, scopes []s // acquireTokenByAuthCodeOptions contains the optional parameters used to acquire an access token using the authorization code flow. type acquireTokenByAuthCodeOptions struct { challenge, claims, tenantID string + clientClaims string + cacheKeyComponents map[string]string } // AcquireByAuthCodeOption is implemented by options for AcquireTokenByAuthCode @@ -721,7 +820,7 @@ func WithChallenge(challenge string) interface { // AcquireTokenByAuthCode is a request to acquire a security token from the authority, using an authorization code. // The specified redirect URI must be the same URI that was used when the authorization code was requested. // -// Options: [WithChallenge], [WithClaims], [WithTenantID] +// Options: [WithChallenge], [WithClaims], [WithClaimsFromClient], [WithTenantID] func (cca Client) AcquireTokenByAuthCode(ctx context.Context, code string, redirectURI string, scopes []string, opts ...AcquireByAuthCodeOption) (AuthResult, error) { o := acquireTokenByAuthCodeOptions{} if err := options.ApplyOptions(&o, opts); err != nil { @@ -729,14 +828,16 @@ func (cca Client) AcquireTokenByAuthCode(ctx context.Context, code string, redir } params := base.AcquireTokenAuthCodeParameters{ - Scopes: scopes, - Code: code, - Challenge: o.challenge, - Claims: o.claims, - AppType: accesstokens.ATConfidential, - Credential: cca.cred, // This setting differs from public.Client.AcquireTokenByAuthCode - RedirectURI: redirectURI, - TenantID: o.tenantID, + Scopes: scopes, + Code: code, + Challenge: o.challenge, + Claims: o.claims, + ClientClaims: o.clientClaims, + AppType: accesstokens.ATConfidential, + Credential: cca.cred, // This setting differs from public.Client.AcquireTokenByAuthCode + RedirectURI: redirectURI, + TenantID: o.tenantID, + CacheKeyComponents: o.cacheKeyComponents, } return cca.base.AcquireTokenByAuthCode(ctx, params) @@ -745,6 +846,7 @@ func (cca Client) AcquireTokenByAuthCode(ctx context.Context, code string, redir // acquireTokenByCredentialOptions contains optional configuration for AcquireTokenByCredential type acquireTokenByCredentialOptions struct { claims, tenantID string + clientClaims string authnScheme AuthenticationScheme extraBodyParameters map[string]string cacheKeyComponents map[string]string @@ -757,7 +859,7 @@ type AcquireByCredentialOption interface { // AcquireTokenByCredential acquires a security token from the authority, using the client credentials grant. // -// Options: [WithClaims], [WithTenantID], [WithFMIPath], [WithAttribute] +// Options: [WithClaims], [WithClaimsFromClient], [WithTenantID], [WithFMIPath], [WithAttribute] func (cca Client) AcquireTokenByCredential(ctx context.Context, scopes []string, opts ...AcquireByCredentialOption) (AuthResult, error) { o := acquireTokenByCredentialOptions{} err := options.ApplyOptions(&o, opts) @@ -771,6 +873,7 @@ func (cca Client) AcquireTokenByCredential(ctx context.Context, scopes []string, authParams.Scopes = scopes authParams.AuthorizationType = authority.ATClientCredentials authParams.Claims = o.claims + authParams.ClientClaims = o.clientClaims if o.authnScheme != nil { authParams.AuthnScheme = o.authnScheme } @@ -786,6 +889,7 @@ func (cca Client) AcquireTokenByCredential(ctx context.Context, scopes []string, TenantID: o.tenantID, AuthnScheme: o.authnScheme, Claims: o.claims, + ClientClaims: o.clientClaims, ExtraBodyParameters: o.extraBodyParameters, CacheKeyComponents: o.cacheKeyComponents, } @@ -806,7 +910,9 @@ func (cca Client) AcquireTokenByCredential(ctx context.Context, scopes []string, // acquireTokenOnBehalfOfOptions contains optional configuration for AcquireTokenOnBehalfOf type acquireTokenOnBehalfOfOptions struct { - claims, tenantID string + claims, tenantID string + clientClaims string + cacheKeyComponents map[string]string } // AcquireOnBehalfOfOption is implemented by options for AcquireTokenOnBehalfOf @@ -817,18 +923,20 @@ type AcquireOnBehalfOfOption interface { // AcquireTokenOnBehalfOf acquires a security token for an app using middle tier apps access token. // Refer https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow. // -// Options: [WithClaims], [WithTenantID] +// Options: [WithClaims], [WithClaimsFromClient], [WithTenantID] func (cca Client) AcquireTokenOnBehalfOf(ctx context.Context, userAssertion string, scopes []string, opts ...AcquireOnBehalfOfOption) (AuthResult, error) { o := acquireTokenOnBehalfOfOptions{} if err := options.ApplyOptions(&o, opts); err != nil { return AuthResult{}, err } params := base.AcquireTokenOnBehalfOfParameters{ - Scopes: scopes, - UserAssertion: userAssertion, - Claims: o.claims, - Credential: cca.cred, - TenantID: o.tenantID, + Scopes: scopes, + UserAssertion: userAssertion, + Claims: o.claims, + ClientClaims: o.clientClaims, + Credential: cca.cred, + TenantID: o.tenantID, + CacheKeyComponents: o.cacheKeyComponents, } return cca.base.AcquireTokenOnBehalfOf(ctx, params) } @@ -902,3 +1010,111 @@ func WithAttribute(attrValue string) interface { ), } } + +// AcquireByUserFICOption is implemented by options for AcquireTokenByUserFederatedIdentityCredential. +type AcquireByUserFICOption interface { + acquireByUserFICOption() +} + +// acquireTokenByUserFICOptions contains optional configuration for AcquireTokenByUserFederatedIdentityCredential. +type acquireTokenByUserFICOptions struct { + claims, tenantID string + clientClaims string + username string + userObjectID string + cacheKeyComponents map[string]string +} + +// acquireByUserFICOption is a marker method that restricts option types to the user_fic API. +func (acquireTokenByUserFICOptions) acquireByUserFICOption() {} + +// WithUserObjectID specifies the target user by their object ID (OID) for the user_fic flow. +// This is mutually exclusive with WithUserFICUsername. +func WithUserObjectID(oid string) interface { + AcquireByUserFICOption + options.CallOption +} { + return struct { + AcquireByUserFICOption + options.CallOption + }{ + CallOption: options.NewCallOption( + func(a any) error { + switch t := a.(type) { + case *acquireTokenByUserFICOptions: + t.userObjectID = oid + default: + return fmt.Errorf("unexpected options type %T", a) + } + return nil + }, + ), + } +} + +// WithUserFICUsername specifies the target user by their UPN (username) for the user_fic flow. +// This is mutually exclusive with WithUserObjectID. +func WithUserFICUsername(username string) interface { + AcquireByUserFICOption + options.CallOption +} { + return struct { + AcquireByUserFICOption + options.CallOption + }{ + CallOption: options.NewCallOption( + func(a any) error { + switch t := a.(type) { + case *acquireTokenByUserFICOptions: + t.username = username + default: + return fmt.Errorf("unexpected options type %T", a) + } + return nil + }, + ), + } +} + +// AcquireTokenByUserFederatedIdentityCredential acquires a user-scoped token using the user_fic grant type. +// This exchanges a federated identity credential (assertion) for a user token, enabling an agent +// to act on behalf of a user. The result includes an Account that can be used with +// [Client.AcquireTokenSilent] for subsequent cached access. +// +// Parameters: +// - ctx: Context for the request. +// - scopes: Scopes requested for the token. +// - assertion: The federated identity credential (instance token) to exchange. +// - opts: Options including user identification (exactly one of WithUserObjectID or WithUserFICUsername +// is required), [WithClaims], [WithClaimsFromClient], [WithTenantID]. +// +// Options: [WithUserObjectID], [WithUserFICUsername], [WithClaims], [WithClaimsFromClient], [WithTenantID] +func (cca Client) AcquireTokenByUserFederatedIdentityCredential(ctx context.Context, scopes []string, assertion string, opts ...AcquireByUserFICOption) (AuthResult, error) { + o := acquireTokenByUserFICOptions{} + if err := options.ApplyOptions(&o, opts); err != nil { + return AuthResult{}, err + } + + if assertion == "" { + return AuthResult{}, errors.New("assertion must not be empty") + } + if o.username == "" && o.userObjectID == "" { + return AuthResult{}, errors.New("exactly one of WithUserObjectID or WithUserFICUsername must be specified") + } + if o.username != "" && o.userObjectID != "" { + return AuthResult{}, errors.New("WithUserObjectID and WithUserFICUsername are mutually exclusive") + } + + params := base.AcquireTokenByUserFICParameters{ + Scopes: scopes, + Claims: o.claims, + ClientClaims: o.clientClaims, + Credential: cca.cred, + TenantID: o.tenantID, + UserFederatedIdentityCredential: assertion, + Username: o.username, + UserObjectID: o.userObjectID, + CacheKeyComponents: o.cacheKeyComponents, + } + return cca.base.AcquireTokenByUserFIC(ctx, params) +} diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go index 9bd96090e8..ed622e5ec6 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go @@ -55,6 +55,7 @@ type AcquireTokenSilentParameters struct { UserAssertion string AuthorizationType authority.AuthorizeType Claims string + ClientClaims string AuthnScheme authority.AuthenticationScheme ExtraBodyParameters map[string]string CacheKeyComponents map[string]string @@ -65,22 +66,39 @@ type AcquireTokenSilentParameters struct { // Code challenges are used to secure authorization code grants; for more information, visit // https://tools.ietf.org/html/rfc7636. type AcquireTokenAuthCodeParameters struct { - Scopes []string - Code string - Challenge string - Claims string - RedirectURI string - AppType accesstokens.AppType - Credential *accesstokens.Credential - TenantID string + Scopes []string + Code string + Challenge string + Claims string + ClientClaims string + RedirectURI string + AppType accesstokens.AppType + Credential *accesstokens.Credential + TenantID string + CacheKeyComponents map[string]string } type AcquireTokenOnBehalfOfParameters struct { - Scopes []string - Claims string - Credential *accesstokens.Credential - TenantID string - UserAssertion string + Scopes []string + Claims string + ClientClaims string + Credential *accesstokens.Credential + TenantID string + UserAssertion string + CacheKeyComponents map[string]string +} + +// AcquireTokenByUserFICParameters contains the parameters to acquire a user token via the user_fic flow. +type AcquireTokenByUserFICParameters struct { + Scopes []string + Claims string + ClientClaims string + Credential *accesstokens.Credential + TenantID string + UserFederatedIdentityCredential string + Username string + UserObjectID string + CacheKeyComponents map[string]string } // AuthResult contains the results of one token acquisition operation in PublicClientApplication @@ -322,7 +340,9 @@ func (b Client) AcquireTokenSilent(ctx context.Context, silent AcquireTokenSilen authParams.HomeAccountID = silent.Account.HomeAccountID authParams.AuthorizationType = silent.AuthorizationType authParams.Claims = silent.Claims + authParams.ClientClaims = silent.ClientClaims authParams.UserAssertion = silent.UserAssertion + authParams.IsAppTokenCache = silent.IsAppCache if silent.AuthnScheme != nil { authParams.AuthnScheme = silent.AuthnScheme } @@ -414,6 +434,10 @@ func (b Client) AcquireTokenByAuthCode(ctx context.Context, authCodeParams Acqui return AuthResult{}, err } authParams.Claims = authCodeParams.Claims + authParams.ClientClaims = authCodeParams.ClientClaims + if authCodeParams.CacheKeyComponents != nil { + authParams.CacheKeyComponents = authCodeParams.CacheKeyComponents + } authParams.Scopes = authCodeParams.Scopes authParams.Redirecturi = authCodeParams.RedirectURI authParams.AuthorizationType = authority.ATAuthCode @@ -441,13 +465,15 @@ func (b Client) AcquireTokenByAuthCode(ctx context.Context, authCodeParams Acqui func (b Client) AcquireTokenOnBehalfOf(ctx context.Context, onBehalfOfParams AcquireTokenOnBehalfOfParameters) (AuthResult, error) { var ar AuthResult silentParameters := AcquireTokenSilentParameters{ - Scopes: onBehalfOfParams.Scopes, - RequestType: accesstokens.ATConfidential, - Credential: onBehalfOfParams.Credential, - UserAssertion: onBehalfOfParams.UserAssertion, - AuthorizationType: authority.ATOnBehalfOf, - TenantID: onBehalfOfParams.TenantID, - Claims: onBehalfOfParams.Claims, + Scopes: onBehalfOfParams.Scopes, + RequestType: accesstokens.ATConfidential, + Credential: onBehalfOfParams.Credential, + UserAssertion: onBehalfOfParams.UserAssertion, + AuthorizationType: authority.ATOnBehalfOf, + TenantID: onBehalfOfParams.TenantID, + Claims: onBehalfOfParams.Claims, + ClientClaims: onBehalfOfParams.ClientClaims, + CacheKeyComponents: onBehalfOfParams.CacheKeyComponents, } ar, err := b.AcquireTokenSilent(ctx, silentParameters) if err == nil { @@ -459,8 +485,12 @@ func (b Client) AcquireTokenOnBehalfOf(ctx context.Context, onBehalfOfParams Acq } authParams.AuthorizationType = authority.ATOnBehalfOf authParams.Claims = onBehalfOfParams.Claims + authParams.ClientClaims = onBehalfOfParams.ClientClaims authParams.Scopes = onBehalfOfParams.Scopes authParams.UserAssertion = onBehalfOfParams.UserAssertion + if onBehalfOfParams.CacheKeyComponents != nil { + authParams.CacheKeyComponents = onBehalfOfParams.CacheKeyComponents + } if authParams.ExtraBodyParameters != nil { authParams.ExtraBodyParameters = silentParameters.ExtraBodyParameters } @@ -471,6 +501,30 @@ func (b Client) AcquireTokenOnBehalfOf(ctx context.Context, onBehalfOfParams Acq return ar, err } +// AcquireTokenByUserFIC acquires a user-scoped token using the user_fic grant type. +func (b Client) AcquireTokenByUserFIC(ctx context.Context, params AcquireTokenByUserFICParameters) (AuthResult, error) { + authParams, err := b.AuthParams.WithTenant(params.TenantID) + if err != nil { + return AuthResult{}, err + } + authParams.AuthorizationType = authority.ATUserFIC + authParams.Claims = params.Claims + authParams.ClientClaims = params.ClientClaims + if params.CacheKeyComponents != nil { + authParams.CacheKeyComponents = params.CacheKeyComponents + } + authParams.Scopes = params.Scopes + authParams.UserFederatedIdentityCredential = params.UserFederatedIdentityCredential + authParams.Username = params.Username + authParams.UserObjectID = params.UserObjectID + + token, err := b.Token.UserFederatedIdentityCredential(ctx, authParams, params.Credential) + if err != nil { + return AuthResult{}, err + } + return b.AuthResultFromToken(ctx, authParams, token) +} + func (b Client) AuthResultFromToken(ctx context.Context, authParams authority.AuthParams, token accesstokens.TokenResponse) (AuthResult, error) { var m manager = b.manager if authParams.AuthorizationType == authority.ATOnBehalfOf { @@ -525,7 +579,7 @@ func (b Client) Account(ctx context.Context, homeAccountID string) (shared.Accou authParams := b.AuthParams // This is a copy, as we don't have a pointer receiver and .AuthParams is not a pointer. authParams.AuthorizationType = authority.AccountByID authParams.HomeAccountID = homeAccountID - key := b.AuthParams.CacheKey(false) + key := authParams.CacheKey(false) err := b.cacheAccessor.Replace(ctx, b.manager, cache.ReplaceHints{PartitionKey: key}) if err != nil { return shared.Account{}, err diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/partitioned_storage.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/partitioned_storage.go index 5d018e117a..0042a1e964 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/partitioned_storage.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/partitioned_storage.go @@ -59,7 +59,7 @@ func (m *PartitionedManager) Read(ctx context.Context, authParameters authority. // errors returned by read* methods indicate a cache miss and are therefore non-fatal. We continue populating // TokenResponse fields so that e.g. lack of an ID token doesn't prevent the caller from receiving a refresh token. - accessToken, err := m.readAccessToken(aliases, realm, clientID, userAssertionHash, scopes, partitionKeyFromRequest, tokenType, authnSchemeKeyID) + accessToken, err := m.readAccessToken(aliases, realm, clientID, userAssertionHash, scopes, partitionKeyFromRequest, tokenType, authnSchemeKeyID, authParameters.CacheExtKeyGenerator()) if err == nil { tr.AccessToken = accessToken } @@ -125,6 +125,7 @@ func (m *PartitionedManager) Write(authParameters authority.AuthParams, tokenRes if authParameters.AuthorizationType == authority.ATOnBehalfOf { accessToken.UserAssertionHash = userAssertionHash // get Hash method on this } + accessToken.ExtCacheKey = authParameters.CacheExtKeyGenerator() // Since we have a valid access token, cache it before moving on. if err := accessToken.Validate(); err == nil { @@ -250,7 +251,7 @@ func (m *PartitionedManager) fallbackMetadata(host string) authority.InstanceDis return fallback } -func (m *PartitionedManager) readAccessToken(envAliases []string, realm, clientID, userAssertionHash string, scopes []string, partitionKey, tokenType, authnSchemeKeyID string) (AccessToken, error) { +func (m *PartitionedManager) readAccessToken(envAliases []string, realm, clientID, userAssertionHash string, scopes []string, partitionKey, tokenType, authnSchemeKeyID, extCacheKey string) (AccessToken, error) { m.contractMu.RLock() defer m.contractMu.RUnlock() if accessTokens, ok := m.contract.AccessTokensPartition[partitionKey]; ok { @@ -262,6 +263,13 @@ func (m *PartitionedManager) readAccessToken(envAliases []string, realm, clientI if at.TokenType == tokenType && at.AuthnSchemeKeyID == authnSchemeKeyID { if checkAlias(at.Environment, envAliases) { if isMatchingScopes(scopes, at.Scopes) { + // Tokens acquired with extra cache-key components (e.g. client claims + // via WithClaimsFromClient) are partitioned by ExtCacheKey. Only return a + // token whose ExtCacheKey matches the request's; this also ensures a + // request without extra components never returns a hashed token. + if at.ExtCacheKey != extCacheKey { + continue + } return at, nil } } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/exported/exported.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/exported/exported.go index de1bf381f4..a1c6ed4daa 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/exported/exported.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/exported/exported.go @@ -11,6 +11,10 @@ type AssertionRequestOptions struct { // TokenEndpoint is the intended token endpoint. Used as the assertion's "aud" claim. TokenEndpoint string + + // FMIPath is the federated managed identity path for the current request, if any. + // Assertion providers can use this to scope the credential they return. + FMIPath string } // TokenProviderParameters is the authentication parameters passed to token providers diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/json.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/json.go index 2134e57c9e..b0311ca6d9 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/json.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/json.go @@ -58,7 +58,26 @@ func Marshal(i interface{}) ([]byte, error) { // Unmarshal unmarshals a []byte representing JSON into i, which must be a *struct. In addition, if the struct has // a field called AdditionalFields of type map[string]interface{}, JSON data representing fields not in the struct // will be written as key/value pairs to AdditionalFields. -func Unmarshal(b []byte, i interface{}) error { +// +// Any panic that escapes the underlying reflect-based decoder (for example +// "reflect: New of type that may not be allocated in heap") is recovered and +// returned as an error so that callers are not crashed by malformed or +// otherwise unexpected input. +// +// IMPORTANT: when Unmarshal returns a non-nil error, the destination i may +// have been partially populated (the decoder writes fields sequentially and a +// panic mid-decode does not roll back earlier writes). Callers that need +// all-or-nothing semantics — particularly those handling untrusted input — +// must decode into a temporary value and only copy/assign it on success. +// MSAL's own token-cache callers already follow this pattern (see +// apps/internal/base/storage.Manager.Unmarshal). +func Unmarshal(b []byte, i interface{}) (err error) { + defer func() { + if r := recover(); r != nil { + err = fmt.Errorf("json: panic during Unmarshal: %v", r) + } + }() + if len(b) == 0 { return nil } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/oauth.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/oauth.go index 738a29eb9d..9b7d3a5f4d 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/oauth.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/oauth.go @@ -39,6 +39,7 @@ type AccessTokens interface { FromUserAssertionClientCertificate(ctx context.Context, authParameters authority.AuthParams, userAssertion string, assertion string) (accesstokens.TokenResponse, error) FromDeviceCodeResult(ctx context.Context, authParameters authority.AuthParams, deviceCodeResult accesstokens.DeviceCodeResult) (accesstokens.TokenResponse, error) FromSamlGrant(ctx context.Context, authParameters authority.AuthParams, samlGrant wstrust.SamlTokenInfo) (accesstokens.TokenResponse, error) + FromUserFederatedIdentityCredential(ctx context.Context, authParameters authority.AuthParams, cred *accesstokens.Credential) (accesstokens.TokenResponse, error) } // FetchAuthority will be implemented by authority.Authority. @@ -170,6 +171,17 @@ func (t *Client) OnBehalfOf(ctx context.Context, authParams authority.AuthParams return tr, nil } +// UserFederatedIdentityCredential acquires a user-scoped token using the user_fic grant type. +func (t *Client) UserFederatedIdentityCredential(ctx context.Context, authParams authority.AuthParams, cred *accesstokens.Credential) (accesstokens.TokenResponse, error) { + if err := scopeError(authParams); err != nil { + return accesstokens.TokenResponse{}, err + } + if err := t.resolveEndpoint(ctx, &authParams, ""); err != nil { + return accesstokens.TokenResponse{}, err + } + return t.AccessTokens.FromUserFederatedIdentityCredential(ctx, authParams, cred) +} + func (t *Client) Refresh(ctx context.Context, reqType accesstokens.AppType, authParams authority.AuthParams, cc *accesstokens.Credential, refreshToken accesstokens.RefreshToken) (accesstokens.TokenResponse, error) { if err := scopeError(authParams); err != nil { return accesstokens.TokenResponse{}, err diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/accesstokens.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/accesstokens.go index 481f9e4341..dc07c558d1 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/accesstokens.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/accesstokens.go @@ -110,6 +110,7 @@ func (c *Credential) JWT(ctx context.Context, authParams authority.AuthParams) ( options := exported.AssertionRequestOptions{ ClientID: authParams.ClientID, TokenEndpoint: authParams.Endpoints.TokenEndpoint, + FMIPath: authParams.ExtraBodyParameters["fmi_path"], } return c.AssertionCallback(ctx, options) } @@ -340,6 +341,44 @@ func (c Client) FromUserAssertionClientCertificate(ctx context.Context, authPara return c.doTokenResp(ctx, authParameters, qv) } +// FromUserFederatedIdentityCredential acquires a user-scoped token using the user_fic grant type. +// This exchanges a federated identity credential for a user token. +func (c Client) FromUserFederatedIdentityCredential(ctx context.Context, authParameters authority.AuthParams, cred *Credential) (TokenResponse, error) { + if cred.Secret == "" && cred.Cert == nil && cred.AssertionCallback == nil { + return TokenResponse{}, fmt.Errorf("user_fic requires a client secret or assertion credential; token provider credentials are not supported") + } + qv := url.Values{} + if err := addClaims(qv, authParameters); err != nil { + return TokenResponse{}, err + } + qv.Set(grantType, grant.UserFIC) + qv.Set(clientID, authParameters.ClientID) + qv.Set("user_federated_identity_credential", authParameters.UserFederatedIdentityCredential) + qv.Set(clientInfo, clientInfoVal) + + // Set user identifier: either user_id (OID) or username (UPN) + if authParameters.UserObjectID != "" { + qv.Set("user_id", authParameters.UserObjectID) + } else if authParameters.Username != "" { + qv.Set("username", authParameters.Username) + } + + addScopeQueryParam(qv, authParameters) + addExtraBodyParameters(ctx, qv, authParameters) + + credParams, err := prepURLVals(ctx, cred, authParameters) + if err != nil { + return TokenResponse{}, err + } + for k, vs := range credParams { + for _, v := range vs { + qv.Set(k, v) + } + } + + return c.doTokenResp(ctx, authParameters, qv) +} + func (c Client) DeviceCodeResult(ctx context.Context, authParameters authority.AuthParams) (DeviceCodeResult, error) { qv := url.Values{} if err := addClaims(qv, authParameters); err != nil { diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/tokens.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/tokens.go index 32dde7b76b..eeb1496974 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/tokens.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/tokens.go @@ -292,7 +292,11 @@ func (tr *TokenResponse) CacheKey(authParams authority.AuthParams) string { if authParams.AuthorizationType == authority.ATOnBehalfOf { return authParams.AssertionHash() } - if authParams.AuthorizationType == authority.ATClientCredentials { + // An app-only (client credentials) request keys on the app-token-cache partition. + // AcquireTokenSilent overrides AuthorizationType to ATRefreshToken before the + // proactive-refresh write-back, so check IsAppTokenCache here to keep the write key + // aligned with the read key (authParams.CacheKey). See issue #630. + if authParams.AuthorizationType == authority.ATClientCredentials || authParams.IsAppTokenCache { return authParams.AppKey() } if authParams.IsConfidentialClient || authParams.AuthorizationType == authority.ATRefreshToken { diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go index db6f8b42ee..07702ef77e 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go @@ -14,7 +14,7 @@ import ( "net/http" "net/url" "os" - "path" + "regexp" "sort" "strings" "time" @@ -29,8 +29,8 @@ const ( aadInstanceDiscoveryEndpoint = "https://%v/common/discovery/instance" tenantDiscoveryEndpointWithRegion = "https://%s.%s/%s/v2.0/.well-known/openid-configuration" regionName = "REGION_NAME" - defaultAPIVersion = "2021-10-01" - imdsEndpoint = "http://169.254.169.254/metadata/instance/compute/location?format=text&api-version=" + defaultAPIVersion + defaultAPIVersion = "2021-02-01" + imdsEndpoint = "http://169.254.169.254/metadata/instance/compute?api-version=" + defaultAPIVersion autoDetectRegion = "TryAutoDetect" AccessTokenTypeBearer = "Bearer" ) @@ -44,6 +44,9 @@ const ( loginMicrosoftOnline = defaultHost ) +// validRegion matches Azure region names: lowercase alphanumeric and hyphens only. +var validRegion = regexp.MustCompile(`^[a-z][a-z0-9-]*$`) + // jsonCaller is an interface that allows us to mock the JSONCall method. type jsonCaller interface { JSONCall(ctx context.Context, endpoint string, headers http.Header, qv url.Values, body, resp interface{}) error @@ -188,6 +191,7 @@ const ( ATRefreshToken AccountByID ATOnBehalfOf + ATUserFIC ) // These are all authority types @@ -269,6 +273,11 @@ type AuthParams struct { Capabilities ClientCapabilities // Claims required for an access token to satisfy a conditional access policy Claims string + // ClientClaims are client-originated claims set via the request-level WithClaimsFromClient option. + // Unlike Claims (server-issued challenge claims, which bypass the cache), ClientClaims participate + // in the token cache and are keyed on the raw claims string as passed by the caller. They are merged + // with Claims and Capabilities into the request's "claims" parameter. + ClientClaims string // KnownAuthorityHosts don't require metadata discovery because they're known to the user KnownAuthorityHosts []string // LoginHint is a username with which to pre-populate account selection during interactive auth @@ -283,6 +292,15 @@ type AuthParams struct { ExtraBodyParameters map[string]string // CacheKeyComponents are additional components to include in the cache key. CacheKeyComponents map[string]string + // IsAppTokenCache indicates the request targets the app-only (client credentials) + // token cache partition. It is propagated onto silent requests so the proactive-refresh + // write-back computes the same partition key as the read path, even though + // AcquireTokenSilent overrides AuthorizationType to ATRefreshToken. See issue #630. + IsAppTokenCache bool + // UserFederatedIdentityCredential is the federated credential token for user_fic flow. + UserFederatedIdentityCredential string + // UserObjectID is the target user's object ID for user_fic flow (mutually exclusive with Username). + UserObjectID string } // NewAuthParams creates an authorization parameters object. @@ -316,7 +334,11 @@ func (p AuthParams) WithTenant(ID string) (AuthParams, error) { if p.AuthorityInfo.Tenant == "consumers" { return p, errors.New(`client is configured to authenticate only personal Microsoft accounts, via the "consumers" endpoint`) } - authority = "https://" + path.Join(p.AuthorityInfo.Host, ID) + authority = (&url.URL{ + Scheme: "https", + Host: p.AuthorityInfo.Host, + Path: "/", + }).ResolveReference(&url.URL{Path: ID}).String() case ADFS: return p, errors.New("ADFS authority doesn't support tenants") case DSTS: @@ -331,9 +353,15 @@ func (p AuthParams) WithTenant(ID string) (AuthParams, error) { return p, err } -// MergeCapabilitiesAndClaims combines client capabilities and challenge claims into a value suitable for an authentication request's "claims" parameter. +// MergeCapabilitiesAndClaims combines client capabilities, server-issued challenge claims and +// client-originated claims into a value suitable for an authentication request's "claims" parameter. func (p AuthParams) MergeCapabilitiesAndClaims() (string, error) { - claims := p.Claims + // Combine server-issued claims (from WithClaims) with client-originated claims + // (from WithClaimsFromClient). When both set the same key, the client claims win. + claims, err := mergeClaims(p.Claims, p.ClientClaims) + if err != nil { + return "", err + } if len(p.Capabilities.asMap) > 0 { if claims == "" { // without claims the result is simply the capabilities @@ -357,6 +385,65 @@ func (p AuthParams) MergeCapabilitiesAndClaims() (string, error) { return claims, nil } +// mergeClaims merges two JSON claims objects into one. If either side is empty the other is returned +// verbatim and unvalidated (the common case; this keeps the value byte-for-byte identical to what the +// caller passed and mirrors MSAL .NET's MergeClaimsObjects). Only when both sides are present are they +// parsed as JSON objects (anything that is not a JSON object is an error), deep-merged with the second +// object's values winning on conflicting keys, and re-serialized. +func mergeClaims(claims1, claims2 string) (string, error) { + if claims1 == "" { + return claims2, nil + } + if claims2 == "" { + return claims1, nil + } + m1, err := parseClaimsObject(claims1) + if err != nil { + return "", err + } + m2, err := parseClaimsObject(claims2) + if err != nil { + return "", err + } + b, err := json.Marshal(deepMergeClaims(m1, m2)) + if err != nil { + return "", err + } + return string(b), nil +} + +// parseClaimsObject unmarshals a non-empty claims string into a JSON object. A value that is valid +// JSON but not an object (e.g. an array, a scalar, or the literal "null") is rejected, mirroring the +// behavior of the other MSAL libraries. +func parseClaimsObject(claims string) (map[string]any, error) { + var m map[string]any + if err := json.Unmarshal([]byte(claims), &m); err != nil { + // Don't include the parser error or the raw value in the message: claims may carry sensitive data. + return nil, errors.New("claims must be a JSON object") + } + if m == nil { + return nil, errors.New("claims must be a JSON object") + } + return m, nil +} + +// deepMergeClaims merges src into dst, with src's values winning on conflicting keys. When both +// values for a key are JSON objects the merge recurses; otherwise src's value overwrites dst's. +func deepMergeClaims(dst, src map[string]any) map[string]any { + for k, sv := range src { + if dv, ok := dst[k]; ok { + if dm, dok := dv.(map[string]any); dok { + if sm, sok := sv.(map[string]any); sok { + dst[k] = deepMergeClaims(dm, sm) + continue + } + } + } + dst[k] = sv + } + return dst +} + // merges a into b without overwriting b's values. Returns an error when a and b share a key for which either has a non-object value. func merge(a, b map[string]any) error { for k, av := range a { @@ -587,6 +674,9 @@ func (c Client) AADInstanceDiscovery(ctx context.Context, authorityInfo Info) (I region = detectRegion(ctx) } if region != "" { + if !validRegion.MatchString(region) { + return resp, fmt.Errorf("invalid region %q: region must contain only lowercase alphanumeric characters and hyphens", region) + } environment := authorityInfo.Host switch environment { case loginMicrosoft, loginWindows, loginSTSWindows, defaultHost: @@ -653,7 +743,24 @@ func detectRegion(ctx context.Context) string { if err != nil { return "" } - return string(response) + return parseRegionFromIMDSResponse(response) +} + +// imdsComputeResponse models the subset of the IMDS compute metadata response +// (http://169.254.169.254/metadata/instance/compute) used for region detection. +type imdsComputeResponse struct { + Location string `json:"location"` +} + +// parseRegionFromIMDSResponse extracts the Azure region from an IMDS compute +// metadata JSON response body. It returns an empty string when the body cannot +// be parsed or the location field is absent. +func parseRegionFromIMDSResponse(body []byte) string { + var parsed imdsComputeResponse + if err := json.Unmarshal(body, &parsed); err != nil { + return "" + } + return parsed.Location } func (a *AuthParams) CacheKey(isAppCache bool) string { @@ -663,7 +770,7 @@ func (a *AuthParams) CacheKey(isAppCache bool) string { if a.AuthorizationType == ATClientCredentials || isAppCache { return a.AppKey() } - if a.AuthorizationType == ATRefreshToken || a.AuthorizationType == AccountByID { + if a.AuthorizationType == ATRefreshToken || a.AuthorizationType == AccountByID || a.AuthorizationType == ATUserFIC { return a.HomeAccountID } return "" @@ -706,13 +813,18 @@ func (a *AuthParams) CacheExtKeyGenerator() string { } sort.Strings(keys) - // Create a string by concatenating key+value pairs - keyStr := "" + // Concatenate length-prefixed key/value pairs so the boundaries between + // components are unambiguous. A plain key+value concatenation with no + // separators can collide when a value happens to contain another component's + // key or value (client_claims, for example, is arbitrary caller-supplied + // JSON), which would map two distinct component sets to the same hash and + // return the wrong cached token. Length prefixes make the encoding injective. + var sb strings.Builder for _, key := range keys { - // Append key followed by its value with no separator - keyStr += key + a.CacheKeyComponents[key] + val := a.CacheKeyComponents[key] + fmt.Fprintf(&sb, "%d:%s%d:%s", len(key), key, len(val), val) } - hash := sha256.Sum256([]byte(keyStr)) + hash := sha256.Sum256([]byte(sb.String())) return strings.ToLower(base64.RawURLEncoding.EncodeToString(hash[:])) } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authorizetype_string.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authorizetype_string.go index 10039773b0..7d93930ccc 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authorizetype_string.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authorizetype_string.go @@ -16,15 +16,19 @@ func _() { _ = x[ATClientCredentials-5] _ = x[ATDeviceCode-6] _ = x[ATRefreshToken-7] + _ = x[AccountByID-8] + _ = x[ATOnBehalfOf-9] + _ = x[ATUserFIC-10] } -const _AuthorizeType_name = "ATUnknownATUsernamePasswordATWindowsIntegratedATAuthCodeATInteractiveATClientCredentialsATDeviceCodeATRefreshToken" +const _AuthorizeType_name = "ATUnknownATUsernamePasswordATWindowsIntegratedATAuthCodeATInteractiveATClientCredentialsATDeviceCodeATRefreshTokenAccountByIDATOnBehalfOfATUserFIC" -var _AuthorizeType_index = [...]uint8{0, 9, 27, 46, 56, 69, 88, 100, 114} +var _AuthorizeType_index = [...]uint8{0, 9, 27, 46, 56, 69, 88, 100, 114, 125, 137, 146} func (i AuthorizeType) String() string { - if i < 0 || i >= AuthorizeType(len(_AuthorizeType_index)-1) { + idx := int(i) - 0 + if i < 0 || idx >= len(_AuthorizeType_index)-1 { return "AuthorizeType(" + strconv.FormatInt(int64(i), 10) + ")" } - return _AuthorizeType_name[_AuthorizeType_index[i]:_AuthorizeType_index[i+1]] + return _AuthorizeType_name[_AuthorizeType_index[idx]:_AuthorizeType_index[idx+1]] } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/grant/grant.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/grant/grant.go index b628f61ac0..f09bff390a 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/grant/grant.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/grant/grant.go @@ -14,4 +14,5 @@ const ( RefreshToken = "refresh_token" ClientCredential = "client_credentials" ClientAssertion = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" + UserFIC = "user_fic" ) diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go index d220a99466..92170a7628 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go @@ -16,6 +16,7 @@ import ( "github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops" "github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority" + "golang.org/x/sync/singleflight" ) type cacheEntry struct { @@ -35,6 +36,8 @@ type authorityEndpoint struct { mu sync.Mutex cache map[string]cacheEntry + + resolveGroup singleflight.Group } // newAuthorityEndpoint is the constructor for AuthorityEndpoint. @@ -50,35 +53,49 @@ func (m *authorityEndpoint) ResolveEndpoints(ctx context.Context, authorityInfo return endpoints, nil } - endpoint, err := m.openIDConfigurationEndpoint(ctx, authorityInfo) - if err != nil { - return authority.Endpoints{}, err - } + key := authorityInfo.CanonicalAuthorityURI + v, err, _ := m.resolveGroup.Do(key, func() (interface{}, error) { + // Double-check inside the singleflight group: another goroutine may + // have populated the cache while we were waiting. + if endpoints, found := m.cachedEndpoints(authorityInfo, userPrincipalName); found { + return endpoints, nil + } - resp, err := m.rest.Authority().GetTenantDiscoveryResponse(ctx, endpoint) - if err != nil { - return authority.Endpoints{}, err - } - if err := resp.Validate(); err != nil { - return authority.Endpoints{}, fmt.Errorf("ResolveEndpoints(): %w", err) - } + endpoint, err := m.openIDConfigurationEndpoint(ctx, authorityInfo) + if err != nil { + return authority.Endpoints{}, err + } + + resp, err := m.rest.Authority().GetTenantDiscoveryResponse(ctx, endpoint) + if err != nil { + return authority.Endpoints{}, err + } + if err := resp.Validate(); err != nil { + return authority.Endpoints{}, fmt.Errorf("ResolveEndpoints(): %w", err) + } - tenant := authorityInfo.Tenant + tenant := authorityInfo.Tenant - endpoints := authority.NewEndpoints( - strings.Replace(resp.AuthorizationEndpoint, "{tenant}", tenant, -1), - strings.Replace(resp.TokenEndpoint, "{tenant}", tenant, -1), - strings.Replace(resp.Issuer, "{tenant}", tenant, -1), - authorityInfo.Host) + endpoints := authority.NewEndpoints( + strings.Replace(resp.AuthorizationEndpoint, "{tenant}", tenant, -1), + strings.Replace(resp.TokenEndpoint, "{tenant}", tenant, -1), + strings.Replace(resp.Issuer, "{tenant}", tenant, -1), + authorityInfo.Host) - m.addCachedEndpoints(authorityInfo, userPrincipalName, endpoints) + aliases := m.addCachedEndpoints(authorityInfo, userPrincipalName, endpoints) - if err := resp.ValidateIssuerMatchesAuthority(authorityInfo.CanonicalAuthorityURI, - m.cache[authorityInfo.CanonicalAuthorityURI].Aliases); err != nil { - return authority.Endpoints{}, fmt.Errorf("ResolveEndpoints(): %w", err) + if err := resp.ValidateIssuerMatchesAuthority(authorityInfo.CanonicalAuthorityURI, + aliases); err != nil { + return authority.Endpoints{}, fmt.Errorf("ResolveEndpoints(): %w", err) + } + + return endpoints, nil + }) + if err != nil { + return authority.Endpoints{}, err } - return endpoints, nil + return v.(authority.Endpoints), nil } // cachedEndpoints returns the cached endpoints if they exist. If not, we return false. @@ -100,7 +117,7 @@ func (m *authorityEndpoint) cachedEndpoints(authorityInfo authority.Info, userPr return authority.Endpoints{}, false } -func (m *authorityEndpoint) addCachedEndpoints(authorityInfo authority.Info, userPrincipalName string, endpoints authority.Endpoints) { +func (m *authorityEndpoint) addCachedEndpoints(authorityInfo authority.Info, userPrincipalName string, endpoints authority.Endpoints) map[string]bool { m.mu.Lock() defer m.mu.Unlock() @@ -128,6 +145,7 @@ func (m *authorityEndpoint) addCachedEndpoints(authorityInfo authority.Info, use } m.cache[authorityInfo.CanonicalAuthorityURI] = updatedCacheEntry + return updatedCacheEntry.Aliases } func (m *authorityEndpoint) openIDConfigurationEndpoint(ctx context.Context, authorityInfo authority.Info) (string, error) { diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go index 40da7d5d1e..d19d8376a2 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go @@ -8,4 +8,4 @@ package version const SKU = "MSAL.Go" // Version is the version of this client package that is communicated to the server. -const Version = "1.7.2" +const Version = "1.8.0" diff --git a/vendor/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp/detector.go b/vendor/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp/detector.go index 4eac3c74b6..20b33dedf1 100644 --- a/vendor/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp/detector.go +++ b/vendor/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp/detector.go @@ -39,6 +39,7 @@ const ( GCE CloudRun CloudRunJob + CloudRunWorkerPool CloudFunctions AppEngineStandard AppEngineFlex @@ -58,6 +59,8 @@ func (d *Detector) CloudPlatform() Platform { return CloudRun case d.onCloudRunJob(): return CloudRunJob + case d.onCloudRunWorkerPool(): + return CloudRunWorkerPool case d.onAppEngineStandard(): return AppEngineStandard case d.onAppEngine(): diff --git a/vendor/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp/faas.go b/vendor/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp/faas.go index f137b1fae6..49f8818999 100644 --- a/vendor/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp/faas.go +++ b/vendor/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp/faas.go @@ -28,14 +28,19 @@ const ( // // Cloud Run jobs env vars: // https://cloud.google.com/run/docs/container-contract#jobs-env-vars - cloudFunctionsTargetEnv = "FUNCTION_TARGET" - cloudRunConfigurationEnv = "K_CONFIGURATION" - cloudRunJobsEnv = "CLOUD_RUN_JOB" - faasServiceEnv = "K_SERVICE" - faasRevisionEnv = "K_REVISION" - cloudRunJobExecutionEnv = "CLOUD_RUN_EXECUTION" - cloudRunJobTaskIndexEnv = "CLOUD_RUN_TASK_INDEX" - regionMetadataAttr = "instance/region" + // + // Cloud Run worker pool env vars: + // https://cloud.google.com/run/docs/container-contract#worker-pools-env-vars + cloudFunctionsTargetEnv = "FUNCTION_TARGET" + cloudRunConfigurationEnv = "K_CONFIGURATION" + cloudRunJobsEnv = "CLOUD_RUN_JOB" + faasServiceEnv = "K_SERVICE" + faasRevisionEnv = "K_REVISION" + cloudRunJobExecutionEnv = "CLOUD_RUN_EXECUTION" + cloudRunJobTaskIndexEnv = "CLOUD_RUN_TASK_INDEX" + cloudRunWorkerPoolEnv = "CLOUD_RUN_WORKER_POOL" + cloudRunRevisionEnv = "CLOUD_RUN_REVISION" + regionMetadataAttr = "instance/region" ) func (d *Detector) onCloudFunctions() bool { @@ -53,6 +58,11 @@ func (d *Detector) onCloudRunJob() bool { return found } +func (d *Detector) onCloudRunWorkerPool() bool { + _, found := d.os.LookupEnv(cloudRunWorkerPoolEnv) + return found +} + // FaaSName returns the name of the Cloud Run, Cloud Run jobs or Cloud Functions service. func (d *Detector) FaaSName() (string, error) { if name, found := d.os.LookupEnv(faasServiceEnv); found { @@ -61,11 +71,17 @@ func (d *Detector) FaaSName() (string, error) { if name, found := d.os.LookupEnv(cloudRunJobsEnv); found { return name, nil } + if name, found := d.os.LookupEnv(cloudRunWorkerPoolEnv); found { + return name, nil + } return "", errEnvVarNotFound } // FaaSVersion returns the revision of the Cloud Run or Cloud Functions service. func (d *Detector) FaaSVersion() (string, error) { + if version, found := d.os.LookupEnv(cloudRunRevisionEnv); found { + return version, nil + } if version, found := d.os.LookupEnv(faasRevisionEnv); found { return version, nil } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go index ba7e7270d9..03a9b840d5 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go @@ -3,4 +3,4 @@ package aws // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.43.0" +const goModuleVersion = "1.46.0" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/metadata.go index d66f0960aa..ba2082411f 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/metadata.go @@ -15,6 +15,8 @@ type RegisterServiceMetadata struct { SigningName string Region string OperationName string + + RequiresLegacyEndpoints bool } // ID returns the middleware identifier. @@ -33,10 +35,13 @@ func (s RegisterServiceMetadata) HandleInitialize( ctx = SetSigningName(ctx, s.SigningName) } if len(s.Region) > 0 { - ctx = setRegion(ctx, s.Region) + ctx = SetRegion(ctx, s.Region) } if len(s.OperationName) > 0 { - ctx = setOperationName(ctx, s.OperationName) + ctx = SetOperationName(ctx, s.OperationName) + } + if s.RequiresLegacyEndpoints { + ctx = SetRequiresLegacyEndpoints(ctx, true) } return next.HandleInitialize(ctx, in) } @@ -161,19 +166,19 @@ func SetServiceID(ctx context.Context, value string) context.Context { return middleware.WithStackValue(ctx, serviceIDKey{}, value) } -// setRegion sets the endpoint region on the context. +// SetRegion sets the endpoint region on the context. // // Scoped to stack values. Use github.com/aws/smithy-go/middleware#ClearStackValues // to clear all stack values. -func setRegion(ctx context.Context, value string) context.Context { +func SetRegion(ctx context.Context, value string) context.Context { return middleware.WithStackValue(ctx, regionKey{}, value) } -// setOperationName sets the service operation on the context. +// SetOperationName sets the service operation on the context. // // Scoped to stack values. Use github.com/aws/smithy-go/middleware#ClearStackValues // to clear all stack values. -func setOperationName(ctx context.Context, value string) context.Context { +func SetOperationName(ctx context.Context, value string) context.Context { return middleware.WithStackValue(ctx, operationNameKey{}, value) } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go index 126dcf47bd..bb31852c15 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go @@ -93,6 +93,9 @@ func (r Attempt) logf(logger logging.Logger, classification logging.Classificati func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeInput, next smithymiddle.FinalizeHandler) ( out smithymiddle.FinalizeOutput, metadata smithymiddle.Metadata, err error, ) { + ctx, span := tracing.StartSpan(ctx, "RetryLoop") + defer span.End() + var attemptClockSkew time.Duration if !r.DisableClockSkewCorrection && r.ClientSkew != nil { attemptClockSkew = time.Duration(r.ClientSkew.Load()) diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/headers.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/headers.go index d99b32ceb0..0b9ddd13ba 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/headers.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/headers.go @@ -58,6 +58,10 @@ var RequiredSignedHeaders = Rules{ "X-Amz-Tagging": struct{}{}, }, }, + InclusiveRules{ + Patterns{"X-Amz-Checksum-"}, + ExcludeList{Patterns{"X-Amz-Checksum-Mode"}}, + }, Patterns{"X-Amz-Object-Lock-"}, Patterns{"X-Amz-Meta-"}, } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.go index 49cc31205c..50b7417c28 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.go @@ -2,6 +2,7 @@ package http import ( "context" + "crypto/fips140" "crypto/tls" "net" "net/http" @@ -27,6 +28,19 @@ var ( // Default to TLS 1.2 for all HTTPS requests. DefaultHTTPTransportTLSMinVersion uint16 = tls.VersionTLS12 + + // DefaultHTTPTransportTLSCurvePreferencesFIPS is the elliptic curve preference + // list applied to the default transport when the FIPS 140-3 module is active. + // + // Go's default preferences lead with X25519, which crypto/ecdh rejects under + // GODEBUG=fips140=only, failing every TLS handshake the SDK attempts. Only the + // NIST curves are FIPS-approved, so restricting to them keeps the default + // client usable in FIPS deployments. + DefaultHTTPTransportTLSCurvePreferencesFIPS = []tls.CurveID{ + tls.CurveP256, + tls.CurveP384, + tls.CurveP521, + } ) // Timeouts for net.Dialer's network connection. @@ -48,6 +62,7 @@ type BuildableClient struct { initOnce sync.Once clientTimeout time.Duration + readTimeout *time.Duration client *http.Client } @@ -82,9 +97,12 @@ func (b *BuildableClient) Freeze() aws.HTTPClient { } func (b *BuildableClient) build() { + tr := b.GetTransport() + b.installReadTimeout(tr) + b.client = wrapWithLimitedRedirect(&http.Client{ Timeout: b.clientTimeout, - Transport: b.GetTransport(), + Transport: tr, }) } @@ -93,6 +111,7 @@ func (b *BuildableClient) clone() *BuildableClient { cpy.transport = b.GetTransport() cpy.dialer = b.GetDialer() cpy.clientTimeout = b.clientTimeout + cpy.readTimeout = b.readTimeout return cpy } @@ -141,6 +160,25 @@ func (b *BuildableClient) WithTimeout(timeout time.Duration) *BuildableClient { return cpy } +// WithReadTimeout copies the BuildableClient and returns it with the read +// timeout set. +// +// The timeout is the maximum time the client waits for a connection to deliver +// any data. It resets on every byte received, so a slow but progressing response +// does not fail. It is not a deadline on the operation; use WithTimeout for that. +// +// A value set here takes precedence over the SDK's defaults for every service +// this client is used with, including services the SDK would otherwise apply a +// higher value to or exempt entirely. Pass 0 to disable read timeouts. +// +// The timeout is applied per connection, so a client shared between service +// clients applies the same value to all of them. +func (b *BuildableClient) WithReadTimeout(timeout time.Duration) *BuildableClient { + cpy := b.clone() + cpy.readTimeout = &timeout + return cpy +} + // GetTransport returns a copy of the client's HTTP Transport. func (b *BuildableClient) GetTransport() *http.Transport { var tr *http.Transport @@ -170,6 +208,17 @@ func (b *BuildableClient) GetTimeout() time.Duration { return b.clientTimeout } +// GetReadTimeout returns the configured read timeout and whether one was set on +// this client. When it was not, the SDK resolves a default per +// service. +func (b *BuildableClient) GetReadTimeout() (time.Duration, bool) { + if b.readTimeout == nil { + return 0, false + } + + return *b.readTimeout, true +} + func defaultDialer() *net.Dialer { return &net.Dialer{ Timeout: DefaultDialConnectTimeout, @@ -178,6 +227,16 @@ func defaultDialer() *net.Dialer { } } +// defaultTLSCurvePreferences returns the curve preferences for the default +// transport. Outside FIPS mode it returns nil so Go's own defaults apply, +// preserving X25519 and the post-quantum X25519MLKEM768 hybrid. +func defaultTLSCurvePreferences(fipsEnabled bool) []tls.CurveID { + if !fipsEnabled { + return nil + } + return DefaultHTTPTransportTLSCurvePreferencesFIPS +} + func defaultHTTPTransport() *http.Transport { dialer := defaultDialer() @@ -192,7 +251,8 @@ func defaultHTTPTransport() *http.Transport { ExpectContinueTimeout: DefaultHTTPTransportExpectContinueTimeout, ForceAttemptHTTP2: true, TLSClientConfig: &tls.Config{ - MinVersion: DefaultHTTPTransportTLSMinVersion, + MinVersion: DefaultHTTPTransportTLSMinVersion, + CurvePreferences: defaultTLSCurvePreferences(fips140.Enabled()), }, } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/timeouts.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/timeouts.go new file mode 100644 index 0000000000..fbd23ef971 --- /dev/null +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/timeouts.go @@ -0,0 +1,54 @@ +package http + +import ( + "context" + "errors" + "net" + "net/http" + "os" + "time" +) + +// deadlineConn applies a rolling inactivity window to reads on a connection by +// resetting the read deadline before each one. A read returns as soon as any +// bytes are available, so a slow but progressing transfer survives, and a +// connection that goes silent fails once. +type deadlineConn struct { + net.Conn + timeout time.Duration +} + +// Read implements [io.Reader]. +func (c *deadlineConn) Read(p []byte) (int, error) { + if err := c.Conn.SetReadDeadline(time.Now().Add(c.timeout)); err != nil { + return 0, err + } + + n, err := c.Conn.Read(p) + if errors.Is(err, os.ErrDeadlineExceeded) { + return n, &ResponseTimeoutError{TimeoutDur: c.timeout} + } + + return n, err +} + +func (b *BuildableClient) installReadTimeout(tr *http.Transport) { + timeout, ok := b.GetReadTimeout() + if !ok || timeout <= 0 { + return + } + + dial := tr.DialContext + if dial == nil { + dial = defaultDialer().DialContext + } + + tr.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) { + conn, err := dial(ctx, network, addr) + if err != nil { + return nil, err + } + + return &deadlineConn{Conn: conn, timeout: timeout}, nil + } +} diff --git a/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md index 589f82973f..2086afb4d2 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md @@ -1,3 +1,62 @@ +# v1.33.3 (2026-09-04) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.2 (2026-08-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.32.40 (2026-08-26) + +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.32.39 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.32.38 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.32.37 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.32.36 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.32.35 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.32.34 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.32.33 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.32.32 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.32.31 (2026-07-21) * **Dependency Update**: Updated to the latest SDK module versions diff --git a/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go index 0b48de0f80..621beebafc 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go @@ -3,4 +3,4 @@ package config // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.32.31" +const goModuleVersion = "1.33.3" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md index d26df48863..eea2e90ee3 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md @@ -1,3 +1,62 @@ +# v1.20.3 (2026-09-04) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.20.2 (2026-08-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.20.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.20.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.39 (2026-08-26) + +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.38 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.37 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.36 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.35 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.34 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.33 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.19.32 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.31 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.19.30 (2026-07-21) * **Dependency Update**: Updated to the latest SDK module versions diff --git a/vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/client.go b/vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/client.go index dc291c97cd..429e3261e5 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/client.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/client.go @@ -104,8 +104,6 @@ func (c *Client) GetCredentials(ctx context.Context, params *GetCredentialsInput addProtocolFinalizerMiddlewares(stack, options, "GetCredentials") retry.AddRetryMiddlewares(stack, retry.AddRetryMiddlewaresOptions{Retryer: options.Retryer}) middleware.AddSDKAgentKey(middleware.FeatureMetadata, ServiceID) - smithyhttp.AddErrorCloseResponseBodyMiddleware(stack) - smithyhttp.AddCloseResponseBodyMiddleware(stack) for _, fn := range options.APIOptions { if err := fn(stack); err != nil { diff --git a/vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/middleware.go b/vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/middleware.go index f2820d20ea..ba98589052 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/middleware.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client/middleware.go @@ -82,12 +82,18 @@ func (d *deserializeOpGetCredential) HandleDeserialize(ctx context.Context, in s out smithymiddleware.DeserializeOutput, metadata smithymiddleware.Metadata, err error, ) { out, metadata, err = next.HandleDeserialize(ctx, in) + + // Close the response body on every exit path in place of the standalone close middleware. + // Deferred in a closure so it observes the final err (this output is not a streaming + // payload, so it is always closed regardless). + response, _ := out.RawResponse.(*smithyhttp.Response) + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + if err != nil { return out, metadata, err } - response, ok := out.RawResponse.(*smithyhttp.Response) - if !ok { + if response == nil { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go index e75a38fe25..396f3430c4 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go @@ -3,4 +3,4 @@ package credentials // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.19.30" +const goModuleVersion = "1.20.3" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.md index 2dc09fe9bf..fca92b7ee6 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.md @@ -1,3 +1,58 @@ +# v1.19.2 (2026-09-04) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.19.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.18.40 (2026-08-26) + +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.18.39 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.18.38 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.18.37 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.18.36 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.18.35 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.18.34 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.18.33 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.18.32 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.18.31 (2026-07-21) * **Dependency Update**: Updated to the latest SDK module versions diff --git a/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.go index 38253be79b..56f66817e5 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.go @@ -3,4 +3,4 @@ package imds // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.18.31" +const goModuleVersion = "1.19.2" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.md index 03d1578b10..4451fcee86 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.md @@ -1,3 +1,58 @@ +# v1.5.2 (2026-09-04) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.40 (2026-08-26) + +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.39 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.38 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.37 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.36 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.35 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.34 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.4.33 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.32 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.4.31 (2026-07-21) * **Dependency Update**: Updated to the latest SDK module versions diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.go index 29af650104..02bef26b41 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.go @@ -3,4 +3,4 @@ package configsources // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.4.31" +const goModuleVersion = "1.5.2" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.md index ab7609799a..3049b99406 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.md @@ -1,3 +1,58 @@ +# v2.8.2 (2026-09-04) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.8.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.8.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.7.40 (2026-08-26) + +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.7.39 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.7.38 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.7.37 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.7.36 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.7.35 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.7.34 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v2.7.33 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v2.7.32 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v2.7.31 (2026-07-21) * **Dependency Update**: Updated to the latest SDK module versions diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.go index 29f2aedc75..7d51740112 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.go @@ -3,4 +3,4 @@ package endpoints // goModuleVersion is the tagged release for this module -const goModuleVersion = "2.7.31" +const goModuleVersion = "2.8.2" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/awsinternal.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/awsinternal.go new file mode 100644 index 0000000000..7967f70913 --- /dev/null +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/awsinternal.go @@ -0,0 +1,6 @@ +package timeouts + +// Enabled internally. +var enableReadTimeout2026 = false + +var readTimeout2026Rollout map[string]bool diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/timeouts.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/timeouts.go new file mode 100644 index 0000000000..626f29c925 --- /dev/null +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/timeouts.go @@ -0,0 +1,39 @@ +package timeouts + +import ( + "os" + "sync" + "time" +) + +// DefaultReadTimeout is the SDK's default read timeout for a service with no +// entry in serviceInactivityTimeoutMillis. +const DefaultReadTimeout = 5 * time.Minute + +const enableReadTimeoutEnvVar = "AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026" + +var enableFromEnv = sync.OnceValue(func() bool { + return os.Getenv(enableReadTimeoutEnvVar) == "true" +}) + +// GetServiceReadTimeout reports the SDK's default read timeout for a service, +// and whether one applies. +func GetServiceReadTimeout(serviceID string) (time.Duration, bool) { + if enableReadTimeout2026 { + if !readTimeout2026Rollout[serviceID] { + return 0, false + } + } else if !enableFromEnv() { + return 0, false + } + + ms, ok := serviceInactivityTimeoutMillis[serviceID] + if !ok { + return DefaultReadTimeout, true + } + if ms < 0 { + return 0, false + } + + return time.Duration(ms) * time.Millisecond, true +} diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/timeouts_services.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/timeouts_services.go new file mode 100644 index 0000000000..216a5895aa --- /dev/null +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/timeouts/timeouts_services.go @@ -0,0 +1,102 @@ +// Code generated from the connection read timeout risk mitigation +// document's exemption table. DO NOT EDIT. + +package timeouts + +// serviceInactivityTimeoutMillis overrides the default read timeout for +// services whose operations legitimately hold a connection open, keyed by +// ServiceID. A negative value means the service is fully exempt and gets no +// timeout. +// +// Services absent from this map get DefaultReadTimeout. +var serviceInactivityTimeoutMillis = map[string]int64{ + // Fully exempt: an operation takes an event stream or a streaming blob as + // input. The caller controls how long the request takes, and no response + // arrives until it finishes, so a read timeout would fire on the duration of + // the caller's own upload rather than on a network problem. + "Bedrock Runtime": -1, + "CloudSearch Domain": -1, + "ConnectHealth": -1, + "EBS": -1, + "Glacier": -1, + "Lambda": -1, + "Lex Runtime Service": -1, + "Lex Runtime V2": -1, + "MediaStore Data": -1, + "Omics": -1, + "Polly": -1, + "QBusiness": -1, + "S3": -1, + "SageMaker Runtime HTTP2": -1, + "Transcribe Streaming": -1, + "codeartifact": -1, + + // Long-hold operations: a higher ceiling rather than no ceiling. + "API Gateway": 900000, + "ApiGatewayV2": 900000, + "AppIntegrations": 900000, + "AppStream": 900000, + "Athena": 900000, + "Auto Scaling": 900000, + "Batch": 900000, + "Bedrock": 900000, + "Bedrock Agent": 900000, + "Bedrock Agent Runtime": 900000, + "Bedrock AgentCore": 900000, + "Bedrock AgentCore Control": 900000, + "Bedrock Data Automation Runtime": 900000, + "CloudFormation": 900000, + "CloudWatch": 900000, + "CodeBuild": 900000, + "CodeCatalyst": 900000, + "CodeDeploy": 900000, + "Config Service": 900000, + "Connect": 900000, + "Data Pipeline": 900000, + "DataBrew": 900000, + "DataExchange": 900000, + "DataZone": 900000, + "Device Farm": 900000, + "EC2": 900000, + "ECS": 900000, + "EMR Serverless": 900000, + "Elastic Load Balancing v2": 900000, + "GameLift": 900000, + "GameLiftStreams": 900000, + "Glue": 900000, + "IoT": 900000, + "IoT Data Plane": 900000, + "IoT Jobs Data Plane": 900000, + "IoTSecureTunneling": 900000, + "Kinesis": 900000, + "Kinesis Analytics V2": 900000, + "Kinesis Video Archived Media": 900000, + "Kinesis Video Media": 900000, + "Kinesis Video Signaling": 900000, + "Kinesis Video WebRTC Storage": 900000, + "Lex Model Building Service": 900000, + "Lex Models V2": 900000, + "Neptune Graph": 900000, + "Nova Act": 900000, + "QApps": 900000, + "QConnect": 900000, + "QuickSight": 900000, + "RDS": 900000, + "RDS Data": 900000, + "RTBFabric": 900000, + "SFN": 900000, + "SQS": 900000, + "SSM": 900000, + "SWF": 900000, + "SageMaker": 900000, + "SageMaker Runtime": 900000, + "SagemakerJobRuntime": 900000, + "Storage Gateway": 900000, + "Timestream Query": 900000, + "Wisdom": 900000, + "WorkSpaces": 900000, + "WorkSpaces Web": 900000, + "b2bi": 900000, + "mgn": 900000, + "neptunedata": 900000, +} diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.md index fecf8ec482..1898b4251a 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.md @@ -1,3 +1,58 @@ +# v1.5.2 (2026-09-04) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.41 (2026-08-26) + +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.40 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.39 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.38 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.37 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.36 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.35 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.4.34 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.4.33 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.4.32 (2026-07-21) * **Dependency Update**: Updated to the latest SDK module versions diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.go index cd7be2fd2f..f33821d7d2 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.go @@ -3,4 +3,4 @@ package v4a // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.4.32" +const goModuleVersion = "1.5.2" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.md index 33bb210356..6723895d1a 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.md @@ -1,3 +1,27 @@ +# v1.13.19 (2026-08-26) + +* **Dependency Update**: Update to smithy-go v1.28.0. + +# v1.13.18 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. + +# v1.13.17 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. + +# v1.13.16 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. + +# v1.13.15 (2026-07-31.2) + +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.13.14 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. + # v1.13.13 (2026-07-01) * No change notes available for this release. diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.go index b02fbce7f2..f5bc392a46 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.go @@ -3,4 +3,4 @@ package acceptencoding // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.13.13" +const goModuleVersion = "1.13.19" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.md index 5294029806..aa69a09311 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.md @@ -1,3 +1,58 @@ +# v1.14.2 (2026-09-04) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.14.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.14.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.13.40 (2026-08-26) + +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.13.39 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.13.38 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.13.37 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.13.36 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.13.35 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.13.34 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.13.33 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.13.32 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.13.31 (2026-07-21) * **Dependency Update**: Updated to the latest SDK module versions diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.go index d180642c34..bdb98c425f 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.go @@ -3,4 +3,4 @@ package presignedurl // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.13.31" +const goModuleVersion = "1.14.2" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/CHANGELOG.md index 567df5ba93..ad01cf92ef 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/CHANGELOG.md @@ -1,3 +1,55 @@ +# v1.57.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.57.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.56.0 (2026-08-26) + +* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`. +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.55.8 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.55.7 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.55.6 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.55.5 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.55.4 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.55.3 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.55.2 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.55.1 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.55.0 (2026-07-21) * **Feature**: Add an option to clients to disable clock skew diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_client.go index fe287b64e7..cefa00ed5e 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_client.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_client.go @@ -15,6 +15,7 @@ import ( internalauth "github.com/aws/aws-sdk-go-v2/internal/auth" internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy" internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources" + "github.com/aws/aws-sdk-go-v2/internal/timeouts" smithy "github.com/aws/smithy-go" smithydocument "github.com/aws/smithy-go/document" "github.com/aws/smithy-go/logging" @@ -260,6 +261,10 @@ func (c *Client) invokeOperation( finalizeClientEndpointResolverOptions(&options) + ctx = setLoggerContext(ctx, options, opID) + + ctx = resolveServiceMetadata(ctx, options, opID) + if err := c.addCommonMiddlewares(stack, options, opID); err != nil { return nil, metadata, err } @@ -376,9 +381,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addProtocolFinalizerMiddlewares(stack, options, operation); err != nil { return fmt.Errorf("add protocol finalizers: %v", err) } - if err := addSetLoggerMiddleware(stack, options); err != nil { - return err - } if err := addClientRequestID(stack); err != nil { return err } @@ -431,30 +433,6 @@ func resolveAuthSchemes(options *Options) { type noSmithyDocumentSerde = smithydocument.NoSerde -type legacyEndpointContextSetter struct { - LegacyResolver EndpointResolver -} - -func (*legacyEndpointContextSetter) ID() string { - return "legacyEndpointContextSetter" -} - -func (m *legacyEndpointContextSetter) HandleInitialize(ctx context.Context, in middleware.InitializeInput, next middleware.InitializeHandler) ( - out middleware.InitializeOutput, metadata middleware.Metadata, err error, -) { - if m.LegacyResolver != nil { - ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) - } - - return next.HandleInitialize(ctx, in) - -} -func addlegacyEndpointContextSetter(stack *middleware.Stack, o Options) error { - return stack.Initialize.Add(&legacyEndpointContextSetter{ - LegacyResolver: o.EndpointResolver, - }, middleware.Before) -} - func resolveDefaultLogger(o *Options) { if o.Logger != nil { return @@ -462,8 +440,9 @@ func resolveDefaultLogger(o *Options) { o.Logger = logging.Nop{} } -func addSetLoggerMiddleware(stack *middleware.Stack, o Options) error { - return middleware.AddSetLoggerMiddleware(stack, o.Logger) +func setLoggerContext(ctx context.Context, options Options, operation string) context.Context { + _ = operation + return middleware.SetLogger(ctx, options.Logger) } func setResolvedDefaultsMode(o *Options) { @@ -542,6 +521,12 @@ func resolveHTTPClient(o *Options) { }) } + if _, ok := buildable.GetReadTimeout(); !ok { + if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok { + buildable = buildable.WithReadTimeout(timeout) + } + } + o.HTTPClient = buildable } @@ -683,10 +668,6 @@ func addClientRequestID(stack *middleware.Stack) error { return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After) } -func addComputeContentLength(stack *middleware.Stack) error { - return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After) -} - func addRawResponseToMetadata(stack *middleware.Stack) error { return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before) } @@ -868,12 +849,16 @@ func resolveMeterProvider(options *Options) { } } -func newServiceMetadataMiddleware(region, operation string) *awsmiddleware.RegisterServiceMetadata { - return &awsmiddleware.RegisterServiceMetadata{ - Region: region, - ServiceID: ServiceID, - OperationName: operation, +func resolveServiceMetadata(ctx context.Context, options Options, operation string) context.Context { + ctx = awsmiddleware.SetServiceID(ctx, ServiceID) + if options.Region != "" { + ctx = awsmiddleware.SetRegion(ctx, options.Region) + } + ctx = awsmiddleware.SetOperationName(ctx, operation) + if options.EndpointResolver != nil { + ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) } + return ctx } func addRecursionDetection(stack *middleware.Stack) error { diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CancelKeyDeletion.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CancelKeyDeletion.go index 2f5a62809f..ca123d50ba 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CancelKeyDeletion.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CancelKeyDeletion.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Cancels the deletion of a KMS key. When this operation succeeds, the key state @@ -90,12 +89,6 @@ func (c *Client) addOperationCancelKeyDeletionMiddlewares(stack *middleware.Stac return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -105,21 +98,12 @@ func (c *Client) addOperationCancelKeyDeletionMiddlewares(stack *middleware.Stac if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCancelKeyDeletionValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CancelKeyDeletion"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ConnectCustomKeyStore.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ConnectCustomKeyStore.go index 807eb28c15..6c1dd562f6 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ConnectCustomKeyStore.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ConnectCustomKeyStore.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Connects or reconnects a [custom key store] to its backing key store. For an CloudHSM key store, @@ -143,12 +142,6 @@ func (c *Client) addOperationConnectCustomKeyStoreMiddlewares(stack *middleware. return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -158,21 +151,12 @@ func (c *Client) addOperationConnectCustomKeyStoreMiddlewares(stack *middleware. if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpConnectCustomKeyStoreValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ConnectCustomKeyStore"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateAlias.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateAlias.go index 915984b8b2..b41599a047 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateAlias.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateAlias.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Creates a friendly name for a KMS key. @@ -143,12 +142,6 @@ func (c *Client) addOperationCreateAliasMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -158,21 +151,12 @@ func (c *Client) addOperationCreateAliasMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCreateAliasValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CreateAlias"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateCustomKeyStore.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateCustomKeyStore.go index 51b6e9664c..8e7468da55 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateCustomKeyStore.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateCustomKeyStore.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Creates a [custom key store] backed by a key store that you own and manage. When you use a KMS @@ -294,12 +293,6 @@ func (c *Client) addOperationCreateCustomKeyStoreMiddlewares(stack *middleware.S return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -309,21 +302,12 @@ func (c *Client) addOperationCreateCustomKeyStoreMiddlewares(stack *middleware.S if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCreateCustomKeyStoreValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CreateCustomKeyStore"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateGrant.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateGrant.go index 8628b8cd82..620365ae30 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateGrant.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateGrant.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Adds a grant to a KMS key. @@ -293,12 +292,6 @@ func (c *Client) addOperationCreateGrantMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -308,21 +301,12 @@ func (c *Client) addOperationCreateGrantMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCreateGrantValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CreateGrant"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateKey.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateKey.go index e9015fe683..c891dad4c4 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateKey.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_CreateKey.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Creates a unique customer managed [KMS key] in your Amazon Web Services account and @@ -528,12 +527,6 @@ func (c *Client) addOperationCreateKeyMiddlewares(stack *middleware.Stack, optio return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -543,21 +536,12 @@ func (c *Client) addOperationCreateKeyMiddlewares(stack *middleware.Stack, optio if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCreateKeyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CreateKey"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Decrypt.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Decrypt.go index 9c107f109d..1af33568ce 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Decrypt.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Decrypt.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Decrypts ciphertext that was encrypted by a KMS key using any of the following @@ -289,12 +288,6 @@ func (c *Client) addOperationDecryptMiddlewares(stack *middleware.Stack, options return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -304,18 +297,9 @@ func (c *Client) addOperationDecryptMiddlewares(stack *middleware.Stack, options if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "Decrypt"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteAlias.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteAlias.go index 0db9946484..b47efa15c8 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteAlias.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteAlias.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Deletes the specified alias. @@ -93,12 +92,6 @@ func (c *Client) addOperationDeleteAliasMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -108,21 +101,12 @@ func (c *Client) addOperationDeleteAliasMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDeleteAliasValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DeleteAlias"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteCustomKeyStore.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteCustomKeyStore.go index 0b7906721a..e10cfec2d5 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteCustomKeyStore.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteCustomKeyStore.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Deletes a [custom key store]. This operation does not affect any backing elements of the custom @@ -109,12 +108,6 @@ func (c *Client) addOperationDeleteCustomKeyStoreMiddlewares(stack *middleware.S return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -124,21 +117,12 @@ func (c *Client) addOperationDeleteCustomKeyStoreMiddlewares(stack *middleware.S if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDeleteCustomKeyStoreValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DeleteCustomKeyStore"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteImportedKeyMaterial.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteImportedKeyMaterial.go index 36c66b91d1..13539f9120 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteImportedKeyMaterial.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeleteImportedKeyMaterial.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Deletes key material that was previously imported. This operation makes the @@ -120,12 +119,6 @@ func (c *Client) addOperationDeleteImportedKeyMaterialMiddlewares(stack *middlew return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -135,21 +128,12 @@ func (c *Client) addOperationDeleteImportedKeyMaterialMiddlewares(stack *middlew if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDeleteImportedKeyMaterialValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DeleteImportedKeyMaterial"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeriveSharedSecret.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeriveSharedSecret.go index f70c812f85..47ea670438 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeriveSharedSecret.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DeriveSharedSecret.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Derives a shared secret using a key agreement algorithm. @@ -268,12 +267,6 @@ func (c *Client) addOperationDeriveSharedSecretMiddlewares(stack *middleware.Sta return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -283,21 +276,12 @@ func (c *Client) addOperationDeriveSharedSecretMiddlewares(stack *middleware.Sta if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDeriveSharedSecretValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DeriveSharedSecret"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DescribeCustomKeyStores.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DescribeCustomKeyStores.go index 1e53df8ef7..57ab3a4ecd 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DescribeCustomKeyStores.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DescribeCustomKeyStores.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Gets information about [custom key stores] in the account and Region. @@ -144,12 +143,6 @@ func (c *Client) addOperationDescribeCustomKeyStoresMiddlewares(stack *middlewar return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -159,18 +152,9 @@ func (c *Client) addOperationDescribeCustomKeyStoresMiddlewares(stack *middlewar if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DescribeCustomKeyStores"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DescribeKey.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DescribeKey.go index e94423c58b..dc967d9706 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DescribeKey.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DescribeKey.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Provides detailed information about a KMS key. You can run DescribeKey on a [customer managed key] or @@ -156,12 +155,6 @@ func (c *Client) addOperationDescribeKeyMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -171,21 +164,12 @@ func (c *Client) addOperationDescribeKeyMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDescribeKeyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DescribeKey"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisableKey.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisableKey.go index 96383943c6..7afb158dd8 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisableKey.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisableKey.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Sets the state of a KMS key to disabled. This change temporarily prevents use @@ -82,12 +81,6 @@ func (c *Client) addOperationDisableKeyMiddlewares(stack *middleware.Stack, opti return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -97,21 +90,12 @@ func (c *Client) addOperationDisableKeyMiddlewares(stack *middleware.Stack, opti if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDisableKeyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DisableKey"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisableKeyRotation.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisableKeyRotation.go index e8b4ebc319..91470a0170 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisableKeyRotation.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisableKeyRotation.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Disables [automatic rotation of the key material] of the specified symmetric encryption KMS key. @@ -114,12 +113,6 @@ func (c *Client) addOperationDisableKeyRotationMiddlewares(stack *middleware.Sta return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -129,21 +122,12 @@ func (c *Client) addOperationDisableKeyRotationMiddlewares(stack *middleware.Sta if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDisableKeyRotationValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DisableKeyRotation"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisconnectCustomKeyStore.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisconnectCustomKeyStore.go index dcae2c878b..df7cf7f2b7 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisconnectCustomKeyStore.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_DisconnectCustomKeyStore.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Disconnects the [custom key store] from its backing key store. This operation disconnects an @@ -98,12 +97,6 @@ func (c *Client) addOperationDisconnectCustomKeyStoreMiddlewares(stack *middlewa return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -113,21 +106,12 @@ func (c *Client) addOperationDisconnectCustomKeyStoreMiddlewares(stack *middlewa if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDisconnectCustomKeyStoreValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DisconnectCustomKeyStore"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_EnableKey.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_EnableKey.go index e084acac2f..260ed65a90 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_EnableKey.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_EnableKey.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Sets the key state of a KMS key to enabled. This allows you to use the KMS key @@ -81,12 +80,6 @@ func (c *Client) addOperationEnableKeyMiddlewares(stack *middleware.Stack, optio return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -96,21 +89,12 @@ func (c *Client) addOperationEnableKeyMiddlewares(stack *middleware.Stack, optio if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpEnableKeyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "EnableKey"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_EnableKeyRotation.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_EnableKeyRotation.go index 673588533e..1e47fdaf1f 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_EnableKeyRotation.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_EnableKeyRotation.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Enables [automatic rotation of the key material] of the specified symmetric encryption KMS key. @@ -153,12 +152,6 @@ func (c *Client) addOperationEnableKeyRotationMiddlewares(stack *middleware.Stac return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -168,21 +161,12 @@ func (c *Client) addOperationEnableKeyRotationMiddlewares(stack *middleware.Stac if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpEnableKeyRotationValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "EnableKeyRotation"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Encrypt.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Encrypt.go index 6797b33382..8de582a416 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Encrypt.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Encrypt.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Encrypts plaintext of up to 4,096 bytes using a KMS key. You can use a @@ -221,12 +220,6 @@ func (c *Client) addOperationEncryptMiddlewares(stack *middleware.Stack, options return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -236,21 +229,12 @@ func (c *Client) addOperationEncryptMiddlewares(stack *middleware.Stack, options if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpEncryptValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "Encrypt"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKey.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKey.go index 0705543bf0..e840686730 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKey.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKey.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a unique symmetric data key for use outside of KMS. This operation @@ -282,12 +281,6 @@ func (c *Client) addOperationGenerateDataKeyMiddlewares(stack *middleware.Stack, return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -297,21 +290,12 @@ func (c *Client) addOperationGenerateDataKeyMiddlewares(stack *middleware.Stack, if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGenerateDataKeyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GenerateDataKey"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyPair.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyPair.go index b7641d89a5..0c25c157a0 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyPair.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyPair.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a unique asymmetric data key pair for use outside of KMS. This @@ -282,12 +281,6 @@ func (c *Client) addOperationGenerateDataKeyPairMiddlewares(stack *middleware.St return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -297,21 +290,12 @@ func (c *Client) addOperationGenerateDataKeyPairMiddlewares(stack *middleware.St if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGenerateDataKeyPairValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GenerateDataKeyPair"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyPairWithoutPlaintext.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyPairWithoutPlaintext.go index fc0d1bdcbf..57e2f39029 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyPairWithoutPlaintext.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyPairWithoutPlaintext.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a unique asymmetric data key pair for use outside of KMS. This @@ -205,12 +204,6 @@ func (c *Client) addOperationGenerateDataKeyPairWithoutPlaintextMiddlewares(stac return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -220,21 +213,12 @@ func (c *Client) addOperationGenerateDataKeyPairWithoutPlaintextMiddlewares(stac if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGenerateDataKeyPairWithoutPlaintextValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GenerateDataKeyPairWithoutPlaintext"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyWithoutPlaintext.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyWithoutPlaintext.go index 51a7425e1e..a1d405f1b6 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyWithoutPlaintext.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateDataKeyWithoutPlaintext.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a unique symmetric data key for use outside of KMS. This operation @@ -204,12 +203,6 @@ func (c *Client) addOperationGenerateDataKeyWithoutPlaintextMiddlewares(stack *m return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -219,21 +212,12 @@ func (c *Client) addOperationGenerateDataKeyWithoutPlaintextMiddlewares(stack *m if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGenerateDataKeyWithoutPlaintextValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GenerateDataKeyWithoutPlaintext"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateMac.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateMac.go index 8365512b91..b305047db5 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateMac.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateMac.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Generates a hash-based message authentication code (HMAC) for a message using @@ -146,12 +145,6 @@ func (c *Client) addOperationGenerateMacMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -161,21 +154,12 @@ func (c *Client) addOperationGenerateMacMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGenerateMacValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GenerateMac"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateRandom.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateRandom.go index fd5d922a17..b4f4bd3a85 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateRandom.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GenerateRandom.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a random byte string that is cryptographically secure. @@ -137,12 +136,6 @@ func (c *Client) addOperationGenerateRandomMiddlewares(stack *middleware.Stack, return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -152,18 +145,9 @@ func (c *Client) addOperationGenerateRandomMiddlewares(stack *middleware.Stack, if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GenerateRandom"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyLastUsage.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyLastUsage.go index 68f5f03f1a..4b590f7127 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyLastUsage.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyLastUsage.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" "time" ) @@ -136,12 +135,6 @@ func (c *Client) addOperationGetKeyLastUsageMiddlewares(stack *middleware.Stack, return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -151,21 +144,12 @@ func (c *Client) addOperationGetKeyLastUsageMiddlewares(stack *middleware.Stack, if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetKeyLastUsageValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetKeyLastUsage"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyPolicy.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyPolicy.go index a81ba45a31..988ac98cfa 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyPolicy.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyPolicy.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Gets a key policy attached to the specified KMS key. @@ -88,12 +87,6 @@ func (c *Client) addOperationGetKeyPolicyMiddlewares(stack *middleware.Stack, op return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -103,21 +96,12 @@ func (c *Client) addOperationGetKeyPolicyMiddlewares(stack *middleware.Stack, op if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetKeyPolicyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetKeyPolicy"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyRotationStatus.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyRotationStatus.go index 656012950b..3886626376 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyRotationStatus.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetKeyRotationStatus.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" "time" ) @@ -156,12 +155,6 @@ func (c *Client) addOperationGetKeyRotationStatusMiddlewares(stack *middleware.S return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -171,21 +164,12 @@ func (c *Client) addOperationGetKeyRotationStatusMiddlewares(stack *middleware.S if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetKeyRotationStatusValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetKeyRotationStatus"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetParametersForImport.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetParametersForImport.go index 6c101e0de3..dc25dfc8ad 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetParametersForImport.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetParametersForImport.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" "time" ) @@ -206,12 +205,6 @@ func (c *Client) addOperationGetParametersForImportMiddlewares(stack *middleware return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -221,21 +214,12 @@ func (c *Client) addOperationGetParametersForImportMiddlewares(stack *middleware if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetParametersForImportValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetParametersForImport"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetPublicKey.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetPublicKey.go index 2cd6c90669..e274a088a5 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetPublicKey.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_GetPublicKey.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns the public key of an asymmetric KMS key. Unlike the private key of a @@ -197,12 +196,6 @@ func (c *Client) addOperationGetPublicKeyMiddlewares(stack *middleware.Stack, op return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -212,21 +205,12 @@ func (c *Client) addOperationGetPublicKeyMiddlewares(stack *middleware.Stack, op if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetPublicKeyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetPublicKey"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ImportKeyMaterial.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ImportKeyMaterial.go index d54aa8ddfd..7fc2a42450 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ImportKeyMaterial.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ImportKeyMaterial.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" "time" ) @@ -291,12 +290,6 @@ func (c *Client) addOperationImportKeyMaterialMiddlewares(stack *middleware.Stac return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -306,21 +299,12 @@ func (c *Client) addOperationImportKeyMaterialMiddlewares(stack *middleware.Stac if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpImportKeyMaterialValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ImportKeyMaterial"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListAliases.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListAliases.go index cc6485f693..75dbca19ca 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListAliases.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListAliases.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Gets a list of aliases in the caller's Amazon Web Services account and region. @@ -132,12 +131,6 @@ func (c *Client) addOperationListAliasesMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -147,18 +140,9 @@ func (c *Client) addOperationListAliasesMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListAliases"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListGrants.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListGrants.go index 5c5a9567c9..83acf5a5af 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListGrants.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListGrants.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Gets a list of all grants for the specified KMS key. @@ -154,12 +153,6 @@ func (c *Client) addOperationListGrantsMiddlewares(stack *middleware.Stack, opti return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -169,21 +162,12 @@ func (c *Client) addOperationListGrantsMiddlewares(stack *middleware.Stack, opti if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpListGrantsValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListGrants"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeyPolicies.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeyPolicies.go index e24d0645ea..1f81ad74c9 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeyPolicies.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeyPolicies.go @@ -6,7 +6,6 @@ import ( "context" "fmt" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Gets the names of the key policies that are attached to a KMS key. This @@ -112,12 +111,6 @@ func (c *Client) addOperationListKeyPoliciesMiddlewares(stack *middleware.Stack, return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -127,21 +120,12 @@ func (c *Client) addOperationListKeyPoliciesMiddlewares(stack *middleware.Stack, if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpListKeyPoliciesValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListKeyPolicies"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeyRotations.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeyRotations.go index e0f20f3fac..93d73760b1 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeyRotations.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeyRotations.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns information about the key materials associated with the specified KMS @@ -136,12 +135,6 @@ func (c *Client) addOperationListKeyRotationsMiddlewares(stack *middleware.Stack return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -151,21 +144,12 @@ func (c *Client) addOperationListKeyRotationsMiddlewares(stack *middleware.Stack if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpListKeyRotationsValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListKeyRotations"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeys.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeys.go index f4492c0c3b..a6a6c77912 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeys.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListKeys.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Gets a list of all KMS keys in the caller's Amazon Web Services account and @@ -97,12 +96,6 @@ func (c *Client) addOperationListKeysMiddlewares(stack *middleware.Stack, option return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -112,18 +105,9 @@ func (c *Client) addOperationListKeysMiddlewares(stack *middleware.Stack, option if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListKeys"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListResourceTags.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListResourceTags.go index b67ca90f96..6aa78b1096 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListResourceTags.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListResourceTags.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns all tags on the specified KMS key. @@ -128,12 +127,6 @@ func (c *Client) addOperationListResourceTagsMiddlewares(stack *middleware.Stack return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -143,21 +136,12 @@ func (c *Client) addOperationListResourceTagsMiddlewares(stack *middleware.Stack if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpListResourceTagsValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListResourceTags"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListRetirableGrants.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListRetirableGrants.go index ec03fe682c..a9404dbaf1 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListRetirableGrants.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ListRetirableGrants.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns information about all grants in the Amazon Web Services account and @@ -145,12 +144,6 @@ func (c *Client) addOperationListRetirableGrantsMiddlewares(stack *middleware.St return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -160,18 +153,9 @@ func (c *Client) addOperationListRetirableGrantsMiddlewares(stack *middleware.St if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListRetirableGrants"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_PutKeyPolicy.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_PutKeyPolicy.go index 111e5964af..047fdcd42e 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_PutKeyPolicy.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_PutKeyPolicy.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Attaches a key policy to the specified KMS key. @@ -156,12 +155,6 @@ func (c *Client) addOperationPutKeyPolicyMiddlewares(stack *middleware.Stack, op return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -171,21 +164,12 @@ func (c *Client) addOperationPutKeyPolicyMiddlewares(stack *middleware.Stack, op if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpPutKeyPolicyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "PutKeyPolicy"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ReEncrypt.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ReEncrypt.go index f3ac90907e..44d60f3ed0 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ReEncrypt.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ReEncrypt.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Decrypts ciphertext and then reencrypts it entirely within KMS. You can use @@ -333,12 +332,6 @@ func (c *Client) addOperationReEncryptMiddlewares(stack *middleware.Stack, optio return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -348,21 +341,12 @@ func (c *Client) addOperationReEncryptMiddlewares(stack *middleware.Stack, optio if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpReEncryptValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ReEncrypt"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ReplicateKey.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ReplicateKey.go index 07e47449a9..c4770b674f 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ReplicateKey.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ReplicateKey.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Replicates a multi-Region key into the specified Region. This operation creates @@ -286,12 +285,6 @@ func (c *Client) addOperationReplicateKeyMiddlewares(stack *middleware.Stack, op return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -301,21 +294,12 @@ func (c *Client) addOperationReplicateKeyMiddlewares(stack *middleware.Stack, op if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpReplicateKeyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ReplicateKey"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RetireGrant.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RetireGrant.go index b319eae26d..29c7850e76 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RetireGrant.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RetireGrant.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Deletes a grant. Typically, you retire a grant when you no longer need its @@ -114,12 +113,6 @@ func (c *Client) addOperationRetireGrantMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -129,18 +122,9 @@ func (c *Client) addOperationRetireGrantMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "RetireGrant"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RevokeGrant.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RevokeGrant.go index 0d8ec33c6d..5d32fb505d 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RevokeGrant.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RevokeGrant.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Deletes the specified grant. You revoke a grant to terminate the permissions @@ -114,12 +113,6 @@ func (c *Client) addOperationRevokeGrantMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -129,21 +122,12 @@ func (c *Client) addOperationRevokeGrantMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpRevokeGrantValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "RevokeGrant"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RotateKeyOnDemand.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RotateKeyOnDemand.go index 3e744a7753..17605b8d45 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RotateKeyOnDemand.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_RotateKeyOnDemand.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Immediately initiates rotation of the key material of the specified symmetric @@ -144,12 +143,6 @@ func (c *Client) addOperationRotateKeyOnDemandMiddlewares(stack *middleware.Stac return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -159,21 +152,12 @@ func (c *Client) addOperationRotateKeyOnDemandMiddlewares(stack *middleware.Stac if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpRotateKeyOnDemandValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "RotateKeyOnDemand"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ScheduleKeyDeletion.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ScheduleKeyDeletion.go index 2c1b82a664..8859033d81 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ScheduleKeyDeletion.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_ScheduleKeyDeletion.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" "time" ) @@ -168,12 +167,6 @@ func (c *Client) addOperationScheduleKeyDeletionMiddlewares(stack *middleware.St return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -183,21 +176,12 @@ func (c *Client) addOperationScheduleKeyDeletionMiddlewares(stack *middleware.St if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpScheduleKeyDeletionValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ScheduleKeyDeletion"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Sign.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Sign.go index e70c8f0b39..4733de60bb 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Sign.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Sign.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Creates a [digital signature] for a message or message digest by using the private key in an @@ -245,12 +244,6 @@ func (c *Client) addOperationSignMiddlewares(stack *middleware.Stack, options Op return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -260,21 +253,12 @@ func (c *Client) addOperationSignMiddlewares(stack *middleware.Stack, options Op if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpSignValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "Sign"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_TagResource.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_TagResource.go index 162ca4a1fd..b366929163 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_TagResource.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_TagResource.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Adds or edits tags on a [customer managed key]. @@ -125,12 +124,6 @@ func (c *Client) addOperationTagResourceMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -140,21 +133,12 @@ func (c *Client) addOperationTagResourceMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpTagResourceValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "TagResource"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UntagResource.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UntagResource.go index 6121b4b763..1f147b6db2 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UntagResource.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UntagResource.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Deletes tags from a [customer managed key]. To delete a tag, specify the tag key and the KMS key. @@ -108,12 +107,6 @@ func (c *Client) addOperationUntagResourceMiddlewares(stack *middleware.Stack, o return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -123,21 +116,12 @@ func (c *Client) addOperationUntagResourceMiddlewares(stack *middleware.Stack, o if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpUntagResourceValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "UntagResource"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateAlias.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateAlias.go index 6b7c4b1326..3642a2e9c8 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateAlias.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateAlias.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Associates an existing KMS alias with a different KMS key. Each alias is @@ -139,12 +138,6 @@ func (c *Client) addOperationUpdateAliasMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -154,21 +147,12 @@ func (c *Client) addOperationUpdateAliasMiddlewares(stack *middleware.Stack, opt if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpUpdateAliasValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "UpdateAlias"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateCustomKeyStore.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateCustomKeyStore.go index 301b2d35c1..2165ab380f 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateCustomKeyStore.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateCustomKeyStore.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Changes the properties of a custom key store. You can use this operation to @@ -257,12 +256,6 @@ func (c *Client) addOperationUpdateCustomKeyStoreMiddlewares(stack *middleware.S return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -272,21 +265,12 @@ func (c *Client) addOperationUpdateCustomKeyStoreMiddlewares(stack *middleware.S if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpUpdateCustomKeyStoreValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "UpdateCustomKeyStore"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateKeyDescription.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateKeyDescription.go index f38124250c..58da30b8f0 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateKeyDescription.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdateKeyDescription.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Updates the description of a KMS key. To see the description of a KMS key, use DescribeKey @@ -92,12 +91,6 @@ func (c *Client) addOperationUpdateKeyDescriptionMiddlewares(stack *middleware.S return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -107,21 +100,12 @@ func (c *Client) addOperationUpdateKeyDescriptionMiddlewares(stack *middleware.S if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpUpdateKeyDescriptionValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "UpdateKeyDescription"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdatePrimaryRegion.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdatePrimaryRegion.go index 0943769b2e..1f605550b9 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdatePrimaryRegion.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_UpdatePrimaryRegion.go @@ -5,7 +5,6 @@ package kms import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Changes the primary key of a multi-Region key. @@ -147,12 +146,6 @@ func (c *Client) addOperationUpdatePrimaryRegionMiddlewares(stack *middleware.St return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -162,21 +155,12 @@ func (c *Client) addOperationUpdatePrimaryRegionMiddlewares(stack *middleware.St if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpUpdatePrimaryRegionValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "UpdatePrimaryRegion"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Verify.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Verify.go index ed39ac34af..dd2b573429 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Verify.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_Verify.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Verifies a digital signature that was generated by the Sign operation. @@ -231,12 +230,6 @@ func (c *Client) addOperationVerifyMiddlewares(stack *middleware.Stack, options return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -246,21 +239,12 @@ func (c *Client) addOperationVerifyMiddlewares(stack *middleware.Stack, options if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpVerifyValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "Verify"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_VerifyMac.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_VerifyMac.go index 10dd84f442..e7d8bf0175 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_VerifyMac.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/api_op_VerifyMac.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/kms/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Verifies the hash-based message authentication code (HMAC) for a specified @@ -145,12 +144,6 @@ func (c *Client) addOperationVerifyMacMiddlewares(stack *middleware.Stack, optio return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -160,21 +153,12 @@ func (c *Client) addOperationVerifyMacMiddlewares(stack *middleware.Stack, optio if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpVerifyMacValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "VerifyMac"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/deserializers.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/deserializers.go index 7a4220e38b..5d6da84bff 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/deserializers.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/deserializers.go @@ -36,15 +36,18 @@ func (m *awsAwsjson11_deserializeOpCancelKeyDeletion) HandleDeserialize(ctx cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorCancelKeyDeletion(response, &metadata) } @@ -159,15 +162,18 @@ func (m *awsAwsjson11_deserializeOpConnectCustomKeyStore) HandleDeserialize(ctx return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorConnectCustomKeyStore(response, &metadata) } @@ -282,15 +288,18 @@ func (m *awsAwsjson11_deserializeOpCreateAlias) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorCreateAlias(response, &metadata) } @@ -389,15 +398,18 @@ func (m *awsAwsjson11_deserializeOpCreateCustomKeyStore) HandleDeserialize(ctx c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorCreateCustomKeyStore(response, &metadata) } @@ -548,15 +560,18 @@ func (m *awsAwsjson11_deserializeOpCreateGrant) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorCreateGrant(response, &metadata) } @@ -683,15 +698,18 @@ func (m *awsAwsjson11_deserializeOpCreateKey) HandleDeserialize(ctx context.Cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorCreateKey(response, &metadata) } @@ -830,15 +848,18 @@ func (m *awsAwsjson11_deserializeOpDecrypt) HandleDeserialize(ctx context.Contex return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDecrypt(response, &metadata) } @@ -971,15 +992,18 @@ func (m *awsAwsjson11_deserializeOpDeleteAlias) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDeleteAlias(response, &metadata) } @@ -1069,15 +1093,18 @@ func (m *awsAwsjson11_deserializeOpDeleteCustomKeyStore) HandleDeserialize(ctx c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDeleteCustomKeyStore(response, &metadata) } @@ -1189,15 +1216,18 @@ func (m *awsAwsjson11_deserializeOpDeleteImportedKeyMaterial) HandleDeserialize( return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDeleteImportedKeyMaterial(response, &metadata) } @@ -1315,15 +1345,18 @@ func (m *awsAwsjson11_deserializeOpDeriveSharedSecret) HandleDeserialize(ctx con return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDeriveSharedSecret(response, &metadata) } @@ -1450,15 +1483,18 @@ func (m *awsAwsjson11_deserializeOpDescribeCustomKeyStores) HandleDeserialize(ct return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDescribeCustomKeyStores(response, &metadata) } @@ -1567,15 +1603,18 @@ func (m *awsAwsjson11_deserializeOpDescribeKey) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDescribeKey(response, &metadata) } @@ -1687,15 +1726,18 @@ func (m *awsAwsjson11_deserializeOpDisableKey) HandleDeserialize(ctx context.Con return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDisableKey(response, &metadata) } @@ -1788,15 +1830,18 @@ func (m *awsAwsjson11_deserializeOpDisableKeyRotation) HandleDeserialize(ctx con return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDisableKeyRotation(response, &metadata) } @@ -1895,15 +1940,18 @@ func (m *awsAwsjson11_deserializeOpDisconnectCustomKeyStore) HandleDeserialize(c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorDisconnectCustomKeyStore(response, &metadata) } @@ -2012,15 +2060,18 @@ func (m *awsAwsjson11_deserializeOpEnableKey) HandleDeserialize(ctx context.Cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorEnableKey(response, &metadata) } @@ -2116,15 +2167,18 @@ func (m *awsAwsjson11_deserializeOpEnableKeyRotation) HandleDeserialize(ctx cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorEnableKeyRotation(response, &metadata) } @@ -2223,15 +2277,18 @@ func (m *awsAwsjson11_deserializeOpEncrypt) HandleDeserialize(ctx context.Contex return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorEncrypt(response, &metadata) } @@ -2358,15 +2415,18 @@ func (m *awsAwsjson11_deserializeOpGenerateDataKey) HandleDeserialize(ctx contex return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGenerateDataKey(response, &metadata) } @@ -2493,15 +2553,18 @@ func (m *awsAwsjson11_deserializeOpGenerateDataKeyPair) HandleDeserialize(ctx co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGenerateDataKeyPair(response, &metadata) } @@ -2631,15 +2694,18 @@ func (m *awsAwsjson11_deserializeOpGenerateDataKeyPairWithoutPlaintext) HandleDe return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGenerateDataKeyPairWithoutPlaintext(response, &metadata) } @@ -2769,15 +2835,18 @@ func (m *awsAwsjson11_deserializeOpGenerateDataKeyWithoutPlaintext) HandleDeseri return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGenerateDataKeyWithoutPlaintext(response, &metadata) } @@ -2904,15 +2973,18 @@ func (m *awsAwsjson11_deserializeOpGenerateMac) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGenerateMac(response, &metadata) } @@ -3036,15 +3108,18 @@ func (m *awsAwsjson11_deserializeOpGenerateRandom) HandleDeserialize(ctx context return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGenerateRandom(response, &metadata) } @@ -3159,17 +3234,20 @@ func (m *awsAwsjson11_deserializeOpGetKeyLastUsage) HandleDeserialize(ctx contex return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } - if response.StatusCode < 200 || response.StatusCode >= 300 { - return out, metadata, awsAwsjson11_deserializeOpErrorGetKeyLastUsage(response, &metadata) + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + + if response.StatusCode < 200 || response.StatusCode >= 300 { + return out, metadata, awsAwsjson11_deserializeOpErrorGetKeyLastUsage(response, &metadata) } output := &GetKeyLastUsageOutput{} out.Result = output @@ -3279,15 +3357,18 @@ func (m *awsAwsjson11_deserializeOpGetKeyPolicy) HandleDeserialize(ctx context.C return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGetKeyPolicy(response, &metadata) } @@ -3402,15 +3483,18 @@ func (m *awsAwsjson11_deserializeOpGetKeyRotationStatus) HandleDeserialize(ctx c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGetKeyRotationStatus(response, &metadata) } @@ -3528,15 +3612,18 @@ func (m *awsAwsjson11_deserializeOpGetParametersForImport) HandleDeserialize(ctx return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGetParametersForImport(response, &metadata) } @@ -3654,15 +3741,18 @@ func (m *awsAwsjson11_deserializeOpGetPublicKey) HandleDeserialize(ctx context.C return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorGetPublicKey(response, &metadata) } @@ -3792,15 +3882,18 @@ func (m *awsAwsjson11_deserializeOpImportKeyMaterial) HandleDeserialize(ctx cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorImportKeyMaterial(response, &metadata) } @@ -3930,15 +4023,18 @@ func (m *awsAwsjson11_deserializeOpListAliases) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorListAliases(response, &metadata) } @@ -4053,15 +4149,18 @@ func (m *awsAwsjson11_deserializeOpListGrants) HandleDeserialize(ctx context.Con return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorListGrants(response, &metadata) } @@ -4182,15 +4281,18 @@ func (m *awsAwsjson11_deserializeOpListKeyPolicies) HandleDeserialize(ctx contex return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorListKeyPolicies(response, &metadata) } @@ -4305,15 +4407,18 @@ func (m *awsAwsjson11_deserializeOpListKeyRotations) HandleDeserialize(ctx conte return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorListKeyRotations(response, &metadata) } @@ -4431,15 +4536,18 @@ func (m *awsAwsjson11_deserializeOpListKeys) HandleDeserialize(ctx context.Conte return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorListKeys(response, &metadata) } @@ -4548,15 +4656,18 @@ func (m *awsAwsjson11_deserializeOpListResourceTags) HandleDeserialize(ctx conte return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorListResourceTags(response, &metadata) } @@ -4668,15 +4779,18 @@ func (m *awsAwsjson11_deserializeOpListRetirableGrants) HandleDeserialize(ctx co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorListRetirableGrants(response, &metadata) } @@ -4791,15 +4905,18 @@ func (m *awsAwsjson11_deserializeOpPutKeyPolicy) HandleDeserialize(ctx context.C return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorPutKeyPolicy(response, &metadata) } @@ -4901,15 +5018,18 @@ func (m *awsAwsjson11_deserializeOpReEncrypt) HandleDeserialize(ctx context.Cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorReEncrypt(response, &metadata) } @@ -5042,15 +5162,18 @@ func (m *awsAwsjson11_deserializeOpReplicateKey) HandleDeserialize(ctx context.C return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorReplicateKey(response, &metadata) } @@ -5180,15 +5303,18 @@ func (m *awsAwsjson11_deserializeOpRetireGrant) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorRetireGrant(response, &metadata) } @@ -5290,15 +5416,18 @@ func (m *awsAwsjson11_deserializeOpRevokeGrant) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorRevokeGrant(response, &metadata) } @@ -5397,15 +5526,18 @@ func (m *awsAwsjson11_deserializeOpRotateKeyOnDemand) HandleDeserialize(ctx cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorRotateKeyOnDemand(response, &metadata) } @@ -5532,15 +5664,18 @@ func (m *awsAwsjson11_deserializeOpScheduleKeyDeletion) HandleDeserialize(ctx co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorScheduleKeyDeletion(response, &metadata) } @@ -5655,15 +5790,18 @@ func (m *awsAwsjson11_deserializeOpSign) HandleDeserialize(ctx context.Context, return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorSign(response, &metadata) } @@ -5790,15 +5928,18 @@ func (m *awsAwsjson11_deserializeOpTagResource) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorTagResource(response, &metadata) } @@ -5894,15 +6035,18 @@ func (m *awsAwsjson11_deserializeOpUntagResource) HandleDeserialize(ctx context. return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorUntagResource(response, &metadata) } @@ -5995,15 +6139,18 @@ func (m *awsAwsjson11_deserializeOpUpdateAlias) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorUpdateAlias(response, &metadata) } @@ -6096,15 +6243,18 @@ func (m *awsAwsjson11_deserializeOpUpdateCustomKeyStore) HandleDeserialize(ctx c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorUpdateCustomKeyStore(response, &metadata) } @@ -6255,15 +6405,18 @@ func (m *awsAwsjson11_deserializeOpUpdateKeyDescription) HandleDeserialize(ctx c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorUpdateKeyDescription(response, &metadata) } @@ -6356,15 +6509,18 @@ func (m *awsAwsjson11_deserializeOpUpdatePrimaryRegion) HandleDeserialize(ctx co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorUpdatePrimaryRegion(response, &metadata) } @@ -6460,15 +6616,18 @@ func (m *awsAwsjson11_deserializeOpVerify) HandleDeserialize(ctx context.Context return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorVerify(response, &metadata) } @@ -6598,15 +6757,18 @@ func (m *awsAwsjson11_deserializeOpVerifyMac) HandleDeserialize(ctx context.Cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsjson11_deserializeOpErrorVerifyMac(response, &metadata) } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/go_module_metadata.go index 8b88235851..4097bf630b 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/kms/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/kms/go_module_metadata.go @@ -3,4 +3,4 @@ package kms // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.55.0" +const goModuleVersion = "1.57.1" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.md index 627ee90ec3..1dec4a7f81 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.md @@ -1,3 +1,64 @@ +# v1.9.0 (2026-09-04) + +* **Feature**: Stop registering the `spanRetryLoop` middleware in generated clients. The retry loop's tracing span is now opened by the retry middleware itself. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.8.0 (2026-08-31.2) + +* **Feature**: Stop registering the `SetCredentialSourceMiddleware` middleware in generated clients. Credential source user agent features are now set when the client's middleware stack is constructed. + +# v1.7.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.7.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.6.0 (2026-08-26) + +* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`. +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.8 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.7 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.6 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.5 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.4 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.3 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.5.2 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.5.1 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.5.0 (2026-07-21) * **Feature**: Add an option to clients to disable clock skew diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.go index 2094f01d27..7e6b118fca 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.go @@ -16,6 +16,7 @@ import ( internalauth "github.com/aws/aws-sdk-go-v2/internal/auth" internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy" internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources" + "github.com/aws/aws-sdk-go-v2/internal/timeouts" smithy "github.com/aws/smithy-go" smithydocument "github.com/aws/smithy-go/document" "github.com/aws/smithy-go/logging" @@ -263,6 +264,10 @@ func (c *Client) invokeOperation( finalizeClientEndpointResolverOptions(&options) + ctx = setLoggerContext(ctx, options, opID) + + ctx = resolveServiceMetadata(ctx, options, opID) + if err := c.addCommonMiddlewares(stack, options, opID); err != nil { return nil, metadata, err } @@ -379,9 +384,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addProtocolFinalizerMiddlewares(stack, options, operation); err != nil { return fmt.Errorf("add protocol finalizers: %v", err) } - if err := addSetLoggerMiddleware(stack, options); err != nil { - return err - } if err := addClientRequestID(stack); err != nil { return err } @@ -391,9 +393,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addRawResponseToMetadata(stack); err != nil { return err } - if err := addSpanRetryLoop(stack, options); err != nil { - return err - } if err := addClientUserAgent(stack, options); err != nil { return err } @@ -434,30 +433,6 @@ func resolveAuthSchemes(options *Options) { type noSmithyDocumentSerde = smithydocument.NoSerde -type legacyEndpointContextSetter struct { - LegacyResolver EndpointResolver -} - -func (*legacyEndpointContextSetter) ID() string { - return "legacyEndpointContextSetter" -} - -func (m *legacyEndpointContextSetter) HandleInitialize(ctx context.Context, in middleware.InitializeInput, next middleware.InitializeHandler) ( - out middleware.InitializeOutput, metadata middleware.Metadata, err error, -) { - if m.LegacyResolver != nil { - ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) - } - - return next.HandleInitialize(ctx, in) - -} -func addlegacyEndpointContextSetter(stack *middleware.Stack, o Options) error { - return stack.Initialize.Add(&legacyEndpointContextSetter{ - LegacyResolver: o.EndpointResolver, - }, middleware.Before) -} - func resolveDefaultLogger(o *Options) { if o.Logger != nil { return @@ -465,8 +440,9 @@ func resolveDefaultLogger(o *Options) { o.Logger = logging.Nop{} } -func addSetLoggerMiddleware(stack *middleware.Stack, o Options) error { - return middleware.AddSetLoggerMiddleware(stack, o.Logger) +func setLoggerContext(ctx context.Context, options Options, operation string) context.Context { + _ = operation + return middleware.SetLogger(ctx, options.Logger) } func setResolvedDefaultsMode(o *Options) { @@ -545,6 +521,12 @@ func resolveHTTPClient(o *Options) { }) } + if _, ok := buildable.GetReadTimeout(); !ok { + if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok { + buildable = buildable.WithReadTimeout(timeout) + } + } + o.HTTPClient = buildable } @@ -686,10 +668,6 @@ func addClientRequestID(stack *middleware.Stack) error { return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After) } -func addComputeContentLength(stack *middleware.Stack) error { - return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After) -} - func addRawResponseToMetadata(stack *middleware.Stack) error { return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before) } @@ -699,30 +677,6 @@ func addRecordResponseTiming(stack *middleware.Stack, options Options) error { DisableClockSkewCorrection: options.DisableClockSkewCorrection, }, middleware.After) } - -func addSpanRetryLoop(stack *middleware.Stack, options Options) error { - return stack.Finalize.Insert(&spanRetryLoop{options: options}, "Retry", middleware.Before) -} - -type spanRetryLoop struct { - options Options -} - -func (*spanRetryLoop) ID() string { - return "spanRetryLoop" -} - -func (m *spanRetryLoop) HandleFinalize( - ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler, -) ( - middleware.FinalizeOutput, middleware.Metadata, error, -) { - tracer := operationTracer(m.options.TracerProvider) - ctx, span := tracer.StartSpan(ctx, "RetryLoop") - defer span.End() - - return next.HandleFinalize(ctx, in) -} func addStreamingEventsPayload(stack *middleware.Stack) error { return stack.Finalize.Add(&v4.StreamingEventsPayload{}, middleware.Before) } @@ -835,35 +789,21 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error { return nil } -type setCredentialSourceMiddleware struct { - ua *awsmiddleware.RequestUserAgent - options Options -} - -func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" } - -func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) ( - out middleware.BuildOutput, metadata middleware.Metadata, err error, -) { - asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource) - if !ok { - return next.HandleBuild(ctx, in) - } - providerSources := asProviderSource.ProviderSources() - for _, source := range providerSources { - m.ua.AddCredentialsSource(source) - } - return next.HandleBuild(ctx, in) -} - func addCredentialSource(stack *middleware.Stack, options Options) error { ua, err := getOrAddRequestUserAgent(stack) if err != nil { return err } - mw := setCredentialSourceMiddleware{ua: ua, options: options} - return stack.Build.Insert(&mw, "UserAgent", middleware.Before) + asProviderSource, ok := options.Credentials.(aws.CredentialProviderSource) + if !ok { + return nil + } + + for _, source := range asProviderSource.ProviderSources() { + ua.AddCredentialsSource(source) + } + return nil } func resolveTracerProvider(options *Options) { @@ -883,12 +823,16 @@ type IdempotencyTokenProvider interface { GetIdempotencyToken() (string, error) } -func newServiceMetadataMiddleware(region, operation string) *awsmiddleware.RegisterServiceMetadata { - return &awsmiddleware.RegisterServiceMetadata{ - Region: region, - ServiceID: ServiceID, - OperationName: operation, +func resolveServiceMetadata(ctx context.Context, options Options, operation string) context.Context { + ctx = awsmiddleware.SetServiceID(ctx, ServiceID) + if options.Region != "" { + ctx = awsmiddleware.SetRegion(ctx, options.Region) + } + ctx = awsmiddleware.SetOperationName(ctx, operation) + if options.EndpointResolver != nil { + ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) } + return ctx } func addRecursionDetection(stack *middleware.Stack) error { diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.go index 00bec7fb7e..d58473ac8d 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.go @@ -7,7 +7,6 @@ import ( "github.com/aws/aws-sdk-go-v2/service/signin/types" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // CreateOAuth2Token API @@ -117,33 +116,18 @@ func (c *Client) addOperationCreateOAuth2TokenMiddlewares(stack *middleware.Stac return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCreateOAuth2TokenValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CreateOAuth2Token"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2TokenWithIAM.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2TokenWithIAM.go index f66701cd3d..ee19239b25 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2TokenWithIAM.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2TokenWithIAM.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Grants permission to exchange client credentials for an OAuth 2.0 access token @@ -85,12 +84,6 @@ func (c *Client) addOperationCreateOAuth2TokenWithIAMMiddlewares(stack *middlewa return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -100,21 +93,12 @@ func (c *Client) addOperationCreateOAuth2TokenWithIAMMiddlewares(stack *middlewa if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCreateOAuth2TokenWithIAMValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CreateOAuth2TokenWithIAM"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_DeleteConsoleAuthorizationConfiguration.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_DeleteConsoleAuthorizationConfiguration.go index 749157c227..0471b9c569 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_DeleteConsoleAuthorizationConfiguration.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_DeleteConsoleAuthorizationConfiguration.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Delete console authorization configuration with automatic scope detection @@ -73,12 +72,6 @@ func (c *Client) addOperationDeleteConsoleAuthorizationConfigurationMiddlewares( return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -88,18 +81,9 @@ func (c *Client) addOperationDeleteConsoleAuthorizationConfigurationMiddlewares( if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DeleteConsoleAuthorizationConfiguration"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_DeleteResourcePermissionStatement.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_DeleteResourcePermissionStatement.go index d76325ff80..513a82481d 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_DeleteResourcePermissionStatement.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_DeleteResourcePermissionStatement.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Remove a permission statement from the account's SignIn resource-based policy @@ -63,12 +62,6 @@ func (c *Client) addOperationDeleteResourcePermissionStatementMiddlewares(stack return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -78,12 +71,6 @@ func (c *Client) addOperationDeleteResourcePermissionStatementMiddlewares(stack if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } @@ -93,9 +80,6 @@ func (c *Client) addOperationDeleteResourcePermissionStatementMiddlewares(stack if err = addOpDeleteResourcePermissionStatementValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DeleteResourcePermissionStatement"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_GetConsoleAuthorizationConfiguration.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_GetConsoleAuthorizationConfiguration.go index 74a927da1b..90498a68c1 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_GetConsoleAuthorizationConfiguration.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_GetConsoleAuthorizationConfiguration.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Get console authorization configuration with automatic scope detection @@ -73,12 +72,6 @@ func (c *Client) addOperationGetConsoleAuthorizationConfigurationMiddlewares(sta return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -88,18 +81,9 @@ func (c *Client) addOperationGetConsoleAuthorizationConfigurationMiddlewares(sta if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetConsoleAuthorizationConfiguration"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_GetResourcePolicy.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_GetResourcePolicy.go index 4ee0d496ad..087ff167f5 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_GetResourcePolicy.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_GetResourcePolicy.go @@ -7,7 +7,6 @@ import ( "github.com/aws/aws-sdk-go-v2/service/signin/types" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Retrieve the account's consolidated SignIn resource-based policy @@ -60,12 +59,6 @@ func (c *Client) addOperationGetResourcePolicyMiddlewares(stack *middleware.Stac return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -75,18 +68,9 @@ func (c *Client) addOperationGetResourcePolicyMiddlewares(stack *middleware.Stac if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetResourcePolicy"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_IntrospectOAuth2TokenWithIAM.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_IntrospectOAuth2TokenWithIAM.go index 610390995d..a2894eca9b 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_IntrospectOAuth2TokenWithIAM.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_IntrospectOAuth2TokenWithIAM.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Grants permission to inspect the metadata and state of an OAuth 2.0 access @@ -135,12 +134,6 @@ func (c *Client) addOperationIntrospectOAuth2TokenWithIAMMiddlewares(stack *midd return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -150,21 +143,12 @@ func (c *Client) addOperationIntrospectOAuth2TokenWithIAMMiddlewares(stack *midd if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpIntrospectOAuth2TokenWithIAMValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "IntrospectOAuth2TokenWithIAM"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_ListResourcePermissionStatements.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_ListResourcePermissionStatements.go index 2cb7c5c67f..22d0b58a91 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_ListResourcePermissionStatements.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_ListResourcePermissionStatements.go @@ -8,7 +8,6 @@ import ( "github.com/aws/aws-sdk-go-v2/service/signin/types" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Retrieve all permission statements in the account's SignIn resource-based policy @@ -71,12 +70,6 @@ func (c *Client) addOperationListResourcePermissionStatementsMiddlewares(stack * return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -86,18 +79,9 @@ func (c *Client) addOperationListResourcePermissionStatementsMiddlewares(stack * if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListResourcePermissionStatements"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_PutConsoleAuthorizationConfiguration.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_PutConsoleAuthorizationConfiguration.go index 7f2bc68ada..ab698a339f 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_PutConsoleAuthorizationConfiguration.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_PutConsoleAuthorizationConfiguration.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Enable console authorization configuration with automatic scope detection @@ -73,12 +72,6 @@ func (c *Client) addOperationPutConsoleAuthorizationConfigurationMiddlewares(sta return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -88,18 +81,9 @@ func (c *Client) addOperationPutConsoleAuthorizationConfigurationMiddlewares(sta if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "PutConsoleAuthorizationConfiguration"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_PutResourcePermissionStatement.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_PutResourcePermissionStatement.go index 071e1fb506..7013ae576d 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_PutResourcePermissionStatement.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_PutResourcePermissionStatement.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Create a permission statement in the account's SignIn resource-based policy @@ -86,12 +85,6 @@ func (c *Client) addOperationPutResourcePermissionStatementMiddlewares(stack *mi return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -101,21 +94,12 @@ func (c *Client) addOperationPutResourcePermissionStatementMiddlewares(stack *mi if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addIdempotencyToken_opPutResourcePermissionStatementMiddleware(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "PutResourcePermissionStatement"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_RevokeOAuth2TokenWithIAM.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_RevokeOAuth2TokenWithIAM.go index 3524e1eccd..366d76c493 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_RevokeOAuth2TokenWithIAM.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_RevokeOAuth2TokenWithIAM.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/smithy-go/middleware" "github.com/aws/smithy-go/ptr" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Grants permission to revoke an OAuth 2.0 refresh token and its associated @@ -73,12 +72,6 @@ func (c *Client) addOperationRevokeOAuth2TokenWithIAMMiddlewares(stack *middlewa return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -88,21 +81,12 @@ func (c *Client) addOperationRevokeOAuth2TokenWithIAMMiddlewares(stack *middlewa if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpRevokeOAuth2TokenWithIAMValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "RevokeOAuth2TokenWithIAM"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/deserializers.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/deserializers.go index e78be3229e..cc6b07d95c 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/deserializers.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/deserializers.go @@ -34,15 +34,18 @@ func (m *awsRestjson1_deserializeOpCreateOAuth2Token) HandleDeserialize(ctx cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorCreateOAuth2Token(response, &metadata) } @@ -195,15 +198,18 @@ func (m *awsRestjson1_deserializeOpCreateOAuth2TokenWithIAM) HandleDeserialize(c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorCreateOAuth2TokenWithIAM(response, &metadata) } @@ -382,15 +388,18 @@ func (m *awsRestjson1_deserializeOpDeleteConsoleAuthorizationConfiguration) Hand return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorDeleteConsoleAuthorizationConfiguration(response, &metadata) } @@ -568,15 +577,18 @@ func (m *awsRestjson1_deserializeOpDeleteResourcePermissionStatement) HandleDese return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorDeleteResourcePermissionStatement(response, &metadata) } @@ -668,15 +680,18 @@ func (m *awsRestjson1_deserializeOpGetConsoleAuthorizationConfiguration) HandleD return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorGetConsoleAuthorizationConfiguration(response, &metadata) } @@ -854,15 +869,18 @@ func (m *awsRestjson1_deserializeOpGetResourcePolicy) HandleDeserialize(ctx cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorGetResourcePolicy(response, &metadata) } @@ -1015,15 +1033,18 @@ func (m *awsRestjson1_deserializeOpIntrospectOAuth2TokenWithIAM) HandleDeseriali return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorIntrospectOAuth2TokenWithIAM(response, &metadata) } @@ -1309,15 +1330,18 @@ func (m *awsRestjson1_deserializeOpListResourcePermissionStatements) HandleDeser return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorListResourcePermissionStatements(response, &metadata) } @@ -1482,15 +1506,18 @@ func (m *awsRestjson1_deserializeOpPutConsoleAuthorizationConfiguration) HandleD return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorPutConsoleAuthorizationConfiguration(response, &metadata) } @@ -1671,15 +1698,18 @@ func (m *awsRestjson1_deserializeOpPutResourcePermissionStatement) HandleDeseria return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorPutResourcePermissionStatement(response, &metadata) } @@ -1842,15 +1872,18 @@ func (m *awsRestjson1_deserializeOpRevokeOAuth2TokenWithIAM) HandleDeserialize(c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorRevokeOAuth2TokenWithIAM(response, &metadata) } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.go index c430df151f..2d9419f90a 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.go @@ -3,4 +3,4 @@ package signin // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.5.0" +const goModuleVersion = "1.9.0" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.md index f9f09bb018..0d77694906 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.md @@ -1,3 +1,64 @@ +# v1.37.0 (2026-09-04) + +* **Feature**: Stop registering the `spanRetryLoop` middleware in generated clients. The retry loop's tracing span is now opened by the retry middleware itself. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.36.0 (2026-08-31.2) + +* **Feature**: Stop registering the `SetCredentialSourceMiddleware` middleware in generated clients. Credential source user agent features are now set when the client's middleware stack is constructed. + +# v1.35.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.35.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.34.0 (2026-08-26) + +* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`. +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.8 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.7 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.6 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.5 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.4 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.3 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.33.2 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.33.1 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.33.0 (2026-07-21) * **Feature**: Add an option to clients to disable clock skew diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.go index 76b3527d35..c9c116145b 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.go @@ -15,6 +15,7 @@ import ( internalauth "github.com/aws/aws-sdk-go-v2/internal/auth" internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy" internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources" + "github.com/aws/aws-sdk-go-v2/internal/timeouts" smithy "github.com/aws/smithy-go" smithydocument "github.com/aws/smithy-go/document" "github.com/aws/smithy-go/logging" @@ -259,6 +260,10 @@ func (c *Client) invokeOperation( finalizeClientEndpointResolverOptions(&options) + ctx = setLoggerContext(ctx, options, opID) + + ctx = resolveServiceMetadata(ctx, options, opID) + if err := c.addCommonMiddlewares(stack, options, opID); err != nil { return nil, metadata, err } @@ -375,9 +380,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addProtocolFinalizerMiddlewares(stack, options, operation); err != nil { return fmt.Errorf("add protocol finalizers: %v", err) } - if err := addSetLoggerMiddleware(stack, options); err != nil { - return err - } if err := addClientRequestID(stack); err != nil { return err } @@ -387,9 +389,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addRawResponseToMetadata(stack); err != nil { return err } - if err := addSpanRetryLoop(stack, options); err != nil { - return err - } if err := addClientUserAgent(stack, options); err != nil { return err } @@ -430,30 +429,6 @@ func resolveAuthSchemes(options *Options) { type noSmithyDocumentSerde = smithydocument.NoSerde -type legacyEndpointContextSetter struct { - LegacyResolver EndpointResolver -} - -func (*legacyEndpointContextSetter) ID() string { - return "legacyEndpointContextSetter" -} - -func (m *legacyEndpointContextSetter) HandleInitialize(ctx context.Context, in middleware.InitializeInput, next middleware.InitializeHandler) ( - out middleware.InitializeOutput, metadata middleware.Metadata, err error, -) { - if m.LegacyResolver != nil { - ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) - } - - return next.HandleInitialize(ctx, in) - -} -func addlegacyEndpointContextSetter(stack *middleware.Stack, o Options) error { - return stack.Initialize.Add(&legacyEndpointContextSetter{ - LegacyResolver: o.EndpointResolver, - }, middleware.Before) -} - func resolveDefaultLogger(o *Options) { if o.Logger != nil { return @@ -461,8 +436,9 @@ func resolveDefaultLogger(o *Options) { o.Logger = logging.Nop{} } -func addSetLoggerMiddleware(stack *middleware.Stack, o Options) error { - return middleware.AddSetLoggerMiddleware(stack, o.Logger) +func setLoggerContext(ctx context.Context, options Options, operation string) context.Context { + _ = operation + return middleware.SetLogger(ctx, options.Logger) } func setResolvedDefaultsMode(o *Options) { @@ -541,6 +517,12 @@ func resolveHTTPClient(o *Options) { }) } + if _, ok := buildable.GetReadTimeout(); !ok { + if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok { + buildable = buildable.WithReadTimeout(timeout) + } + } + o.HTTPClient = buildable } @@ -682,10 +664,6 @@ func addClientRequestID(stack *middleware.Stack) error { return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After) } -func addComputeContentLength(stack *middleware.Stack) error { - return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After) -} - func addRawResponseToMetadata(stack *middleware.Stack) error { return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before) } @@ -695,30 +673,6 @@ func addRecordResponseTiming(stack *middleware.Stack, options Options) error { DisableClockSkewCorrection: options.DisableClockSkewCorrection, }, middleware.After) } - -func addSpanRetryLoop(stack *middleware.Stack, options Options) error { - return stack.Finalize.Insert(&spanRetryLoop{options: options}, "Retry", middleware.Before) -} - -type spanRetryLoop struct { - options Options -} - -func (*spanRetryLoop) ID() string { - return "spanRetryLoop" -} - -func (m *spanRetryLoop) HandleFinalize( - ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler, -) ( - middleware.FinalizeOutput, middleware.Metadata, error, -) { - tracer := operationTracer(m.options.TracerProvider) - ctx, span := tracer.StartSpan(ctx, "RetryLoop") - defer span.End() - - return next.HandleFinalize(ctx, in) -} func addStreamingEventsPayload(stack *middleware.Stack) error { return stack.Finalize.Add(&v4.StreamingEventsPayload{}, middleware.Before) } @@ -824,35 +778,21 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error { return nil } -type setCredentialSourceMiddleware struct { - ua *awsmiddleware.RequestUserAgent - options Options -} - -func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" } - -func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) ( - out middleware.BuildOutput, metadata middleware.Metadata, err error, -) { - asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource) - if !ok { - return next.HandleBuild(ctx, in) - } - providerSources := asProviderSource.ProviderSources() - for _, source := range providerSources { - m.ua.AddCredentialsSource(source) - } - return next.HandleBuild(ctx, in) -} - func addCredentialSource(stack *middleware.Stack, options Options) error { ua, err := getOrAddRequestUserAgent(stack) if err != nil { return err } - mw := setCredentialSourceMiddleware{ua: ua, options: options} - return stack.Build.Insert(&mw, "UserAgent", middleware.Before) + asProviderSource, ok := options.Credentials.(aws.CredentialProviderSource) + if !ok { + return nil + } + + for _, source := range asProviderSource.ProviderSources() { + ua.AddCredentialsSource(source) + } + return nil } func resolveTracerProvider(options *Options) { @@ -867,12 +807,16 @@ func resolveMeterProvider(options *Options) { } } -func newServiceMetadataMiddleware(region, operation string) *awsmiddleware.RegisterServiceMetadata { - return &awsmiddleware.RegisterServiceMetadata{ - Region: region, - ServiceID: ServiceID, - OperationName: operation, +func resolveServiceMetadata(ctx context.Context, options Options, operation string) context.Context { + ctx = awsmiddleware.SetServiceID(ctx, ServiceID) + if options.Region != "" { + ctx = awsmiddleware.SetRegion(ctx, options.Region) + } + ctx = awsmiddleware.SetOperationName(ctx, operation) + if options.EndpointResolver != nil { + ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) } + return ctx } func addRecursionDetection(stack *middleware.Stack) error { diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.go index cefc88ad8e..b26651c439 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/sso/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns the STS short-term credentials for a given role name that is assigned @@ -70,33 +69,18 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetRoleCredentialsValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetRoleCredentials"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.go index c766f1c44e..38fee5926c 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/sso/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Lists all roles that are assigned to the user for a given AWS account. @@ -76,33 +75,18 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpListAccountRolesValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListAccountRoles"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.go index e8af94746c..342aa88e31 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.go @@ -7,7 +7,6 @@ import ( "fmt" "github.com/aws/aws-sdk-go-v2/service/sso/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Lists all AWS accounts assigned to the user. These AWS accounts are assigned by @@ -75,33 +74,18 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpListAccountsValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "ListAccounts"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.go index 2f38f944e1..44d1c57d5a 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.go @@ -5,7 +5,6 @@ package sso import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Removes the locally stored SSO tokens from the client-side cache and sends an @@ -69,33 +68,18 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpLogoutValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "Logout"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/deserializers.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/deserializers.go index bfa1758c8a..dbc691c49e 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/deserializers.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/deserializers.go @@ -34,15 +34,18 @@ func (m *awsRestjson1_deserializeOpGetRoleCredentials) HandleDeserialize(ctx con return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorGetRoleCredentials(response, &metadata) } @@ -195,15 +198,18 @@ func (m *awsRestjson1_deserializeOpListAccountRoles) HandleDeserialize(ctx conte return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorListAccountRoles(response, &metadata) } @@ -365,15 +371,18 @@ func (m *awsRestjson1_deserializeOpListAccounts) HandleDeserialize(ctx context.C return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorListAccounts(response, &metadata) } @@ -535,15 +544,18 @@ func (m *awsRestjson1_deserializeOpLogout) HandleDeserialize(ctx context.Context return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorLogout(response, &metadata) } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.go index 37c3e625a6..1d431586d4 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.go @@ -3,4 +3,4 @@ package sso // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.33.0" +const goModuleVersion = "1.37.0" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.md index f4c8658d93..825e43780d 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.md @@ -1,3 +1,64 @@ +# v1.42.0 (2026-09-04) + +* **Feature**: Stop registering the `spanRetryLoop` middleware in generated clients. The retry loop's tracing span is now opened by the retry middleware itself. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.41.0 (2026-08-31.2) + +* **Feature**: Stop registering the `SetCredentialSourceMiddleware` middleware in generated clients. Credential source user agent features are now set when the client's middleware stack is constructed. + +# v1.40.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.40.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.39.0 (2026-08-26) + +* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`. +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.38.8 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.38.7 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.38.6 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.38.5 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.38.4 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.38.3 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.38.2 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.38.1 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.38.0 (2026-07-21) * **Feature**: Add an option to clients to disable clock skew diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.go index 0ab277871b..fe70ec69db 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.go @@ -15,6 +15,7 @@ import ( internalauth "github.com/aws/aws-sdk-go-v2/internal/auth" internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy" internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources" + "github.com/aws/aws-sdk-go-v2/internal/timeouts" smithy "github.com/aws/smithy-go" smithydocument "github.com/aws/smithy-go/document" "github.com/aws/smithy-go/logging" @@ -259,6 +260,10 @@ func (c *Client) invokeOperation( finalizeClientEndpointResolverOptions(&options) + ctx = setLoggerContext(ctx, options, opID) + + ctx = resolveServiceMetadata(ctx, options, opID) + if err := c.addCommonMiddlewares(stack, options, opID); err != nil { return nil, metadata, err } @@ -375,9 +380,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addProtocolFinalizerMiddlewares(stack, options, operation); err != nil { return fmt.Errorf("add protocol finalizers: %v", err) } - if err := addSetLoggerMiddleware(stack, options); err != nil { - return err - } if err := addClientRequestID(stack); err != nil { return err } @@ -387,9 +389,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addRawResponseToMetadata(stack); err != nil { return err } - if err := addSpanRetryLoop(stack, options); err != nil { - return err - } if err := addClientUserAgent(stack, options); err != nil { return err } @@ -430,30 +429,6 @@ func resolveAuthSchemes(options *Options) { type noSmithyDocumentSerde = smithydocument.NoSerde -type legacyEndpointContextSetter struct { - LegacyResolver EndpointResolver -} - -func (*legacyEndpointContextSetter) ID() string { - return "legacyEndpointContextSetter" -} - -func (m *legacyEndpointContextSetter) HandleInitialize(ctx context.Context, in middleware.InitializeInput, next middleware.InitializeHandler) ( - out middleware.InitializeOutput, metadata middleware.Metadata, err error, -) { - if m.LegacyResolver != nil { - ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) - } - - return next.HandleInitialize(ctx, in) - -} -func addlegacyEndpointContextSetter(stack *middleware.Stack, o Options) error { - return stack.Initialize.Add(&legacyEndpointContextSetter{ - LegacyResolver: o.EndpointResolver, - }, middleware.Before) -} - func resolveDefaultLogger(o *Options) { if o.Logger != nil { return @@ -461,8 +436,9 @@ func resolveDefaultLogger(o *Options) { o.Logger = logging.Nop{} } -func addSetLoggerMiddleware(stack *middleware.Stack, o Options) error { - return middleware.AddSetLoggerMiddleware(stack, o.Logger) +func setLoggerContext(ctx context.Context, options Options, operation string) context.Context { + _ = operation + return middleware.SetLogger(ctx, options.Logger) } func setResolvedDefaultsMode(o *Options) { @@ -541,6 +517,12 @@ func resolveHTTPClient(o *Options) { }) } + if _, ok := buildable.GetReadTimeout(); !ok { + if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok { + buildable = buildable.WithReadTimeout(timeout) + } + } + o.HTTPClient = buildable } @@ -682,10 +664,6 @@ func addClientRequestID(stack *middleware.Stack) error { return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After) } -func addComputeContentLength(stack *middleware.Stack) error { - return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After) -} - func addRawResponseToMetadata(stack *middleware.Stack) error { return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before) } @@ -695,30 +673,6 @@ func addRecordResponseTiming(stack *middleware.Stack, options Options) error { DisableClockSkewCorrection: options.DisableClockSkewCorrection, }, middleware.After) } - -func addSpanRetryLoop(stack *middleware.Stack, options Options) error { - return stack.Finalize.Insert(&spanRetryLoop{options: options}, "Retry", middleware.Before) -} - -type spanRetryLoop struct { - options Options -} - -func (*spanRetryLoop) ID() string { - return "spanRetryLoop" -} - -func (m *spanRetryLoop) HandleFinalize( - ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler, -) ( - middleware.FinalizeOutput, middleware.Metadata, error, -) { - tracer := operationTracer(m.options.TracerProvider) - ctx, span := tracer.StartSpan(ctx, "RetryLoop") - defer span.End() - - return next.HandleFinalize(ctx, in) -} func addStreamingEventsPayload(stack *middleware.Stack) error { return stack.Finalize.Add(&v4.StreamingEventsPayload{}, middleware.Before) } @@ -824,35 +778,21 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error { return nil } -type setCredentialSourceMiddleware struct { - ua *awsmiddleware.RequestUserAgent - options Options -} - -func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" } - -func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) ( - out middleware.BuildOutput, metadata middleware.Metadata, err error, -) { - asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource) - if !ok { - return next.HandleBuild(ctx, in) - } - providerSources := asProviderSource.ProviderSources() - for _, source := range providerSources { - m.ua.AddCredentialsSource(source) - } - return next.HandleBuild(ctx, in) -} - func addCredentialSource(stack *middleware.Stack, options Options) error { ua, err := getOrAddRequestUserAgent(stack) if err != nil { return err } - mw := setCredentialSourceMiddleware{ua: ua, options: options} - return stack.Build.Insert(&mw, "UserAgent", middleware.Before) + asProviderSource, ok := options.Credentials.(aws.CredentialProviderSource) + if !ok { + return nil + } + + for _, source := range asProviderSource.ProviderSources() { + ua.AddCredentialsSource(source) + } + return nil } func resolveTracerProvider(options *Options) { @@ -867,12 +807,16 @@ func resolveMeterProvider(options *Options) { } } -func newServiceMetadataMiddleware(region, operation string) *awsmiddleware.RegisterServiceMetadata { - return &awsmiddleware.RegisterServiceMetadata{ - Region: region, - ServiceID: ServiceID, - OperationName: operation, +func resolveServiceMetadata(ctx context.Context, options Options, operation string) context.Context { + ctx = awsmiddleware.SetServiceID(ctx, ServiceID) + if options.Region != "" { + ctx = awsmiddleware.SetRegion(ctx, options.Region) + } + ctx = awsmiddleware.SetOperationName(ctx, operation) + if options.EndpointResolver != nil { + ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) } + return ctx } func addRecursionDetection(stack *middleware.Stack) error { diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.go index bba750bc70..a770ccb54f 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.go @@ -5,7 +5,6 @@ package ssooidc import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Creates and returns access and refresh tokens for clients that are @@ -140,33 +139,18 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCreateTokenValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CreateToken"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.go index 2c6de5a839..a7a7d76182 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/ssooidc/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Creates and returns access and refresh tokens for authorized client @@ -184,12 +183,6 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -199,21 +192,12 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpCreateTokenWithIAMValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "CreateTokenWithIAM"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.go index 2df6cba224..cdb1c3cfa9 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.go @@ -5,7 +5,6 @@ package ssooidc import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Registers a public client with IAM Identity Center. This allows clients to @@ -111,33 +110,18 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack, return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpRegisterClientValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "RegisterClient"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.go index 232ff802eb..3cec46e23a 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.go @@ -5,7 +5,6 @@ package ssooidc import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Initiates device authorization by requesting a pair of verification codes from @@ -93,33 +92,18 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpStartDeviceAuthorizationValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "StartDeviceAuthorization"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/deserializers.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/deserializers.go index fb9a0df519..da4a9e2f54 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/deserializers.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/deserializers.go @@ -34,15 +34,18 @@ func (m *awsRestjson1_deserializeOpCreateToken) HandleDeserialize(ctx context.Co return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorCreateToken(response, &metadata) } @@ -260,15 +263,18 @@ func (m *awsRestjson1_deserializeOpCreateTokenWithIAM) HandleDeserialize(ctx con return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorCreateTokenWithIAM(response, &metadata) } @@ -508,15 +514,18 @@ func (m *awsRestjson1_deserializeOpRegisterClient) HandleDeserialize(ctx context return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorRegisterClient(response, &metadata) } @@ -735,15 +744,18 @@ func (m *awsRestjson1_deserializeOpStartDeviceAuthorization) HandleDeserialize(c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsRestjson1_deserializeOpErrorStartDeviceAuthorization(response, &metadata) } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.go index cbe02320ac..7ba5425695 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.go @@ -3,4 +3,4 @@ package ssooidc // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.38.0" +const goModuleVersion = "1.42.0" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md index 6082149d1f..0d4187d36a 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md @@ -1,3 +1,64 @@ +# v1.49.0 (2026-09-04) + +* **Feature**: Stop registering the `spanRetryLoop` middleware in generated clients. The retry loop's tracing span is now opened by the retry middleware itself. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.48.0 (2026-08-31.2) + +* **Feature**: Stop registering the `SetCredentialSourceMiddleware` middleware in generated clients. Credential source user agent features are now set when the client's middleware stack is constructed. + +# v1.47.1 (2026-08-28) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.47.0 (2026-08-27) + +* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.46.0 (2026-08-26) + +* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`. +* **Dependency Update**: Update to smithy-go v1.28.0. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.45.8 (2026-08-25) + +* **Dependency Update**: Update to smithy-go v1.27.10. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.45.7 (2026-08-20) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.45.6 (2026-08-14) + +* **Dependency Update**: Update to smithy-go v1.27.8. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.45.5 (2026-08-10) + +* **Dependency Update**: Update to smithy-go v1.27.7. +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.45.4 (2026-08-05) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.45.3 (2026-07-31.2) + +* **Dependency Update**: Updated to the latest SDK module versions +* **Dependency Update**: Upgrade to smithy-go v1.27.6 to fix various serde issues in HTTP binding services. + +# v1.45.2 (2026-07-29) + +* **Dependency Update**: Updated to the latest SDK module versions + +# v1.45.1 (2026-07-28) + +* **Dependency Update**: Update to smithy-go v1.27.5. +* **Dependency Update**: Updated to the latest SDK module versions + # v1.45.0 (2026-07-21) * **Feature**: Add an option to clients to disable clock skew diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.go index da6a5b3060..1bef7df642 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.go @@ -16,6 +16,7 @@ import ( internalauth "github.com/aws/aws-sdk-go-v2/internal/auth" internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy" internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources" + "github.com/aws/aws-sdk-go-v2/internal/timeouts" "github.com/aws/aws-sdk-go-v2/internal/v4a" acceptencodingcust "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding" presignedurlcust "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url" @@ -268,6 +269,10 @@ func (c *Client) invokeOperation( finalizeClientEndpointResolverOptions(&options) + ctx = setLoggerContext(ctx, options, opID) + + ctx = resolveServiceMetadata(ctx, options, opID) + if err := c.addCommonMiddlewares(stack, options, opID); err != nil { return nil, metadata, err } @@ -384,9 +389,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addProtocolFinalizerMiddlewares(stack, options, operation); err != nil { return fmt.Errorf("add protocol finalizers: %v", err) } - if err := addSetLoggerMiddleware(stack, options); err != nil { - return err - } if err := addClientRequestID(stack); err != nil { return err } @@ -396,9 +398,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options, if err := addRawResponseToMetadata(stack); err != nil { return err } - if err := addSpanRetryLoop(stack, options); err != nil { - return err - } if err := addClientUserAgent(stack, options); err != nil { return err } @@ -444,30 +443,6 @@ func resolveAuthSchemes(options *Options) { type noSmithyDocumentSerde = smithydocument.NoSerde -type legacyEndpointContextSetter struct { - LegacyResolver EndpointResolver -} - -func (*legacyEndpointContextSetter) ID() string { - return "legacyEndpointContextSetter" -} - -func (m *legacyEndpointContextSetter) HandleInitialize(ctx context.Context, in middleware.InitializeInput, next middleware.InitializeHandler) ( - out middleware.InitializeOutput, metadata middleware.Metadata, err error, -) { - if m.LegacyResolver != nil { - ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) - } - - return next.HandleInitialize(ctx, in) - -} -func addlegacyEndpointContextSetter(stack *middleware.Stack, o Options) error { - return stack.Initialize.Add(&legacyEndpointContextSetter{ - LegacyResolver: o.EndpointResolver, - }, middleware.Before) -} - func resolveDefaultLogger(o *Options) { if o.Logger != nil { return @@ -475,8 +450,9 @@ func resolveDefaultLogger(o *Options) { o.Logger = logging.Nop{} } -func addSetLoggerMiddleware(stack *middleware.Stack, o Options) error { - return middleware.AddSetLoggerMiddleware(stack, o.Logger) +func setLoggerContext(ctx context.Context, options Options, operation string) context.Context { + _ = operation + return middleware.SetLogger(ctx, options.Logger) } func setResolvedDefaultsMode(o *Options) { @@ -555,6 +531,12 @@ func resolveHTTPClient(o *Options) { }) } + if _, ok := buildable.GetReadTimeout(); !ok { + if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok { + buildable = buildable.WithReadTimeout(timeout) + } + } + o.HTTPClient = buildable } @@ -696,10 +678,6 @@ func addClientRequestID(stack *middleware.Stack) error { return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After) } -func addComputeContentLength(stack *middleware.Stack) error { - return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After) -} - func addRawResponseToMetadata(stack *middleware.Stack) error { return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before) } @@ -709,30 +687,6 @@ func addRecordResponseTiming(stack *middleware.Stack, options Options) error { DisableClockSkewCorrection: options.DisableClockSkewCorrection, }, middleware.After) } - -func addSpanRetryLoop(stack *middleware.Stack, options Options) error { - return stack.Finalize.Insert(&spanRetryLoop{options: options}, "Retry", middleware.Before) -} - -type spanRetryLoop struct { - options Options -} - -func (*spanRetryLoop) ID() string { - return "spanRetryLoop" -} - -func (m *spanRetryLoop) HandleFinalize( - ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler, -) ( - middleware.FinalizeOutput, middleware.Metadata, error, -) { - tracer := operationTracer(m.options.TracerProvider) - ctx, span := tracer.StartSpan(ctx, "RetryLoop") - defer span.End() - - return next.HandleFinalize(ctx, in) -} func addStreamingEventsPayload(stack *middleware.Stack) error { return stack.Finalize.Add(&v4.StreamingEventsPayload{}, middleware.Before) } @@ -858,35 +812,21 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error { return nil } -type setCredentialSourceMiddleware struct { - ua *awsmiddleware.RequestUserAgent - options Options -} - -func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" } - -func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) ( - out middleware.BuildOutput, metadata middleware.Metadata, err error, -) { - asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource) - if !ok { - return next.HandleBuild(ctx, in) - } - providerSources := asProviderSource.ProviderSources() - for _, source := range providerSources { - m.ua.AddCredentialsSource(source) - } - return next.HandleBuild(ctx, in) -} - func addCredentialSource(stack *middleware.Stack, options Options) error { ua, err := getOrAddRequestUserAgent(stack) if err != nil { return err } - mw := setCredentialSourceMiddleware{ua: ua, options: options} - return stack.Build.Insert(&mw, "UserAgent", middleware.Before) + asProviderSource, ok := options.Credentials.(aws.CredentialProviderSource) + if !ok { + return nil + } + + for _, source := range asProviderSource.ProviderSources() { + ua.AddCredentialsSource(source) + } + return nil } func finalizeSTSRetryableErrors(o *Options) { @@ -905,12 +845,16 @@ func resolveMeterProvider(options *Options) { } } -func newServiceMetadataMiddleware(region, operation string) *awsmiddleware.RegisterServiceMetadata { - return &awsmiddleware.RegisterServiceMetadata{ - Region: region, - ServiceID: ServiceID, - OperationName: operation, +func resolveServiceMetadata(ctx context.Context, options Options, operation string) context.Context { + ctx = awsmiddleware.SetServiceID(ctx, ServiceID) + if options.Region != "" { + ctx = awsmiddleware.SetRegion(ctx, options.Region) + } + ctx = awsmiddleware.SetOperationName(ctx, operation) + if options.EndpointResolver != nil { + ctx = awsmiddleware.SetRequiresLegacyEndpoints(ctx, true) } + return ctx } func addRecursionDetection(stack *middleware.Stack) error { diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go index d10f11a620..b1cd675601 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go @@ -7,7 +7,6 @@ import ( "github.com/aws/aws-sdk-go-v2/aws/signer/v4" "github.com/aws/aws-sdk-go-v2/service/sts/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a set of temporary security credentials that you can use to access @@ -422,12 +421,6 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -437,21 +430,12 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpAssumeRoleValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "AssumeRole"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.go index bd5bfdc224..10f16e1655 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/sts/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a set of temporary security credentials for users who have been @@ -360,33 +359,18 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpAssumeRoleWithSAMLValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "AssumeRoleWithSAML"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.go index 6f6ea05b5e..97f51b8be7 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/sts/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a set of temporary security credentials for users who have been @@ -377,33 +376,18 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpAssumeRoleWithWebIdentityValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "AssumeRoleWithWebIdentity"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.go index 92aee49080..8946a9bb95 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/sts/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a set of short term credentials you can use to perform privileged tasks @@ -131,12 +130,6 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -146,21 +139,12 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpAssumeRootValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "AssumeRoot"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.go index e3294e3241..41b3fe02f1 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.go @@ -5,7 +5,6 @@ package sts import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Decodes additional information about the authorization status of a request from @@ -91,12 +90,6 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -106,21 +99,12 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpDecodeAuthorizationMessageValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "DecodeAuthorizationMessage"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go index 4d1dbed59d..da652ff1c7 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go @@ -5,7 +5,6 @@ package sts import ( "context" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns the account identifier for the specified access key ID. @@ -82,12 +81,6 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -97,21 +90,12 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetAccessKeyInfoValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetAccessKeyInfo"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.go index 8901bef2c4..56dbdbf574 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/aws/signer/v4" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns details about the IAM user or role whose credentials are used to call @@ -73,12 +72,6 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -88,18 +81,9 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetCallerIdentity"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.go index f013cb9330..33370240ff 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/sts/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Exchanges a trade-in token for temporary Amazon Web Services credentials with @@ -71,12 +70,6 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -86,21 +79,12 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetDelegatedAccessTokenValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetDelegatedAccessToken"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go index fbee53221e..09e7ab30b7 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/sts/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a set of temporary security credentials (consisting of an access key @@ -295,12 +294,6 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -310,21 +303,12 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetFederationTokenValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetFederationToken"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.go index 6b5c8ed171..ce0b895668 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/sts/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" ) // Returns a set of temporary credentials for an Amazon Web Services account or @@ -144,12 +143,6 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack, return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -159,18 +152,9 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack, if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetSessionToken"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.go index 1c45a28e73..b36723d475 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.go @@ -6,7 +6,6 @@ import ( "context" "github.com/aws/aws-sdk-go-v2/service/sts/types" "github.com/aws/smithy-go/middleware" - smithyhttp "github.com/aws/smithy-go/transport/http" "time" ) @@ -94,12 +93,6 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St return err } - if err = addlegacyEndpointContextSetter(stack, options); err != nil { - return err - } - if err = addComputeContentLength(stack); err != nil { - return err - } if err = addResolveEndpointMiddleware(stack, options); err != nil { return err } @@ -109,21 +102,12 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St if err = addRecordResponseTiming(stack, options); err != nil { return err } - if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil { - return err - } - if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil { - return err - } if err = addCredentialSource(stack, options); err != nil { return err } if err = addOpGetWebIdentityTokenValidationMiddleware(stack); err != nil { return err } - if err = stack.Initialize.Add(newServiceMetadataMiddleware(options.Region, "GetWebIdentityToken"), middleware.Before); err != nil { - return err - } if err = addRequestIDRetrieverMiddleware(stack); err != nil { return err } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/deserializers.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/deserializers.go index 8c1ce35161..45e073ffdc 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/deserializers.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/deserializers.go @@ -38,15 +38,18 @@ func (m *awsAwsquery_deserializeOpAssumeRole) HandleDeserialize(ctx context.Cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorAssumeRole(response, &metadata) } @@ -159,15 +162,18 @@ func (m *awsAwsquery_deserializeOpAssumeRoleWithSAML) HandleDeserialize(ctx cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorAssumeRoleWithSAML(response, &metadata) } @@ -286,15 +292,18 @@ func (m *awsAwsquery_deserializeOpAssumeRoleWithWebIdentity) HandleDeserialize(c return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorAssumeRoleWithWebIdentity(response, &metadata) } @@ -416,15 +425,18 @@ func (m *awsAwsquery_deserializeOpAssumeRoot) HandleDeserialize(ctx context.Cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorAssumeRoot(response, &metadata) } @@ -531,15 +543,18 @@ func (m *awsAwsquery_deserializeOpDecodeAuthorizationMessage) HandleDeserialize( return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorDecodeAuthorizationMessage(response, &metadata) } @@ -643,15 +658,18 @@ func (m *awsAwsquery_deserializeOpGetAccessKeyInfo) HandleDeserialize(ctx contex return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorGetAccessKeyInfo(response, &metadata) } @@ -752,15 +770,18 @@ func (m *awsAwsquery_deserializeOpGetCallerIdentity) HandleDeserialize(ctx conte return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorGetCallerIdentity(response, &metadata) } @@ -861,15 +882,18 @@ func (m *awsAwsquery_deserializeOpGetDelegatedAccessToken) HandleDeserialize(ctx return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorGetDelegatedAccessToken(response, &metadata) } @@ -979,15 +1003,18 @@ func (m *awsAwsquery_deserializeOpGetFederationToken) HandleDeserialize(ctx cont return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorGetFederationToken(response, &metadata) } @@ -1097,15 +1124,18 @@ func (m *awsAwsquery_deserializeOpGetSessionToken) HandleDeserialize(ctx context return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorGetSessionToken(response, &metadata) } @@ -1209,15 +1239,18 @@ func (m *awsAwsquery_deserializeOpGetWebIdentityToken) HandleDeserialize(ctx con return out, metadata, err } - _, span := tracing.StartSpan(ctx, "OperationDeserializer") - endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") - defer endTimer() - defer span.End() response, ok := out.RawResponse.(*smithyhttp.Response) if !ok { return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)} } + defer func() { smithyhttp.CloseResponseBody(ctx, response, false, err) }() + + _, span := tracing.StartSpan(ctx, "OperationDeserializer") + endTimer := startMetricTimer(ctx, "client.call.deserialization_duration") + defer endTimer() + defer span.End() + if response.StatusCode < 200 || response.StatusCode >= 300 { return out, metadata, awsAwsquery_deserializeOpErrorGetWebIdentityToken(response, &metadata) } diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go index fcea011075..64619a08bd 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go @@ -3,4 +3,4 @@ package sts // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.45.0" +const goModuleVersion = "1.49.0" diff --git a/vendor/github.com/aws/smithy-go/AGENTS.md b/vendor/github.com/aws/smithy-go/AGENTS.md index e2a75b8ea1..de1e3b2bbe 100644 --- a/vendor/github.com/aws/smithy-go/AGENTS.md +++ b/vendor/github.com/aws/smithy-go/AGENTS.md @@ -68,8 +68,9 @@ cd codegen && ./gradlew build cd codegen && ./gradlew publishToMavenLocal ``` -The codegen artifact version is fixed at `0.1.0` and is not published to -Maven Central — you **MUST** `publishToMavenLocal`. +The codegen artifact version is published to Maven Central and bumped on each +release. For local development against unreleased codegen changes, use +`publishToMavenLocal` and point consumers at `mavenLocal()`. ## Runtime architecture diff --git a/vendor/github.com/aws/smithy-go/CHANGELOG.md b/vendor/github.com/aws/smithy-go/CHANGELOG.md index 1c96bba237..0d26e973c5 100644 --- a/vendor/github.com/aws/smithy-go/CHANGELOG.md +++ b/vendor/github.com/aws/smithy-go/CHANGELOG.md @@ -1,3 +1,92 @@ +# Release (2026-08-26) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go`: v1.28.1 + * **Bug Fix**: Fix broken AddLogger middleware since its insert point was removed. + +# Release (2026-08-25.2) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go`: v1.28.0 + * **Feature**: Set `Content-Length` inline when the request body is set via `SetStream`. The `ComputeContentLength` middleware is now deprecated. + +# Release (2026-08-25) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go`: v1.27.10 + * **Bug Fix**: Fix a data race on the underlying writer when an event stream is closed while an event write is in flight. + * **Bug Fix**: Restore draining the HTTP response body in `CloseResponseBody` to avoid issues with TCP connection reuse. + +# Release (2026-08-21) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go`: v1.27.9 + * **Bug Fix**: Fix a generic event stream exception not carrying the error code and message from its payload. + * **Bug Fix**: Fix an event stream not being closed when its connection is lost, which would cause a caller writing to the stream to block indefinitely. + * **Bug Fix**: Fix deserialization of an empty list producing a nil slice instead of an empty one. + * **Bug Fix**: Restore draining the HTTP response body in `CloseResponseBody` to avoid issues with TCP connection reuse. + +# Release (2026-08-14) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go`: v1.27.8 + * **Bug Fix**: Restore draining the HTTP response body in `CloseResponseBody` to avoid issues with TCP connection reuse. + +# Release (2026-08-07) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go`: v1.27.7 + * **Bug Fix**: Don't serialize unset JSON documents as `nil` in structure members. + * **Bug Fix**: Fix a deserialization panic around collection members in recursive shape configs. + +# Release (2026-07-31) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go`: v1.27.6 + * **Bug Fix**: Fix failure to deserialize any `@httpPayload` struct with a non-string member. + * **Bug Fix**: Fix failure to serialize any `@httpPayload` struct with a nested struct. + +# Release (2026-07-27) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go`: v1.27.5 + * **Bug Fix**: Fix a performance issue in awsQuery with large response payloads. + +# Release (2026-07-16) + +## General Highlights +* **Dependency Update**: Updated to the latest SDK module versions + +## Module Highlights +* `github.com/aws/smithy-go/aws-http-auth`: [v1.2.1](aws-http-auth/CHANGELOG.md#v121-2026-07-16) + * **Bug Fix**: Use r.URL.Host when r.Host is unset. +* `github.com/aws/smithy-go/aws-http-auth-schemes`: [v1.0.0](aws-http-auth-schemes/CHANGELOG.md#v100-2026-07-16) + * **Release**: Module `github.com/aws/smithy-go/aws-http-auth-schemes` adds generic smithy-go client support for AWS Sigv4 and Sigv4a. + # Release (2026-06-26) ## General Highlights diff --git a/vendor/github.com/aws/smithy-go/README.md b/vendor/github.com/aws/smithy-go/README.md index c5e14564b4..ac5a0a6139 100644 --- a/vendor/github.com/aws/smithy-go/README.md +++ b/vendor/github.com/aws/smithy-go/README.md @@ -11,8 +11,8 @@ The smithy-go runtime requires a minimum version of Go 1.24. ## :warning: Client codegen is unstable The client code generator in this repository powers the aws-sdk-go-v2. -Arbitrary client generation, while technically possible, is in an early stage -of development: +Arbitrary client generation, while possible, is in an early stage of +development: * Generated clients are missing certain features that were originally implemented SDK-side (e.g. retries) @@ -32,8 +32,6 @@ This repository implements the following Smithy build plugins: | `go-server-codegen` | `software.amazon.smithy.go:smithy-go-codegen` | Implements Go server code generation for Smithy models. | | `go-shape-codegen` | `software.amazon.smithy.go:smithy-go-codegen` | Implements Go shape code generation (types only) for Smithy models. | -**NOTE: Build plugins are not currently published to mavenCentral. You must publish to mavenLocal to make the build plugins visible to the Smithy CLI. The artifact version is currently fixed at 0.1.0.** - ## `go-codegen` ### Configuration @@ -79,7 +77,7 @@ example created from `smithy init`: ], "maven": { "dependencies": [ - "software.amazon.smithy.go:smithy-go-codegen:0.1.0" + "software.amazon.smithy.go:smithy-go-codegen:[0.1.0,2.0)" ] }, "plugins": { diff --git a/vendor/github.com/aws/smithy-go/go_module_metadata.go b/vendor/github.com/aws/smithy-go/go_module_metadata.go index c9230c669d..c945a45db8 100644 --- a/vendor/github.com/aws/smithy-go/go_module_metadata.go +++ b/vendor/github.com/aws/smithy-go/go_module_metadata.go @@ -3,4 +3,4 @@ package smithy // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.27.3" +const goModuleVersion = "1.28.1" diff --git a/vendor/github.com/aws/smithy-go/schema.go b/vendor/github.com/aws/smithy-go/schema.go index 6293d34b1e..8e9c209a58 100644 --- a/vendor/github.com/aws/smithy-go/schema.go +++ b/vendor/github.com/aws/smithy-go/schema.go @@ -71,8 +71,9 @@ type Schema struct { directMask uint64 // bitmask: bit i set means indexed[i] was declared directly on this schema targetID ShapeID // for member schemas, the target's shape ID - listMember *Schema - mapKey, mapValue *Schema + // resolved on the fly and cached + listMember atomic.Pointer[Schema] + mapKey, mapValue atomic.Pointer[Schema] ext [numExtensionSlots]unsafe.Pointer // lazily-computed codec extensions, accessed atomically } @@ -126,9 +127,6 @@ func (s *Schema) AddMember(name string, target *Schema, ts ...Trait) *Schema { traits: cloneTraits(target.traits), directMask: 0, // inherited traits are not direct targetID: target.id, - listMember: target.listMember, - mapKey: target.mapKey, - mapValue: target.mapValue, } // member-declared traits override and are direct @@ -143,14 +141,6 @@ func (s *Schema) AddMember(name string, target *Schema, ts ...Trait) *Schema { atomic.StorePointer(&s.ext[i], nil) } - switch name { - case "member": - s.listMember = m - case "key": - s.mapKey = m - case "value": - s.mapValue = m - } return m } @@ -176,17 +166,31 @@ func cloneTraits(src map[ShapeID]Trait) map[ShapeID]Trait { // ListMember returns the "member" schema for list types. func (s *Schema) ListMember() *Schema { - return s.listMember + return s.lookup(&s.listMember, "member") } // MapKey returns the "key" schema for map types. func (s *Schema) MapKey() *Schema { - return s.mapKey + return s.lookup(&s.mapKey, "key") } // MapValue returns the "value" schema for map types. func (s *Schema) MapValue() *Schema { - return s.mapValue + return s.lookup(&s.mapValue, "value") +} + +func (s *Schema) lookup(cached *atomic.Pointer[Schema], name string) *Schema { + if v := cached.Load(); v != nil { + return v + } + + m, ok := s.members[name] + if !ok { + return nil + } + + cached.Store(m) + return m } // MemberName returns the member component of the schema's shape ID. diff --git a/vendor/github.com/aws/smithy-go/schema_ext.go b/vendor/github.com/aws/smithy-go/schema_ext.go index 7503b30b80..e98427ae34 100644 --- a/vendor/github.com/aws/smithy-go/schema_ext.go +++ b/vendor/github.com/aws/smithy-go/schema_ext.go @@ -9,13 +9,14 @@ import ( // (JSON, CBOR, etc.) uses a distinct slot to cache precomputed data. type ExtensionID int -const numExtensionSlots = 4 +const numExtensionSlots = 5 const ( - ExtJSON ExtensionID = iota // transport/http/protocol/internal/json - ExtCBOR // transport/http/protocol/internal/cbor - ExtXML // transport/http/protocol/internal/xml - ExtQuery // transport/http/protocol/internal/query + ExtJSON ExtensionID = iota // transport/http/protocol/internal/json + ExtCBOR // transport/http/protocol/internal/cbor + ExtXML // transport/http/protocol/internal/xml + ExtQuery // transport/http/protocol/internal/query + ExtHTTPBinding // transport/http/protocol/internal/httpbinding ) // SchemaExtension retrieves or lazily computes the extension for the given diff --git a/vendor/github.com/aws/smithy-go/transport/http/eventstream.go b/vendor/github.com/aws/smithy-go/transport/http/eventstream.go index 251db8ac35..970ade30e2 100644 --- a/vendor/github.com/aws/smithy-go/transport/http/eventstream.go +++ b/vendor/github.com/aws/smithy-go/transport/http/eventstream.go @@ -56,7 +56,10 @@ func NewEventStreamWriter(protocol ClientProtocol, schema *smithy.Schema, stream } func (w *EventStreamWriter) writeStream() { - defer w.Close() + defer func() { + w.err.SetError(w.eventStream.Close()) + }() + defer w.signalClose() for { select { @@ -100,11 +103,14 @@ func (w *EventStreamWriter) Send(ctx context.Context, variant *smithy.Schema, ev // Close signals end-of-stream and closes the underlying writer. Close is // safe for concurrent calls. func (w *EventStreamWriter) Close() error { + w.signalClose() + return w.err.Err() +} + +func (w *EventStreamWriter) signalClose() { w.closeOnce.Do(func() { close(w.done) - w.err.SetError(w.eventStream.Close()) }) - return w.err.Err() } // Err returns the first error encountered during writing. diff --git a/vendor/github.com/aws/smithy-go/transport/http/middleware_close_response_body.go b/vendor/github.com/aws/smithy-go/transport/http/middleware_close_response_body.go index 914338f2e7..a7e70b1cb5 100644 --- a/vendor/github.com/aws/smithy-go/transport/http/middleware_close_response_body.go +++ b/vendor/github.com/aws/smithy-go/transport/http/middleware_close_response_body.go @@ -8,9 +8,35 @@ import ( "github.com/aws/smithy-go/middleware" ) +// CloseResponseBody closes the HTTP response body. It leaves the body open only +// for a successful response whose payload is a caller-owned stream (isStreaming +// with a nil opErr); on error, or for a non-streaming response, it closes the +// body — an error response body is diagnostic, not a caller-owned stream. +func CloseResponseBody(ctx context.Context, resp *Response, isStreaming bool, opErr error) { + if resp == nil || resp.Body == nil { + return + } + if isStreaming && opErr == nil { + return + } + + // Drain to EOF before closing; a body closed while unread prevents + // connection reuse. + if _, copyErr := io.Copy(io.Discard, resp.Body); copyErr != nil { + middleware.GetLogger(ctx).Logf(logging.Warn, "failed to discard remaining HTTP response body, this may affect connection reuse") + } + + if closeErr := resp.Body.Close(); closeErr != nil { + middleware.GetLogger(ctx).Logf(logging.Warn, "failed to close HTTP response body, this may affect connection reuse") + } +} + // AddErrorCloseResponseBodyMiddleware adds the middleware to automatically // close the response body of an operation request if the request response // failed. +// +// Deprecated: generated operation deserializers now close the response body +// via CloseResponseBody, so this middleware is no longer used. func AddErrorCloseResponseBodyMiddleware(stack *middleware.Stack) error { return stack.Deserialize.Insert(&errorCloseResponseBodyMiddleware{}, "OperationDeserializer", middleware.Before) } @@ -42,6 +68,9 @@ func (m *errorCloseResponseBodyMiddleware) HandleDeserialize( // AddCloseResponseBodyMiddleware adds the middleware to automatically close // the response body of an operation request, after the response had been // deserialized. +// +// Deprecated: generated operation deserializers now close the response body +// via CloseResponseBody, so this middleware is no longer used. func AddCloseResponseBodyMiddleware(stack *middleware.Stack) error { return stack.Deserialize.Insert(&closeResponseBody{}, "OperationDeserializer", middleware.Before) } diff --git a/vendor/github.com/aws/smithy-go/transport/http/middleware_content_length.go b/vendor/github.com/aws/smithy-go/transport/http/middleware_content_length.go index 9969389bb2..7a1c47fe36 100644 --- a/vendor/github.com/aws/smithy-go/transport/http/middleware_content_length.go +++ b/vendor/github.com/aws/smithy-go/transport/http/middleware_content_length.go @@ -14,6 +14,9 @@ type ComputeContentLength struct { // AddComputeContentLengthMiddleware adds ComputeContentLength to the middleware // stack's Build step. +// +// Deprecated: Content-Length is now set when the request body is set via +// Request.SetStream, so this middleware is no longer used. func AddComputeContentLengthMiddleware(stack *middleware.Stack) error { return stack.Build.Add(&ComputeContentLength{}, middleware.After) } diff --git a/vendor/github.com/aws/smithy-go/transport/http/request.go b/vendor/github.com/aws/smithy-go/transport/http/request.go index 5cbf6f10ac..87acdfe57c 100644 --- a/vendor/github.com/aws/smithy-go/transport/http/request.go +++ b/vendor/github.com/aws/smithy-go/transport/http/request.go @@ -118,6 +118,9 @@ func (r *Request) IsStreamSeekable() bool { // SetStream returns a clone of the request with the stream set to the provided // reader. May return an error if the provided reader is seekable but returns // an error. +// +// ContentLength is set to the stream's length when it can be determined, and +// left unchanged otherwise. func (r *Request) SetStream(reader io.Reader) (rc *Request, err error) { rc = r.Clone() @@ -151,6 +154,12 @@ func (r *Request) SetStream(reader io.Reader) (rc *Request, err error) { rc.isStreamSeekable = isStreamSeekable rc.streamStartPos = streamStartPos + if n, ok, err := rc.StreamLength(); err != nil { + return rc, err + } else if ok { + rc.ContentLength = n + } + return rc, err } diff --git a/vendor/github.com/aws/smithy-go/waiter/logger.go b/vendor/github.com/aws/smithy-go/waiter/logger.go index 8d70a03ff2..cb31a2e099 100644 --- a/vendor/github.com/aws/smithy-go/waiter/logger.go +++ b/vendor/github.com/aws/smithy-go/waiter/logger.go @@ -30,7 +30,7 @@ func (m *Logger) HandleInitialize(ctx context.Context, in middleware.InitializeI return next.HandleInitialize(ctx, in) } -// AddLogger is a helper util to add waiter logger after `SetLogger` middleware in +// AddLogger is a helper util to add a waiter logger to the initialize stack. func (m Logger) AddLogger(stack *middleware.Stack) error { - return stack.Initialize.Insert(&m, "SetLogger", middleware.After) + return stack.Initialize.Add(&m, middleware.After) } diff --git a/vendor/github.com/docker/cli/cli/config/credentials/file_store.go b/vendor/github.com/docker/cli/cli/config/credentials/file_store.go index e3ef8e25ed..d4037b7a48 100644 --- a/vendor/github.com/docker/cli/cli/config/credentials/file_store.go +++ b/vendor/github.com/docker/cli/cli/config/credentials/file_store.go @@ -104,7 +104,7 @@ func (c *fileStore) Store(authConfig types.AuthConfig) error { // stored as hostname or as hostname including scheme (in legacy configuration // files). // -// It's the equivalent to [registry.ConvertToHostname] in the daemon. +// It's based on [registry.ConvertToHostname] from Moby daemon. // // [registry.ConvertToHostname]: https://pkg.go.dev/github.com/moby/moby/v2@v2.0.0-beta.7/daemon/pkg/registry#ConvertToHostname func ConvertToHostname(maybeURL string) string { @@ -117,7 +117,48 @@ func ConvertToHostname(maybeURL string) string { } return net.JoinHostPort(u.Hostname(), u.Port()) } + + if hostName := hostFromURLFallback(stripped); hostName != "" { + return hostName + } } hostName, _, _ := strings.Cut(stripped, "/") return hostName } + +// hostFromURLFallback extracts a host from scheme URLs that net/url rejects. +// Go rejects unbracketed IPv6 literals in URL hosts since +// https://github.com/golang/go/commit/0c28789bd7dfc55099cac86a3212dda0d6c091f6 +func hostFromURLFallback(maybeURL string) string { + _, rest, ok := strings.Cut(maybeURL, "://") + if !ok { + return "" + } + + hostName, _, _ := strings.Cut(rest, "/") + if hostName == "" { + return "" + } + + if strings.Count(hostName, ":") > 1 && !strings.HasPrefix(hostName, "[") { + portStart := strings.LastIndex(hostName, ":") + addr, port := hostName[:portStart], hostName[portStart+1:] + if addr != "" && isPort(port) { + return net.JoinHostPort(addr, port) + } + } + + return hostName +} + +func isPort(port string) bool { + if port == "" { + return false + } + for _, r := range port { + if r < '0' || r > '9' { + return false + } + } + return true +} diff --git a/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.go b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.go new file mode 100644 index 0000000000..f296b4d199 --- /dev/null +++ b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.go @@ -0,0 +1,146 @@ +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.10 +// protoc v6.33.2 +// source: envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto + +package http_11_proxyv3 + +import ( + _ "github.com/cncf/xds/go/udpa/annotations" + v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + reflect "reflect" + sync "sync" + unsafe "unsafe" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +// HTTP/1.1 proxy transport socket establishes an upstream connection to a proxy address +// instead of the target host's address. This behavior is triggered when the transport +// socket is configured and proxy information is provided. +// +// Behavior when proxying: +// ======================= +// When an upstream connection is established, instead of connecting directly to the endpoint +// address, the client will connect to the specified proxy address, send an HTTP/1.1 “CONNECT“ request +// indicating the endpoint address, and process the response. If the response has HTTP status 200, +// the connection will be passed down to the underlying transport socket. +// +// Configuring proxy information: +// ============================== +// Set “typed_filter_metadata“ in :ref:`LbEndpoint.Metadata ` or :ref:`LocalityLbEndpoints.Metadata `. +// using the key “envoy.http11_proxy_transport_socket.proxy_address“ and the +// proxy address in “config::core::v3::Address“ format. +type Http11ProxyUpstreamTransport struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The underlying transport socket being wrapped. Defaults to plaintext (raw_buffer) if unset. + TransportSocket *v3.TransportSocket `protobuf:"bytes,1,opt,name=transport_socket,json=transportSocket,proto3" json:"transport_socket,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Http11ProxyUpstreamTransport) Reset() { + *x = Http11ProxyUpstreamTransport{} + mi := &file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Http11ProxyUpstreamTransport) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Http11ProxyUpstreamTransport) ProtoMessage() {} + +func (x *Http11ProxyUpstreamTransport) ProtoReflect() protoreflect.Message { + mi := &file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Http11ProxyUpstreamTransport.ProtoReflect.Descriptor instead. +func (*Http11ProxyUpstreamTransport) Descriptor() ([]byte, []int) { + return file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDescGZIP(), []int{0} +} + +func (x *Http11ProxyUpstreamTransport) GetTransportSocket() *v3.TransportSocket { + if x != nil { + return x.TransportSocket + } + return nil +} + +var File_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto protoreflect.FileDescriptor + +const file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDesc = "" + + "\n" + + "Renvoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto\x123envoy.extensions.transport_sockets.http_11_proxy.v3\x1a\x1fenvoy/config/core/v3/base.proto\x1a\x1dudpa/annotations/status.proto\"p\n" + + "\x1cHttp11ProxyUpstreamTransport\x12P\n" + + "\x10transport_socket\x18\x01 \x01(\v2%.envoy.config.core.v3.TransportSocketR\x0ftransportSocketB\xd5\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" + + "Aio.envoyproxy.envoy.extensions.transport_sockets.http_11_proxy.v3B\x1aUpstreamHttp11ConnectProtoP\x01Zjgithub.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3;http_11_proxyv3b\x06proto3" + +var ( + file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDescOnce sync.Once + file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDescData []byte +) + +func file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDescGZIP() []byte { + file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDescOnce.Do(func() { + file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDesc), len(file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDesc))) + }) + return file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDescData +} + +var file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_msgTypes = make([]protoimpl.MessageInfo, 1) +var file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_goTypes = []any{ + (*Http11ProxyUpstreamTransport)(nil), // 0: envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport + (*v3.TransportSocket)(nil), // 1: envoy.config.core.v3.TransportSocket +} +var file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_depIdxs = []int32{ + 1, // 0: envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport.transport_socket:type_name -> envoy.config.core.v3.TransportSocket + 1, // [1:1] is the sub-list for method output_type + 1, // [1:1] is the sub-list for method input_type + 1, // [1:1] is the sub-list for extension type_name + 1, // [1:1] is the sub-list for extension extendee + 0, // [0:1] is the sub-list for field type_name +} + +func init() { + file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_init() +} +func file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_init() { + if File_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto != nil { + return + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDesc), len(file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_rawDesc)), + NumEnums: 0, + NumMessages: 1, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_goTypes, + DependencyIndexes: file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_depIdxs, + MessageInfos: file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_msgTypes, + }.Build() + File_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto = out.File + file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_goTypes = nil + file_envoy_extensions_transport_sockets_http_11_proxy_v3_upstream_http_11_connect_proto_depIdxs = nil +} diff --git a/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.validate.go b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.validate.go new file mode 100644 index 0000000000..a825cd59fa --- /dev/null +++ b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.pb.validate.go @@ -0,0 +1,169 @@ +//go:build !disable_pgv +// Code generated by protoc-gen-validate. DO NOT EDIT. +// source: envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto + +package http_11_proxyv3 + +import ( + "bytes" + "errors" + "fmt" + "net" + "net/mail" + "net/url" + "regexp" + "sort" + "strings" + "time" + "unicode/utf8" + + "google.golang.org/protobuf/types/known/anypb" +) + +// ensure the imports are used +var ( + _ = bytes.MinRead + _ = errors.New("") + _ = fmt.Print + _ = utf8.UTFMax + _ = (*regexp.Regexp)(nil) + _ = (*strings.Reader)(nil) + _ = net.IPv4len + _ = time.Duration(0) + _ = (*url.URL)(nil) + _ = (*mail.Address)(nil) + _ = anypb.Any{} + _ = sort.Sort +) + +// Validate checks the field values on Http11ProxyUpstreamTransport with the +// rules defined in the proto definition for this message. If any rules are +// violated, the first error encountered is returned, or nil if there are no violations. +func (m *Http11ProxyUpstreamTransport) Validate() error { + return m.validate(false) +} + +// ValidateAll checks the field values on Http11ProxyUpstreamTransport with the +// rules defined in the proto definition for this message. If any rules are +// violated, the result is a list of violation errors wrapped in +// Http11ProxyUpstreamTransportMultiError, or nil if none found. +func (m *Http11ProxyUpstreamTransport) ValidateAll() error { + return m.validate(true) +} + +func (m *Http11ProxyUpstreamTransport) validate(all bool) error { + if m == nil { + return nil + } + + var errors []error + + if all { + switch v := interface{}(m.GetTransportSocket()).(type) { + case interface{ ValidateAll() error }: + if err := v.ValidateAll(); err != nil { + errors = append(errors, Http11ProxyUpstreamTransportValidationError{ + field: "TransportSocket", + reason: "embedded message failed validation", + cause: err, + }) + } + case interface{ Validate() error }: + if err := v.Validate(); err != nil { + errors = append(errors, Http11ProxyUpstreamTransportValidationError{ + field: "TransportSocket", + reason: "embedded message failed validation", + cause: err, + }) + } + } + } else if v, ok := interface{}(m.GetTransportSocket()).(interface{ Validate() error }); ok { + if err := v.Validate(); err != nil { + return Http11ProxyUpstreamTransportValidationError{ + field: "TransportSocket", + reason: "embedded message failed validation", + cause: err, + } + } + } + + if len(errors) > 0 { + return Http11ProxyUpstreamTransportMultiError(errors) + } + + return nil +} + +// Http11ProxyUpstreamTransportMultiError is an error wrapping multiple +// validation errors returned by Http11ProxyUpstreamTransport.ValidateAll() if +// the designated constraints aren't met. +type Http11ProxyUpstreamTransportMultiError []error + +// Error returns a concatenation of all the error messages it wraps. +func (m Http11ProxyUpstreamTransportMultiError) Error() string { + msgs := make([]string, 0, len(m)) + for _, err := range m { + msgs = append(msgs, err.Error()) + } + return strings.Join(msgs, "; ") +} + +// AllErrors returns a list of validation violation errors. +func (m Http11ProxyUpstreamTransportMultiError) AllErrors() []error { return m } + +// Http11ProxyUpstreamTransportValidationError is the validation error returned +// by Http11ProxyUpstreamTransport.Validate if the designated constraints +// aren't met. +type Http11ProxyUpstreamTransportValidationError struct { + field string + reason string + cause error + key bool +} + +// Field function returns field value. +func (e Http11ProxyUpstreamTransportValidationError) Field() string { return e.field } + +// Reason function returns reason value. +func (e Http11ProxyUpstreamTransportValidationError) Reason() string { return e.reason } + +// Cause function returns cause value. +func (e Http11ProxyUpstreamTransportValidationError) Cause() error { return e.cause } + +// Key function returns key value. +func (e Http11ProxyUpstreamTransportValidationError) Key() bool { return e.key } + +// ErrorName returns error name. +func (e Http11ProxyUpstreamTransportValidationError) ErrorName() string { + return "Http11ProxyUpstreamTransportValidationError" +} + +// Error satisfies the builtin error interface +func (e Http11ProxyUpstreamTransportValidationError) Error() string { + cause := "" + if e.cause != nil { + cause = fmt.Sprintf(" | caused by: %v", e.cause) + } + + key := "" + if e.key { + key = "key for " + } + + return fmt.Sprintf( + "invalid %sHttp11ProxyUpstreamTransport.%s: %s%s", + key, + e.field, + e.reason, + cause) +} + +var _ error = Http11ProxyUpstreamTransportValidationError{} + +var _ interface { + Field() string + Reason() string + Key() bool + Cause() error + ErrorName() string +} = Http11ProxyUpstreamTransportValidationError{} diff --git a/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect_vtproto.pb.go b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect_vtproto.pb.go new file mode 100644 index 0000000000..47df0d0eb6 --- /dev/null +++ b/vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect_vtproto.pb.go @@ -0,0 +1,95 @@ +//go:build vtprotobuf +// +build vtprotobuf + +// Code generated by protoc-gen-go-vtproto. DO NOT EDIT. +// source: envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto + +package http_11_proxyv3 + +import ( + protohelpers "github.com/planetscale/vtprotobuf/protohelpers" + proto "google.golang.org/protobuf/proto" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +func (m *Http11ProxyUpstreamTransport) MarshalVTStrict() (dAtA []byte, err error) { + if m == nil { + return nil, nil + } + size := m.SizeVT() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *Http11ProxyUpstreamTransport) MarshalToVTStrict(dAtA []byte) (int, error) { + size := m.SizeVT() + return m.MarshalToSizedBufferVTStrict(dAtA[:size]) +} + +func (m *Http11ProxyUpstreamTransport) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) { + if m == nil { + return 0, nil + } + i := len(dAtA) + _ = i + var l int + _ = l + if m.unknownFields != nil { + i -= len(m.unknownFields) + copy(dAtA[i:], m.unknownFields) + } + if m.TransportSocket != nil { + if vtmsg, ok := interface{}(m.TransportSocket).(interface { + MarshalToSizedBufferVTStrict([]byte) (int, error) + }); ok { + size, err := vtmsg.MarshalToSizedBufferVTStrict(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = protohelpers.EncodeVarint(dAtA, i, uint64(size)) + } else { + encoded, err := proto.Marshal(m.TransportSocket) + if err != nil { + return 0, err + } + i -= len(encoded) + copy(dAtA[i:], encoded) + i = protohelpers.EncodeVarint(dAtA, i, uint64(len(encoded))) + } + i-- + dAtA[i] = 0xa + } + return len(dAtA) - i, nil +} + +func (m *Http11ProxyUpstreamTransport) SizeVT() (n int) { + if m == nil { + return 0 + } + var l int + _ = l + if m.TransportSocket != nil { + if size, ok := interface{}(m.TransportSocket).(interface { + SizeVT() int + }); ok { + l = size.SizeVT() + } else { + l = proto.Size(m.TransportSocket) + } + n += 1 + l + protohelpers.SizeOfVarint(uint64(l)) + } + n += len(m.unknownFields) + return n +} diff --git a/vendor/github.com/go-jose/go-jose/v4/asymmetric.go b/vendor/github.com/go-jose/go-jose/v4/asymmetric.go index 7784cd4584..2b5607617e 100644 --- a/vendor/github.com/go-jose/go-jose/v4/asymmetric.go +++ b/vendor/github.com/go-jose/go-jose/v4/asymmetric.go @@ -21,6 +21,7 @@ import ( "crypto/aes" "crypto/ecdsa" "crypto/ed25519" + "crypto/elliptic" "crypto/rand" "crypto/rsa" "crypto/sha1" @@ -195,11 +196,11 @@ func (ctx rsaEncrypterVerifier) encryptKey(cek []byte, alg KeyAlgorithm) (recipi func (ctx rsaEncrypterVerifier) encrypt(cek []byte, alg KeyAlgorithm) ([]byte, error) { switch alg { case RSA1_5: - return rsa.EncryptPKCS1v15(RandReader, ctx.publicKey, cek) + return rsa.EncryptPKCS1v15(randReader, ctx.publicKey, cek) case RSA_OAEP: - return rsa.EncryptOAEP(sha1.New(), RandReader, ctx.publicKey, cek, []byte{}) + return rsa.EncryptOAEP(sha1.New(), randReader, ctx.publicKey, cek, []byte{}) case RSA_OAEP_256: - return rsa.EncryptOAEP(sha256.New(), RandReader, ctx.publicKey, cek, []byte{}) + return rsa.EncryptOAEP(sha256.New(), randReader, ctx.publicKey, cek, []byte{}) } return nil, ErrUnsupportedAlgorithm @@ -288,9 +289,9 @@ func (ctx rsaDecrypterSigner) signPayload(payload []byte, alg SignatureAlgorithm // TODO(https://github.com/go-jose/go-jose/issues/40): As of go1.20, the // random parameter is legacy and ignored, and it can be nil. // https://cs.opensource.google/go/go/+/refs/tags/go1.20:src/crypto/rsa/pkcs1v15.go;l=263;bpv=0;bpt=1 - out, err = rsa.SignPKCS1v15(RandReader, ctx.privateKey, hash, hashed) + out, err = rsa.SignPKCS1v15(randReader, ctx.privateKey, hash, hashed) case PS256, PS384, PS512: - out, err = rsa.SignPSS(RandReader, ctx.privateKey, hash, hashed, &rsa.PSSOptions{ + out, err = rsa.SignPSS(randReader, ctx.privateKey, hash, hashed, &rsa.PSSOptions{ SaltLength: rsa.PSSSaltLengthEqualsHash, }) } @@ -391,7 +392,7 @@ func (ctx ecKeyGenerator) keySize() int { // Get a content encryption key for ECDH-ES func (ctx ecKeyGenerator) genKey() ([]byte, rawHeader, error) { - priv, err := ecdsa.GenerateKey(ctx.publicKey.Curve, RandReader) + priv, err := ecdsa.GenerateKey(ctx.publicKey.Curve, randReader) if err != nil { return nil, rawHeader{}, err } @@ -483,7 +484,7 @@ func (ctx edDecrypterSigner) signPayload(payload []byte, alg SignatureAlgorithm) return Signature{}, ErrUnsupportedAlgorithm } - sig, err := ctx.privateKey.Sign(RandReader, payload, crypto.Hash(0)) + sig, err := ctx.privateKey.Sign(randReader, payload, crypto.Hash(0)) if err != nil { return Signature{}, err } @@ -533,7 +534,7 @@ func (ctx ecDecrypterSigner) signPayload(payload []byte, alg SignatureAlgorithm) _, _ = hasher.Write(payload) hashed := hasher.Sum(nil) - r, s, err := ecdsa.Sign(RandReader, ctx.privateKey, hashed) + r, s, err := ecdsa.Sign(randReader, ctx.privateKey, hashed) if err != nil { return Signature{}, err } @@ -571,12 +572,21 @@ func (ctx ecEncrypterVerifier) verifyPayload(payload []byte, signature []byte, a case ES256: keySize = 32 hash = crypto.SHA256 + if ctx.publicKey.Curve != elliptic.P256() { + return fmt.Errorf("go-jose/go-jose: signature uses different algorithm than public key") + } case ES384: keySize = 48 hash = crypto.SHA384 + if ctx.publicKey.Curve != elliptic.P384() { + return fmt.Errorf("go-jose/go-jose: signature uses different algorithm than public key") + } case ES512: keySize = 66 hash = crypto.SHA512 + if ctx.publicKey.Curve != elliptic.P521() { + return fmt.Errorf("go-jose/go-jose: signature uses different algorithm than public key") + } default: return ErrUnsupportedAlgorithm } diff --git a/vendor/github.com/go-jose/go-jose/v4/cipher/cbc_hmac.go b/vendor/github.com/go-jose/go-jose/v4/cipher/cbc_hmac.go index af029cec0b..a301ad9e20 100644 --- a/vendor/github.com/go-jose/go-jose/v4/cipher/cbc_hmac.go +++ b/vendor/github.com/go-jose/go-jose/v4/cipher/cbc_hmac.go @@ -51,6 +51,8 @@ func NewCBCHMAC(key []byte, newBlockCipher func([]byte) (cipher.Block, error)) ( hash = sha512.New384 case 32: hash = sha512.New + default: + return nil, errors.New("go-jose/go-jose: invalid key size for CBC-HMAC") } return &cbcAEAD{ @@ -176,7 +178,9 @@ func padBuffer(buffer []byte, blockSize int) []byte { // Remove padding func unpadBuffer(buffer []byte, blockSize int) ([]byte, error) { - if len(buffer)%blockSize != 0 { + // A padded buffer can't be empty because an empty input is padded with + // `blockSize` bytes, resulting in a non-empty ciphertext. + if len(buffer) == 0 || len(buffer)%blockSize != 0 { return nil, errors.New("go-jose/go-jose: invalid padding") } diff --git a/vendor/github.com/go-jose/go-jose/v4/crypter.go b/vendor/github.com/go-jose/go-jose/v4/crypter.go index 31290fc871..e3df79c2dc 100644 --- a/vendor/github.com/go-jose/go-jose/v4/crypter.go +++ b/vendor/github.com/go-jose/go-jose/v4/crypter.go @@ -258,6 +258,10 @@ func (ctx *genericEncrypter) addRecipient(recipient Recipient) (err error) { } recipientInfo, err = makeJWERecipient(recipient.Algorithm, recipient.Key) + if err != nil { + return err + } + if recipient.KeyID != "" { recipientInfo.keyID = recipient.KeyID } @@ -270,10 +274,8 @@ func (ctx *genericEncrypter) addRecipient(recipient Recipient) (err error) { } } - if err == nil { - ctx.recipients = append(ctx.recipients, recipientInfo) - } - return err + ctx.recipients = append(ctx.recipients, recipientInfo) + return nil } func makeJWERecipient(alg KeyAlgorithm, encryptionKey interface{}) (recipientKeyInfo, error) { @@ -490,21 +492,19 @@ func (obj JSONWebEncryption) Decrypt(decryptionKey interface{}) ([]byte, error) recipientHeaders := obj.mergedHeaders(&recipient) cek, err := decrypter.decryptKey(recipientHeaders, &recipient, generator) - if err == nil { - // Found a valid CEK -- let's try to decrypt. - plaintext, err = cipher.decrypt(cek, authData, parts) + if err != nil { + return nil, ErrCryptoFailure } - if plaintext == nil { + // Found a valid CEK -- let's try to decrypt. + plaintext, err = cipher.decrypt(cek, authData, parts) + if err != nil { return nil, ErrCryptoFailure } - // The "zip" header parameter may only be present in the protected header. - if comp := obj.protected.getCompression(); comp != "" { - plaintext, err = decompress(comp, plaintext) - if err != nil { - return nil, fmt.Errorf("go-jose/go-jose: failed to decompress plaintext: %v", err) - } + plaintext, err = obj.decompress(plaintext) + if err != nil { + return nil, err } return plaintext, nil @@ -559,31 +559,38 @@ func (obj JSONWebEncryption) DecryptMulti(decryptionKey interface{}) (int, Heade var plaintext []byte var headers rawHeader + if len(obj.recipients) == 0 { + return -1, Header{}, nil, errors.New("go-jose/go-jose: no recipients") + } + + // Loop sets `err` in the function scope; don't shadow it. for i, recipient := range obj.recipients { recipientHeaders := obj.mergedHeaders(&recipient) - cek, err := decrypter.decryptKey(recipientHeaders, &recipient, generator) - if err == nil { - // Found a valid CEK -- let's try to decrypt. - plaintext, err = cipher.decrypt(cek, authData, parts) - if err == nil { - index = i - headers = recipientHeaders - break - } + var cek []byte + cek, err = decrypter.decryptKey(recipientHeaders, &recipient, generator) + if err != nil { + continue } + + // Found a valid CEK -- let's try to decrypt. + plaintext, err = cipher.decrypt(cek, authData, parts) + if err != nil { + continue + } + + index = i + headers = recipientHeaders + break } - if plaintext == nil { + if err != nil { return -1, Header{}, nil, ErrCryptoFailure } - // The "zip" header parameter may only be present in the protected header. - if comp := obj.protected.getCompression(); comp != "" { - plaintext, err = decompress(comp, plaintext) - if err != nil { - return -1, Header{}, nil, fmt.Errorf("go-jose/go-jose: failed to decompress plaintext: %v", err) - } + plaintext, err = obj.decompress(plaintext) + if err != nil { + return -1, Header{}, nil, err } sanitized, err := headers.sanitized() @@ -593,3 +600,22 @@ func (obj JSONWebEncryption) DecryptMulti(decryptionKey interface{}) (int, Heade return index, sanitized, plaintext, err } + +// decompress decompresses plaintext using the protected "zip" header, if present. +// It returns plaintext unchanged when there is no protected header or "zip" value. +func (obj JSONWebEncryption) decompress(plaintext []byte) ([]byte, error) { + if obj.protected == nil { + return plaintext, nil + } + + comp := obj.protected.getCompression() + if comp == "" { + return plaintext, nil + } + + plaintext, err := decompress(comp, plaintext) + if err != nil { + return nil, fmt.Errorf("go-jose/go-jose: failed to decompress plaintext: %v", err) + } + return plaintext, nil +} diff --git a/vendor/github.com/go-jose/go-jose/v4/json/scanner.go b/vendor/github.com/go-jose/go-jose/v4/json/scanner.go index ee6622e8cf..3bd29f397a 100644 --- a/vendor/github.com/go-jose/go-jose/v4/json/scanner.go +++ b/vendor/github.com/go-jose/go-jose/v4/json/scanner.go @@ -140,6 +140,10 @@ const ( parseArrayValue // parsing array value ) +// This limits the max nesting depth to prevent stack overflow. +// This is permitted by https://tools.ietf.org/html/rfc7159#section-9 +const maxNestingDepth = 10000 + // reset prepares the scanner for use. // It must be called before calling s.step. func (s *scanner) reset() { @@ -170,8 +174,13 @@ func (s *scanner) eof() int { } // pushParseState pushes a new parse state p onto the parse stack. -func (s *scanner) pushParseState(p int) { - s.parseState = append(s.parseState, p) +// an error state is returned if maxNestingDepth was exceeded, otherwise successState is returned. +func (s *scanner) pushParseState(c byte, newParseState int, successState int) int { + s.parseState = append(s.parseState, newParseState) + if len(s.parseState) <= maxNestingDepth { + return successState + } + return s.error(c, "exceeded max depth") } // popParseState pops a parse state (already obtained) off the stack @@ -211,12 +220,10 @@ func stateBeginValue(s *scanner, c byte) int { switch c { case '{': s.step = stateBeginStringOrEmpty - s.pushParseState(parseObjectKey) - return scanBeginObject + return s.pushParseState(c, parseObjectKey, scanBeginObject) case '[': s.step = stateBeginValueOrEmpty - s.pushParseState(parseArrayValue) - return scanBeginArray + return s.pushParseState(c, parseArrayValue, scanBeginArray) case '"': s.step = stateInString return scanBeginLiteral diff --git a/vendor/github.com/go-jose/go-jose/v4/jwe.go b/vendor/github.com/go-jose/go-jose/v4/jwe.go index 6102f91000..ae173461b7 100644 --- a/vendor/github.com/go-jose/go-jose/v4/jwe.go +++ b/vendor/github.com/go-jose/go-jose/v4/jwe.go @@ -153,6 +153,10 @@ func ParseEncryptedJSON( keyEncryptionAlgorithms []KeyAlgorithm, contentEncryption []ContentEncryption, ) (*JSONWebEncryption, error) { + if len(input) == 0 { + return nil, errEmptyInput + } + var parsed rawJSONWebEncryption err := json.Unmarshal([]byte(input), &parsed) if err != nil { @@ -291,6 +295,10 @@ func ParseEncryptedCompact( var parts [5]string var ok bool + if len(input) == 0 { + return nil, errEmptyInput + } + for i := range 4 { parts[i], input, ok = strings.Cut(input, ".") if !ok { diff --git a/vendor/github.com/go-jose/go-jose/v4/jwk.go b/vendor/github.com/go-jose/go-jose/v4/jwk.go index 164d6a1619..f712ec7ec8 100644 --- a/vendor/github.com/go-jose/go-jose/v4/jwk.go +++ b/vendor/github.com/go-jose/go-jose/v4/jwk.go @@ -107,7 +107,7 @@ func (k JSONWebKey) MarshalJSON() ([]byte, error) { switch key := k.Key.(type) { case ed25519.PublicKey: - raw = fromEdPublicKey(key) + raw, err = fromEdPublicKey(key) case *ecdsa.PublicKey: raw, err = fromEcPublicKey(key) case *rsa.PublicKey: @@ -207,21 +207,29 @@ func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) { case "EC": if raw.D != nil { key, err = raw.ecPrivateKey() - if err == nil { - keyPub = key.(*ecdsa.PrivateKey).Public() + if err != nil { + return err } + keyPub = key.(*ecdsa.PrivateKey).Public() } else { key, err = raw.ecPublicKey() + if err != nil { + return err + } keyPub = key } case "RSA": if raw.D != nil { key, err = raw.rsaPrivateKey() - if err == nil { - keyPub = key.(*rsa.PrivateKey).Public() + if err != nil { + return err } + keyPub = key.(*rsa.PrivateKey).Public() } else { key, err = raw.rsaPublicKey() + if err != nil { + return err + } keyPub = key } case "oct": @@ -229,25 +237,28 @@ func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) { return errors.New("go-jose/go-jose: invalid JWK, found 'oct' (symmetric) key with cert chain") } key, err = raw.symmetricKey() + if err != nil { + return err + } case "OKP": if raw.Crv == "Ed25519" { if raw.D != nil { key, err = raw.edPrivateKey() - if err == nil { - keyPub = key.(ed25519.PrivateKey).Public() + if err != nil { + return err } + keyPub = key.(ed25519.PrivateKey).Public() } else { key, err = raw.edPublicKey() + if err != nil { + return err + } keyPub = key } } case "": // kty MUST be present - err = fmt.Errorf("go-jose/go-jose: missing json web key type") - } - - if err != nil { - return + return fmt.Errorf("go-jose/go-jose: missing json web key type") } if key == nil { @@ -388,11 +399,12 @@ func rsaThumbprintInput(n *big.Int, e int) (string, error) { func edThumbprintInput(ed ed25519.PublicKey) (string, error) { crv := "Ed25519" - if len(ed) > 32 { - return "", errors.New("go-jose/go-jose: invalid elliptic key (too large)") + err := validateEd25519PublicKey(ed) + if err != nil { + return "", err } return fmt.Sprintf(edThumbprintTemplate, crv, - newFixedSizeBuffer(ed, 32).base64()), nil + newFixedSizeBuffer(ed, ed25519.PublicKeySize).base64()), nil } // Thumbprint computes the JWK Thumbprint of a key using the @@ -504,12 +516,16 @@ func (key rawJSONWebKey) rsaPublicKey() (*rsa.PublicKey, error) { }, nil } -func fromEdPublicKey(pub ed25519.PublicKey) *rawJSONWebKey { +func fromEdPublicKey(pub ed25519.PublicKey) (*rawJSONWebKey, error) { + err := validateEd25519PublicKey(pub) + if err != nil { + return nil, err + } return &rawJSONWebKey{ Kty: "OKP", Crv: "Ed25519", X: newBuffer(pub), - } + }, nil } func fromRsaPublicKey(pub *rsa.PublicKey) *rawJSONWebKey { @@ -604,21 +620,36 @@ func (key rawJSONWebKey) edPrivateKey() (ed25519.PrivateKey, error) { return nil, fmt.Errorf("go-jose/go-jose: invalid Ed25519 private key, missing %s value(s)", strings.Join(missing, ", ")) } - privateKey := make([]byte, ed25519.PrivateKeySize) - copy(privateKey[0:32], key.D.bytes()) - copy(privateKey[32:], key.X.bytes()) - rv := ed25519.PrivateKey(privateKey) - return rv, nil + publicKey := key.X.bytes() + err := validateEd25519PublicKey(publicKey) + if err != nil { + return nil, err + } + + seed := key.D.bytes() + if len(seed) != ed25519.SeedSize { + return nil, fmt.Errorf("go-jose/go-jose: invalid Ed25519 private key, wrong length for d") + } + + privateKey := ed25519.NewKeyFromSeed(seed) + derivedPublicKey := privateKey.Public().(ed25519.PublicKey) + if !bytes.Equal(derivedPublicKey, publicKey) { + return nil, errors.New("go-jose/go-jose: invalid Ed25519 private key, x does not match d") + } + + return privateKey, nil } func (key rawJSONWebKey) edPublicKey() (ed25519.PublicKey, error) { if key.X == nil { return nil, fmt.Errorf("go-jose/go-jose: invalid Ed key, missing x value") } - publicKey := make([]byte, ed25519.PublicKeySize) - copy(publicKey[0:32], key.X.bytes()) - rv := ed25519.PublicKey(publicKey) - return rv, nil + publicKey := key.X.bytes() + err := validateEd25519PublicKey(publicKey) + if err != nil { + return nil, err + } + return ed25519.PublicKey(bytes.Clone(publicKey)), nil } func (key rawJSONWebKey) rsaPrivateKey() (*rsa.PrivateKey, error) { @@ -669,9 +700,17 @@ func (key rawJSONWebKey) rsaPrivateKey() (*rsa.PrivateKey, error) { } func fromEdPrivateKey(ed ed25519.PrivateKey) (*rawJSONWebKey, error) { - raw := fromEdPublicKey(ed25519.PublicKey(ed[32:])) + if len(ed) != ed25519.PrivateKeySize { + return nil, errors.New("go-jose/go-jose: invalid Ed25519 private key length") + } - raw.D = newBuffer(ed[0:32]) + publicKey := ed.Public().(ed25519.PublicKey) + raw, err := fromEdPublicKey(publicKey) + if err != nil { + return nil, err + } + + raw.D = newBuffer(ed.Seed()) return raw, nil } @@ -810,7 +849,7 @@ var ( ErrJWKSKidNotFound = errors.New("go-jose/go-jose: JWK with matching kid not found in JWK Set") ) -func tryJWKS(key interface{}, headers ...Header) (interface{}, error) { +func tryJWKS(key interface{}, header Header) (interface{}, error) { var jwks JSONWebKeySet switch jwksType := key.(type) { @@ -823,16 +862,8 @@ func tryJWKS(key interface{}, headers ...Header) (interface{}, error) { return key, nil } - // Determine the KID to search for from the headers. - var kid string - for _, header := range headers { - if header.KeyID != "" { - kid = header.KeyID - break - } - } - - // If no KID is specified in the headers, reject. + // If no KID is specified in the header, reject. + kid := header.KeyID if kid == "" { return nil, ErrJWKSKidNotFound } @@ -846,3 +877,107 @@ func tryJWKS(key interface{}, headers ...Header) (interface{}, error) { return keys[0].Key, nil } + +// weakEd25519PublicKeys contains the low-order Ed25519 encodings accepted by +// Go's verifier that must not be accepted as JOSE verification keys. +var weakEd25519PublicKeys = map[[ed25519.PublicKeySize]byte]struct{}{ + { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + }: {}, + { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, + }: {}, + { + 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + }: {}, + { + 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, + }: {}, + { + 0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, + 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, + 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, + 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05, + }: {}, + { + 0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, + 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, + 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, + 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85, + }: {}, + { + 0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, + 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, + 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, + 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a, + }: {}, + { + 0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, + 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, + 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, + 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa, + }: {}, + { + 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f, + }: {}, + { + 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + }: {}, + { + 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f, + }: {}, + { + 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + }: {}, + { + 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f, + }: {}, + { + 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + }: {}, +} + +func validateEd25519PublicKey(publicKey ed25519.PublicKey) error { + if len(publicKey) != ed25519.PublicKeySize { + return fmt.Errorf("go-jose/go-jose: invalid Ed25519 public key, wrong length for x") + } + + var encoded [ed25519.PublicKeySize]byte + copy(encoded[:], publicKey) + _, ok := weakEd25519PublicKeys[encoded] + if ok { + return errors.New("go-jose/go-jose: invalid Ed25519 public key, low-order point") + } + + return nil +} diff --git a/vendor/github.com/go-jose/go-jose/v4/jws.go b/vendor/github.com/go-jose/go-jose/v4/jws.go index c40bd3ec10..0444a5da05 100644 --- a/vendor/github.com/go-jose/go-jose/v4/jws.go +++ b/vendor/github.com/go-jose/go-jose/v4/jws.go @@ -22,6 +22,7 @@ import ( "errors" "fmt" "strings" + "unicode" "github.com/go-jose/go-jose/v4/json" ) @@ -89,12 +90,12 @@ func ParseSigned( signature string, signatureAlgorithms []SignatureAlgorithm, ) (*JSONWebSignature, error) { - signature = stripWhitespace(signature) - if strings.HasPrefix(signature, "{") { + trimmed := strings.TrimLeftFunc(signature, unicode.IsSpace) + if strings.HasPrefix(trimmed, "{") { return ParseSignedJSON(signature, signatureAlgorithms) } - return parseSignedCompact(signature, nil, signatureAlgorithms) + return parseSignedCompact(stripWhitespace(signature), nil, signatureAlgorithms) } // ParseSignedCompact parses a message in JWS Compact Serialization. Validation fails if the JWS is @@ -186,6 +187,10 @@ func ParseSignedJSON( input string, signatureAlgorithms []SignatureAlgorithm, ) (*JSONWebSignature, error) { + if len(input) == 0 { + return nil, errEmptyInput + } + var parsed rawJSONWebSignature err := json.Unmarshal([]byte(input), &parsed) if err != nil { @@ -369,6 +374,10 @@ func parseSignedCompact( payload []byte, signatureAlgorithms []SignatureAlgorithm, ) (*JSONWebSignature, error) { + if len(input) == 0 { + return nil, errEmptyInput + } + protected, s, ok := strings.Cut(input, tokenDelim) if !ok { // no period found return nil, fmt.Errorf("go-jose/go-jose: compact JWS format must have three parts") diff --git a/vendor/github.com/go-jose/go-jose/v4/jwt/claims.go b/vendor/github.com/go-jose/go-jose/v4/jwt/claims.go index e73412a391..ec199e29a4 100644 --- a/vendor/github.com/go-jose/go-jose/v4/jwt/claims.go +++ b/vendor/github.com/go-jose/go-jose/v4/jwt/claims.go @@ -24,6 +24,11 @@ import ( "github.com/go-jose/go-jose/v4/json" ) +// maxNumericDate bounds an accepted NumericDate (in seconds). It is far past +// any real timestamp but safely below where an int64 conversion or time.Unix +// would overflow and wrap Time() to a bogus instant. +const maxNumericDate = 1 << 62 + // Claims represents public claim values (as specified in RFC 7519). type Claims struct { Issuer string `json:"iss,omitempty"` @@ -69,6 +74,16 @@ func (n *NumericDate) UnmarshalJSON(b []byte) error { return ErrUnmarshalNumericDate } + // Reject values large enough to overflow either the int64 conversion below + // or time.Unix in Time(). time.Unix adds a ~62e9-second offset internally, + // so a value near the int64 limit wraps and compares as a time in the + // past; for "nbf" that lets a not-yet-valid token pass the not-before + // check instead of being rejected. maxNumericDate (2^62 seconds) is far + // beyond any real timestamp yet safely below both overflow points. + if f >= maxNumericDate || f <= -maxNumericDate { + return ErrUnmarshalNumericDate + } + *n = NumericDate(f) return nil } diff --git a/vendor/github.com/go-jose/go-jose/v4/opaque.go b/vendor/github.com/go-jose/go-jose/v4/opaque.go index 429427232e..91a42fc1dc 100644 --- a/vendor/github.com/go-jose/go-jose/v4/opaque.go +++ b/vendor/github.com/go-jose/go-jose/v4/opaque.go @@ -46,6 +46,11 @@ func newOpaqueSigner(alg SignatureAlgorithm, signer OpaqueSigner) (recipientSigI return recipientSigInfo{}, ErrUnsupportedAlgorithm } + pk := signer.Public() + if pk != nil && !pk.IsPublic() { + return recipientSigInfo{}, ErrNotPublic + } + return recipientSigInfo{ sigAlg: alg, publicKey: signer.Public, diff --git a/vendor/github.com/go-jose/go-jose/v4/shared.go b/vendor/github.com/go-jose/go-jose/v4/shared.go index 35130b3aa8..3df242ca6a 100644 --- a/vendor/github.com/go-jose/go-jose/v4/shared.go +++ b/vendor/github.com/go-jose/go-jose/v4/shared.go @@ -80,6 +80,12 @@ var ( // ErrUnsupportedCriticalHeader is returned when a header is marked critical but not supported by go-jose. ErrUnsupportedCriticalHeader = errors.New("go-jose/go-jose: unsupported critical header") + + // errEmptyInput is returned when go-jose was asked to parse an empty string. + errEmptyInput = errors.New("go-jose/go-jose: empty input") + + // ErrNotPublic indicates a private key was passed where a public key was expected + ErrNotPublic = errors.New("go-jose/go-jose: public key was unexpectedly not public") ) // Key management algorithms diff --git a/vendor/github.com/go-jose/go-jose/v4/signing.go b/vendor/github.com/go-jose/go-jose/v4/signing.go index 5dbd04c278..5baf75cb2e 100644 --- a/vendor/github.com/go-jose/go-jose/v4/signing.go +++ b/vendor/github.com/go-jose/go-jose/v4/signing.go @@ -130,6 +130,8 @@ type payloadVerifier interface { verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error } +var errInvalidVerificationKey = errors.New("go-jose/go-jose: invalid verification key") + type genericSigner struct { recipients []recipientSigInfo nonceSource NonceSource @@ -138,11 +140,21 @@ type genericSigner struct { } type recipientSigInfo struct { - sigAlg SignatureAlgorithm + sigAlg SignatureAlgorithm + // publicKey returns a synthetic JSONWebKey for the signer. + // For opaque signers, it calls OpaqueSigner.Public(). publicKey func() *JSONWebKey signer payloadSigner } +// getPublicKey gets the public key, with a nil check on the func. +func (r recipientSigInfo) getPublicKey() *JSONWebKey { + if r.publicKey == nil { + return nil + } + return r.publicKey() +} + func staticPublicKey(jwk *JSONWebKey) func() *JSONWebKey { return func() *JSONWebKey { return jwk @@ -178,14 +190,23 @@ func NewMultiSigner(sigs []SigningKey, opts *SignerOptions) (Signer, error) { func newVerifier(verificationKey interface{}) (payloadVerifier, error) { switch verificationKey := verificationKey.(type) { case ed25519.PublicKey: + if len(verificationKey) == 0 { + return nil, errInvalidVerificationKey + } return &edEncrypterVerifier{ publicKey: verificationKey, }, nil case *rsa.PublicKey: + if verificationKey == nil { + return nil, errInvalidVerificationKey + } return &rsaEncrypterVerifier{ publicKey: verificationKey, }, nil case *ecdsa.PublicKey: + if verificationKey == nil { + return nil, errInvalidVerificationKey + } return &ecEncrypterVerifier{ publicKey: verificationKey, }, nil @@ -196,6 +217,9 @@ func newVerifier(verificationKey interface{}) (payloadVerifier, error) { case JSONWebKey: return newVerifier(verificationKey.Key) case *JSONWebKey: + if verificationKey == nil { + return nil, errInvalidVerificationKey + } return newVerifier(verificationKey.Key) case OpaqueVerifier: return &opaqueVerifier{verifier: verificationKey}, nil @@ -240,18 +264,18 @@ func newJWKSigner(alg SignatureAlgorithm, signingKey JSONWebKey) (recipientSigIn if err != nil { return recipientSigInfo{}, err } - if recipient.publicKey != nil && recipient.publicKey() != nil { + if recipientPubKey := recipient.getPublicKey(); recipientPubKey != nil { + // This should be impossible, but let's check anyway. + if !recipientPubKey.IsPublic() { + return recipientSigInfo{}, ErrNotPublic + } + // recipient.publicKey is a JWK synthesized for embedding when recipientSigInfo // was created for the inner key (such as a RSA or ECDSA public key). It contains // the pub key for embedding, but doesn't have extra params like key id. publicKey := signingKey - publicKey.Key = recipient.publicKey().Key + publicKey.Key = recipientPubKey.Key recipient.publicKey = staticPublicKey(&publicKey) - - // This should be impossible, but let's check anyway. - if !recipient.publicKey().IsPublic() { - return recipientSigInfo{}, errors.New("go-jose/go-jose: public key was unexpectedly not public") - } } return recipient, nil } @@ -266,7 +290,7 @@ func (ctx *genericSigner) Sign(payload []byte) (*JSONWebSignature, error) { headerAlgorithm: string(recipient.sigAlg), } - if recipient.publicKey != nil && recipient.publicKey() != nil { + if recipientPubKey := recipient.getPublicKey(); recipientPubKey != nil { // We want to embed the JWK or set the kid header, but not both. Having a protected // header that contains an embedded JWK while also simultaneously containing the kid // header is confusing, and at least in ACME the two are considered to be mutually @@ -274,11 +298,11 @@ func (ctx *genericSigner) Sign(payload []byte) (*JSONWebSignature, error) { // result of the JOSE spec. We've decided that this library will only include one or // the other to avoid this confusion. // - // See https://github.com/go-jose/go-jose/issues/157 for more context. + // See https://github.com/square/go-jose/issues/157 for more context. if ctx.embedJWK { - protected[headerJWK] = recipient.publicKey() + protected[headerJWK] = recipientPubKey } else { - keyID := recipient.publicKey().KeyID + keyID := recipientPubKey.KeyID if keyID != "" { protected[headerKeyID] = keyID } @@ -390,7 +414,13 @@ func (obj JSONWebSignature) UnsafePayloadWithoutVerification() []byte { // The verificationKey argument must have one of the types allowed for the // verificationKey argument of JSONWebSignature.Verify(). func (obj JSONWebSignature) DetachedVerify(payload []byte, verificationKey interface{}) error { - key, err := tryJWKS(verificationKey, obj.headers()...) + if len(obj.Signatures) > 1 { + return errors.New("go-jose/go-jose: too many signatures in payload; expecting only one") + } + + signature := obj.Signatures[0] + + key, err := tryJWKS(verificationKey, signature.Header) if err != nil { return err } @@ -399,12 +429,6 @@ func (obj JSONWebSignature) DetachedVerify(payload []byte, verificationKey inter return err } - if len(obj.Signatures) > 1 { - return errors.New("go-jose/go-jose: too many signatures in payload; expecting only one") - } - - signature := obj.Signatures[0] - if signature.header != nil { // Per https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11, // 4.1.11. "crit" (Critical) Header Parameter @@ -432,11 +456,11 @@ func (obj JSONWebSignature) DetachedVerify(payload []byte, verificationKey inter headers := signature.mergedHeaders() alg := headers.getSignatureAlgorithm() err = verifier.verifyPayload(input, signature.Signature, alg) - if err == nil { - return nil + if err != nil { + return ErrCryptoFailure } - return ErrCryptoFailure + return nil } // VerifyMulti validates (one of the multiple) signatures on the object and @@ -467,16 +491,6 @@ func (obj JSONWebSignature) VerifyMulti(verificationKey interface{}) (int, Signa // The verificationKey argument must have one of the types allowed for the // verificationKey argument of JSONWebSignature.Verify(). func (obj JSONWebSignature) DetachedVerifyMulti(payload []byte, verificationKey interface{}) (int, Signature, error) { - key, err := tryJWKS(verificationKey, obj.headers()...) - if err != nil { - return -1, Signature{}, err - } - verifier, err := newVerifier(key) - if err != nil { - return -1, Signature{}, err - } - -outer: for i, signature := range obj.Signatures { if signature.header != nil { // Per https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11, @@ -484,20 +498,31 @@ outer: // "When used, this Header Parameter MUST be integrity // protected; therefore, it MUST occur only within the JWS // Protected Header." - err = signature.header.checkNoCritical() + err := signature.header.checkNoCritical() if err != nil { - continue outer + continue } } if signature.protected != nil { // Check for only supported critical headers - err = signature.protected.checkSupportedCritical(supportedCritical) + err := signature.protected.checkSupportedCritical(supportedCritical) if err != nil { - continue outer + continue } } + // If the verification key is a JWK Set, pick a key based on this signature's + // "kid" header. If no match, skip this signature. + key, err := tryJWKS(verificationKey, signature.Header) + if err != nil { + continue + } + verifier, err := newVerifier(key) + if err != nil { + continue + } + input, err := obj.computeAuthData(payload, &signature) if err != nil { continue @@ -506,18 +531,12 @@ outer: headers := signature.mergedHeaders() alg := headers.getSignatureAlgorithm() err = verifier.verifyPayload(input, signature.Signature, alg) - if err == nil { - return i, signature, nil + if err != nil { + continue } + + return i, signature, nil } return -1, Signature{}, ErrCryptoFailure } - -func (obj JSONWebSignature) headers() []Header { - headers := make([]Header, len(obj.Signatures)) - for i, sig := range obj.Signatures { - headers[i] = sig.Header - } - return headers -} diff --git a/vendor/github.com/go-jose/go-jose/v4/symmetric.go b/vendor/github.com/go-jose/go-jose/v4/symmetric.go index f2ff29e179..ca597d6a12 100644 --- a/vendor/github.com/go-jose/go-jose/v4/symmetric.go +++ b/vendor/github.com/go-jose/go-jose/v4/symmetric.go @@ -34,8 +34,8 @@ import ( josecipher "github.com/go-jose/go-jose/v4/cipher" ) -// RandReader is a cryptographically secure random number generator (stubbed out in tests). -var RandReader = rand.Reader +// randReader is a cryptographically secure random number generator (stubbed out in tests). +var randReader = rand.Reader const ( // RFC7518 recommends a minimum of 1,000 iterations: @@ -153,7 +153,7 @@ func getPbkdf2Params(alg KeyAlgorithm) (int, func() hash.Hash) { // getRandomSalt generates a new salt of the given size. func getRandomSalt(size int) ([]byte, error) { salt := make([]byte, size) - _, err := io.ReadFull(RandReader, salt) + _, err := io.ReadFull(randReader, salt) if err != nil { return nil, err } @@ -198,7 +198,7 @@ func newSymmetricSigner(sigAlg SignatureAlgorithm, key []byte) (recipientSigInfo // Generate a random key for the given content cipher func (ctx randomKeyGenerator) genKey() ([]byte, rawHeader, error) { key := make([]byte, ctx.size) - _, err := io.ReadFull(RandReader, key) + _, err := io.ReadFull(randReader, key) if err != nil { return nil, rawHeader{}, err } @@ -238,7 +238,7 @@ func (ctx aeadContentCipher) encrypt(key, aad, pt []byte) (*aeadParts, error) { // Initialize a new nonce iv := make([]byte, aead.NonceSize()) - _, err = io.ReadFull(RandReader, iv) + _, err = io.ReadFull(randReader, iv) if err != nil { return nil, err } diff --git a/vendor/github.com/google/go-containerregistry/internal/ipaddr/ipaddr.go b/vendor/github.com/google/go-containerregistry/internal/ipaddr/ipaddr.go new file mode 100644 index 0000000000..a7f5b8a4b4 --- /dev/null +++ b/vendor/github.com/google/go-containerregistry/internal/ipaddr/ipaddr.go @@ -0,0 +1,82 @@ +// Copyright 2026 Google LLC All Rights Reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package ipaddr + +import ( + "net/netip" + "strconv" + "strings" +) + +// IsPrivateOrLinkLocal reports whether host denotes a loopback, private, +// link-local, or unspecified address. It accepts any IP-literal form the Go +// dialer accepts — canonical dotted-quad IPv4 and IPv6, zone-qualified and +// IPv4-mapped IPv6, and legacy inet_aton encodings (32-bit decimal +// "2130706433", hexadecimal "0x7f000001", partial dotted-quad "127.1", +// zero-padded octets) — so a guard based on it cannot be bypassed by +// spelling an internal address in a non-canonical way. DNS names are not IP +// literals and return false. +func IsPrivateOrLinkLocal(host string) bool { + addr, ok := Parse(host) + if !ok { + return false + } + return addr.IsLoopback() || addr.IsLinkLocalUnicast() || addr.IsLinkLocalMulticast() || + addr.IsPrivate() || addr.IsUnspecified() +} + +// Parse parses an IP literal in any form the Go dialer accepts. +func Parse(host string) (netip.Addr, bool) { + // The dialer ignores IPv6 zone identifiers, so guards must too. + host, _, _ = strings.Cut(host, "%") + if addr, err := netip.ParseAddr(host); err == nil { + // Treat IPv4-mapped IPv6 as the IPv4 address the dialer connects to. + return addr.WithZone("").Unmap(), true + } + return parseLegacyIPv4(host) +} + +// parseLegacyIPv4 implements the inet_aton forms the Go resolver accepts for +// IPv4: one to four dot-separated parts where the final part may fill the +// remaining bytes ("127.1" == 127.0.0.1) and each part may be decimal, +// hexadecimal (0x prefix), or octal (leading 0). +func parseLegacyIPv4(host string) (netip.Addr, bool) { + parts := strings.Split(host, ".") + if len(parts) < 1 || len(parts) > 4 { + return netip.Addr{}, false + } + var b [4]byte + for i, part := range parts[:len(parts)-1] { + // bitsize 8 enforces the single-octet range before any conversion. + v, err := strconv.ParseUint(part, 0, 8) + if err != nil { + return netip.Addr{}, false + } + b[i] = byte(v) + } + // The final part may fill as many bytes as remain, e.g. "127.1" -> 127.0.0.1; + // with four parts it must still be a single octet. The bitsize enforces the + // range before the conversion below. + lastBits := [...]int{32, 24, 16, 8}[len(parts)-1] + last, err := strconv.ParseUint(parts[len(parts)-1], 0, lastBits) + if err != nil { + return netip.Addr{}, false + } + v := uint32(last) + for i := len(parts) - 1; i < 4; i++ { + b[i] = byte(v >> (8 * (3 - i))) + } + return netip.AddrFrom4(b), true +} diff --git a/vendor/github.com/google/go-containerregistry/internal/verify/verify.go b/vendor/github.com/google/go-containerregistry/internal/verify/verify.go index 463f7e4b39..ff48ba8719 100644 --- a/vendor/github.com/google/go-containerregistry/internal/verify/verify.go +++ b/vendor/github.com/google/go-containerregistry/internal/verify/verify.go @@ -17,7 +17,6 @@ package verify import ( - "bytes" "encoding/hex" "errors" "fmt" @@ -107,10 +106,16 @@ func Descriptor(d v1.Descriptor) error { return errors.New("error verifying descriptor; Data == nil") } - h, sz, err := v1.SHA256(bytes.NewReader(d.Data)) + hasher, err := v1.Hasher(d.Digest.Algorithm) if err != nil { return err } + hasher.Write(d.Data) + h := v1.Hash{ + Algorithm: d.Digest.Algorithm, + Hex: hex.EncodeToString(hasher.Sum(make([]byte, 0, hasher.Size()))), + } + sz := int64(len(d.Data)) if h != d.Digest { return fmt.Errorf("error verifying Digest; got %q, want %q", h, d.Digest) } diff --git a/vendor/github.com/google/go-containerregistry/pkg/authn/authn.go b/vendor/github.com/google/go-containerregistry/pkg/authn/authn.go index 1555efae04..c962235c74 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/authn/authn.go +++ b/vendor/github.com/google/go-containerregistry/pkg/authn/authn.go @@ -89,7 +89,9 @@ func (a *AuthConfig) UnmarshalJSON(data []byte) error { // MarshalJSON implements json.Marshaler func (a AuthConfig) MarshalJSON() ([]byte, error) { shadow := (authConfig)(a) - shadow.Auth = encodeDockerConfigFieldAuth(shadow.Username, shadow.Password) + if shadow.Username != "" || shadow.Password != "" { + shadow.Auth = encodeDockerConfigFieldAuth(shadow.Username, shadow.Password) + } return json.Marshal(shadow) } diff --git a/vendor/github.com/google/go-containerregistry/pkg/name/digest.go b/vendor/github.com/google/go-containerregistry/pkg/name/digest.go index 5b8eb4ff46..9d6650ee62 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/name/digest.go +++ b/vendor/github.com/google/go-containerregistry/pkg/name/digest.go @@ -17,6 +17,8 @@ package name import ( // nolint: depguard _ "crypto/sha256" // Recommended by go-digest. + // nolint: depguard + _ "crypto/sha512" // Needed for sha512 digests. "encoding" "encoding/json" "strings" @@ -107,13 +109,8 @@ func NewDigest(name string, opts ...Option) (Digest, error) { } base := parts[0] dig := parts[1] - prefix := digest.Canonical.String() + ":" - if !strings.HasPrefix(dig, prefix) { - return Digest{}, newErrBadName("unsupported digest algorithm: %s", dig) - } - hex := strings.TrimPrefix(dig, prefix) - if err := digest.Canonical.Validate(hex); err != nil { - return Digest{}, err + if err := digest.Digest(dig).Validate(); err != nil { + return Digest{}, newErrBadName("%s: %s", err, dig) } tag, err := NewTag(base, opts...) diff --git a/vendor/github.com/google/go-containerregistry/pkg/name/ref.go b/vendor/github.com/google/go-containerregistry/pkg/name/ref.go index 539d0ff318..1ce999a2e3 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/name/ref.go +++ b/vendor/github.com/google/go-containerregistry/pkg/name/ref.go @@ -16,6 +16,7 @@ package name import ( "fmt" + "strings" ) // Reference defines the interface that consumers use when they can @@ -39,6 +40,11 @@ type Reference interface { // ParseReference parses the string as a reference, either by tag or digest. // References that include both a tag and digest parse as Digest references. func ParseReference(s string, opts ...Option) (Reference, error) { + // Image references never contain a URL scheme, so tell the user to + // strip it instead of returning a confusing parse error. + if strings.HasPrefix(s, "http://") || strings.HasPrefix(s, "https://") { + return nil, newErrBadName("image reference must not contain a URL scheme (http:// or https://): %s; to connect to a registry over plain HTTP, use name.Insecure", s) + } if t, err := NewTag(s, opts...); err == nil { return t, nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/name/repository.go b/vendor/github.com/google/go-containerregistry/pkg/name/repository.go index efde6e869d..ad7b329111 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/name/repository.go +++ b/vendor/github.com/google/go-containerregistry/pkg/name/repository.go @@ -72,7 +72,7 @@ func (r Repository) Scope(action string) string { } func checkRepository(repository string) error { - return checkElement("repository", repository, repositoryChars, 2, 255) + return checkElement("repository", repository, repositoryChars, 1, 255) } // NewRepository returns a new Repository representing the given name, according to the given strictness. diff --git a/vendor/github.com/google/go-containerregistry/pkg/registry/manifest.go b/vendor/github.com/google/go-containerregistry/pkg/registry/manifest.go index db8a8dc690..fc9c4a77dd 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/registry/manifest.go +++ b/vendor/github.com/google/go-containerregistry/pkg/registry/manifest.go @@ -426,6 +426,7 @@ func (m *manifests) handleReferrers(resp http.ResponseWriter, req *http.Request) Config struct { MediaType string `json:"mediaType"` } `json:"config"` + Annotations map[string]string `json:"annotations"` } json.Unmarshal(manifest.blob, &imageAsArtifact) im.Manifests = append(im.Manifests, v1.Descriptor{ @@ -433,6 +434,7 @@ func (m *manifests) handleReferrers(resp http.ResponseWriter, req *http.Request) Size: int64(len(manifest.blob)), Digest: h, ArtifactType: imageAsArtifact.Config.MediaType, + Annotations: imageAsArtifact.Annotations, }) } msg, _ := json.Marshal(&im) diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/hash.go b/vendor/github.com/google/go-containerregistry/pkg/v1/hash.go index bbb600ed7f..4114d5ab2e 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/hash.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/hash.go @@ -16,6 +16,10 @@ package v1 import ( "crypto" + // nolint: depguard + _ "crypto/sha256" // Registered for Hasher. + // nolint: depguard + _ "crypto/sha512" // Registered for Hasher. "encoding" "encoding/hex" "encoding/json" @@ -78,6 +82,8 @@ func Hasher(name string) (hash.Hash, error) { switch name { case "sha256": return crypto.SHA256.New(), nil + case "sha512": + return crypto.SHA512.New(), nil default: return nil, fmt.Errorf("unsupported hash: %q", name) } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.go index a6fdaceed5..7b4ed0884f 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.go @@ -56,6 +56,9 @@ func computeDescriptor(ia IndexAddendum) (*v1.Descriptor, error) { if ia.Data != nil { desc.Data = ia.Data } + if ia.ArtifactType != "" { + desc.ArtifactType = ia.ArtifactType + } return desc, nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go index 596c78cb26..00ad8c0d49 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go @@ -24,9 +24,9 @@ import ( "maps" "path" "strings" + "sync" "time" - "github.com/google/go-containerregistry/internal/gzip" v1 "github.com/google/go-containerregistry/pkg/v1" "github.com/google/go-containerregistry/pkg/v1/empty" "github.com/google/go-containerregistry/pkg/v1/match" @@ -469,7 +469,8 @@ func hasWindowsDrivePrefix(name string) bool { } // Time sets all timestamps in an image to the given timestamp. -func Time(img v1.Image, t time.Time) (v1.Image, error) { +// Layers are rewritten as dockerv2+gzip unless opts say otherwise. +func Time(img v1.Image, t time.Time, opts ...tarball.LayerOption) (v1.Image, error) { newImage := empty.Image layers, err := img.Layers() @@ -485,10 +486,7 @@ func Time(img v1.Image, t time.Time) (v1.Image, error) { addendums := make([]Addendum, max(len(ocf.History), len(layers))) var historyIdx, addendumIdx int for layerIdx := 0; layerIdx < len(layers); addendumIdx, layerIdx = addendumIdx+1, layerIdx+1 { - newLayer, err := layerTime(layers[layerIdx], t) - if err != nil { - return nil, fmt.Errorf("setting layer times: %w", err) - } + newLayer := layerTime(layers[layerIdx], t, opts...) // try to search for the history entry that corresponds to this layer for ; historyIdx < len(ocf.History); historyIdx++ { @@ -547,7 +545,28 @@ func Time(img v1.Image, t time.Time) (v1.Image, error) { return ConfigFile(newImage, cfg) } -func layerTime(layer v1.Layer, t time.Time) (v1.Layer, error) { +func layerTime(layer v1.Layer, t time.Time, opts ...tarball.LayerOption) v1.Layer { + return &timeLayer{inner: layer, t: t, opts: opts} +} + +type timeLayer struct { + inner v1.Layer + t time.Time + opts []tarball.LayerOption + + once sync.Once + material v1.Layer + err error +} + +func (l *timeLayer) materialize() error { + l.once.Do(func() { + l.material, l.err = materializeLayerTime(l.inner, l.t, l.opts...) + }) + return l.err +} + +func materializeLayerTime(layer v1.Layer, t time.Time, opts ...tarball.LayerOption) (v1.Layer, error) { layerReader, err := layer.Uncompressed() if err != nil { return nil, fmt.Errorf("getting layer: %w", err) @@ -580,7 +599,6 @@ func layerTime(layer v1.Layer, t time.Time) (v1.Layer, error) { } if header.Typeflag == tar.TypeReg { - // TODO(#1168): This should be lazy, and not buffer the entire layer contents. if _, err = io.CopyN(tarWriter, tarReader, header.Size); err != nil { return nil, fmt.Errorf("writing layer file: %w", err) } @@ -598,24 +616,65 @@ func layerTime(layer v1.Layer, t time.Time) (v1.Layer, error) { } b := w.Bytes() - // gzip the contents, then create the layer opener := func() (io.ReadCloser, error) { - return gzip.ReadCloser(io.NopCloser(bytes.NewReader(b))), nil + return io.NopCloser(bytes.NewReader(b)), nil } - layer, err = tarball.LayerFromOpener(opener) + newLayer, err := tarball.LayerFromOpener(opener, opts...) if err != nil { return nil, fmt.Errorf("creating layer: %w", err) } - return layer, nil + return newLayer, nil +} + +func (l *timeLayer) Compressed() (io.ReadCloser, error) { + if err := l.materialize(); err != nil { + return nil, err + } + return l.material.Compressed() +} + +func (l *timeLayer) Uncompressed() (io.ReadCloser, error) { + if err := l.materialize(); err != nil { + return nil, err + } + return l.material.Uncompressed() +} + +func (l *timeLayer) Size() (int64, error) { + if err := l.materialize(); err != nil { + return 0, err + } + return l.material.Size() +} + +func (l *timeLayer) DiffID() (v1.Hash, error) { + if err := l.materialize(); err != nil { + return v1.Hash{}, err + } + return l.material.DiffID() +} + +func (l *timeLayer) Digest() (v1.Hash, error) { + if err := l.materialize(); err != nil { + return v1.Hash{}, err + } + return l.material.Digest() +} + +func (l *timeLayer) MediaType() (types.MediaType, error) { + if err := l.materialize(); err != nil { + return "", err + } + return l.material.MediaType() } // Canonical is a helper function to combine Time and configFile // to remove any randomness during a docker build. -func Canonical(img v1.Image) (v1.Image, error) { +func Canonical(img v1.Image, opts ...tarball.LayerOption) (v1.Image, error) { // Set all timestamps to 0 created := time.Time{} - img, err := Time(img, created) + img, err := Time(img, created, opts...) if err != nil { return nil, err } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go index ac879a6737..06e9099086 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go @@ -32,9 +32,9 @@ import ( // // TODO(#412): Remove the need for this method. func CheckPushPermission(ref name.Reference, kc authn.Keychain, t http.RoundTripper) error { - auth, err := kc.Resolve(ref.Context().Registry) + auth, err := authn.Resolve(context.TODO(), kc, ref.Context()) if err != nil { - return fmt.Errorf("resolving authorization for %v failed: %w", ref.Context().Registry, err) + return fmt.Errorf("resolving authorization for %v failed: %w", ref.Context(), err) } scopes := []string{ref.Scope(transport.PushScope)} @@ -50,7 +50,7 @@ func CheckPushPermission(ref name.Reference, kc authn.Keychain, t http.RoundTrip // to avoid a roundtrip for spec-compliant registries. w := writer{ repo: ref.Context(), - client: &http.Client{Transport: tr}, + client: &http.Client{Transport: tr, CheckRedirect: checkRedirectSSRF}, } loc, _, err := w.initiateUpload(context.Background(), "", "", "") if loc != "" { diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.go index 4b238d1290..26605d979d 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.go @@ -17,13 +17,14 @@ package remote import ( "bytes" "context" + "encoding/hex" "fmt" "io" - "net" "net/http" "net/url" "strings" + "github.com/google/go-containerregistry/internal/ipaddr" "github.com/google/go-containerregistry/internal/limit" "github.com/google/go-containerregistry/internal/redact" "github.com/google/go-containerregistry/internal/verify" @@ -98,10 +99,8 @@ func checkRedirectSSRF(req *http.Request, via []*http.Request) error { if destHost == origHost { return nil // same-host redirect is always allowed } - if ip := net.ParseIP(destHost); ip != nil { - if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() || ip.IsUnspecified() { - return fmt.Errorf("SSRF protection: redirect from %q to private/link-local host %q denied", origHost, destHost) - } + if ipaddr.IsPrivateOrLinkLocal(destHost) { + return fmt.Errorf("SSRF protection: redirect from %q to private/link-local host %q denied", origHost, destHost) } return nil } @@ -174,10 +173,26 @@ func (f *fetcher) fetchManifest(ctx context.Context, ref name.Reference, accepta return nil, nil, err } - digest, size, err := v1.SHA256(bytes.NewReader(manifest)) + // Hash with the algorithm of the reference when pulling by digest. + dgst, byDigest := ref.(name.Digest) + algo := "sha256" + if byDigest { + h, err := v1.NewHash(dgst.DigestStr()) + if err != nil { + return nil, nil, err + } + algo = h.Algorithm + } + hasher, err := v1.Hasher(algo) if err != nil { return nil, nil, err } + hasher.Write(manifest) + digest := v1.Hash{ + Algorithm: algo, + Hex: hex.EncodeToString(hasher.Sum(make([]byte, 0, hasher.Size()))), + } + size := int64(len(manifest)) mediaType := types.MediaType(resp.Header.Get("Content-Type")) contentDigest, err := v1.NewHash(resp.Header.Get("Docker-Content-Digest")) @@ -188,7 +203,7 @@ func (f *fetcher) fetchManifest(ctx context.Context, ref name.Reference, accepta } // Validate the digest matches what we asked for, if pulling by digest. - if dgst, ok := ref.(name.Digest); ok { + if byDigest { if digest.String() != dgst.DigestStr() { return nil, nil, fmt.Errorf("manifest digest: %q does not match requested digest: %q for %q", digest, dgst.DigestStr(), ref) } @@ -380,10 +395,8 @@ func validateForeignURL(rawURL string, insecure bool) error { return fmt.Errorf("foreign layer URL scheme %q not allowed; must be https (or http for insecure registries)", u.Scheme) } host := u.Hostname() - if ip := net.ParseIP(host); ip != nil { - if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() || ip.IsUnspecified() { - return fmt.Errorf("foreign layer URL host %q is a private or link-local address", host) - } + if ipaddr.IsPrivateOrLinkLocal(host) { + return fmt.Errorf("foreign layer URL host %q is a private or link-local address", host) } return nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go index bcb0d7350f..094162ec44 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go @@ -76,7 +76,11 @@ func (p *Puller) fetcher(ctx context.Context, target resource) (*fetcher, error) o: p.o, }) rr := v.(*reader) - return rr.f, rr.init(ctx) + if err := rr.init(ctx); err != nil { + p.readers.CompareAndDelete(target, rr) + return nil, err + } + return rr.f, nil } // Head is like remote.Head, but avoids re-authenticating when possible. diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go index 3a1d16f544..3466c7a671 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go @@ -122,7 +122,11 @@ func (p *Pusher) writer(ctx context.Context, repo name.Repository, o *options) ( o: o, }) rw := v.(*repoWriter) - return rw, rw.init(ctx) + if err := rw.init(ctx); err != nil { + p.writers.CompareAndDelete(repo, rw) + return nil, err + } + return rw, nil } func (p *Pusher) Put(ctx context.Context, ref name.Reference, t Taggable) error { diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go index f576ccd300..b984827633 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go @@ -25,6 +25,7 @@ import ( "strings" "sync" + "github.com/google/go-containerregistry/internal/ipaddr" "github.com/google/go-containerregistry/internal/limit" "github.com/google/go-containerregistry/internal/redact" "github.com/google/go-containerregistry/pkg/authn" @@ -151,10 +152,8 @@ func validateRealmURL(realm, registryHost string, insecure bool) error { // (169.254.169.254 / fd00:ec2::254). DNS-based SSRF is out of scope // here; callers should apply network-level controls if needed. host := u.Hostname() - if ip := net.ParseIP(host); ip != nil { - if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() || ip.IsUnspecified() { - return fmt.Errorf("realm host %q is a private or link-local address", host) - } + if ipaddr.IsPrivateOrLinkLocal(host) { + return fmt.Errorf("realm host %q is a private or link-local address", host) } return nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go index 01e9c767bb..4064711f46 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go @@ -21,13 +21,13 @@ import ( "errors" "fmt" "io" - "net" "net/http" "net/url" "sort" "strings" "sync" + "github.com/google/go-containerregistry/internal/ipaddr" "github.com/google/go-containerregistry/internal/redact" "github.com/google/go-containerregistry/internal/retry" "github.com/google/go-containerregistry/pkg/authn" @@ -92,7 +92,7 @@ func makeDeleteClient(ctx context.Context, repo name.Repository, o *options) (*h if err != nil { return nil, err } - return &http.Client{Transport: tr}, nil + return &http.Client{Transport: tr, CheckRedirect: checkRedirectSSRF}, nil } func makeWriter(ctx context.Context, repo name.Repository, ls []v1.Layer, o *options) (*writer, error) { @@ -116,7 +116,7 @@ func makeWriter(ctx context.Context, repo name.Repository, ls []v1.Layer, o *opt } return &writer{ repo: repo, - client: &http.Client{Transport: tr}, + client: &http.Client{Transport: tr, CheckRedirect: checkRedirectSSRF}, auth: auth, transport: o.transport, progress: o.progress, @@ -159,7 +159,7 @@ func (w *writer) maybeUpdateScopes(ctx context.Context, ml *MountableLayer) erro if err != nil { return err } - w.client = &http.Client{Transport: wt} + w.client = &http.Client{Transport: wt, CheckRedirect: checkRedirectSSRF} } return nil @@ -193,10 +193,8 @@ func (w *writer) nextLocation(resp *http.Response) (string, error) { // always allowed regardless of whether the registry IP is private. origHost := resp.Request.URL.Hostname() if destHost := resolved.Hostname(); destHost != origHost { - if ip := net.ParseIP(destHost); ip != nil { - if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() || ip.IsUnspecified() { - return "", fmt.Errorf("SSRF protection: Location header redirects to private/link-local host %q", destHost) - } + if ipaddr.IsPrivateOrLinkLocal(destHost) { + return "", fmt.Errorf("SSRF protection: Location header redirects to private/link-local host %q", destHost) } } @@ -610,9 +608,10 @@ func (w *writer) commitManifest(ctx context.Context, t Taggable, ref name.Refere return err } var mf struct { - MediaType types.MediaType `json:"mediaType"` - Subject *v1.Descriptor `json:"subject,omitempty"` - ArtifactType string `json:"artifactType,omitempty"` + MediaType types.MediaType `json:"mediaType"` + Subject *v1.Descriptor `json:"subject,omitempty"` + ArtifactType string `json:"artifactType,omitempty"` + Annotations map[string]string `json:"annotations,omitempty"` Config struct { MediaType types.MediaType `json:"mediaType"` } `json:"config"` @@ -655,9 +654,10 @@ func (w *writer) commitManifest(ctx context.Context, t Taggable, ref name.Refere return err } desc := v1.Descriptor{ - MediaType: mf.MediaType, - Digest: h, - Size: size, + MediaType: mf.MediaType, + Digest: h, + Size: size, + Annotations: mf.Annotations, } if mf.ArtifactType != "" { desc.ArtifactType = mf.ArtifactType diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/types/types.go b/vendor/github.com/google/go-containerregistry/pkg/v1/types/types.go index c86657d7b8..69878980b5 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/types/types.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/types/types.go @@ -29,6 +29,7 @@ const ( OCIRestrictedLayer MediaType = "application/vnd.oci.image.layer.nondistributable.v1.tar+gzip" OCIUncompressedLayer MediaType = "application/vnd.oci.image.layer.v1.tar" OCIUncompressedRestrictedLayer MediaType = "application/vnd.oci.image.layer.nondistributable.v1.tar" + OCIEmptyJSON MediaType = "application/vnd.oci.empty.v1+json" DockerManifestSchema1 MediaType = "application/vnd.docker.distribution.manifest.v1+json" DockerManifestSchema1Signed MediaType = "application/vnd.docker.distribution.manifest.v1+prettyjws" diff --git a/vendor/github.com/googleapis/gax-go/v2/.release-please-manifest.json b/vendor/github.com/googleapis/gax-go/v2/.release-please-manifest.json index 90b5af3c47..b0a3abaa78 100644 --- a/vendor/github.com/googleapis/gax-go/v2/.release-please-manifest.json +++ b/vendor/github.com/googleapis/gax-go/v2/.release-please-manifest.json @@ -1,3 +1,3 @@ { - "v2": "2.23.0" + "v2": "2.24.0" } diff --git a/vendor/github.com/googleapis/gax-go/v2/CHANGES.md b/vendor/github.com/googleapis/gax-go/v2/CHANGES.md index d7559b7532..6402fb18eb 100644 --- a/vendor/github.com/googleapis/gax-go/v2/CHANGES.md +++ b/vendor/github.com/googleapis/gax-go/v2/CHANGES.md @@ -1,5 +1,12 @@ # Changes +## [2.24.0](https://github.com/googleapis/gax-go/compare/v2.23.0...v2.24.0) (2026-08-20) + + +### Features + +* **iterator:** remove build constraint ([#525](https://github.com/googleapis/gax-go/issues/525)) ([b3f4053](https://github.com/googleapis/gax-go/commit/b3f40539135c909c38030fda9b1a25503d576051)) + ## [2.23.0](https://github.com/googleapis/gax-go/compare/v2.22.0...v2.23.0) (2026-07-07) diff --git a/vendor/github.com/googleapis/gax-go/v2/internal/version.go b/vendor/github.com/googleapis/gax-go/v2/internal/version.go index d35188c502..ca9382d528 100644 --- a/vendor/github.com/googleapis/gax-go/v2/internal/version.go +++ b/vendor/github.com/googleapis/gax-go/v2/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "2.23.0" +const Version = "2.24.0" diff --git a/vendor/github.com/googleapis/gax-go/v2/iterator/iterator.go b/vendor/github.com/googleapis/gax-go/v2/iterator/iterator.go index d4d6019ff6..ef777a7247 100644 --- a/vendor/github.com/googleapis/gax-go/v2/iterator/iterator.go +++ b/vendor/github.com/googleapis/gax-go/v2/iterator/iterator.go @@ -27,8 +27,6 @@ // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -//go:build go1.23 - // Package iterator contains helper for working with iterators. It is meant for // internal use only by the Go Client Libraries. package iterator diff --git a/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go b/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go index 2d6ef64be1..7035d656d9 100644 --- a/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go +++ b/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go @@ -1,222 +1,49 @@ //go:build amd64 && !appengine && !noasm && gc -// This file contains the specialisation of Decoder.Decompress4X -// and Decoder.Decompress1X that use an asm implementation of thir main loops. +// amd64 stubs and dispatch for the asm loops used by decompress_asm.go. package huff0 import ( - "errors" - "fmt" - "github.com/klauspost/compress/internal/cpuinfo" ) -// decompress4x_main_loop_x86 is an x86 assembler implementation +// decompress4x_main_loop_amd64 is an x86 assembler implementation // of Decompress4X when tablelog > 8. // //go:noescape func decompress4x_main_loop_amd64(ctx *decompress4xContext) -// decompress4x_8b_loop_x86 is an x86 assembler implementation +// decompress4x_8b_main_loop_amd64 is an x86 assembler implementation // of Decompress4X when tablelog <= 8 which decodes 4 entries // per loop. // //go:noescape func decompress4x_8b_main_loop_amd64(ctx *decompress4xContext) -// fallback8BitSize is the size where using Go version is faster. -const fallback8BitSize = 800 - -type decompress4xContext struct { - pbr *[4]bitReaderShifted - peekBits uint8 - out *byte - dstEvery int - tbl *dEntrySingle - decoded int - limit *byte -} - -// Decompress4X will decompress a 4X encoded stream. -// The length of the supplied input must match the end of a block exactly. -// The *capacity* of the dst slice must match the destination size of -// the uncompressed data exactly. -func (d *Decoder) Decompress4X(dst, src []byte) ([]byte, error) { - if len(d.dt.single) == 0 { - return nil, errors.New("no table loaded") - } - if len(src) < 6+(4*1) { - return nil, errors.New("input too small") - } - - use8BitTables := d.actualTableLog <= 8 - if cap(dst) < fallback8BitSize && use8BitTables { - return d.decompress4X8bit(dst, src) - } - - var br [4]bitReaderShifted - // Decode "jump table" - start := 6 - for i := range 3 { - length := int(src[i*2]) | (int(src[i*2+1]) << 8) - if start+length >= len(src) { - return nil, errors.New("truncated input (or invalid offset)") - } - err := br[i].init(src[start : start+length]) - if err != nil { - return nil, err - } - start += length - } - err := br[3].init(src[start:]) - if err != nil { - return nil, err - } - - // destination, offset to match first output - dstSize := cap(dst) - dst = dst[:dstSize] - out := dst - dstEvery := (dstSize + 3) / 4 - - const tlSize = 1 << tableLogMax - const tlMask = tlSize - 1 - single := d.dt.single[:tlSize] - - var decoded int - - if len(out) > 4*4 && !(br[0].off < 4 || br[1].off < 4 || br[2].off < 4 || br[3].off < 4) { - ctx := decompress4xContext{ - pbr: &br, - peekBits: uint8((64 - d.actualTableLog) & 63), // see: bitReaderShifted.peekBitsFast() - out: &out[0], - dstEvery: dstEvery, - tbl: &single[0], - limit: &out[dstEvery-4], // Always stop decoding when first buffer gets here to avoid writing OOB on last. - } - if use8BitTables { - decompress4x_8b_main_loop_amd64(&ctx) - } else { - decompress4x_main_loop_amd64(&ctx) - } - - decoded = ctx.decoded - out = out[decoded/4:] - } - - // Decode remaining. - remainBytes := dstEvery - (decoded / 4) - for i := range br { - offset := dstEvery * i - endsAt := min(offset+remainBytes, len(out)) - br := &br[i] - bitsLeft := br.remaining() - for bitsLeft > 0 { - br.fill() - if offset >= endsAt { - return nil, errors.New("corruption detected: stream overrun 4") - } - - // Read value and increment offset. - val := br.peekBitsFast(d.actualTableLog) - v := single[val&tlMask].entry - nBits := uint8(v) - br.advance(nBits) - bitsLeft -= uint(nBits) - out[offset] = uint8(v >> 8) - offset++ - } - if offset != endsAt { - return nil, fmt.Errorf("corruption detected: short output block %d, end %d != %d", i, offset, endsAt) - } - decoded += offset - dstEvery*i - err = br.close() - if err != nil { - return nil, err - } - } - if dstSize != decoded { - return nil, errors.New("corruption detected: short output block") - } - return dst, nil -} - -// decompress4x_main_loop_x86 is an x86 assembler implementation +// decompress1x_main_loop_amd64 is an x86 assembler implementation // of Decompress1X when tablelog > 8. // //go:noescape func decompress1x_main_loop_amd64(ctx *decompress1xContext) -// decompress4x_main_loop_x86 is an x86 with BMI2 assembler implementation +// decompress1x_main_loop_bmi2 is an x86 with BMI2 assembler implementation // of Decompress1X when tablelog > 8. // //go:noescape func decompress1x_main_loop_bmi2(ctx *decompress1xContext) -type decompress1xContext struct { - pbr *bitReaderShifted - peekBits uint8 - out *byte - outCap int - tbl *dEntrySingle - decoded int +func decompress4x_main_loop_asm(ctx *decompress4xContext) { + decompress4x_main_loop_amd64(ctx) } -// Error reported by asm implementations -const error_max_decoded_size_exeeded = -1 - -// Decompress1X will decompress a 1X encoded stream. -// The cap of the output buffer will be the maximum decompressed size. -// The length of the supplied input must match the end of a block exactly. -func (d *Decoder) Decompress1X(dst, src []byte) ([]byte, error) { - if len(d.dt.single) == 0 { - return nil, errors.New("no table loaded") - } - var br bitReaderShifted - err := br.init(src) - if err != nil { - return dst, err - } - maxDecodedSize := cap(dst) - dst = dst[:maxDecodedSize] - - const tlSize = 1 << tableLogMax - const tlMask = tlSize - 1 - - if maxDecodedSize >= 4 { - ctx := decompress1xContext{ - pbr: &br, - out: &dst[0], - outCap: maxDecodedSize, - peekBits: uint8((64 - d.actualTableLog) & 63), // see: bitReaderShifted.peekBitsFast() - tbl: &d.dt.single[0], - } - - if cpuinfo.HasBMI2() { - decompress1x_main_loop_bmi2(&ctx) - } else { - decompress1x_main_loop_amd64(&ctx) - } - if ctx.decoded == error_max_decoded_size_exeeded { - return nil, ErrMaxDecodedSizeExceeded - } - - dst = dst[:ctx.decoded] - } +func decompress4x_8b_main_loop_asm(ctx *decompress4xContext) { + decompress4x_8b_main_loop_amd64(ctx) +} - // br < 8, so uint8 is fine - bitsLeft := uint8(br.off)*8 + 64 - br.bitsRead - for bitsLeft > 0 { - br.fill() - if len(dst) >= maxDecodedSize { - br.close() - return nil, ErrMaxDecodedSizeExceeded - } - v := d.dt.single[br.peekBitsFast(d.actualTableLog)&tlMask] - nBits := uint8(v.entry) - br.advance(nBits) - bitsLeft -= nBits - dst = append(dst, uint8(v.entry>>8)) +func decompress1x_main_loop_asm(ctx *decompress1xContext) { + if cpuinfo.HasBMI2() { + decompress1x_main_loop_bmi2(ctx) + } else { + decompress1x_main_loop_amd64(ctx) } - return dst, br.close() } diff --git a/vendor/github.com/klauspost/compress/huff0/decompress_amd64.s b/vendor/github.com/klauspost/compress/huff0/decompress_amd64.s index c4c7ab2d1f..c5d4a710a0 100644 --- a/vendor/github.com/klauspost/compress/huff0/decompress_amd64.s +++ b/vendor/github.com/klauspost/compress/huff0/decompress_amd64.s @@ -1,6 +1,6 @@ -// Code generated by command: go run gen.go -out ../decompress_amd64.s -pkg=huff0. DO NOT EDIT. +// Code generated by command: go run gen.go -out ../decompress.s -arch amd64,arm64 -pkg=huff0. DO NOT EDIT. -//go:build amd64 && !appengine && !noasm && gc +//go:build !appengine && !noasm && gc // func decompress4x_main_loop_amd64(ctx *decompress4xContext) TEXT ·decompress4x_main_loop_amd64(SB), $0-8 diff --git a/vendor/github.com/klauspost/compress/huff0/decompress_arm64.go b/vendor/github.com/klauspost/compress/huff0/decompress_arm64.go new file mode 100644 index 0000000000..8ba3c810e6 --- /dev/null +++ b/vendor/github.com/klauspost/compress/huff0/decompress_arm64.go @@ -0,0 +1,37 @@ +//go:build arm64 && !appengine && !noasm && gc + +// arm64 stubs and dispatch for the asm loops used by decompress_asm.go. +// The asm (decompress_arm64.s) is generated by the avo arm64 lowering +// printer from the same source as the amd64 asm; see _generate/gen.go. +package huff0 + +// decompress4x_main_loop_arm64 is an arm64 assembler implementation +// of Decompress4X when tablelog > 8. +// +//go:noescape +func decompress4x_main_loop_arm64(ctx *decompress4xContext) + +// decompress4x_8b_main_loop_arm64 is an arm64 assembler implementation +// of Decompress4X when tablelog <= 8 which decodes 4 entries +// per loop. +// +//go:noescape +func decompress4x_8b_main_loop_arm64(ctx *decompress4xContext) + +// decompress1x_main_loop_arm64 is an arm64 assembler implementation +// of Decompress1X when tablelog > 8. +// +//go:noescape +func decompress1x_main_loop_arm64(ctx *decompress1xContext) + +func decompress4x_main_loop_asm(ctx *decompress4xContext) { + decompress4x_main_loop_arm64(ctx) +} + +func decompress4x_8b_main_loop_asm(ctx *decompress4xContext) { + decompress4x_8b_main_loop_arm64(ctx) +} + +func decompress1x_main_loop_asm(ctx *decompress1xContext) { + decompress1x_main_loop_arm64(ctx) +} diff --git a/vendor/github.com/klauspost/compress/huff0/decompress_arm64.s b/vendor/github.com/klauspost/compress/huff0/decompress_arm64.s new file mode 100644 index 0000000000..e16012721a --- /dev/null +++ b/vendor/github.com/klauspost/compress/huff0/decompress_arm64.s @@ -0,0 +1,851 @@ +// Code generated by command: go run gen.go -out ../decompress.s -arch amd64,arm64 -pkg=huff0. DO NOT EDIT. +// EXPERIMENTAL arm64 output lowered from an amd64 avo program. + +//go:build arm64 && !appengine && !noasm && gc + +// func decompress4x_main_loop_amd64(ctx *decompress4xContext) +TEXT ·decompress4x_main_loop_arm64(SB), $0-8 + // Preload values + MOVD ctx+0(FP), R0 + MOVBU 8(R0), R6 + MOVD 16(R0), R3 + MOVD 48(R0), R5 + MOVD 24(R0), R7 + MOVD 32(R0), R8 + MOVD (R0), R9 + + // Main loop +main_loop: + MOVD $0, R2 + CMP R5, R3 + CSET GE, R16 + BFI $0, R16, $8, R2 + + // br0.fillFast32() + MOVD 32(R9), R10 + MOVBU 40(R9), R11 + CMP $0x20, R11 + BLS skip_fill0 + MOVD 24(R9), R0 + SUB $0x20, R11, R11 + SUB $0x04, R0, R0 + MOVD (R9), R12 + + // b.value |= uint64(low) << (b.bitsRead & 63) + ADD R12, R0, R15 + MOVWU (R15), R12 + MOVD R11, R1 + LSL R1, R12, R12 + MOVD R0, 24(R9) + ORR R12, R10, R10 + + // exhausted += (br0.off < 4) + CMP $0x04, R0 + CSINC HS, R2, R2, R16 + BFI $0, R16, $8, R2 + +skip_fill0: + // val0 := br0.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v0 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br0.advance(uint8(v0.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val1 := br0.peekTopBits(peekBits) + MOVD R6, R1 + MOVD R10, R12 + LSR R1, R12, R12 + + // v1 := table[val1&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br0.advance(uint8(v1.entry)) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // these two writes get coalesced + // out[id * dstEvery + 0] = uint8(v0.entry >> 8) + // out[id * dstEvery + 1] = uint8(v1.entry >> 8) + MOVH R0, (R3) + + // update the bitreader structure + MOVD R10, 32(R9) + MOVB R11, 40(R9) + + // br1.fillFast32() + MOVD 80(R9), R10 + MOVBU 88(R9), R11 + CMP $0x20, R11 + BLS skip_fill1 + MOVD 72(R9), R0 + SUB $0x20, R11, R11 + SUB $0x04, R0, R0 + MOVD 48(R9), R12 + + // b.value |= uint64(low) << (b.bitsRead & 63) + ADD R12, R0, R15 + MOVWU (R15), R12 + MOVD R11, R1 + LSL R1, R12, R12 + MOVD R0, 72(R9) + ORR R12, R10, R10 + + // exhausted += (br1.off < 4) + CMP $0x04, R0 + CSINC HS, R2, R2, R16 + BFI $0, R16, $8, R2 + +skip_fill1: + // val0 := br1.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v0 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br1.advance(uint8(v0.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val1 := br1.peekTopBits(peekBits) + MOVD R6, R1 + MOVD R10, R12 + LSR R1, R12, R12 + + // v1 := table[val1&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br1.advance(uint8(v1.entry)) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // these two writes get coalesced + // out[id * dstEvery + 0] = uint8(v0.entry >> 8) + // out[id * dstEvery + 1] = uint8(v1.entry >> 8) + ADD R7, R3, R15 + MOVH R0, (R15) + + // update the bitreader structure + MOVD R10, 80(R9) + MOVB R11, 88(R9) + + // br2.fillFast32() + MOVD 128(R9), R10 + MOVBU 136(R9), R11 + CMP $0x20, R11 + BLS skip_fill2 + MOVD 120(R9), R0 + SUB $0x20, R11, R11 + SUB $0x04, R0, R0 + MOVD 96(R9), R12 + + // b.value |= uint64(low) << (b.bitsRead & 63) + ADD R12, R0, R15 + MOVWU (R15), R12 + MOVD R11, R1 + LSL R1, R12, R12 + MOVD R0, 120(R9) + ORR R12, R10, R10 + + // exhausted += (br2.off < 4) + CMP $0x04, R0 + CSINC HS, R2, R2, R16 + BFI $0, R16, $8, R2 + +skip_fill2: + // val0 := br2.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v0 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br2.advance(uint8(v0.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val1 := br2.peekTopBits(peekBits) + MOVD R6, R1 + MOVD R10, R12 + LSR R1, R12, R12 + + // v1 := table[val1&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br2.advance(uint8(v1.entry)) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // these two writes get coalesced + // out[id * dstEvery + 0] = uint8(v0.entry >> 8) + // out[id * dstEvery + 1] = uint8(v1.entry >> 8) + ADD R7<<1, R3, R15 + MOVH R0, (R15) + + // update the bitreader structure + MOVD R10, 128(R9) + MOVB R11, 136(R9) + + // br3.fillFast32() + MOVD 176(R9), R10 + MOVBU 184(R9), R11 + CMP $0x20, R11 + BLS skip_fill3 + MOVD 168(R9), R0 + SUB $0x20, R11, R11 + SUB $0x04, R0, R0 + MOVD 144(R9), R12 + + // b.value |= uint64(low) << (b.bitsRead & 63) + ADD R12, R0, R15 + MOVWU (R15), R12 + MOVD R11, R1 + LSL R1, R12, R12 + MOVD R0, 168(R9) + ORR R12, R10, R10 + + // exhausted += (br3.off < 4) + CMP $0x04, R0 + CSINC HS, R2, R2, R16 + BFI $0, R16, $8, R2 + +skip_fill3: + // val0 := br3.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v0 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br3.advance(uint8(v0.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val1 := br3.peekTopBits(peekBits) + MOVD R6, R1 + MOVD R10, R12 + LSR R1, R12, R12 + + // v1 := table[val1&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br3.advance(uint8(v1.entry)) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // these two writes get coalesced + // out[id * dstEvery + 0] = uint8(v0.entry >> 8) + // out[id * dstEvery + 1] = uint8(v1.entry >> 8) + ADD R7<<1, R7, R1 + ADD R1, R3, R15 + MOVH R0, (R15) + + // update the bitreader structure + MOVD R10, 176(R9) + MOVB R11, 184(R9) + ADD $0x02, R3, R3 + AND $0xff, R2, R15 + AND $0xff, R2, R16 + TST R16, R15 + BEQ main_loop + MOVD ctx+0(FP), R0 + MOVD 16(R0), R16 + SUB R16, R3, R3 + LSL $0x02, R3, R3 + MOVD R3, 40(R0) + RET + +// func decompress4x_8b_main_loop_amd64(ctx *decompress4xContext) +TEXT ·decompress4x_8b_main_loop_arm64(SB), $0-8 + // Preload values + MOVD ctx+0(FP), R1 + MOVBU 8(R1), R6 + MOVD 16(R1), R3 + MOVD 48(R1), R5 + MOVD 24(R1), R7 + MOVD 32(R1), R8 + MOVD (R1), R9 + + // Main loop +main_loop: + MOVD $0, R2 + CMP R5, R3 + CSET GE, R16 + BFI $0, R16, $8, R2 + + // br0.fillFast32() + MOVD 32(R9), R10 + MOVBU 40(R9), R11 + CMP $0x20, R11 + BLS skip_fill0 + MOVD 24(R9), R12 + SUB $0x20, R11, R11 + SUB $0x04, R12, R12 + MOVD (R9), R13 + + // b.value |= uint64(low) << (b.bitsRead & 63) + ADD R13, R12, R15 + MOVWU (R15), R13 + MOVD R11, R1 + LSL R1, R13, R13 + MOVD R12, 24(R9) + ORR R13, R10, R10 + + // exhausted += (br0.off < 4) + CMP $0x04, R12 + CSINC HS, R2, R2, R16 + BFI $0, R16, $8, R2 + +skip_fill0: + // val0 := br0.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v0 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br0.advance(uint8(v0.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val1 := br0.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v1 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br0.advance(uint8(v1.entry) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + REVW R0, R0 + + // val2 := br0.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v2 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br0.advance(uint8(v2.entry) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val3 := br0.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v3 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br0.advance(uint8(v3.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + REVW R0, R0 + + // these four writes get coalesced + // out[id * dstEvery + 0] = uint8(v0.entry >> 8) + // out[id * dstEvery + 1] = uint8(v1.entry >> 8) + // out[id * dstEvery + 3] = uint8(v2.entry >> 8) + // out[id * dstEvery + 4] = uint8(v3.entry >> 8) + MOVW R0, (R3) + + // update the bitreader structure + MOVD R10, 32(R9) + MOVB R11, 40(R9) + + // br1.fillFast32() + MOVD 80(R9), R10 + MOVBU 88(R9), R11 + CMP $0x20, R11 + BLS skip_fill1 + MOVD 72(R9), R12 + SUB $0x20, R11, R11 + SUB $0x04, R12, R12 + MOVD 48(R9), R13 + + // b.value |= uint64(low) << (b.bitsRead & 63) + ADD R13, R12, R15 + MOVWU (R15), R13 + MOVD R11, R1 + LSL R1, R13, R13 + MOVD R12, 72(R9) + ORR R13, R10, R10 + + // exhausted += (br1.off < 4) + CMP $0x04, R12 + CSINC HS, R2, R2, R16 + BFI $0, R16, $8, R2 + +skip_fill1: + // val0 := br1.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v0 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br1.advance(uint8(v0.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val1 := br1.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v1 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br1.advance(uint8(v1.entry) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + REVW R0, R0 + + // val2 := br1.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v2 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br1.advance(uint8(v2.entry) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val3 := br1.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v3 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br1.advance(uint8(v3.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + REVW R0, R0 + + // these four writes get coalesced + // out[id * dstEvery + 0] = uint8(v0.entry >> 8) + // out[id * dstEvery + 1] = uint8(v1.entry >> 8) + // out[id * dstEvery + 3] = uint8(v2.entry >> 8) + // out[id * dstEvery + 4] = uint8(v3.entry >> 8) + ADD R7, R3, R15 + MOVW R0, (R15) + + // update the bitreader structure + MOVD R10, 80(R9) + MOVB R11, 88(R9) + + // br2.fillFast32() + MOVD 128(R9), R10 + MOVBU 136(R9), R11 + CMP $0x20, R11 + BLS skip_fill2 + MOVD 120(R9), R12 + SUB $0x20, R11, R11 + SUB $0x04, R12, R12 + MOVD 96(R9), R13 + + // b.value |= uint64(low) << (b.bitsRead & 63) + ADD R13, R12, R15 + MOVWU (R15), R13 + MOVD R11, R1 + LSL R1, R13, R13 + MOVD R12, 120(R9) + ORR R13, R10, R10 + + // exhausted += (br2.off < 4) + CMP $0x04, R12 + CSINC HS, R2, R2, R16 + BFI $0, R16, $8, R2 + +skip_fill2: + // val0 := br2.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v0 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br2.advance(uint8(v0.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val1 := br2.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v1 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br2.advance(uint8(v1.entry) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + REVW R0, R0 + + // val2 := br2.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v2 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br2.advance(uint8(v2.entry) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val3 := br2.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v3 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br2.advance(uint8(v3.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + REVW R0, R0 + + // these four writes get coalesced + // out[id * dstEvery + 0] = uint8(v0.entry >> 8) + // out[id * dstEvery + 1] = uint8(v1.entry >> 8) + // out[id * dstEvery + 3] = uint8(v2.entry >> 8) + // out[id * dstEvery + 4] = uint8(v3.entry >> 8) + ADD R7<<1, R3, R15 + MOVW R0, (R15) + + // update the bitreader structure + MOVD R10, 128(R9) + MOVB R11, 136(R9) + + // br3.fillFast32() + MOVD 176(R9), R10 + MOVBU 184(R9), R11 + CMP $0x20, R11 + BLS skip_fill3 + MOVD 168(R9), R12 + SUB $0x20, R11, R11 + SUB $0x04, R12, R12 + MOVD 144(R9), R13 + + // b.value |= uint64(low) << (b.bitsRead & 63) + ADD R13, R12, R15 + MOVWU (R15), R13 + MOVD R11, R1 + LSL R1, R13, R13 + MOVD R12, 168(R9) + ORR R13, R10, R10 + + // exhausted += (br3.off < 4) + CMP $0x04, R12 + CSINC HS, R2, R2, R16 + BFI $0, R16, $8, R2 + +skip_fill3: + // val0 := br3.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v0 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br3.advance(uint8(v0.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val1 := br3.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v1 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br3.advance(uint8(v1.entry) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + REVW R0, R0 + + // val2 := br3.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v2 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br3.advance(uint8(v2.entry) + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + + // val3 := br3.peekTopBits(peekBits) + MOVD R10, R12 + MOVD R6, R1 + LSR R1, R12, R12 + + // v3 := table[val0&mask] + ADD R12<<1, R8, R15 + MOVHU (R15), R1 + + // br3.advance(uint8(v3.entry) + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + LSL R1, R10, R10 + ADD R1, R11, R15 + BFI $0, R15, $8, R11 + REVW R0, R0 + + // these four writes get coalesced + // out[id * dstEvery + 0] = uint8(v0.entry >> 8) + // out[id * dstEvery + 1] = uint8(v1.entry >> 8) + // out[id * dstEvery + 3] = uint8(v2.entry >> 8) + // out[id * dstEvery + 4] = uint8(v3.entry >> 8) + ADD R7<<1, R7, R1 + ADD R1, R3, R15 + MOVW R0, (R15) + + // update the bitreader structure + MOVD R10, 176(R9) + MOVB R11, 184(R9) + ADD $0x04, R3, R3 + AND $0xff, R2, R15 + AND $0xff, R2, R16 + TST R16, R15 + BEQ main_loop + MOVD ctx+0(FP), R0 + MOVD 16(R0), R16 + SUB R16, R3, R3 + LSL $0x02, R3, R3 + MOVD R3, 40(R0) + RET + +// func decompress1x_main_loop_amd64(ctx *decompress1xContext) +TEXT ·decompress1x_main_loop_arm64(SB), $0-8 + MOVD ctx+0(FP), R1 + MOVD 16(R1), R2 + MOVD 24(R1), R3 + CMP $0x04, R3 + BLO error_max_decoded_size_exceeded + ADD R3, R2, R3 + MOVD (R1), R5 + MOVD (R5), R7 + MOVD 24(R5), R8 + MOVD 32(R5), R9 + MOVBU 40(R5), R10 + MOVD 32(R1), R5 + MOVBU 8(R1), R6 + JMP loop_condition + +main_loop: + // Check if we have room for 4 bytes in the output buffer + ADD $4, R2, R1 + CMP R3, R1 + BGE error_max_decoded_size_exceeded + + // Decode 4 values + CMP $0x20, R10 + BLT bitReader_fillFast_1_end + SUB $0x20, R10, R10 + SUB $0x04, R8, R8 + ADD R8, R7, R15 + MOVWU (R15), R11 + MOVD R10, R1 + LSL R1, R11, R11 + ORR R11, R9, R9 + +bitReader_fillFast_1_end: + MOVD R6, R1 + MOVD R9, R11 + LSR R1, R11, R11 + ADD R11<<1, R5, R15 + MOVHU (R15), R1 + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + MOVBU R1, R1 + ADD R1, R10, R10 + LSL R1, R9, R9 + MOVD R6, R1 + MOVD R9, R11 + LSR R1, R11, R11 + ADD R11<<1, R5, R15 + MOVHU (R15), R1 + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + MOVBU R1, R1 + ADD R1, R10, R10 + LSL R1, R9, R9 + REVW R0, R0 + CMP $0x20, R10 + BLT bitReader_fillFast_2_end + SUB $0x20, R10, R10 + SUB $0x04, R8, R8 + ADD R8, R7, R15 + MOVWU (R15), R11 + MOVD R10, R1 + LSL R1, R11, R11 + ORR R11, R9, R9 + +bitReader_fillFast_2_end: + MOVD R6, R1 + MOVD R9, R11 + LSR R1, R11, R11 + ADD R11<<1, R5, R15 + MOVHU (R15), R1 + UBFX $8, R1, $8, R16 + BFI $8, R16, $8, R0 + MOVBU R1, R1 + ADD R1, R10, R10 + LSL R1, R9, R9 + MOVD R6, R1 + MOVD R9, R11 + LSR R1, R11, R11 + ADD R11<<1, R5, R15 + MOVHU (R15), R1 + UBFX $8, R1, $8, R16 + BFI $0, R16, $8, R0 + MOVBU R1, R1 + ADD R1, R10, R10 + LSL R1, R9, R9 + REVW R0, R0 + + // Store the decoded values + MOVW R0, (R2) + ADD $0x04, R2, R2 + +loop_condition: + CMP $0x08, R8 + BGE main_loop + + // Update ctx structure + MOVD ctx+0(FP), R0 + MOVD 16(R0), R16 + SUB R16, R2, R2 + MOVD R2, 40(R0) + MOVD (R0), R0 + MOVD R8, 24(R0) + MOVD R9, 32(R0) + MOVB R10, 40(R0) + RET + + // Report error +error_max_decoded_size_exceeded: + MOVD ctx+0(FP), R0 + MOVD $-1, R1 + MOVD R1, 40(R0) + RET + +// skipped decompress1x_main_loop_bmi2 (generic twin preferred on arm64) diff --git a/vendor/github.com/klauspost/compress/huff0/decompress_asm.go b/vendor/github.com/klauspost/compress/huff0/decompress_asm.go new file mode 100644 index 0000000000..4854dd4365 --- /dev/null +++ b/vendor/github.com/klauspost/compress/huff0/decompress_asm.go @@ -0,0 +1,193 @@ +//go:build (amd64 || arm64) && !appengine && !noasm && gc + +// This file contains the specialisation of Decoder.Decompress4X +// and Decoder.Decompress1X that use an asm implementation of their main loops. +// The asm function stubs and any per-arch dispatch live in decompress_amd64.go +// and decompress_arm64.go. +package huff0 + +import ( + "errors" + "fmt" +) + +// fallback8BitSize is the size where using Go version is faster. +const fallback8BitSize = 800 + +type decompress4xContext struct { + pbr *[4]bitReaderShifted + peekBits uint8 + out *byte + dstEvery int + tbl *dEntrySingle + decoded int + limit *byte +} + +// Decompress4X will decompress a 4X encoded stream. +// The length of the supplied input must match the end of a block exactly. +// The *capacity* of the dst slice must match the destination size of +// the uncompressed data exactly. +func (d *Decoder) Decompress4X(dst, src []byte) ([]byte, error) { + if len(d.dt.single) == 0 { + return nil, errors.New("no table loaded") + } + if len(src) < 6+(4*1) { + return nil, errors.New("input too small") + } + + use8BitTables := d.actualTableLog <= 8 + if cap(dst) < fallback8BitSize && use8BitTables { + return d.decompress4X8bit(dst, src) + } + + var br [4]bitReaderShifted + // Decode "jump table" + start := 6 + for i := range 3 { + length := int(src[i*2]) | (int(src[i*2+1]) << 8) + if start+length >= len(src) { + return nil, errors.New("truncated input (or invalid offset)") + } + err := br[i].init(src[start : start+length]) + if err != nil { + return nil, err + } + start += length + } + err := br[3].init(src[start:]) + if err != nil { + return nil, err + } + + // destination, offset to match first output + dstSize := cap(dst) + dst = dst[:dstSize] + out := dst + dstEvery := (dstSize + 3) / 4 + + const tlSize = 1 << tableLogMax + const tlMask = tlSize - 1 + single := d.dt.single[:tlSize] + + var decoded int + + if len(out) > 4*4 && !(br[0].off < 4 || br[1].off < 4 || br[2].off < 4 || br[3].off < 4) { + ctx := decompress4xContext{ + pbr: &br, + peekBits: uint8((64 - d.actualTableLog) & 63), // see: bitReaderShifted.peekBitsFast() + out: &out[0], + dstEvery: dstEvery, + tbl: &single[0], + limit: &out[dstEvery-4], // Always stop decoding when first buffer gets here to avoid writing OOB on last. + } + if use8BitTables { + decompress4x_8b_main_loop_asm(&ctx) + } else { + decompress4x_main_loop_asm(&ctx) + } + + decoded = ctx.decoded + out = out[decoded/4:] + } + + // Decode remaining. + remainBytes := dstEvery - (decoded / 4) + for i := range br { + offset := dstEvery * i + endsAt := min(offset+remainBytes, len(out)) + br := &br[i] + bitsLeft := br.remaining() + for bitsLeft > 0 { + br.fill() + if offset >= endsAt { + return nil, errors.New("corruption detected: stream overrun 4") + } + + // Read value and increment offset. + val := br.peekBitsFast(d.actualTableLog) + v := single[val&tlMask].entry + nBits := uint8(v) + br.advance(nBits) + bitsLeft -= uint(nBits) + out[offset] = uint8(v >> 8) + offset++ + } + if offset != endsAt { + return nil, fmt.Errorf("corruption detected: short output block %d, end %d != %d", i, offset, endsAt) + } + decoded += offset - dstEvery*i + err = br.close() + if err != nil { + return nil, err + } + } + if dstSize != decoded { + return nil, errors.New("corruption detected: short output block") + } + return dst, nil +} + +type decompress1xContext struct { + pbr *bitReaderShifted + peekBits uint8 + out *byte + outCap int + tbl *dEntrySingle + decoded int +} + +// Error reported by asm implementations +const error_max_decoded_size_exeeded = -1 + +// Decompress1X will decompress a 1X encoded stream. +// The cap of the output buffer will be the maximum decompressed size. +// The length of the supplied input must match the end of a block exactly. +func (d *Decoder) Decompress1X(dst, src []byte) ([]byte, error) { + if len(d.dt.single) == 0 { + return nil, errors.New("no table loaded") + } + var br bitReaderShifted + err := br.init(src) + if err != nil { + return dst, err + } + maxDecodedSize := cap(dst) + dst = dst[:maxDecodedSize] + + const tlSize = 1 << tableLogMax + const tlMask = tlSize - 1 + + if maxDecodedSize >= 4 { + ctx := decompress1xContext{ + pbr: &br, + out: &dst[0], + outCap: maxDecodedSize, + peekBits: uint8((64 - d.actualTableLog) & 63), // see: bitReaderShifted.peekBitsFast() + tbl: &d.dt.single[0], + } + + decompress1x_main_loop_asm(&ctx) + if ctx.decoded == error_max_decoded_size_exeeded { + return nil, ErrMaxDecodedSizeExceeded + } + + dst = dst[:ctx.decoded] + } + + // br < 8, so uint8 is fine + bitsLeft := uint8(br.off)*8 + 64 - br.bitsRead + for bitsLeft > 0 { + br.fill() + if len(dst) >= maxDecodedSize { + br.close() + return nil, ErrMaxDecodedSizeExceeded + } + v := d.dt.single[br.peekBitsFast(d.actualTableLog)&tlMask] + nBits := uint8(v.entry) + br.advance(nBits) + bitsLeft -= nBits + dst = append(dst, uint8(v.entry>>8)) + } + return dst, br.close() +} diff --git a/vendor/github.com/klauspost/compress/huff0/decompress_generic.go b/vendor/github.com/klauspost/compress/huff0/decompress_generic.go index 6103923222..e1bca5c686 100644 --- a/vendor/github.com/klauspost/compress/huff0/decompress_generic.go +++ b/vendor/github.com/klauspost/compress/huff0/decompress_generic.go @@ -1,4 +1,4 @@ -//go:build !amd64 || appengine || !gc || noasm +//go:build (!amd64 && !arm64) || appengine || !gc || noasm // This file contains a generic implementation of Decoder.Decompress4X. package huff0 diff --git a/vendor/github.com/klauspost/compress/zstd/blockdec.go b/vendor/github.com/klauspost/compress/zstd/blockdec.go index 2329e996f8..51f9da0387 100644 --- a/vendor/github.com/klauspost/compress/zstd/blockdec.go +++ b/vendor/github.com/klauspost/compress/zstd/blockdec.go @@ -400,8 +400,9 @@ func (b *blockDec) decodeLiterals(in []byte, hist *history) (remain []byte, err } } var err error - // Use our out buffer. - huff.MaxDecodedSize = litRegenSize + // Decoder.Decompress* uses cap(dst) for the size limit. Do not write + // MaxDecodedSize on hist.huffTree: with a trained dictionary that + // pointer aliases the shared dict.litEnc and concurrent DecodeAll races. if fourStreams { literals, err = huff.Decoder().Decompress4X(b.literalBuf[:0:litRegenSize], literals) } else { @@ -673,10 +674,6 @@ func (b *blockDec) executeSequences(hist *history) error { hbytes := hist.b if len(hbytes) > hist.windowSize { hbytes = hbytes[len(hbytes)-hist.windowSize:] - // We do not need history anymore. - if hist.dict != nil { - hist.dict.content = nil - } } hist.decoders.windowSize = hist.windowSize hist.decoders.out = b.dst[:0] diff --git a/vendor/github.com/klauspost/compress/zstd/dict.go b/vendor/github.com/klauspost/compress/zstd/dict.go index 4f1c4938cd..67f40e7914 100644 --- a/vendor/github.com/klauspost/compress/zstd/dict.go +++ b/vendor/github.com/klauspost/compress/zstd/dict.go @@ -296,40 +296,81 @@ func BuildDict(o BuildDictOptions) ([]byte, error) { if offset > 3 { newOffsets[offset-3]++ } else { - newOffsets[uint32(o.Offsets[offset-1])]++ + // Repeat codes reference the training Offsets. Skip unset + // (zero) entries so they are not ranked as real offsets. + prev := o.Offsets[offset-1] + if prev > 0 { + newOffsets[uint32(prev)]++ + } } } } // Find most used offsets. var sortedOffsets []uint32 for k := range newOffsets { + if k == 0 { + continue + } sortedOffsets = append(sortedOffsets, k) } sort.Slice(sortedOffsets, func(i, j int) bool { a, b := sortedOffsets[i], sortedOffsets[j] - if a == b { + ca, cb := newOffsets[a], newOffsets[b] + if ca == cb { // Prefer the longer offset - return sortedOffsets[i] > sortedOffsets[j] + return a > b } - return newOffsets[sortedOffsets[i]] > newOffsets[sortedOffsets[j]] + return ca > cb }) - if len(sortedOffsets) > 3 { - if debug { - print("Offsets:") - for i, v := range sortedOffsets { - if i > 20 { - break - } - printf("[%d: %d],", v, newOffsets[v]) + if debug { + print("Offsets:") + for i, v := range sortedOffsets { + if i > 20 { + break } - println("") + printf("[%d: %d],", v, newOffsets[v]) + } + println("") + } + // Dictionary recent-offsets must be three positive values within the + // history. Ranked matches may be fewer (or empty when only unset + // repeat codes were seen), so fill remaining slots with defaults. + used := make(map[int]bool, 3) + var finalOffsets [3]int + nOff := 0 + for _, v := range sortedOffsets { + iv := int(v) + if iv <= 0 || iv > len(hist) || used[iv] { + continue + } + finalOffsets[nOff] = iv + used[iv] = true + nOff++ + if nOff == 3 { + break } - - sortedOffsets = sortedOffsets[:3] } - for i, v := range sortedOffsets { - o.Offsets[i] = int(v) + for _, def := range []int{1, 4, 8} { + if nOff == 3 { + break + } + if def <= len(hist) && !used[def] { + finalOffsets[nOff] = def + used[def] = true + nOff++ + } + } + for def := 1; nOff < 3 && def <= len(hist); def++ { + if !used[def] { + finalOffsets[nOff] = def + used[def] = true + nOff++ + } + } + if nOff < 3 { + return nil, fmt.Errorf("could not determine 3 valid dictionary offsets (history size %d)", len(hist)) } + o.Offsets = finalOffsets if debug { println("New repeat offsets", o.Offsets) } @@ -337,6 +378,9 @@ func BuildDict(o BuildDictOptions) ([]byte, error) { if nUsed == 0 || seqs == 0 { return nil, fmt.Errorf("%d blocks, %d sequences found", nUsed, seqs) } + if litTotal == 0 { + return nil, errors.New("0 literals found") + } if debug { println("Sequences:", seqs, "Blocks:", nUsed, "Literals:", litTotal) } @@ -517,11 +561,10 @@ func BuildDict(o BuildDictOptions) ([]byte, error) { out.Write(binary.LittleEndian.AppendUint32(nil, uint32(o.Offsets[1]))) out.Write(binary.LittleEndian.AppendUint32(nil, uint32(o.Offsets[2]))) out.Write(hist) + if _, err := loadDict(out.Bytes()); err != nil { + return nil, fmt.Errorf("built dictionary failed validation: %w", err) + } if debug { - _, err := loadDict(out.Bytes()) - if err != nil { - panic(err) - } i, err := InspectDictionary(out.Bytes()) if err != nil { panic(err) diff --git a/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.s b/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.s index 3fc381c7a7..4d3188ff49 100644 --- a/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.s +++ b/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.s @@ -2081,7 +2081,7 @@ sequenceDecs_decodeSync_amd64_match_len_ofs_ok: MOVQ 16(SP), R13 // Check if we have enough space in s.out - LEAQ (AX)(R13*1), R14 + LEAQ 16(AX)(R13*1), R14 ADDQ R10, R14 CMPQ R14, 32(SP) JA error_not_enough_space @@ -2601,7 +2601,7 @@ sequenceDecs_decodeSync_bmi2_match_len_ofs_ok: MOVQ 16(SP), R13 // Check if we have enough space in s.out - LEAQ (CX)(R13*1), R14 + LEAQ 16(CX)(R13*1), R14 ADDQ R9, R14 CMPQ R14, 32(SP) JA error_not_enough_space diff --git a/vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s b/vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s index a468e5fc2c..6f54ef21ba 100644 --- a/vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s +++ b/vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s @@ -12,7 +12,7 @@ TEXT ·sequenceDecs_decode_arm64(SB), $8-32 MOVD (R1), R0 MOVD 32(R1), R5 ADD R5, R0, R0 - MOVD R0, (RSP) + MOVD R0, 8(RSP) MOVD ctx+16(FP), R0 MOVD 72(R0), R6 MOVD 80(R0), R7 @@ -24,7 +24,7 @@ TEXT ·sequenceDecs_decode_arm64(SB), $8-32 MOVD 160(R0), R12 sequenceDecs_decode_amd64_main_loop: - MOVD (RSP), R13 + MOVD 8(RSP), R13 // Fill bitreader to have enough for the offset and match length. CMP $0x08, R5 @@ -60,7 +60,8 @@ sequenceDecs_decode_amd64_fill_end: MOVD R3, R1 MOVD R2, R14 LSL R1, R14, R14 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decode_amd64_of_update_zero @@ -81,7 +82,8 @@ sequenceDecs_decode_amd64_of_update_zero: MOVD R3, R1 MOVD R2, R14 LSL R1, R14, R14 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decode_amd64_ml_update_zero @@ -131,7 +133,8 @@ sequenceDecs_decode_amd64_fill_2_end: MOVD R3, R1 MOVD R2, R14 LSL R1, R14, R14 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decode_amd64_ll_update_zero @@ -148,7 +151,7 @@ sequenceDecs_decode_amd64_ll_update_zero: MOVD R0, (R9) // Fill bitreader for state updates - MOVD R13, (RSP) + MOVD R13, 8(RSP) MOVD R8, R0 LSR $0x08, R0, R0 MOVBU R0, R0 @@ -166,7 +169,7 @@ sequenceDecs_decode_amd64_ll_update_zero: NEG R1, R16 ROR R16, R14, R14 MOVD $0x00000001, R4 - MOVB R13, R1 + BFI $0, R13, $8, R1 LSLW R1, R4, R4 SUBW $1, R4, R4 AND R4, R14, R14 @@ -187,7 +190,7 @@ sequenceDecs_decode_amd64_ll_update_zero: NEG R1, R16 ROR R16, R14, R14 MOVD $0x00000001, R4 - MOVB R13, R1 + BFI $0, R13, $8, R1 LSLW R1, R4, R4 SUBW $1, R4, R4 AND R4, R14, R14 @@ -208,7 +211,7 @@ sequenceDecs_decode_amd64_ll_update_zero: NEG R1, R16 ROR R16, R14, R14 MOVD $0x00000001, R4 - MOVB R13, R1 + BFI $0, R13, $8, R1 LSLW R1, R4, R4 SUBW $1, R4, R4 AND R4, R14, R14 @@ -360,7 +363,7 @@ TEXT ·sequenceDecs_decode_56_arm64(SB), $8-32 MOVD (R1), R0 MOVD 32(R1), R5 ADD R5, R0, R0 - MOVD R0, (RSP) + MOVD R0, 8(RSP) MOVD ctx+16(FP), R0 MOVD 72(R0), R6 MOVD 80(R0), R7 @@ -372,7 +375,7 @@ TEXT ·sequenceDecs_decode_56_arm64(SB), $8-32 MOVD 160(R0), R12 sequenceDecs_decode_56_amd64_main_loop: - MOVD (RSP), R13 + MOVD 8(RSP), R13 // Fill bitreader to have enough for the offset and match length. CMP $0x08, R5 @@ -408,7 +411,8 @@ sequenceDecs_decode_56_amd64_fill_end: MOVD R3, R1 MOVD R2, R14 LSL R1, R14, R14 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decode_56_amd64_of_update_zero @@ -429,7 +433,8 @@ sequenceDecs_decode_56_amd64_of_update_zero: MOVD R3, R1 MOVD R2, R14 LSL R1, R14, R14 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decode_56_amd64_ml_update_zero @@ -450,7 +455,8 @@ sequenceDecs_decode_56_amd64_ml_update_zero: MOVD R3, R1 MOVD R2, R14 LSL R1, R14, R14 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decode_56_amd64_ll_update_zero @@ -467,7 +473,7 @@ sequenceDecs_decode_56_amd64_ll_update_zero: MOVD R0, (R9) // Fill bitreader for state updates - MOVD R13, (RSP) + MOVD R13, 8(RSP) MOVD R8, R0 LSR $0x08, R0, R0 MOVBU R0, R0 @@ -485,7 +491,7 @@ sequenceDecs_decode_56_amd64_ll_update_zero: NEG R1, R16 ROR R16, R14, R14 MOVD $0x00000001, R4 - MOVB R13, R1 + BFI $0, R13, $8, R1 LSLW R1, R4, R4 SUBW $1, R4, R4 AND R4, R14, R14 @@ -506,7 +512,7 @@ sequenceDecs_decode_56_amd64_ll_update_zero: NEG R1, R16 ROR R16, R14, R14 MOVD $0x00000001, R4 - MOVB R13, R1 + BFI $0, R13, $8, R1 LSLW R1, R4, R4 SUBW $1, R4, R4 AND R4, R14, R14 @@ -527,7 +533,7 @@ sequenceDecs_decode_56_amd64_ll_update_zero: NEG R1, R16 ROR R16, R14, R14 MOVD $0x00000001, R4 - MOVB R13, R1 + BFI $0, R13, $8, R1 LSLW R1, R4, R4 SUBW $1, R4, R4 AND R4, R14, R14 @@ -766,13 +772,14 @@ copy_4_small: JMP copy_4_move_8through16 copy_4_move_3: - MOVH (R13), R10 - MOVB 2(R13), R11 - MOVH R10, (R3) - MOVB R11, 2(R3) - ADD R12, R13, R13 - ADD R12, R3, R3 - JMP copy_4_end + MOVHU (R13), R10 + MOVBU 2(R13), R16 + BFI $0, R16, $8, R11 + MOVH R10, (R3) + MOVB R11, 2(R3) + ADD R12, R13, R13 + ADD R12, R3, R3 + JMP copy_4_end copy_4_move_4through7: MOVWU (R13), R10 @@ -834,24 +841,27 @@ copy_5_small: JMP copy_5_move_8through16 copy_5_move_1or2: - MOVB (R13), R14 - ADD R10, R13, R15 - MOVB -1(R15), R4 - MOVB R14, (R3) - ADD R10, R3, R15 - MOVB R4, -1(R15) - ADD R10, R13, R13 - ADD R10, R3, R3 - JMP copy_5_end + MOVBU (R13), R16 + BFI $0, R16, $8, R14 + ADD R10, R13, R15 + MOVBU -1(R15), R16 + BFI $0, R16, $8, R4 + MOVB R14, (R3) + ADD R10, R3, R15 + MOVB R4, -1(R15) + ADD R10, R13, R13 + ADD R10, R3, R3 + JMP copy_5_end copy_5_move_3: - MOVH (R13), R14 - MOVB 2(R13), R4 - MOVH R14, (R3) - MOVB R4, 2(R3) - ADD R10, R13, R13 - ADD R10, R3, R3 - JMP copy_5_end + MOVHU (R13), R14 + MOVBU 2(R13), R16 + BFI $0, R16, $8, R4 + MOVH R14, (R3) + MOVB R4, 2(R3) + ADD R10, R13, R13 + ADD R10, R3, R3 + JMP copy_5_end copy_5_move_4through7: MOVWU (R13), R14 @@ -906,12 +916,13 @@ copy_overlapping_match: ADD R12, R6, R6 copy_slow_3: - MOVB (R10), R11 - MOVB R11, (R3) - ADD $1, R10, R10 - ADD $1, R3, R3 - SUBS $1, R12, R12 - BNE copy_slow_3 + MOVBU (R10), R16 + BFI $0, R16, $8, R11 + MOVB R11, (R3) + ADD $1, R10, R10 + ADD $1, R3, R3 + SUBS $1, R12, R12 + BNE copy_slow_3 handle_loop: ADD $0x18, R0, R0 @@ -1016,24 +1027,27 @@ copy_1_small: JMP copy_1_move_8through16 copy_1_move_1or2: - MOVB (R5), R13 - ADD R10, R5, R15 - MOVB -1(R15), R14 - MOVB R13, (R3) - ADD R10, R3, R15 - MOVB R14, -1(R15) - ADD R10, R5, R5 - ADD R10, R3, R3 - JMP copy_1_end + MOVBU (R5), R16 + BFI $0, R16, $8, R13 + ADD R10, R5, R15 + MOVBU -1(R15), R16 + BFI $0, R16, $8, R14 + MOVB R13, (R3) + ADD R10, R3, R15 + MOVB R14, -1(R15) + ADD R10, R5, R5 + ADD R10, R3, R3 + JMP copy_1_end copy_1_move_3: - MOVH (R5), R13 - MOVB 2(R5), R14 - MOVH R13, (R3) - MOVB R14, 2(R3) - ADD R10, R5, R5 - ADD R10, R3, R3 - JMP copy_1_end + MOVHU (R5), R13 + MOVBU 2(R5), R16 + BFI $0, R16, $8, R14 + MOVH R13, (R3) + MOVB R14, 2(R3) + ADD R10, R5, R5 + ADD R10, R3, R3 + JMP copy_1_end copy_1_move_4through7: MOVWU (R5), R13 @@ -1104,13 +1118,14 @@ copy_4_small: JMP copy_4_move_8through16 copy_4_move_3: - MOVH (R13), R10 - MOVB 2(R13), R11 - MOVH R10, (R3) - MOVB R11, 2(R3) - ADD R12, R13, R13 - ADD R12, R3, R3 - JMP copy_4_end + MOVHU (R13), R10 + MOVBU 2(R13), R16 + BFI $0, R16, $8, R11 + MOVH R10, (R3) + MOVB R11, 2(R3) + ADD R12, R13, R13 + ADD R12, R3, R3 + JMP copy_4_end copy_4_move_4through7: MOVWU (R13), R10 @@ -1172,24 +1187,27 @@ copy_5_small: JMP copy_5_move_8through16 copy_5_move_1or2: - MOVB (R13), R14 - ADD R10, R13, R15 - MOVB -1(R15), R4 - MOVB R14, (R3) - ADD R10, R3, R15 - MOVB R4, -1(R15) - ADD R10, R13, R13 - ADD R10, R3, R3 - JMP copy_5_end + MOVBU (R13), R16 + BFI $0, R16, $8, R14 + ADD R10, R13, R15 + MOVBU -1(R15), R16 + BFI $0, R16, $8, R4 + MOVB R14, (R3) + ADD R10, R3, R15 + MOVB R4, -1(R15) + ADD R10, R13, R13 + ADD R10, R3, R3 + JMP copy_5_end copy_5_move_3: - MOVH (R13), R14 - MOVB 2(R13), R4 - MOVH R14, (R3) - MOVB R4, 2(R3) - ADD R10, R13, R13 - ADD R10, R3, R3 - JMP copy_5_end + MOVHU (R13), R14 + MOVBU 2(R13), R16 + BFI $0, R16, $8, R4 + MOVH R14, (R3) + MOVB R4, 2(R3) + ADD R10, R13, R13 + ADD R10, R3, R3 + JMP copy_5_end copy_5_move_4through7: MOVWU (R13), R14 @@ -1257,24 +1275,27 @@ copy_2_small: JMP copy_2_move_8through16 copy_2_move_1or2: - MOVB (R10), R11 - ADD R12, R10, R15 - MOVB -1(R15), R13 - MOVB R11, (R3) - ADD R12, R3, R15 - MOVB R13, -1(R15) - ADD R12, R10, R10 - ADD R12, R3, R3 - JMP copy_2_end + MOVBU (R10), R16 + BFI $0, R16, $8, R11 + ADD R12, R10, R15 + MOVBU -1(R15), R16 + BFI $0, R16, $8, R13 + MOVB R11, (R3) + ADD R12, R3, R15 + MOVB R13, -1(R15) + ADD R12, R10, R10 + ADD R12, R3, R3 + JMP copy_2_end copy_2_move_3: - MOVH (R10), R11 - MOVB 2(R10), R13 - MOVH R11, (R3) - MOVB R13, 2(R3) - ADD R12, R10, R10 - ADD R12, R3, R3 - JMP copy_2_end + MOVHU (R10), R11 + MOVBU 2(R10), R16 + BFI $0, R16, $8, R13 + MOVH R11, (R3) + MOVB R13, 2(R3) + ADD R12, R10, R10 + ADD R12, R3, R3 + JMP copy_2_end copy_2_move_4through7: MOVWU (R10), R11 @@ -1305,12 +1326,13 @@ copy_overlapping_match: ADD R12, R6, R6 copy_slow_3: - MOVB (R10), R11 - MOVB R11, (R3) - ADD $1, R10, R10 - ADD $1, R3, R3 - SUBS $1, R12, R12 - BNE copy_slow_3 + MOVBU (R10), R16 + BFI $0, R16, $8, R11 + MOVB R11, (R3) + ADD $1, R10, R10 + ADD $1, R3, R3 + SUBS $1, R12, R12 + BNE copy_slow_3 handle_loop: ADD $0x18, R0, R0 @@ -1361,41 +1383,41 @@ TEXT ·sequenceDecs_decodeSync_arm64(SB), $64-32 MOVD (R1), R0 MOVD 32(R1), R5 ADD R5, R0, R0 - MOVD R0, (RSP) + MOVD R0, 8(RSP) MOVD ctx+16(FP), R0 MOVD 72(R0), R6 MOVD 80(R0), R7 MOVD 88(R0), R8 MOVD $0, R1 - MOVD R1, 8(RSP) MOVD R1, 16(RSP) MOVD R1, 24(RSP) + MOVD R1, 32(RSP) MOVD 112(R0), R9 MOVD 128(R0), R1 - MOVD R1, 32(RSP) + MOVD R1, 40(RSP) MOVD 144(R0), R10 MOVD 136(R0), R11 MOVD 200(R0), R1 - MOVD R1, 56(RSP) + MOVD R1, 64(RSP) MOVD 176(R0), R1 - MOVD R1, 48(RSP) + MOVD R1, 56(RSP) MOVD 184(R0), R0 - MOVD R0, 40(RSP) - MOVD 40(RSP), R0 - MOVD 48(RSP), R16 + MOVD R0, 48(RSP) + MOVD 48(RSP), R0 + MOVD 56(RSP), R16 ADD R0, R16, R16 - MOVD R16, 48(RSP) + MOVD R16, 56(RSP) // Calculate pointer to s.out[cap(s.out)] (a past-end pointer) - MOVD 32(RSP), R16 + MOVD 40(RSP), R16 ADD R9, R16, R16 - MOVD R16, 32(RSP) + MOVD R16, 40(RSP) // outBase += outPosition ADD R11, R9, R9 sequenceDecs_decodeSync_amd64_main_loop: - MOVD (RSP), R12 + MOVD 8(RSP), R12 // Fill bitreader to have enough for the offset and match length. CMP $0x08, R5 @@ -1431,7 +1453,8 @@ sequenceDecs_decodeSync_amd64_fill_end: MOVD R3, R1 MOVD R2, R13 LSL R1, R13, R13 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decodeSync_amd64_of_update_zero @@ -1445,14 +1468,15 @@ sequenceDecs_decodeSync_amd64_fill_end: ADD R13, R0, R0 sequenceDecs_decodeSync_amd64_of_update_zero: - MOVD R0, 8(RSP) + MOVD R0, 16(RSP) // Update match length MOVD R7, R0 MOVD R3, R1 MOVD R2, R13 LSL R1, R13, R13 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decodeSync_amd64_ml_update_zero @@ -1466,7 +1490,7 @@ sequenceDecs_decodeSync_amd64_of_update_zero: ADD R13, R0, R0 sequenceDecs_decodeSync_amd64_ml_update_zero: - MOVD R0, 16(RSP) + MOVD R0, 24(RSP) // Fill bitreader to have enough for the remaining CMP $0x08, R5 @@ -1502,7 +1526,8 @@ sequenceDecs_decodeSync_amd64_fill_2_end: MOVD R3, R1 MOVD R2, R13 LSL R1, R13, R13 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decodeSync_amd64_ll_update_zero @@ -1516,10 +1541,10 @@ sequenceDecs_decodeSync_amd64_fill_2_end: ADD R13, R0, R0 sequenceDecs_decodeSync_amd64_ll_update_zero: - MOVD R0, 24(RSP) + MOVD R0, 32(RSP) // Fill bitreader for state updates - MOVD R12, (RSP) + MOVD R12, 8(RSP) MOVD R8, R0 LSR $0x08, R0, R0 MOVBU R0, R0 @@ -1537,7 +1562,7 @@ sequenceDecs_decodeSync_amd64_ll_update_zero: NEG R1, R16 ROR R16, R13, R13 MOVD $0x00000001, R14 - MOVB R12, R1 + BFI $0, R12, $8, R1 LSLW R1, R14, R14 SUBW $1, R14, R14 AND R14, R13, R13 @@ -1558,7 +1583,7 @@ sequenceDecs_decodeSync_amd64_ll_update_zero: NEG R1, R16 ROR R16, R13, R13 MOVD $0x00000001, R14 - MOVB R12, R1 + BFI $0, R12, $8, R1 LSLW R1, R14, R14 SUBW $1, R14, R14 AND R14, R13, R13 @@ -1579,7 +1604,7 @@ sequenceDecs_decodeSync_amd64_ll_update_zero: NEG R1, R16 ROR R16, R13, R13 MOVD $0x00000001, R14 - MOVB R12, R1 + BFI $0, R12, $8, R1 LSLW R1, R14, R14 SUBW $1, R14, R14 AND R14, R13, R13 @@ -1594,7 +1619,7 @@ sequenceDecs_decodeSync_amd64_ll_update_zero: sequenceDecs_decodeSync_amd64_skip_update: // Adjust offset MOVD s+0(FP), R1 - MOVD 8(RSP), R12 + MOVD 16(RSP), R12 CMP $0x01, R0 BLS sequenceDecs_decodeSync_amd64_adjust_offsetB_1_or_0 ADD $144, R1, R15 @@ -1605,7 +1630,7 @@ sequenceDecs_decodeSync_amd64_skip_update: JMP sequenceDecs_decodeSync_amd64_after_adjust sequenceDecs_decodeSync_amd64_adjust_offsetB_1_or_0: - MOVD 24(RSP), R16 + MOVD 32(RSP), R16 CMP $0x00000000, R16 BNE sequenceDecs_decodeSync_amd64_adjust_offset_maybezero ADD $1, R12, R12 @@ -1643,11 +1668,11 @@ sequenceDecs_decodeSync_amd64_adjust_skip: MOVD R13, R12 sequenceDecs_decodeSync_amd64_after_adjust: - MOVD R12, 8(RSP) + MOVD R12, 16(RSP) // Check values - MOVD 16(RSP), R0 - MOVD 24(RSP), R1 + MOVD 24(RSP), R0 + MOVD 32(RSP), R1 ADD R1, R0, R13 MOVD s+0(FP), R14 MOVD 256(R14), R16 @@ -1666,14 +1691,15 @@ sequenceDecs_decodeSync_amd64_after_adjust: BNE sequenceDecs_decodeSync_amd64_error_match_len_ofs_mismatch sequenceDecs_decodeSync_amd64_match_len_ofs_ok: - MOVD 24(RSP), R0 - MOVD 8(RSP), R1 - MOVD 16(RSP), R12 + MOVD 32(RSP), R0 + MOVD 16(RSP), R1 + MOVD 24(RSP), R12 // Check if we have enough space in s.out ADD R12, R0, R13 + ADD $16, R13, R13 ADD R9, R13, R13 - MOVD 32(RSP), R16 + MOVD 40(RSP), R16 CMP R16, R13 BHI error_not_enough_space @@ -1697,11 +1723,11 @@ copy_1: // Malformed input if seq.mo > t+len(hist) || seq.mo > s.windowSize) check_offset: MOVD R11, R0 - MOVD 40(RSP), R16 + MOVD 48(RSP), R16 ADD R16, R0, R0 CMP R0, R1 BGT error_match_off_too_big - MOVD 56(RSP), R16 + MOVD 64(RSP), R16 CMP R16, R1 BGT error_match_off_too_big @@ -1709,7 +1735,7 @@ check_offset: MOVD R1, R0 SUBS R11, R0, R0 BLS copy_match - MOVD 48(RSP), R13 + MOVD 56(RSP), R13 SUB R0, R13, R13 CMP R0, R12 BGT copy_all_from_history @@ -1742,13 +1768,14 @@ copy_4_small: JMP copy_4_move_8through16 copy_4_move_3: - MOVH (R13), R0 - MOVB 2(R13), R1 - MOVH R0, (R9) - MOVB R1, 2(R9) - ADD R12, R13, R13 - ADD R12, R9, R9 - JMP copy_4_end + MOVHU (R13), R0 + MOVBU 2(R13), R16 + BFI $0, R16, $8, R1 + MOVH R0, (R9) + MOVB R1, 2(R9) + ADD R12, R13, R13 + ADD R12, R9, R9 + JMP copy_4_end copy_4_move_4through7: MOVWU (R13), R0 @@ -1807,24 +1834,27 @@ copy_5_small: JMP copy_5_move_8through16 copy_5_move_1or2: - MOVB (R13), R14 - ADD R0, R13, R15 - MOVB -1(R15), R4 - MOVB R14, (R9) - ADD R0, R9, R15 - MOVB R4, -1(R15) - ADD R0, R13, R13 - ADD R0, R9, R9 - JMP copy_5_end + MOVBU (R13), R16 + BFI $0, R16, $8, R14 + ADD R0, R13, R15 + MOVBU -1(R15), R16 + BFI $0, R16, $8, R4 + MOVB R14, (R9) + ADD R0, R9, R15 + MOVB R4, -1(R15) + ADD R0, R13, R13 + ADD R0, R9, R9 + JMP copy_5_end copy_5_move_3: - MOVH (R13), R14 - MOVB 2(R13), R4 - MOVH R14, (R9) - MOVB R4, 2(R9) - ADD R0, R13, R13 - ADD R0, R9, R9 - JMP copy_5_end + MOVHU (R13), R14 + MOVBU 2(R13), R16 + BFI $0, R16, $8, R4 + MOVH R14, (R9) + MOVB R4, 2(R9) + ADD R0, R13, R13 + ADD R0, R9, R9 + JMP copy_5_end copy_5_move_4through7: MOVWU (R13), R14 @@ -1879,12 +1909,13 @@ copy_overlapping_match: ADD R12, R11, R11 copy_slow_3: - MOVB (R0), R1 - MOVB R1, (R9) - ADD $1, R0, R0 - ADD $1, R9, R9 - SUBS $1, R12, R12 - BNE copy_slow_3 + MOVBU (R0), R16 + BFI $0, R16, $8, R1 + MOVB R1, (R9) + ADD $1, R0, R0 + ADD $1, R9, R9 + SUBS $1, R12, R12 + BNE copy_slow_3 handle_loop: MOVD ctx+16(FP), R0 @@ -1913,7 +1944,7 @@ loop_finished: // Return with match length error sequenceDecs_decodeSync_amd64_error_match_len_ofs_mismatch: - MOVD 16(RSP), R0 + MOVD 24(RSP), R0 MOVD ctx+16(FP), R1 MOVD R0, 216(R1) MOVD $0x00000001, R16 @@ -1923,7 +1954,7 @@ sequenceDecs_decodeSync_amd64_error_match_len_ofs_mismatch: // Return with match too long error sequenceDecs_decodeSync_amd64_error_match_len_too_big: MOVD ctx+16(FP), R0 - MOVD 16(RSP), R1 + MOVD 24(RSP), R1 MOVD R1, 216(R0) MOVD $0x00000002, R16 MOVD R16, ret+24(FP) @@ -1932,7 +1963,7 @@ sequenceDecs_decodeSync_amd64_error_match_len_too_big: // Return with match offset too long error error_match_off_too_big: MOVD ctx+16(FP), R0 - MOVD 8(RSP), R1 + MOVD 16(RSP), R1 MOVD R1, 224(R0) MOVD R11, 136(R0) MOVD $0x00000003, R16 @@ -1942,7 +1973,7 @@ error_match_off_too_big: // Return with not enough literals error error_not_enough_literals: MOVD ctx+16(FP), R0 - MOVD 24(RSP), R1 + MOVD 32(RSP), R1 MOVD R1, 208(R0) MOVD $0x00000004, R16 MOVD R16, ret+24(FP) @@ -1957,9 +1988,9 @@ error_overread: // Return with not enough output space error error_not_enough_space: MOVD ctx+16(FP), R0 - MOVD 24(RSP), R1 + MOVD 32(RSP), R1 MOVD R1, 208(R0) - MOVD 16(RSP), R1 + MOVD 24(RSP), R1 MOVD R1, 216(R0) MOVD R11, 136(R0) MOVD $0x00000005, R16 @@ -1977,41 +2008,41 @@ TEXT ·sequenceDecs_decodeSync_safe_arm64(SB), $64-32 MOVD (R1), R0 MOVD 32(R1), R5 ADD R5, R0, R0 - MOVD R0, (RSP) + MOVD R0, 8(RSP) MOVD ctx+16(FP), R0 MOVD 72(R0), R6 MOVD 80(R0), R7 MOVD 88(R0), R8 MOVD $0, R1 - MOVD R1, 8(RSP) MOVD R1, 16(RSP) MOVD R1, 24(RSP) + MOVD R1, 32(RSP) MOVD 112(R0), R9 MOVD 128(R0), R1 - MOVD R1, 32(RSP) + MOVD R1, 40(RSP) MOVD 144(R0), R10 MOVD 136(R0), R11 MOVD 200(R0), R1 - MOVD R1, 56(RSP) + MOVD R1, 64(RSP) MOVD 176(R0), R1 - MOVD R1, 48(RSP) + MOVD R1, 56(RSP) MOVD 184(R0), R0 - MOVD R0, 40(RSP) - MOVD 40(RSP), R0 - MOVD 48(RSP), R16 + MOVD R0, 48(RSP) + MOVD 48(RSP), R0 + MOVD 56(RSP), R16 ADD R0, R16, R16 - MOVD R16, 48(RSP) + MOVD R16, 56(RSP) // Calculate pointer to s.out[cap(s.out)] (a past-end pointer) - MOVD 32(RSP), R16 + MOVD 40(RSP), R16 ADD R9, R16, R16 - MOVD R16, 32(RSP) + MOVD R16, 40(RSP) // outBase += outPosition ADD R11, R9, R9 sequenceDecs_decodeSync_safe_amd64_main_loop: - MOVD (RSP), R12 + MOVD 8(RSP), R12 // Fill bitreader to have enough for the offset and match length. CMP $0x08, R5 @@ -2047,7 +2078,8 @@ sequenceDecs_decodeSync_safe_amd64_fill_end: MOVD R3, R1 MOVD R2, R13 LSL R1, R13, R13 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decodeSync_safe_amd64_of_update_zero @@ -2061,14 +2093,15 @@ sequenceDecs_decodeSync_safe_amd64_fill_end: ADD R13, R0, R0 sequenceDecs_decodeSync_safe_amd64_of_update_zero: - MOVD R0, 8(RSP) + MOVD R0, 16(RSP) // Update match length MOVD R7, R0 MOVD R3, R1 MOVD R2, R13 LSL R1, R13, R13 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decodeSync_safe_amd64_ml_update_zero @@ -2082,7 +2115,7 @@ sequenceDecs_decodeSync_safe_amd64_of_update_zero: ADD R13, R0, R0 sequenceDecs_decodeSync_safe_amd64_ml_update_zero: - MOVD R0, 16(RSP) + MOVD R0, 24(RSP) // Fill bitreader to have enough for the remaining CMP $0x08, R5 @@ -2118,7 +2151,8 @@ sequenceDecs_decodeSync_safe_amd64_fill_2_end: MOVD R3, R1 MOVD R2, R13 LSL R1, R13, R13 - UBFX $8, R0, $8, R1 + UBFX $8, R0, $8, R16 + BFI $0, R16, $8, R1 LSR $0x20, R0, R0 TST R1, R1 BEQ sequenceDecs_decodeSync_safe_amd64_ll_update_zero @@ -2132,10 +2166,10 @@ sequenceDecs_decodeSync_safe_amd64_fill_2_end: ADD R13, R0, R0 sequenceDecs_decodeSync_safe_amd64_ll_update_zero: - MOVD R0, 24(RSP) + MOVD R0, 32(RSP) // Fill bitreader for state updates - MOVD R12, (RSP) + MOVD R12, 8(RSP) MOVD R8, R0 LSR $0x08, R0, R0 MOVBU R0, R0 @@ -2153,7 +2187,7 @@ sequenceDecs_decodeSync_safe_amd64_ll_update_zero: NEG R1, R16 ROR R16, R13, R13 MOVD $0x00000001, R14 - MOVB R12, R1 + BFI $0, R12, $8, R1 LSLW R1, R14, R14 SUBW $1, R14, R14 AND R14, R13, R13 @@ -2174,7 +2208,7 @@ sequenceDecs_decodeSync_safe_amd64_ll_update_zero: NEG R1, R16 ROR R16, R13, R13 MOVD $0x00000001, R14 - MOVB R12, R1 + BFI $0, R12, $8, R1 LSLW R1, R14, R14 SUBW $1, R14, R14 AND R14, R13, R13 @@ -2195,7 +2229,7 @@ sequenceDecs_decodeSync_safe_amd64_ll_update_zero: NEG R1, R16 ROR R16, R13, R13 MOVD $0x00000001, R14 - MOVB R12, R1 + BFI $0, R12, $8, R1 LSLW R1, R14, R14 SUBW $1, R14, R14 AND R14, R13, R13 @@ -2210,7 +2244,7 @@ sequenceDecs_decodeSync_safe_amd64_ll_update_zero: sequenceDecs_decodeSync_safe_amd64_skip_update: // Adjust offset MOVD s+0(FP), R1 - MOVD 8(RSP), R12 + MOVD 16(RSP), R12 CMP $0x01, R0 BLS sequenceDecs_decodeSync_safe_amd64_adjust_offsetB_1_or_0 ADD $144, R1, R15 @@ -2221,7 +2255,7 @@ sequenceDecs_decodeSync_safe_amd64_skip_update: JMP sequenceDecs_decodeSync_safe_amd64_after_adjust sequenceDecs_decodeSync_safe_amd64_adjust_offsetB_1_or_0: - MOVD 24(RSP), R16 + MOVD 32(RSP), R16 CMP $0x00000000, R16 BNE sequenceDecs_decodeSync_safe_amd64_adjust_offset_maybezero ADD $1, R12, R12 @@ -2259,11 +2293,11 @@ sequenceDecs_decodeSync_safe_amd64_adjust_skip: MOVD R13, R12 sequenceDecs_decodeSync_safe_amd64_after_adjust: - MOVD R12, 8(RSP) + MOVD R12, 16(RSP) // Check values - MOVD 16(RSP), R0 - MOVD 24(RSP), R1 + MOVD 24(RSP), R0 + MOVD 32(RSP), R1 ADD R1, R0, R13 MOVD s+0(FP), R14 MOVD 256(R14), R16 @@ -2282,14 +2316,14 @@ sequenceDecs_decodeSync_safe_amd64_after_adjust: BNE sequenceDecs_decodeSync_safe_amd64_error_match_len_ofs_mismatch sequenceDecs_decodeSync_safe_amd64_match_len_ofs_ok: - MOVD 24(RSP), R0 - MOVD 8(RSP), R1 - MOVD 16(RSP), R12 + MOVD 32(RSP), R0 + MOVD 16(RSP), R1 + MOVD 24(RSP), R12 // Check if we have enough space in s.out ADD R12, R0, R13 ADD R9, R13, R13 - MOVD 32(RSP), R16 + MOVD 40(RSP), R16 CMP R16, R13 BHI error_not_enough_space @@ -2326,24 +2360,27 @@ copy_1_small: JMP copy_1_move_8through16 copy_1_move_1or2: - MOVB (R10), R13 - ADD R0, R10, R15 - MOVB -1(R15), R14 - MOVB R13, (R9) - ADD R0, R9, R15 - MOVB R14, -1(R15) - ADD R0, R10, R10 - ADD R0, R9, R9 - JMP copy_1_end + MOVBU (R10), R16 + BFI $0, R16, $8, R13 + ADD R0, R10, R15 + MOVBU -1(R15), R16 + BFI $0, R16, $8, R14 + MOVB R13, (R9) + ADD R0, R9, R15 + MOVB R14, -1(R15) + ADD R0, R10, R10 + ADD R0, R9, R9 + JMP copy_1_end copy_1_move_3: - MOVH (R10), R13 - MOVB 2(R10), R14 - MOVH R13, (R9) - MOVB R14, 2(R9) - ADD R0, R10, R10 - ADD R0, R9, R9 - JMP copy_1_end + MOVHU (R10), R13 + MOVBU 2(R10), R16 + BFI $0, R16, $8, R14 + MOVH R13, (R9) + MOVB R14, 2(R9) + ADD R0, R10, R10 + ADD R0, R9, R9 + JMP copy_1_end copy_1_move_4through7: MOVWU (R10), R13 @@ -2372,11 +2409,11 @@ copy_1_end: // Malformed input if seq.mo > t+len(hist) || seq.mo > s.windowSize) check_offset: MOVD R11, R0 - MOVD 40(RSP), R16 + MOVD 48(RSP), R16 ADD R16, R0, R0 CMP R0, R1 BGT error_match_off_too_big - MOVD 56(RSP), R16 + MOVD 64(RSP), R16 CMP R16, R1 BGT error_match_off_too_big @@ -2384,7 +2421,7 @@ check_offset: MOVD R1, R0 SUBS R11, R0, R0 BLS copy_match - MOVD 48(RSP), R13 + MOVD 56(RSP), R13 SUB R0, R13, R13 CMP R0, R12 BGT copy_all_from_history @@ -2417,13 +2454,14 @@ copy_4_small: JMP copy_4_move_8through16 copy_4_move_3: - MOVH (R13), R0 - MOVB 2(R13), R1 - MOVH R0, (R9) - MOVB R1, 2(R9) - ADD R12, R13, R13 - ADD R12, R9, R9 - JMP copy_4_end + MOVHU (R13), R0 + MOVBU 2(R13), R16 + BFI $0, R16, $8, R1 + MOVH R0, (R9) + MOVB R1, 2(R9) + ADD R12, R13, R13 + ADD R12, R9, R9 + JMP copy_4_end copy_4_move_4through7: MOVWU (R13), R0 @@ -2482,24 +2520,27 @@ copy_5_small: JMP copy_5_move_8through16 copy_5_move_1or2: - MOVB (R13), R14 - ADD R0, R13, R15 - MOVB -1(R15), R4 - MOVB R14, (R9) - ADD R0, R9, R15 - MOVB R4, -1(R15) - ADD R0, R13, R13 - ADD R0, R9, R9 - JMP copy_5_end + MOVBU (R13), R16 + BFI $0, R16, $8, R14 + ADD R0, R13, R15 + MOVBU -1(R15), R16 + BFI $0, R16, $8, R4 + MOVB R14, (R9) + ADD R0, R9, R15 + MOVB R4, -1(R15) + ADD R0, R13, R13 + ADD R0, R9, R9 + JMP copy_5_end copy_5_move_3: - MOVH (R13), R14 - MOVB 2(R13), R4 - MOVH R14, (R9) - MOVB R4, 2(R9) - ADD R0, R13, R13 - ADD R0, R9, R9 - JMP copy_5_end + MOVHU (R13), R14 + MOVBU 2(R13), R16 + BFI $0, R16, $8, R4 + MOVH R14, (R9) + MOVB R4, 2(R9) + ADD R0, R13, R13 + ADD R0, R9, R9 + JMP copy_5_end copy_5_move_4through7: MOVWU (R13), R14 @@ -2567,24 +2608,27 @@ copy_2_small: JMP copy_2_move_8through16 copy_2_move_1or2: - MOVB (R0), R1 - ADD R12, R0, R15 - MOVB -1(R15), R13 - MOVB R1, (R9) - ADD R12, R9, R15 - MOVB R13, -1(R15) - ADD R12, R0, R0 - ADD R12, R9, R9 - JMP copy_2_end + MOVBU (R0), R16 + BFI $0, R16, $8, R1 + ADD R12, R0, R15 + MOVBU -1(R15), R16 + BFI $0, R16, $8, R13 + MOVB R1, (R9) + ADD R12, R9, R15 + MOVB R13, -1(R15) + ADD R12, R0, R0 + ADD R12, R9, R9 + JMP copy_2_end copy_2_move_3: - MOVH (R0), R1 - MOVB 2(R0), R13 - MOVH R1, (R9) - MOVB R13, 2(R9) - ADD R12, R0, R0 - ADD R12, R9, R9 - JMP copy_2_end + MOVHU (R0), R1 + MOVBU 2(R0), R16 + BFI $0, R16, $8, R13 + MOVH R1, (R9) + MOVB R13, 2(R9) + ADD R12, R0, R0 + ADD R12, R9, R9 + JMP copy_2_end copy_2_move_4through7: MOVWU (R0), R1 @@ -2615,12 +2659,13 @@ copy_overlapping_match: ADD R12, R11, R11 copy_slow_3: - MOVB (R0), R1 - MOVB R1, (R9) - ADD $1, R0, R0 - ADD $1, R9, R9 - SUBS $1, R12, R12 - BNE copy_slow_3 + MOVBU (R0), R16 + BFI $0, R16, $8, R1 + MOVB R1, (R9) + ADD $1, R0, R0 + ADD $1, R9, R9 + SUBS $1, R12, R12 + BNE copy_slow_3 handle_loop: MOVD ctx+16(FP), R0 @@ -2649,7 +2694,7 @@ loop_finished: // Return with match length error sequenceDecs_decodeSync_safe_amd64_error_match_len_ofs_mismatch: - MOVD 16(RSP), R0 + MOVD 24(RSP), R0 MOVD ctx+16(FP), R1 MOVD R0, 216(R1) MOVD $0x00000001, R16 @@ -2659,7 +2704,7 @@ sequenceDecs_decodeSync_safe_amd64_error_match_len_ofs_mismatch: // Return with match too long error sequenceDecs_decodeSync_safe_amd64_error_match_len_too_big: MOVD ctx+16(FP), R0 - MOVD 16(RSP), R1 + MOVD 24(RSP), R1 MOVD R1, 216(R0) MOVD $0x00000002, R16 MOVD R16, ret+24(FP) @@ -2668,7 +2713,7 @@ sequenceDecs_decodeSync_safe_amd64_error_match_len_too_big: // Return with match offset too long error error_match_off_too_big: MOVD ctx+16(FP), R0 - MOVD 8(RSP), R1 + MOVD 16(RSP), R1 MOVD R1, 224(R0) MOVD R11, 136(R0) MOVD $0x00000003, R16 @@ -2678,7 +2723,7 @@ error_match_off_too_big: // Return with not enough literals error error_not_enough_literals: MOVD ctx+16(FP), R0 - MOVD 24(RSP), R1 + MOVD 32(RSP), R1 MOVD R1, 208(R0) MOVD $0x00000004, R16 MOVD R16, ret+24(FP) @@ -2693,9 +2738,9 @@ error_overread: // Return with not enough output space error error_not_enough_space: MOVD ctx+16(FP), R0 - MOVD 24(RSP), R1 + MOVD 32(RSP), R1 MOVD R1, 208(R0) - MOVD 16(RSP), R1 + MOVD 24(RSP), R1 MOVD R1, 216(R0) MOVD R11, 136(R0) MOVD $0x00000005, R16 diff --git a/vendor/github.com/klauspost/compress/zstd/seqdec_asm.go b/vendor/github.com/klauspost/compress/zstd/seqdec_asm.go index 55405f3914..42ce5de716 100644 --- a/vendor/github.com/klauspost/compress/zstd/seqdec_asm.go +++ b/vendor/github.com/klauspost/compress/zstd/seqdec_asm.go @@ -77,6 +77,35 @@ const errorNotEnoughSpace = 5 // error reported when bits are overread. const errorOverread = 6 +// useSafeDecodeSync reports whether decodeSyncSimple must use the bounds-exact +// ("safe") copy variants for the current buffer geometry. +// +// When the output and literal buffers have compressedBlockOverAlloc (16) +// bytes of slack past their logical use, the assembly may use extended +// memory copies that read and write in 16-byte blocks, overrunning the end +// of a literal run or match by up to 15 bytes. Otherwise it must use the +// bounds-exact ("safe") copies. This mirrors the analogous, always-dynamic +// selection in executeSimple below. +// +// The unsafe copies were disabled in #644 (2022) as a mitigation for a +// crash, but that crash's root cause — an unguarded bitReader overread that +// produced out-of-range match offsets/lengths — was fixed three days later +// in #645, which also added the fuzz corpus that has guarded this path since. +// See #1168. An asan-instrumented fuzz job (see .github/workflows/go.yml) +// covers the extended-copy path, which -race and plain fuzzing cannot. +func (s *sequenceDecs) useSafeDecodeSync() bool { + if s.maxSyncLen == 0 && cap(s.out)-len(s.out) < maxCompressedBlockSizeAlloc { + return true + } + if s.maxSyncLen > 0 && cap(s.out)-len(s.out)-compressedBlockOverAlloc < int(s.maxSyncLen) { + return true + } + if cap(s.literals) < len(s.literals)+compressedBlockOverAlloc { + return true + } + return false +} + // decode sequences from the stream with the provided history but without a dictionary. func (s *sequenceDecs) decodeSyncSimple(hist []byte) (bool, error) { if len(s.dict) > 0 { @@ -86,9 +115,7 @@ func (s *sequenceDecs) decodeSyncSimple(hist []byte) (bool, error) { return false, nil } - // FIXME: Using unsafe memory copies leads to rare, random crashes - // with fuzz testing. It is therefore disabled for now. - const useSafe = true + useSafe := s.useSafeDecodeSync() br := s.br diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1/sigstore_bundle.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1/sigstore_bundle.pb.go index 128977e5e1..e059b2e7dd 100644 --- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1/sigstore_bundle.pb.go +++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1/sigstore_bundle.pb.go @@ -14,8 +14,8 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.10 -// protoc v7.34.1 +// protoc-gen-go v1.36.11 +// protoc v7.35.1 // source: sigstore_bundle.proto package v1 diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/common/v1/sigstore_common.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/common/v1/sigstore_common.pb.go index 4730718f47..11570bdb7a 100644 --- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/common/v1/sigstore_common.pb.go +++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/common/v1/sigstore_common.pb.go @@ -14,8 +14,8 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.10 -// protoc v7.34.1 +// protoc-gen-go v1.36.11 +// protoc v7.35.1 // source: sigstore_common.proto package v1 diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/dsse/envelope.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/dsse/envelope.pb.go index 77a81a40f0..73a084b2f9 100644 --- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/dsse/envelope.pb.go +++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/dsse/envelope.pb.go @@ -14,8 +14,8 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.10 -// protoc v7.34.1 +// protoc-gen-go v1.36.11 +// protoc v7.35.1 // source: envelope.proto package dsse @@ -180,7 +180,8 @@ const file_envelope_proto_rawDesc = "" + "signatures\"3\n" + "\tSignature\x12\x10\n" + "\x03sig\x18\x01 \x01(\fR\x03sig\x12\x14\n" + - "\x05keyid\x18\x02 \x01(\tR\x05keyidBDZ1github.com/sigstore/protobuf-specs/gen/pb-go/dsse\xea\x02\x0eSigstore::DSSEb\x06proto3" + "\x05keyid\x18\x02 \x01(\tR\x05keyidB]\n" + + "\x17dev.sigstore.proto.dsseZ1github.com/sigstore/protobuf-specs/gen/pb-go/dsse\xea\x02\x0eSigstore::DSSEb\x06proto3" var ( file_envelope_proto_rawDescOnce sync.Once diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1/sigstore_rekor.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1/sigstore_rekor.pb.go index 2e94c90088..58ce1801e1 100644 --- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1/sigstore_rekor.pb.go +++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1/sigstore_rekor.pb.go @@ -14,8 +14,8 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.10 -// protoc v7.34.1 +// protoc-gen-go v1.36.11 +// protoc v7.35.1 // source: sigstore_rekor.proto package v1 diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go index f1521b9cb7..7542cb92a7 100644 --- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go +++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go @@ -14,8 +14,8 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.10 -// protoc v7.34.1 +// protoc-gen-go v1.36.11 +// protoc v7.35.1 // source: sigstore_trustroot.proto package v1 @@ -103,15 +103,15 @@ func (ServiceSelector) EnumDescriptor() ([]byte, []int) { // TransparencyLogInstance describes the immutable parameters from a // transparency log. -// See https://www.rfc-editor.org/rfc/rfc9162.html#name-log-parameters -// for more details. // The included parameters are the minimal set required to identify a log, // and verify an inclusion proof/promise. type TransparencyLogInstance struct { state protoimpl.MessageState `protogen:"open.v1"` - // The base URL at which can be used to URLs for the client. + // The base URL that a client may use to identify a log. // SHOULD match the origin on the log checkpoint: // https://github.com/C2SP/C2SP/blob/main/tlog-checkpoint.md#note-text. + // MAY be a scheme-less URL. + // SHOULD NOT be used as the read path for log entries. BaseUrl string `protobuf:"bytes,1,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"` // The hash algorithm used for the Merkle Tree. HashAlgorithm v1.HashAlgorithm `protobuf:"varint,2,opt,name=hash_algorithm,json=hashAlgorithm,proto3,enum=dev.sigstore.common.v1.HashAlgorithm" json:"hash_algorithm,omitempty"` diff --git a/vendor/github.com/sigstore/sigstore/pkg/cryptoutils/publickey.go b/vendor/github.com/sigstore/sigstore/pkg/cryptoutils/publickey.go index e1ea8a8a7f..ed0acebf76 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/cryptoutils/publickey.go +++ b/vendor/github.com/sigstore/sigstore/pkg/cryptoutils/publickey.go @@ -20,8 +20,9 @@ import ( "crypto/ecdsa" "crypto/ed25519" "crypto/elliptic" + "crypto/mldsa" "crypto/rsa" - "crypto/sha1" // nolint:gosec + "crypto/sha1" //nolint:gosec "crypto/x509" "crypto/x509/pkix" "encoding/asn1" @@ -64,6 +65,8 @@ func UnmarshalPEMToPublicKey(pemBytes []byte) (crypto.PublicKey, error) { } // MarshalPublicKeyToDER converts a crypto.PublicKey into a PKIX, ASN.1 DER byte slice +// +// Deprecated: Use x509.MarshalPKIXPublicKey directly func MarshalPublicKeyToDER(pub crypto.PublicKey) ([]byte, error) { if pub == nil { return nil, errors.New("empty key") @@ -73,7 +76,7 @@ func MarshalPublicKeyToDER(pub crypto.PublicKey) ([]byte, error) { // MarshalPublicKeyToPEM converts a crypto.PublicKey into a PEM-encoded byte slice func MarshalPublicKeyToPEM(pub crypto.PublicKey) ([]byte, error) { - derBytes, err := MarshalPublicKeyToDER(pub) + derBytes, err := x509.MarshalPKIXPublicKey(pub) if err != nil { return nil, err } @@ -84,6 +87,11 @@ func MarshalPublicKeyToPEM(pub crypto.PublicKey) ([]byte, error) { // subjectPublicKey (excluding the tag, length, and number of unused bits). // https://tools.ietf.org/html/rfc5280#section-4.2.1.2 func SKID(pub crypto.PublicKey) ([]byte, error) { + if mldsaKey, ok := pub.(*mldsa.PublicKey); ok { + if _, err := ValidateMLDSAPublicKey(mldsaKey); err != nil { + return nil, err + } + } derPubBytes, err := x509.MarshalPKIXPublicKey(pub) if err != nil { return nil, err @@ -92,11 +100,11 @@ func SKID(pub crypto.PublicKey) ([]byte, error) { if _, err := asn1.Unmarshal(derPubBytes, &spki); err != nil { return nil, err } - skid := sha1.Sum(spki.SubjectPublicKey.Bytes) // nolint:gosec + skid := sha1.Sum(spki.SubjectPublicKey.Bytes) //nolint:gosec return skid[:], nil } -// EqualKeys compares two public keys. Supports RSA, ECDSA and ED25519. +// EqualKeys compares two public keys. Supports RSA, ECDSA, ED25519, and ML-DSA. // If not equal, the error message contains hex-encoded SHA1 hashes of the DER-encoded keys func EqualKeys(first, second crypto.PublicKey) error { switch pub := first.(type) { @@ -112,12 +120,37 @@ func EqualKeys(first, second crypto.PublicKey) error { if !pub.Equal(second) { return errors.New(genErrMsg(first, second, "ed25519")) } + case *mldsa.PublicKey: + if _, err := ValidateMLDSAPublicKey(pub); err != nil { + return err + } + if !pub.Equal(second) { + return errors.New(genErrMsg(first, second, "mldsa")) + } default: return errors.New("unsupported key type") } return nil } +// ValidateMLDSAPublicKey checks that the ML-DSA public key is non-nil and properly initialized, +// returning its parameters. +// In the Go standard library, calling methods such as Parameters() on an uninitialized +// &mldsa.PublicKey{} panics because its internal parameters are uninitialized. This function +// performs a deliberate probe to catch such panics safely and return a descriptive error. +func ValidateMLDSAPublicKey(pub *mldsa.PublicKey) (params mldsa.Parameters, err error) { + if pub == nil { + return mldsa.Parameters{}, errors.New("ML-DSA public key must not be nil") + } + defer func() { + if r := recover(); r != nil { + err = fmt.Errorf("invalid ML-DSA public key: %v", r) + } + }() + // Deliberate panic probe: calling Parameters() panics if pub is &mldsa.PublicKey{} + return pub.Parameters(), nil +} + // genErrMsg generates an error message for EqualKeys func genErrMsg(first, second crypto.PublicKey, keyType string) string { msg := fmt.Sprintf("%s public keys are not equal", keyType) @@ -133,10 +166,10 @@ func genErrMsg(first, second crypto.PublicKey, keyType string) string { return fmt.Sprintf("%s (%s, %s)", msg, hex.EncodeToString(firstSKID), hex.EncodeToString(secondSKID)) } -// ValidatePubKey validates the parameters of an RSA, ECDSA, or ED25519 public key. +// ValidatePubKey validates the parameters of an RSA, ECDSA, ED25519, or ML-DSA public key. // -// Deprecated: This function only verifies the size of the key for RSA or the curve -// for ECDSA. This is largely unnecessary, and this function will be removed +// Deprecated: This function only verifies the size of the key for RSA, the curve +// for ECDSA, or initialization for ML-DSA. This is largely unnecessary, and this function will be removed // in a future version. func ValidatePubKey(pub crypto.PublicKey) error { switch pk := pub.(type) { @@ -153,6 +186,9 @@ func ValidatePubKey(pub crypto.PublicKey) error { case ed25519.PublicKey: // Nothing to validate for Ed25519 return nil + case *mldsa.PublicKey: + _, err := ValidateMLDSAPublicKey(pk) + return err } return fmt.Errorf("unsupported public key type: %T", pub) } diff --git a/vendor/github.com/sigstore/sigstore/pkg/fulcioroots/fulcioroots.go b/vendor/github.com/sigstore/sigstore/pkg/fulcioroots/fulcioroots.go index 56a5bdd39b..b04c3645ab 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/fulcioroots/fulcioroots.go +++ b/vendor/github.com/sigstore/sigstore/pkg/fulcioroots/fulcioroots.go @@ -27,7 +27,7 @@ import ( "sync" "github.com/sigstore/sigstore/pkg/cryptoutils" - "github.com/sigstore/sigstore/pkg/tuf" // nolint:staticcheck + "github.com/sigstore/sigstore/pkg/tuf" //nolint:staticcheck ) var ( @@ -101,13 +101,13 @@ func GetIntermediatesWithCertPool(pool *x509.CertPool) error { } func initRoots() ([]*x509.Certificate, []*x509.Certificate, error) { - tufClient, err := tuf.NewFromEnv(context.Background()) // nolint:staticcheck + tufClient, err := tuf.NewFromEnv(context.Background()) if err != nil { return nil, nil, fmt.Errorf("initializing tuf: %w", err) } // Retrieve from the embedded or cached TUF root. If expired, a network // call is made to update the root. - targets, err := tufClient.GetTargetsByMeta(tuf.Fulcio, []string{fulcioTargetStr, fulcioV1TargetStr, fulcioV1IntermediateTargetStr}) // nolint:staticcheck + targets, err := tufClient.GetTargetsByMeta(tuf.Fulcio, []string{fulcioTargetStr, fulcioV1TargetStr, fulcioV1IntermediateTargetStr}) if err != nil { return nil, nil, fmt.Errorf("error getting targets: %w", err) } diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/algorithm_registry.go b/vendor/github.com/sigstore/sigstore/pkg/signature/algorithm_registry.go index 802256ac65..0930d2187f 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/algorithm_registry.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/algorithm_registry.go @@ -20,11 +20,13 @@ import ( "crypto/ecdsa" "crypto/ed25519" "crypto/elliptic" + "crypto/mldsa" "crypto/rsa" "errors" "fmt" v1 "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1" + "github.com/sigstore/sigstore/pkg/cryptoutils" ) // PublicKeyType represents the public key algorithm for a given signature algorithm. @@ -37,6 +39,8 @@ const ( ECDSA // ED25519 public key ED25519 + // MLDSA public key + MLDSA ) // RSAKeySize represents the size of an RSA public key in bits. @@ -115,6 +119,19 @@ func (a AlgorithmDetails) GetECDSACurve() (*elliptic.Curve, error) { return &ecdsaCurve, nil } +// GetMLDSAParameters returns the ML-DSA parameters for the algorithm details, if the key type is MLDSA. +func (a AlgorithmDetails) GetMLDSAParameters() (mldsa.Parameters, error) { + if a.keyType != MLDSA { + return mldsa.Parameters{}, fmt.Errorf("unable to retrieve ML-DSA parameters for key type: %T", a.keyType) + } + params, ok := a.extraKeyParams.(mldsa.Parameters) + if !ok { + // This should be unreachable. + return mldsa.Parameters{}, fmt.Errorf("unable to retrieve parameters for ML-DSA, malformed algorithm details?: %T", a.keyType) + } + return params, nil +} + func (a AlgorithmDetails) checkKey(pubKey crypto.PublicKey) (bool, error) { switch a.keyType { case RSA: @@ -140,6 +157,23 @@ func (a AlgorithmDetails) checkKey(pubKey crypto.PublicKey) (bool, error) { case ED25519: _, ok := pubKey.(ed25519.PublicKey) return ok, nil + case MLDSA: + mldsaKey, ok := pubKey.(*mldsa.PublicKey) + if !ok { + return false, nil + } + // Validate the ML-DSA key. If the key is a typed nil or uninitialized, + // return an error so the caller receives a meaningful diagnostic rather + // than a generic "unsupported algorithm" failure. + keyParams, err := cryptoutils.ValidateMLDSAPublicKey(mldsaKey) + if err != nil { + return false, err + } + params, err := a.GetMLDSAParameters() + if err != nil { + return false, err + } + return keyParams == params, nil } return false, fmt.Errorf("unrecognized key type: %T", a.keyType) } @@ -165,6 +199,9 @@ var supportedAlgorithms = []AlgorithmDetails{ {v1.PublicKeyDetails_PKIX_ECDSA_P521_SHA_256, ECDSA, crypto.SHA256, v1.HashAlgorithm_SHA2_256, elliptic.P521(), "ecdsa-sha2-256-nistp521"}, //nolint:staticcheck {v1.PublicKeyDetails_PKIX_ED25519, ED25519, crypto.Hash(0), v1.HashAlgorithm_HASH_ALGORITHM_UNSPECIFIED, nil, "ed25519"}, {v1.PublicKeyDetails_PKIX_ED25519_PH, ED25519, crypto.SHA512, v1.HashAlgorithm_SHA2_512, nil, "ed25519-ph"}, + {v1.PublicKeyDetails_ML_DSA_44, MLDSA, crypto.Hash(0), v1.HashAlgorithm_HASH_ALGORITHM_UNSPECIFIED, mldsa.MLDSA44(), "mldsa-44"}, + {v1.PublicKeyDetails_ML_DSA_65, MLDSA, crypto.Hash(0), v1.HashAlgorithm_HASH_ALGORITHM_UNSPECIFIED, mldsa.MLDSA65(), "mldsa-65"}, + {v1.PublicKeyDetails_ML_DSA_87, MLDSA, crypto.Hash(0), v1.HashAlgorithm_HASH_ALGORITHM_UNSPECIFIED, mldsa.MLDSA87(), "mldsa-87"}, } // AlgorithmRegistryConfig represents a set of permitted algorithms for a given Sigstore service or component. @@ -244,6 +281,9 @@ func ParseSignatureAlgorithmFlag(flag string) (v1.PublicKeyDetails, error) { // ECDSA P384 => v1.PublicKeyDetails_PKIX_ECDSA_P384_SHA_384 // ECDSA P521 => v1.PublicKeyDetails_PKIX_ECDSA_P521_SHA_512 // ED25519 => v1.PublicKeyDetails_PKIX_ED25519_PH +// MLDSA44 => v1.PublicKeyDetails_ML_DSA_44 +// MLDSA65 => v1.PublicKeyDetails_ML_DSA_65 +// MLDSA87 => v1.PublicKeyDetails_ML_DSA_87 // // This function accepts LoadOptions, which are used to determine the default // public key details when there may be ambiguities. For example, RSA keys may @@ -293,6 +333,19 @@ func GetDefaultPublicKeyDetails(publicKey crypto.PublicKey, opts ...LoadOption) return v1.PublicKeyDetails_PKIX_ED25519_PH, nil } return v1.PublicKeyDetails_PKIX_ED25519, nil + case *mldsa.PublicKey: + params, err := cryptoutils.ValidateMLDSAPublicKey(pk) + if err != nil { + return v1.PublicKeyDetails_PUBLIC_KEY_DETAILS_UNSPECIFIED, err + } + switch params { + case mldsa.MLDSA44(): + return v1.PublicKeyDetails_ML_DSA_44, nil + case mldsa.MLDSA65(): + return v1.PublicKeyDetails_ML_DSA_65, nil + case mldsa.MLDSA87(): + return v1.PublicKeyDetails_ML_DSA_87, nil + } } return v1.PublicKeyDetails_PUBLIC_KEY_DETAILS_UNSPECIFIED, errors.New("unsupported public key type") } diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/ecdsa.go b/vendor/github.com/sigstore/sigstore/pkg/signature/ecdsa.go index d333cb23f9..3c689bc63b 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/ecdsa.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/ecdsa.go @@ -140,6 +140,10 @@ func LoadECDSAVerifier(pub *ecdsa.PublicKey, hashFunc crypto.Hash) (*ECDSAVerifi return nil, errors.New("invalid ECDSA public key specified") } + if _, err := pub.Bytes(); err != nil { + return nil, fmt.Errorf("invalid ECDSA public key: %w", err) + } + if !isSupportedAlg(hashFunc, ecdsaSupportedHashFuncs) { return nil, errors.New("invalid hash function specified") } @@ -187,11 +191,6 @@ func (e ECDSAVerifier) VerifySignature(signature, message io.Reader, opts ...Ver return fmt.Errorf("reading signature: %w", err) } - // Without this check, VerifyASN1 panics on an invalid key. - if !e.publicKey.IsOnCurve(e.publicKey.X, e.publicKey.Y) { - return fmt.Errorf("invalid ECDSA public key for %s", e.publicKey.Params().Name) - } - asnParseTest := struct { R, S *big.Int }{} diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/ed25519.go b/vendor/github.com/sigstore/sigstore/pkg/signature/ed25519.go index 23a8638ff5..3719944102 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/ed25519.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/ed25519.go @@ -101,6 +101,10 @@ func LoadED25519Verifier(pub ed25519.PublicKey) (*ED25519Verifier, error) { return nil, errors.New("invalid ED25519 public key specified") } + if len(pub) != ed25519.PublicKeySize { + return nil, errors.New("invalid size for ED25519 key") + } + return &ED25519Verifier{ publicKey: pub, }, nil diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/ed25519ph.go b/vendor/github.com/sigstore/sigstore/pkg/signature/ed25519ph.go index d1660796a8..b5de8e9c40 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/ed25519ph.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/ed25519ph.go @@ -109,6 +109,10 @@ func LoadED25519phVerifier(pub ed25519.PublicKey) (*ED25519phVerifier, error) { return nil, errors.New("invalid ED25519 public key specified") } + if len(pub) != ed25519.PublicKeySize { + return nil, errors.New("invalid size for ED25519 key") + } + return &ED25519phVerifier{ publicKey: pub, }, nil diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/aws/client.go b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/aws/client.go index dc86bbb75d..4b5e543187 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/aws/client.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/aws/client.go @@ -136,7 +136,7 @@ func (a *awsClient) setupClient(ctx context.Context, opts ...func(*config.LoadOp if os.Getenv("AWS_TLS_INSECURE_SKIP_VERIFY") == "1" { opts = append(opts, config.WithHTTPClient(&http.Client{ Transport: &http.Transport{ - TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // nolint: gosec + TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec }, })) } @@ -260,9 +260,9 @@ func (a *awsClient) createKey(ctx context.Context, algorithm string) (crypto.Pub usage := types.KeyUsageTypeSignVerify description := "Created by Sigstore" key, err := a.client.CreateKey(ctx, &kms.CreateKeyInput{ - CustomerMasterKeySpec: types.CustomerMasterKeySpec(algorithm), - KeyUsage: usage, - Description: &description, + KeySpec: types.KeySpec(algorithm), + KeyUsage: usage, + Description: &description, }) if err != nil { return nil, fmt.Errorf("creating key: %w", err) diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/azure/client.go b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/azure/client.go index 1f94aac327..0c885769c0 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/azure/client.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/azure/client.go @@ -261,7 +261,8 @@ func (a *azureVaultClient) createKey(ctx context.Context) (crypto.PublicKey, err Tags: map[string]*string{ "use": to.Ptr("sigstore"), }, - }, nil) + }, nil, + ) if err != nil { return nil, err } diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/azure/signer.go b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/azure/signer.go index 808be61cab..216d76cb3f 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/azure/signer.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/azure/signer.go @@ -18,6 +18,7 @@ package azure import ( "context" "crypto" + "crypto/ecdsa" "errors" "fmt" "io" @@ -181,12 +182,24 @@ func (a *SignerVerifier) VerifySignature(sig, message io.Reader, opts ...signatu return errors.New("parsing signature") } - rBytes := r.Bytes() - sBytes := r.Bytes() + // Azure Key Vault expects the raw signature as r||s, with each + // coordinate left-padded to the curve's byte size. big.Int.Bytes() + // strips leading zero bytes, which would produce an incorrectly sized + // signature (and thus a spurious verification failure) whenever r or s + // has a high zero byte, so pad explicitly using the key's curve size. + pub, err := a.client.public(a.defaultCtx) + if err != nil { + return fmt.Errorf("getting public key: %w", err) + } + ecPub, ok := pub.(*ecdsa.PublicKey) + if !ok { + return fmt.Errorf("expected ECDSA public key, got %T", pub) + } + keyBytes := (ecPub.Curve.Params().BitSize + 7) / 8 - sigBytes = make([]byte, 0, len(rBytes)+len(sBytes)) - sigBytes = append(sigBytes, rBytes...) - sigBytes = append(sigBytes, sBytes...) + sigBytes = make([]byte, 2*keyBytes) + r.FillBytes(sigBytes[:keyBytes]) + s.FillBytes(sigBytes[keyBytes:]) } return a.client.verify(a.defaultCtx, sigBytes, digest) diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/signer.go b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/signer.go index 1965f317d1..9fb237edc2 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/signer.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/signer.go @@ -28,7 +28,6 @@ import ( ) // Taken from https://www.vaultproject.io/api/secret/transit -// nolint:revive const ( AlgorithmECDSAP256 = "ecdsa-p256" AlgorithmECDSAP384 = "ecdsa-p384" diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/mldsa.go b/vendor/github.com/sigstore/sigstore/pkg/signature/mldsa.go new file mode 100644 index 0000000000..eae2590463 --- /dev/null +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/mldsa.go @@ -0,0 +1,238 @@ +// +// Copyright 2026 The Sigstore Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package signature + +import ( + "bytes" + "crypto" + "crypto/mldsa" + "errors" + "fmt" + "io" + + "github.com/sigstore/sigstore/pkg/cryptoutils" +) + +var mldsaSupportedHashFuncs = []crypto.Hash{ + crypto.Hash(0), +} + +// MLDSASigner is a signature.Signer that uses the ML-DSA post-quantum signature scheme. +// +// WARNING: This is experimental and may change. +type MLDSASigner struct { + priv *mldsa.PrivateKey +} + +// validateMLDSAPrivateKey checks that the ML-DSA private key is properly initialized. +// Calling priv.PublicKey() does not panic for an uninitialized &mldsa.PrivateKey{} in current +// Go versions (the panic occurs when probing the resulting public key), but this recover is +// retained as defense-in-depth against future runtime changes. +func validateMLDSAPrivateKey(priv *mldsa.PrivateKey) (err error) { + defer func() { + if r := recover(); r != nil { + err = fmt.Errorf("key is invalid: %v", r) + } + }() + if _, valErr := cryptoutils.ValidateMLDSAPublicKey(priv.PublicKey()); valErr != nil { + return valErr + } + return nil +} + +// LoadMLDSASigner calculates signatures using the specified private key. +func LoadMLDSASigner(priv *mldsa.PrivateKey) (*MLDSASigner, error) { + if priv == nil { + return nil, errors.New("invalid ML-DSA private key specified") + } + if err := validateMLDSAPrivateKey(priv); err != nil { + return nil, fmt.Errorf("invalid ML-DSA private key specified: %w", err) + } + + return &MLDSASigner{ + priv: priv, + }, nil +} + +// SignMessage signs the provided message using Pure ML-DSA with an empty context. +// +// Passing the WithDigest option with a digest is not supported as ML-DSA handles +// its own internal message processing. Other options are ignored. +func (m MLDSASigner) SignMessage(message io.Reader, opts ...SignOption) ([]byte, error) { + var digest []byte + for _, opt := range opts { + opt.ApplyDigest(&digest) + } + if len(digest) > 0 { + return nil, errors.New("WithDigest is not supported for ML-DSA") + } + messageBytes, _, err := ComputeDigestForSigning(message, crypto.Hash(0), mldsaSupportedHashFuncs) + if err != nil { + return nil, err + } + + return m.priv.Sign(nil, messageBytes, nil) +} + +// Public returns the public key that can be used to verify signatures created by +// this signer. +func (m MLDSASigner) Public() crypto.PublicKey { + if m.priv == nil { + return nil + } + + return m.priv.Public() +} + +// PublicKey returns the public key that can be used to verify signatures created by +// this signer. As this value is held in memory, all options provided in arguments +// to this method are ignored. +func (m MLDSASigner) PublicKey(_ ...PublicKeyOption) (crypto.PublicKey, error) { + return m.Public(), nil +} + +// Sign computes the signature for the specified message using Pure ML-DSA with an empty context +// for consistency across software, KMS, and hardware backends. Callers requiring domain separation +// can enforce it at the payload level. +// +// The rand argument is ignored because ML-DSA internally generates randomness. +// If opts is non-nil, only opts with an empty context and HashFunc() == crypto.Hash(0) are supported; +// pre-hashed μ (crypto.MLDSAMu) and non-empty context strings are not permitted. +func (m MLDSASigner) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts) ([]byte, error) { + if message == nil { + return nil, errors.New("message must not be nil") + } + if opts != nil { + if opts.HashFunc() != crypto.Hash(0) { + return nil, fmt.Errorf("unsupported hash function: %v", opts.HashFunc()) + } + if mldsaOpts, ok := opts.(*mldsa.Options); ok && mldsaOpts.Context != "" { + return nil, errors.New("non-empty context is not supported; use empty context for consistency across backends") + } + } + return m.SignMessage(bytes.NewReader(message)) +} + +// MLDSAVerifier is a signature.Verifier that uses the ML-DSA post-quantum signature system. +// +// WARNING: This is experimental and may change. +type MLDSAVerifier struct { + publicKey *mldsa.PublicKey +} + +// LoadMLDSAVerifier returns a Verifier that verifies signatures using the specified ML-DSA public key. +func LoadMLDSAVerifier(pub *mldsa.PublicKey) (*MLDSAVerifier, error) { + if pub == nil { + return nil, errors.New("invalid ML-DSA public key specified") + } + if _, err := cryptoutils.ValidateMLDSAPublicKey(pub); err != nil { + return nil, fmt.Errorf("invalid ML-DSA public key specified: %w", err) + } + + return &MLDSAVerifier{ + publicKey: pub, + }, nil +} + +// PublicKey returns the public key that is used to verify signatures by +// this verifier. As this value is held in memory, all options provided in arguments +// to this method are ignored. +func (m *MLDSAVerifier) PublicKey(_ ...PublicKeyOption) (crypto.PublicKey, error) { + return m.publicKey, nil +} + +// VerifySignature verifies the signature for the given message using Pure ML-DSA with an empty context. +// +// This function returns nil if the verification succeeded, and an error message otherwise. +// +// Passing the WithDigest option with a digest is explicitly rejected as ML-DSA does not support +// pre-hashed message digests. Other options are ignored. +func (m *MLDSAVerifier) VerifySignature(signature, message io.Reader, opts ...VerifyOption) error { + if signature == nil { + return errors.New("nil signature passed to VerifySignature") + } + var digest []byte + for _, opt := range opts { + opt.ApplyDigest(&digest) + } + if len(digest) > 0 { + return errors.New("WithDigest is not supported for ML-DSA") + } + messageBytes, _, err := ComputeDigestForVerifying(message, crypto.Hash(0), mldsaSupportedHashFuncs) + if err != nil { + return err + } + + sigBytes, err := io.ReadAll(signature) + if err != nil { + return fmt.Errorf("reading signature: %w", err) + } + + return mldsa.Verify(m.publicKey, messageBytes, sigBytes, nil) +} + +// MLDSASignerVerifier is a signature.SignerVerifier that uses the ML-DSA post-quantum signature system +type MLDSASignerVerifier struct { + *MLDSASigner + *MLDSAVerifier +} + +// LoadMLDSASignerVerifier creates a combined signer and verifier. This is +// a convenience object that simply wraps an instance of MLDSASigner and MLDSAVerifier. +func LoadMLDSASignerVerifier(priv *mldsa.PrivateKey) (*MLDSASignerVerifier, error) { + signer, err := LoadMLDSASigner(priv) + if err != nil { + return nil, fmt.Errorf("initializing signer: %w", err) + } + verifier, err := LoadMLDSAVerifier(priv.PublicKey()) + if err != nil { + return nil, fmt.Errorf("initializing verifier: %w", err) + } + + return &MLDSASignerVerifier{ + MLDSASigner: signer, + MLDSAVerifier: verifier, + }, nil +} + +// NewDefaultMLDSASignerVerifier creates a combined signer and verifier using ML-DSA. +// This creates a new ML-DSA key using the recommended default MLDSA44 parameter set. +func NewDefaultMLDSASignerVerifier() (*MLDSASignerVerifier, *mldsa.PrivateKey, error) { + return NewMLDSASignerVerifier(mldsa.MLDSA44()) +} + +// NewMLDSASignerVerifier creates a combined signer and verifier using ML-DSA. +// This creates a new ML-DSA key using the specified parameter set. +func NewMLDSASignerVerifier(params mldsa.Parameters) (*MLDSASignerVerifier, *mldsa.PrivateKey, error) { + priv, err := mldsa.GenerateKey(params) + if err != nil { + return nil, nil, err + } + + sv, err := LoadMLDSASignerVerifier(priv) + if err != nil { + return nil, nil, err + } + + return sv, priv, nil +} + +// PublicKey returns the public key that is used to verify signatures by +// this verifier. As this value is held in memory, all options provided in arguments +// to this method are ignored. +func (m MLDSASignerVerifier) PublicKey(_ ...PublicKeyOption) (crypto.PublicKey, error) { + return m.publicKey, nil +} diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/signer.go b/vendor/github.com/sigstore/sigstore/pkg/signature/signer.go index 50f432798d..4e1cd45bd4 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/signer.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/signer.go @@ -19,8 +19,10 @@ import ( "crypto" "crypto/ecdsa" "crypto/ed25519" + "crypto/mldsa" "crypto/rsa" "errors" + "fmt" "io" "os" "path/filepath" @@ -85,8 +87,10 @@ func LoadSignerWithOpts(privateKey crypto.PrivateKey, opts ...LoadOption) (Signe return LoadED25519phSigner(pk) } return LoadED25519Signer(pk) + case *mldsa.PrivateKey: + return LoadMLDSASigner(pk) } - return nil, errors.New("unsupported public key type") + return nil, fmt.Errorf("unsupported private key type: %T", privateKey) } // LoadSignerFromPEMFile returns a signature.Signer based on the algorithm of the private key diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/signerverifier.go b/vendor/github.com/sigstore/sigstore/pkg/signature/signerverifier.go index 9ff93420ec..124ccbb8c8 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/signerverifier.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/signerverifier.go @@ -19,6 +19,7 @@ import ( "crypto" "crypto/ecdsa" "crypto/ed25519" + "crypto/mldsa" "crypto/rsa" "errors" "os" @@ -68,6 +69,8 @@ func LoadSignerVerifierWithOpts(privateKey crypto.PrivateKey, opts ...LoadOption return LoadED25519phSignerVerifier(pk) } return LoadED25519SignerVerifier(pk) + case *mldsa.PrivateKey: + return LoadMLDSASignerVerifier(pk) } return nil, errors.New("unsupported public key type") } diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/verifier.go b/vendor/github.com/sigstore/sigstore/pkg/signature/verifier.go index 0b5a1bba7c..cb72d9f6db 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/verifier.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/verifier.go @@ -19,8 +19,10 @@ import ( "crypto" "crypto/ecdsa" "crypto/ed25519" + "crypto/mldsa" "crypto/rsa" "errors" + "fmt" "io" "os" "path/filepath" @@ -69,8 +71,10 @@ func LoadVerifierWithOpts(publicKey crypto.PublicKey, opts ...LoadOption) (Verif return LoadED25519phVerifier(pk) } return LoadED25519Verifier(pk) + case *mldsa.PublicKey: + return LoadMLDSAVerifier(pk) } - return nil, errors.New("unsupported public key type") + return nil, fmt.Errorf("unsupported public key type: %T", publicKey) } // LoadUnsafeVerifier returns a signature.Verifier based on the algorithm of the public key @@ -98,8 +102,10 @@ func LoadUnsafeVerifier(publicKey crypto.PublicKey) (Verifier, error) { }, nil case ed25519.PublicKey: return LoadED25519Verifier(pk) + case *mldsa.PublicKey: + return LoadMLDSAVerifier(pk) } - return nil, errors.New("unsupported public key type") + return nil, fmt.Errorf("unsupported public key type: %T", publicKey) } // LoadVerifierFromPEMFile returns a signature.Verifier based on the contents of a diff --git a/vendor/github.com/sigstore/sigstore/pkg/tuf/client.go b/vendor/github.com/sigstore/sigstore/pkg/tuf/client.go index 00229e626f..ee32d02444 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/tuf/client.go +++ b/vendor/github.com/sigstore/sigstore/pkg/tuf/client.go @@ -376,7 +376,8 @@ func Initialize(_ context.Context, mirror string, root []byte) error { func isValidTarget(testTarget []byte, validMeta data.TargetFileMeta) (bool, error) { localMeta, err := util.GenerateTargetFileMeta( bytes.NewReader(testTarget), - "sha256", "sha512") + "sha256", "sha512", + ) if err != nil { return false, err } diff --git a/vendor/github.com/spiffe/go-spiffe/v2/bundle/spiffebundle/bundle.go b/vendor/github.com/spiffe/go-spiffe/v2/bundle/spiffebundle/bundle.go index 712ec636bd..95a3c12430 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/bundle/spiffebundle/bundle.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/bundle/spiffebundle/bundle.go @@ -14,6 +14,7 @@ import ( "github.com/go-jose/go-jose/v4" "github.com/spiffe/go-spiffe/v2/bundle/jwtbundle" "github.com/spiffe/go-spiffe/v2/bundle/x509bundle" + "github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle" "github.com/spiffe/go-spiffe/v2/internal/jwtutil" "github.com/spiffe/go-spiffe/v2/internal/x509util" "github.com/spiffe/go-spiffe/v2/spiffeid" @@ -22,6 +23,7 @@ import ( const ( x509SVIDUse = "x509-svid" jwtSVIDUse = "jwt-svid" + witSVIDUse = "wit-svid" ) type bundleDoc struct { @@ -41,6 +43,7 @@ type Bundle struct { refreshHint *time.Duration sequenceNumber *uint64 jwtAuthorities map[string]crypto.PublicKey + witAuthorities map[string]crypto.PublicKey x509Authorities []*x509.Certificate } @@ -49,6 +52,7 @@ func New(trustDomain spiffeid.TrustDomain) *Bundle { return &Bundle{ trustDomain: trustDomain, jwtAuthorities: make(map[string]crypto.PublicKey), + witAuthorities: make(map[string]crypto.PublicKey), } } @@ -105,7 +109,11 @@ func Parse(trustDomain spiffeid.TrustDomain, bundleBytes []byte) (*Bundle, error bundle.AddX509Authority(key.Certificates[0]) case jwtSVIDUse: if err := bundle.AddJWTAuthority(key.KeyID, key.Key); err != nil { - return nil, wrapSpiffebundleErr(fmt.Errorf("error adding authority %d of JWKS: %v", i, errors.Unwrap(err))) + return nil, wrapSpiffebundleErr(fmt.Errorf("error adding authority %d of JWKS: %w", i, errors.Unwrap(err))) + } + case witSVIDUse: + if err := bundle.AddWITAuthority(key.KeyID, key.Key); err != nil { + return nil, wrapSpiffebundleErr(fmt.Errorf("error adding WIT authority %d of JWKS: %w", i, errors.Unwrap(err))) } } } @@ -143,6 +151,21 @@ func FromJWTAuthorities(trustDomain spiffeid.TrustDomain, jwtAuthorities map[str return bundle } +// FromWITAuthorities creates a new bundle from WIT authorities. +func FromWITAuthorities(trustDomain spiffeid.TrustDomain, witAuthorities map[string]crypto.PublicKey) *Bundle { + bundle := New(trustDomain) + bundle.witAuthorities = jwtutil.CopyJWTAuthorities(witAuthorities) + return bundle +} + +// FromWITBundle creates a bundle from a WIT bundle. +// The function panics in case of a nil WIT bundle. +func FromWITBundle(witBundle *witbundle.Bundle) *Bundle { + bundle := New(witBundle.TrustDomain()) + bundle.witAuthorities = witBundle.WITAuthorities() + return bundle +} + // TrustDomain returns the trust domain that the bundle belongs to. func (b *Bundle) TrustDomain() spiffeid.TrustDomain { return b.trustDomain @@ -263,12 +286,70 @@ func (b *Bundle) SetJWTAuthorities(jwtAuthorities map[string]crypto.PublicKey) { b.jwtAuthorities = jwtutil.CopyJWTAuthorities(jwtAuthorities) } -// Empty returns true if the bundle has no X.509 and JWT authorities. +// WITAuthorities returns the WIT authorities in the bundle, keyed by key ID. +func (b *Bundle) WITAuthorities() map[string]crypto.PublicKey { + b.mtx.RLock() + defer b.mtx.RUnlock() + + return jwtutil.CopyJWTAuthorities(b.witAuthorities) +} + +// FindWITAuthority finds the WIT authority with the given key ID from the bundle. +// If the authority is found, it is returned and the boolean is true. Otherwise, +// the returned value is nil and the boolean is false. +func (b *Bundle) FindWITAuthority(keyID string) (crypto.PublicKey, bool) { + b.mtx.RLock() + defer b.mtx.RUnlock() + + witAuthority, ok := b.witAuthorities[keyID] + return witAuthority, ok +} + +// HasWITAuthority returns true if the bundle has a WIT authority with the given key ID. +func (b *Bundle) HasWITAuthority(keyID string) bool { + b.mtx.RLock() + defer b.mtx.RUnlock() + + _, ok := b.witAuthorities[keyID] + return ok +} + +// AddWITAuthority adds a WIT authority to the bundle. If a WIT authority already exists +// under the given key ID, it is replaced. A key ID must be specified. +func (b *Bundle) AddWITAuthority(keyID string, witAuthority crypto.PublicKey) error { + if keyID == "" { + return wrapSpiffebundleErr(errors.New("keyID cannot be empty")) + } + + b.mtx.Lock() + defer b.mtx.Unlock() + + b.witAuthorities[keyID] = witAuthority + return nil +} + +// RemoveWITAuthority removes the WIT authority identified by the key ID from the bundle. +func (b *Bundle) RemoveWITAuthority(keyID string) { + b.mtx.Lock() + defer b.mtx.Unlock() + + delete(b.witAuthorities, keyID) +} + +// SetWITAuthorities sets the WIT authorities in the bundle. +func (b *Bundle) SetWITAuthorities(witAuthorities map[string]crypto.PublicKey) { + b.mtx.Lock() + defer b.mtx.Unlock() + + b.witAuthorities = jwtutil.CopyJWTAuthorities(witAuthorities) +} + +// Empty returns true if the bundle has no X.509, JWT, or WIT authorities. func (b *Bundle) Empty() bool { b.mtx.RLock() defer b.mtx.RUnlock() - return len(b.x509Authorities) == 0 && len(b.jwtAuthorities) == 0 + return len(b.x509Authorities) == 0 && len(b.jwtAuthorities) == 0 && len(b.witAuthorities) == 0 } // RefreshHint returns the refresh hint. If the refresh hint is set in @@ -359,6 +440,14 @@ func (b *Bundle) Marshal() ([]byte, error) { }) } + for keyID, witAuthority := range b.witAuthorities { + jwks.Keys = append(jwks.Keys, jose.JSONWebKey{ + Key: witAuthority, + KeyID: keyID, + Use: witSVIDUse, + }) + } + return json.Marshal(jwks) } @@ -373,6 +462,7 @@ func (b *Bundle) Clone() *Bundle { sequenceNumber: copySequenceNumber(b.sequenceNumber), x509Authorities: x509util.CopyX509Authorities(b.x509Authorities), jwtAuthorities: jwtutil.CopyJWTAuthorities(b.jwtAuthorities), + witAuthorities: jwtutil.CopyJWTAuthorities(b.witAuthorities), } } @@ -437,6 +527,28 @@ func (b *Bundle) GetJWTBundleForTrustDomain(trustDomain spiffeid.TrustDomain) (* return b.JWTBundle(), nil } +// WITBundle returns a WIT bundle containing the WIT authorities in the SPIFFE bundle. +func (b *Bundle) WITBundle() *witbundle.Bundle { + b.mtx.RLock() + defer b.mtx.RUnlock() + + return witbundle.FromWITAuthorities(b.trustDomain, b.witAuthorities) +} + +// GetWITBundleForTrustDomain returns the WIT bundle of the given trust domain. +// It implements the witbundle.Source interface. An error will be returned if +// the trust domain does not match that of the bundle. +func (b *Bundle) GetWITBundleForTrustDomain(trustDomain spiffeid.TrustDomain) (*witbundle.Bundle, error) { + b.mtx.RLock() + defer b.mtx.RUnlock() + + if b.trustDomain != trustDomain { + return nil, wrapSpiffebundleErr(fmt.Errorf("no WIT bundle for trust domain %q", trustDomain)) + } + + return b.WITBundle(), nil +} + // Equal compares the bundle for equality against the given bundle. func (b *Bundle) Equal(other *Bundle) bool { if b == nil || other == nil { @@ -447,6 +559,7 @@ func (b *Bundle) Equal(other *Bundle) bool { refreshHintEqual(b.refreshHint, other.refreshHint) && sequenceNumberEqual(b.sequenceNumber, other.sequenceNumber) && jwtutil.JWTAuthoritiesEqual(b.jwtAuthorities, other.jwtAuthorities) && + jwtutil.JWTAuthoritiesEqual(b.witAuthorities, other.witAuthorities) && x509util.CertsEqual(b.x509Authorities, other.x509Authorities) } diff --git a/vendor/github.com/spiffe/go-spiffe/v2/bundle/spiffebundle/set.go b/vendor/github.com/spiffe/go-spiffe/v2/bundle/spiffebundle/set.go index e0d5d4568b..c2e02e6aad 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/bundle/spiffebundle/set.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/bundle/spiffebundle/set.go @@ -7,6 +7,7 @@ import ( "github.com/spiffe/go-spiffe/v2/bundle/jwtbundle" "github.com/spiffe/go-spiffe/v2/bundle/x509bundle" + "github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle" "github.com/spiffe/go-spiffe/v2/spiffeid" ) @@ -134,3 +135,17 @@ func (s *Set) GetJWTBundleForTrustDomain(trustDomain spiffeid.TrustDomain) (*jwt return bundle.JWTBundle(), nil } + +// GetWITBundleForTrustDomain returns the WIT bundle for the given trust +// domain. It implements the witbundle.Source interface. +func (s *Set) GetWITBundleForTrustDomain(trustDomain spiffeid.TrustDomain) (*witbundle.Bundle, error) { + s.mtx.RLock() + defer s.mtx.RUnlock() + + bundle, ok := s.bundles[trustDomain] + if !ok { + return nil, wrapSpiffebundleErr(fmt.Errorf("no WIT bundle for trust domain %q", trustDomain)) + } + + return bundle.WITBundle(), nil +} diff --git a/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/bundle.go b/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/bundle.go new file mode 100644 index 0000000000..dbf8cf3cd9 --- /dev/null +++ b/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/bundle.go @@ -0,0 +1,208 @@ +// Package witbundle provides support for WIT bundles, which are JWK Sets used +// to validate WIT-SVID signatures. +package witbundle + +import ( + "crypto" + "encoding/json" + "errors" + "fmt" + "io" + "os" + "sync" + + "github.com/go-jose/go-jose/v4" + "github.com/spiffe/go-spiffe/v2/internal/jwtutil" + "github.com/spiffe/go-spiffe/v2/spiffeid" +) + +// Bundle is a collection of trusted WIT authorities for a trust domain. +type Bundle struct { + trustDomain spiffeid.TrustDomain + + mtx sync.RWMutex + witAuthorities map[string]crypto.PublicKey +} + +// New creates a new empty bundle for the given trust domain. +func New(trustDomain spiffeid.TrustDomain) *Bundle { + return &Bundle{ + trustDomain: trustDomain, + witAuthorities: make(map[string]crypto.PublicKey), + } +} + +// FromWITAuthorities creates a new bundle from a map of WIT authorities keyed +// by key ID. +func FromWITAuthorities(trustDomain spiffeid.TrustDomain, witAuthorities map[string]crypto.PublicKey) *Bundle { + return &Bundle{ + trustDomain: trustDomain, + witAuthorities: jwtutil.CopyJWTAuthorities(witAuthorities), + } +} + +// Load loads a bundle from a file on disk. The file must contain a standard +// RFC 7517 JWKS document. +func Load(trustDomain spiffeid.TrustDomain, path string) (*Bundle, error) { + bundleBytes, err := os.ReadFile(path) + if err != nil { + return nil, wrapErr(fmt.Errorf("unable to read WIT bundle: %w", err)) + } + + return Parse(trustDomain, bundleBytes) +} + +// Read decodes a bundle from a reader. The contents must contain a standard +// RFC 7517 JWKS document. +func Read(trustDomain spiffeid.TrustDomain, r io.Reader) (*Bundle, error) { + b, err := io.ReadAll(r) + if err != nil { + return nil, wrapErr(fmt.Errorf("unable to read: %v", err)) + } + + return Parse(trustDomain, b) +} + +// Parse parses a bundle from a JWK Set JSON document. +func Parse(trustDomain spiffeid.TrustDomain, bundleBytes []byte) (*Bundle, error) { + jwks := new(jose.JSONWebKeySet) + if err := json.Unmarshal(bundleBytes, jwks); err != nil { + return nil, wrapErr(fmt.Errorf("unable to parse JWKS: %v", err)) + } + + bundle := New(trustDomain) + for i, key := range jwks.Keys { + if err := bundle.AddWITAuthority(key.KeyID, key.Key); err != nil { + return nil, wrapErr(fmt.Errorf("error adding authority %d of JWKS: %v", i, errors.Unwrap(err))) + } + } + + return bundle, nil +} + +// TrustDomain returns the trust domain that the bundle belongs to. +func (b *Bundle) TrustDomain() spiffeid.TrustDomain { + return b.trustDomain +} + +// WITAuthorities returns the WIT authorities in the bundle, keyed by key ID. +func (b *Bundle) WITAuthorities() map[string]crypto.PublicKey { + b.mtx.RLock() + defer b.mtx.RUnlock() + + return jwtutil.CopyJWTAuthorities(b.witAuthorities) +} + +// FindWITAuthority finds the WIT authority with the given key ID from the bundle. +// If the authority is found, it is returned and the boolean is true. Otherwise, +// the returned value is nil and the boolean is false. +func (b *Bundle) FindWITAuthority(keyID string) (crypto.PublicKey, bool) { + b.mtx.RLock() + defer b.mtx.RUnlock() + + if witAuthority, ok := b.witAuthorities[keyID]; ok { + return witAuthority, true + } + return nil, false +} + +// HasWITAuthority returns true if the bundle has a WIT authority with the +// given key ID. +func (b *Bundle) HasWITAuthority(keyID string) bool { + b.mtx.RLock() + defer b.mtx.RUnlock() + + _, ok := b.witAuthorities[keyID] + return ok +} + +// AddWITAuthority adds a WIT authority to the bundle. If a WIT authority already +// exists under the given key ID, it is replaced. A key ID must be specified. +func (b *Bundle) AddWITAuthority(keyID string, witAuthority crypto.PublicKey) error { + if keyID == "" { + return wrapErr(errors.New("keyID cannot be empty")) + } + + b.mtx.Lock() + defer b.mtx.Unlock() + + b.witAuthorities[keyID] = witAuthority + return nil +} + +// RemoveWITAuthority removes the WIT authority identified by the key ID from +// the bundle. +func (b *Bundle) RemoveWITAuthority(keyID string) { + b.mtx.Lock() + defer b.mtx.Unlock() + + delete(b.witAuthorities, keyID) +} + +// SetWITAuthorities sets the WIT authorities in the bundle. +func (b *Bundle) SetWITAuthorities(witAuthorities map[string]crypto.PublicKey) { + b.mtx.Lock() + defer b.mtx.Unlock() + + b.witAuthorities = jwtutil.CopyJWTAuthorities(witAuthorities) +} + +// Empty returns true if the bundle has no WIT authorities. +func (b *Bundle) Empty() bool { + b.mtx.RLock() + defer b.mtx.RUnlock() + + return len(b.witAuthorities) == 0 +} + +// Marshal marshals the WIT bundle into a standard RFC 7517 JWKS document. +func (b *Bundle) Marshal() ([]byte, error) { + b.mtx.RLock() + defer b.mtx.RUnlock() + + jwks := jose.JSONWebKeySet{} + for keyID, witAuthority := range b.witAuthorities { + jwks.Keys = append(jwks.Keys, jose.JSONWebKey{ + Key: witAuthority, + KeyID: keyID, + }) + } + + return json.Marshal(jwks) +} + +// Clone clones the bundle. +func (b *Bundle) Clone() *Bundle { + b.mtx.RLock() + defer b.mtx.RUnlock() + + return FromWITAuthorities(b.trustDomain, b.witAuthorities) +} + +// Equal compares the bundle for equality against the given bundle. +func (b *Bundle) Equal(other *Bundle) bool { + if b == nil || other == nil { + return b == other + } + + return b.trustDomain == other.trustDomain && + jwtutil.JWTAuthoritiesEqual(b.witAuthorities, other.witAuthorities) +} + +// GetWITBundleForTrustDomain returns the WIT bundle for the given trust domain. +// It implements the Source interface. An error will be returned if the trust +// domain does not match that of the bundle. +func (b *Bundle) GetWITBundleForTrustDomain(trustDomain spiffeid.TrustDomain) (*Bundle, error) { + b.mtx.RLock() + defer b.mtx.RUnlock() + + if b.trustDomain != trustDomain { + return nil, wrapErr(fmt.Errorf("no WIT bundle for trust domain %q", trustDomain)) + } + + return b, nil +} + +func wrapErr(err error) error { + return fmt.Errorf("witbundle: %w", err) +} diff --git a/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/set.go b/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/set.go new file mode 100644 index 0000000000..2a44c5a5db --- /dev/null +++ b/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/set.go @@ -0,0 +1,106 @@ +package witbundle + +import ( + "fmt" + "sort" + "sync" + + "github.com/spiffe/go-spiffe/v2/spiffeid" +) + +// Set is a set of WIT bundles, keyed by trust domain. +type Set struct { + mtx sync.RWMutex + bundles map[spiffeid.TrustDomain]*Bundle +} + +// NewSet creates a new set initialized with the given bundles. +func NewSet(bundles ...*Bundle) *Set { + bundlesMap := make(map[spiffeid.TrustDomain]*Bundle) + + for _, b := range bundles { + if b != nil { + bundlesMap[b.trustDomain] = b + } + } + + return &Set{ + bundles: bundlesMap, + } +} + +// Add adds a new bundle into the set. If a bundle already exists for the +// trust domain, the existing bundle is replaced. +func (s *Set) Add(bundle *Bundle) { + s.mtx.Lock() + defer s.mtx.Unlock() + + if bundle != nil { + s.bundles[bundle.trustDomain] = bundle + } +} + +// Remove removes the bundle for the given trust domain. +func (s *Set) Remove(trustDomain spiffeid.TrustDomain) { + s.mtx.Lock() + defer s.mtx.Unlock() + + delete(s.bundles, trustDomain) +} + +// Has returns true if there is a bundle for the given trust domain. +func (s *Set) Has(trustDomain spiffeid.TrustDomain) bool { + s.mtx.RLock() + defer s.mtx.RUnlock() + + _, ok := s.bundles[trustDomain] + return ok +} + +// Get returns a bundle for the given trust domain. If the bundle is in the set +// it is returned and the boolean is true. Otherwise, the returned value is nil +// and the boolean is false. +func (s *Set) Get(trustDomain spiffeid.TrustDomain) (*Bundle, bool) { + s.mtx.RLock() + defer s.mtx.RUnlock() + + bundle, ok := s.bundles[trustDomain] + return bundle, ok +} + +// Bundles returns the bundles in the set sorted by trust domain. +func (s *Set) Bundles() []*Bundle { + s.mtx.RLock() + defer s.mtx.RUnlock() + + out := make([]*Bundle, 0, len(s.bundles)) + for _, bundle := range s.bundles { + out = append(out, bundle) + } + sort.Slice(out, func(a, b int) bool { + return out[a].TrustDomain().Compare(out[b].TrustDomain()) < 0 + }) + return out +} + +// Len returns the number of bundles in the set. +func (s *Set) Len() int { + s.mtx.RLock() + defer s.mtx.RUnlock() + + return len(s.bundles) +} + +// GetWITBundleForTrustDomain returns the WIT bundle for the given trust domain. +// It implements the Source interface. +func (s *Set) GetWITBundleForTrustDomain(trustDomain spiffeid.TrustDomain) (*Bundle, error) { + s.mtx.RLock() + defer s.mtx.RUnlock() + + bundle, ok := s.bundles[trustDomain] + if !ok { + return nil, wrapErr(fmt.Errorf("no WIT bundle for trust domain %q", trustDomain)) + } + + return bundle, nil +} diff --git a/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/source.go b/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/source.go new file mode 100644 index 0000000000..183ebd1b3d --- /dev/null +++ b/vendor/github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle/source.go @@ -0,0 +1,10 @@ +package witbundle + +import "github.com/spiffe/go-spiffe/v2/spiffeid" + +// Source represents a source of WIT bundles keyed by trust domain. +type Source interface { + // GetWITBundleForTrustDomain returns the WIT bundle for the given trust + // domain. + GetWITBundleForTrustDomain(trustDomain spiffeid.TrustDomain) (*Bundle, error) +} diff --git a/vendor/github.com/spiffe/go-spiffe/v2/exp/svid/witsvid/source.go b/vendor/github.com/spiffe/go-spiffe/v2/exp/svid/witsvid/source.go new file mode 100644 index 0000000000..6ca789783c --- /dev/null +++ b/vendor/github.com/spiffe/go-spiffe/v2/exp/svid/witsvid/source.go @@ -0,0 +1,9 @@ +package witsvid + +import "github.com/spiffe/go-spiffe/v2/spiffeid" + +// Source is a source of WIT-SVIDs keyed by SPIFFE ID. +type Source interface { + // GetWITSVIDForID returns the WIT-SVID for the given SPIFFE ID. + GetWITSVIDForID(id spiffeid.ID) (*SVID, error) +} diff --git a/vendor/github.com/spiffe/go-spiffe/v2/exp/svid/witsvid/svid.go b/vendor/github.com/spiffe/go-spiffe/v2/exp/svid/witsvid/svid.go new file mode 100644 index 0000000000..0dbec410d7 --- /dev/null +++ b/vendor/github.com/spiffe/go-spiffe/v2/exp/svid/witsvid/svid.go @@ -0,0 +1,227 @@ +// Package witsvid provides support for WIT-SVIDs (Workload Identity Token SVIDs), +// an experimental SPIFFE credential type based on the IETF WIMSE WIT specification. +// WIT-SVIDs bind a public key to the workload identity via the cnf.jwk claim and +// require proof of possession — they are never bearer tokens. +package witsvid + +import ( + "crypto" + "encoding/json" + "errors" + "fmt" + "slices" + "time" + + "github.com/go-jose/go-jose/v4" + "github.com/go-jose/go-jose/v4/jwt" + "github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle" + "github.com/spiffe/go-spiffe/v2/spiffeid" +) + +var allowedSignatureAlgorithms = []jose.SignatureAlgorithm{ + jose.RS256, + jose.RS384, + jose.RS512, + jose.ES256, + jose.ES384, + jose.ES512, + jose.PS256, + jose.PS384, + jose.PS512, +} + +// SVID represents a WIT-SVID. +type SVID struct { + // ID is the SPIFFE ID of the WIT-SVID as present in the 'sub' claim. + ID spiffeid.ID + + // Expiry is the expiration time of the WIT-SVID as present in the 'exp' claim. + Expiry time.Time + + // PublicKey is the public key bound to the WIT-SVID via the cnf.jwk claim. + PublicKey crypto.PublicKey + + // KeyID is the key ID from the JOSE header. + KeyID string + + // PrivateKey is the private key corresponding to PublicKey. It is populated + // when the WIT-SVID is fetched from the Workload API, and nil otherwise. + PrivateKey crypto.PrivateKey + + // Hint is an operator-specified string used to provide guidance on how this + // identity should be used by a workload when more than one SVID is returned. + Hint string + + // token is the serialized JWS compact serialization. + token string +} + +// Marshal returns the WIT-SVID as a JWS compact serialization string. +func (s *SVID) Marshal() string { + return s.token +} + +// ParseAndValidate parses and validates a WIT-SVID token, verifying its +// signature using the provided WIT bundle source. +func ParseAndValidate(token string, bundles witbundle.Source) (*SVID, error) { + return parse(token, func(tok *jwt.JSONWebToken, trustDomain spiffeid.TrustDomain, keyID string) error { + bundle, err := bundles.GetWITBundleForTrustDomain(trustDomain) + if err != nil { + return wrapErr(fmt.Errorf("no WIT bundle found for trust domain %q", trustDomain)) + } + + authority, ok := bundle.FindWITAuthority(keyID) + if !ok { + return wrapErr(fmt.Errorf("no WIT authority %q found for trust domain %q", keyID, trustDomain)) + } + + // Verify signature by claiming with the authority key. + var dummy map[string]any + if err := tok.Claims(authority, &dummy); err != nil { + return wrapErr(fmt.Errorf("signature verification failed: %w", err)) + } + return nil + }) +} + +// ParseInsecure parses a WIT-SVID token without verifying its signature. +// This should only be used when the token was received from a trusted source +// (e.g., the Workload API). +func ParseInsecure(token string) (*SVID, error) { + return parse(token, func(*jwt.JSONWebToken, spiffeid.TrustDomain, string) error { + return nil + }) +} + +type verifyFn func(*jwt.JSONWebToken, spiffeid.TrustDomain, string) error + +func parse(token string, verify verifyFn) (*SVID, error) { + tok, err := jwt.ParseSigned(token, allowedSignatureAlgorithms) + if err != nil { + return nil, wrapErr(errors.New("unable to parse WIT-SVID token")) + } + + // Validate typ header: MUST be "wit+jwt" + typ, _ := tok.Headers[0].ExtraHeaders[jose.HeaderType].(string) + if typ != "wit+jwt" { + return nil, wrapErr(fmt.Errorf("token header type must be %q, got %q", "wit+jwt", typ)) + } + + // kid header MUST be present + keyID := tok.Headers[0].KeyID + if keyID == "" { + return nil, wrapErr(errors.New("token header missing key id")) + } + + // Parse standard claims without verification + var stdClaims jwt.Claims + if err := tok.UnsafeClaimsWithoutVerification(&stdClaims); err != nil { + return nil, wrapErr(fmt.Errorf("unable to parse standard claims: %v", err)) + } + + if stdClaims.Subject == "" { + return nil, wrapErr(errors.New("token missing subject claim")) + } + if stdClaims.Expiry == nil { + return nil, wrapErr(errors.New("token missing exp claim")) + } + if len(stdClaims.Audience) > 0 { + return nil, wrapErr(errors.New("WIT-SVID must not contain aud claim")) + } + + spiffeID, err := spiffeid.FromString(stdClaims.Subject) + if err != nil { + return nil, wrapErr(fmt.Errorf("token has an invalid subject claim: %v", err)) + } + + // Parse full claims map to extract cnf.jwk + var rawClaims map[string]any + if err := tok.UnsafeClaimsWithoutVerification(&rawClaims); err != nil { + return nil, wrapErr(fmt.Errorf("unable to parse claims: %v", err)) + } + + publicKey, err := extractCnfJWK(rawClaims) + if err != nil { + return nil, err + } + + // Verify time claims with leeway matching JWT-SVID (spec §3.5 allows leeway for clock skew). + if err := stdClaims.ValidateWithLeeway(jwt.Expected{Time: time.Now()}, jwt.DefaultLeeway); err != nil { + switch err { + case jwt.ErrExpired: + return nil, wrapErr(errors.New("token has expired")) + case jwt.ErrNotValidYet: + return nil, wrapErr(errors.New("token is not yet valid")) + default: + return nil, wrapErr(err) + } + } + + // Run signature verification (if any) + if err := verify(tok, spiffeID.TrustDomain(), keyID); err != nil { + return nil, err + } + + return &SVID{ + ID: spiffeID, + Expiry: stdClaims.Expiry.Time().UTC(), + PublicKey: publicKey, + KeyID: keyID, + token: token, + }, nil +} + +// extractCnfJWK extracts and parses the public key from the cnf.jwk claim. +func extractCnfJWK(claims map[string]any) (crypto.PublicKey, error) { + cnfRaw, ok := claims["cnf"] + if !ok { + return nil, wrapErr(errors.New("token missing cnf claim")) + } + + cnfMap, ok := cnfRaw.(map[string]any) + if !ok { + return nil, wrapErr(errors.New("cnf claim is not an object")) + } + + jwkRaw, ok := cnfMap["jwk"] + if !ok { + return nil, wrapErr(errors.New("cnf claim missing jwk field")) + } + + jwkMap, ok := jwkRaw.(map[string]any) + if !ok { + return nil, wrapErr(errors.New("cnf.jwk is not an object")) + } + + algRaw, ok := jwkMap["alg"] + if !ok { + return nil, wrapErr(errors.New("cnf.jwk missing alg field")) + } + algStr, ok := algRaw.(string) + if !ok { + return nil, wrapErr(errors.New("cnf.jwk alg field is not a string")) + } + if !slices.Contains(allowedSignatureAlgorithms, jose.SignatureAlgorithm(algStr)) { + return nil, wrapErr(fmt.Errorf("cnf.jwk alg %q is not supported", algStr)) + } + + data, err := json.Marshal(jwkMap) + if err != nil { + return nil, wrapErr(fmt.Errorf("unable to marshal cnf.jwk: %v", err)) + } + + var jwk jose.JSONWebKey + if err := jwk.UnmarshalJSON(data); err != nil { + return nil, wrapErr(fmt.Errorf("unable to parse cnf.jwk: %v", err)) + } + + if !jwk.IsPublic() { + return nil, wrapErr(errors.New("cnf.jwk must be a public key")) + } + + return jwk.Key, nil +} + +func wrapErr(err error) error { + return fmt.Errorf("witsvid: %w", err) +} diff --git a/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload.pb.go b/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload.pb.go index 46f4251194..8a5b8ff2b9 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload.pb.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.6 +// protoc-gen-go v1.36.8 // protoc v6.30.2 // source: workload.proto @@ -680,6 +680,259 @@ func (x *ValidateJWTSVIDResponse) GetClaims() *structpb.Struct { return nil } +// WITSVIDRequest conveys parameters for requesting WIT-SVIDs. +type WITSVIDRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Optional. The requested SPIFFE ID for the WIT-SVID. If unset, all + // WIT-SVIDs to which the workload is entitled are requested. + SpiffeId string `protobuf:"bytes,1,opt,name=spiffe_id,json=spiffeId,proto3" json:"spiffe_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WITSVIDRequest) Reset() { + *x = WITSVIDRequest{} + mi := &file_workload_proto_msgTypes[12] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WITSVIDRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WITSVIDRequest) ProtoMessage() {} + +func (x *WITSVIDRequest) ProtoReflect() protoreflect.Message { + mi := &file_workload_proto_msgTypes[12] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WITSVIDRequest.ProtoReflect.Descriptor instead. +func (*WITSVIDRequest) Descriptor() ([]byte, []int) { + return file_workload_proto_rawDescGZIP(), []int{12} +} + +func (x *WITSVIDRequest) GetSpiffeId() string { + if x != nil { + return x.SpiffeId + } + return "" +} + +// WITSVIDResponse conveys WIT-SVIDs. +type WITSVIDResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Required. The list of returned WIT-SVIDs. + Svids []*WITSVID `protobuf:"bytes,1,rep,name=svids,proto3" json:"svids,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WITSVIDResponse) Reset() { + *x = WITSVIDResponse{} + mi := &file_workload_proto_msgTypes[13] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WITSVIDResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WITSVIDResponse) ProtoMessage() {} + +func (x *WITSVIDResponse) ProtoReflect() protoreflect.Message { + mi := &file_workload_proto_msgTypes[13] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WITSVIDResponse.ProtoReflect.Descriptor instead. +func (*WITSVIDResponse) Descriptor() ([]byte, []int) { + return file_workload_proto_rawDescGZIP(), []int{13} +} + +func (x *WITSVIDResponse) GetSvids() []*WITSVID { + if x != nil { + return x.Svids + } + return nil +} + +// WITSVID carries a single WIT-SVID and associated metadata. +type WITSVID struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Required. The SPIFFE ID of the WIT-SVID. + SpiffeId string `protobuf:"bytes,1,opt,name=spiffe_id,json=spiffeId,proto3" json:"spiffe_id,omitempty"` + // Required. Encoded WIT-SVID using JWS Compact Serialization. + WitSvid string `protobuf:"bytes,2,opt,name=wit_svid,json=witSvid,proto3" json:"wit_svid,omitempty"` + // Required. JWK-encoded private key bound to this WIT-SVID. + WitSvidKey string `protobuf:"bytes,3,opt,name=wit_svid_key,json=witSvidKey,proto3" json:"wit_svid_key,omitempty"` + // Optional. An operator-specified string used to provide guidance on how + // this identity should be used by a workload when more than one SVID is + // returned. + Hint string `protobuf:"bytes,4,opt,name=hint,proto3" json:"hint,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WITSVID) Reset() { + *x = WITSVID{} + mi := &file_workload_proto_msgTypes[14] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WITSVID) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WITSVID) ProtoMessage() {} + +func (x *WITSVID) ProtoReflect() protoreflect.Message { + mi := &file_workload_proto_msgTypes[14] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WITSVID.ProtoReflect.Descriptor instead. +func (*WITSVID) Descriptor() ([]byte, []int) { + return file_workload_proto_rawDescGZIP(), []int{14} +} + +func (x *WITSVID) GetSpiffeId() string { + if x != nil { + return x.SpiffeId + } + return "" +} + +func (x *WITSVID) GetWitSvid() string { + if x != nil { + return x.WitSvid + } + return "" +} + +func (x *WITSVID) GetWitSvidKey() string { + if x != nil { + return x.WitSvidKey + } + return "" +} + +func (x *WITSVID) GetHint() string { + if x != nil { + return x.Hint + } + return "" +} + +// WITBundlesRequest conveys parameters for requesting WIT bundles. +// There are currently no such parameters. +type WITBundlesRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WITBundlesRequest) Reset() { + *x = WITBundlesRequest{} + mi := &file_workload_proto_msgTypes[15] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WITBundlesRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WITBundlesRequest) ProtoMessage() {} + +func (x *WITBundlesRequest) ProtoReflect() protoreflect.Message { + mi := &file_workload_proto_msgTypes[15] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WITBundlesRequest.ProtoReflect.Descriptor instead. +func (*WITBundlesRequest) Descriptor() ([]byte, []int) { + return file_workload_proto_rawDescGZIP(), []int{15} +} + +// WITBundlesResponse conveys WIT bundles. +type WITBundlesResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Required. JWK encoded WIT bundles, keyed by the SPIFFE ID of the trust + // domain. + Bundles map[string]string `protobuf:"bytes,1,rep,name=bundles,proto3" json:"bundles,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WITBundlesResponse) Reset() { + *x = WITBundlesResponse{} + mi := &file_workload_proto_msgTypes[16] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WITBundlesResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WITBundlesResponse) ProtoMessage() {} + +func (x *WITBundlesResponse) ProtoReflect() protoreflect.Message { + mi := &file_workload_proto_msgTypes[16] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WITBundlesResponse.ProtoReflect.Descriptor instead. +func (*WITBundlesResponse) Descriptor() ([]byte, []int) { + return file_workload_proto_rawDescGZIP(), []int{16} +} + +func (x *WITBundlesResponse) GetBundles() map[string]string { + if x != nil { + return x.Bundles + } + return nil +} + var File_workload_proto protoreflect.FileDescriptor const file_workload_proto_rawDesc = "" + @@ -726,13 +979,31 @@ const file_workload_proto_rawDesc = "" + "\x04svid\x18\x02 \x01(\tR\x04svid\"g\n" + "\x17ValidateJWTSVIDResponse\x12\x1b\n" + "\tspiffe_id\x18\x01 \x01(\tR\bspiffeId\x12/\n" + - "\x06claims\x18\x02 \x01(\v2\x17.google.protobuf.StructR\x06claims2\xc3\x02\n" + + "\x06claims\x18\x02 \x01(\v2\x17.google.protobuf.StructR\x06claims\"-\n" + + "\x0eWITSVIDRequest\x12\x1b\n" + + "\tspiffe_id\x18\x01 \x01(\tR\bspiffeId\"1\n" + + "\x0fWITSVIDResponse\x12\x1e\n" + + "\x05svids\x18\x01 \x03(\v2\b.WITSVIDR\x05svids\"w\n" + + "\aWITSVID\x12\x1b\n" + + "\tspiffe_id\x18\x01 \x01(\tR\bspiffeId\x12\x19\n" + + "\bwit_svid\x18\x02 \x01(\tR\awitSvid\x12 \n" + + "\fwit_svid_key\x18\x03 \x01(\tR\n" + + "witSvidKey\x12\x12\n" + + "\x04hint\x18\x04 \x01(\tR\x04hint\"\x13\n" + + "\x11WITBundlesRequest\"\x8c\x01\n" + + "\x12WITBundlesResponse\x12:\n" + + "\abundles\x18\x01 \x03(\v2 .WITBundlesResponse.BundlesEntryR\abundles\x1a:\n" + + "\fBundlesEntry\x12\x10\n" + + "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + + "\x05value\x18\x02 \x01(\tR\x05value:\x028\x012\xb6\x03\n" + "\x11SpiffeWorkloadAPI\x126\n" + "\rFetchX509SVID\x12\x10.X509SVIDRequest\x1a\x11.X509SVIDResponse0\x01\x12?\n" + "\x10FetchX509Bundles\x12\x13.X509BundlesRequest\x1a\x14.X509BundlesResponse0\x01\x121\n" + "\fFetchJWTSVID\x12\x0f.JWTSVIDRequest\x1a\x10.JWTSVIDResponse\x12<\n" + "\x0fFetchJWTBundles\x12\x12.JWTBundlesRequest\x1a\x13.JWTBundlesResponse0\x01\x12D\n" + - "\x0fValidateJWTSVID\x12\x17.ValidateJWTSVIDRequest\x1a\x18.ValidateJWTSVIDResponseB?Z=github.com/spiffe/go-spiffe/v2/proto/spiffe/workload;workloadb\x06proto3" + "\x0fValidateJWTSVID\x12\x17.ValidateJWTSVIDRequest\x1a\x18.ValidateJWTSVIDResponse\x123\n" + + "\fFetchWITSVID\x12\x0f.WITSVIDRequest\x1a\x10.WITSVIDResponse0\x01\x12<\n" + + "\x0fFetchWITBundles\x12\x12.WITBundlesRequest\x1a\x13.WITBundlesResponse0\x01B?Z=github.com/spiffe/go-spiffe/v2/proto/spiffe/workload;workloadb\x06proto3" var ( file_workload_proto_rawDescOnce sync.Once @@ -746,7 +1017,7 @@ func file_workload_proto_rawDescGZIP() []byte { return file_workload_proto_rawDescData } -var file_workload_proto_msgTypes = make([]protoimpl.MessageInfo, 15) +var file_workload_proto_msgTypes = make([]protoimpl.MessageInfo, 21) var file_workload_proto_goTypes = []any{ (*X509SVIDRequest)(nil), // 0: X509SVIDRequest (*X509SVIDResponse)(nil), // 1: X509SVIDResponse @@ -760,33 +1031,45 @@ var file_workload_proto_goTypes = []any{ (*JWTBundlesResponse)(nil), // 9: JWTBundlesResponse (*ValidateJWTSVIDRequest)(nil), // 10: ValidateJWTSVIDRequest (*ValidateJWTSVIDResponse)(nil), // 11: ValidateJWTSVIDResponse - nil, // 12: X509SVIDResponse.FederatedBundlesEntry - nil, // 13: X509BundlesResponse.BundlesEntry - nil, // 14: JWTBundlesResponse.BundlesEntry - (*structpb.Struct)(nil), // 15: google.protobuf.Struct + (*WITSVIDRequest)(nil), // 12: WITSVIDRequest + (*WITSVIDResponse)(nil), // 13: WITSVIDResponse + (*WITSVID)(nil), // 14: WITSVID + (*WITBundlesRequest)(nil), // 15: WITBundlesRequest + (*WITBundlesResponse)(nil), // 16: WITBundlesResponse + nil, // 17: X509SVIDResponse.FederatedBundlesEntry + nil, // 18: X509BundlesResponse.BundlesEntry + nil, // 19: JWTBundlesResponse.BundlesEntry + nil, // 20: WITBundlesResponse.BundlesEntry + (*structpb.Struct)(nil), // 21: google.protobuf.Struct } var file_workload_proto_depIdxs = []int32{ 2, // 0: X509SVIDResponse.svids:type_name -> X509SVID - 12, // 1: X509SVIDResponse.federated_bundles:type_name -> X509SVIDResponse.FederatedBundlesEntry - 13, // 2: X509BundlesResponse.bundles:type_name -> X509BundlesResponse.BundlesEntry + 17, // 1: X509SVIDResponse.federated_bundles:type_name -> X509SVIDResponse.FederatedBundlesEntry + 18, // 2: X509BundlesResponse.bundles:type_name -> X509BundlesResponse.BundlesEntry 7, // 3: JWTSVIDResponse.svids:type_name -> JWTSVID - 14, // 4: JWTBundlesResponse.bundles:type_name -> JWTBundlesResponse.BundlesEntry - 15, // 5: ValidateJWTSVIDResponse.claims:type_name -> google.protobuf.Struct - 0, // 6: SpiffeWorkloadAPI.FetchX509SVID:input_type -> X509SVIDRequest - 3, // 7: SpiffeWorkloadAPI.FetchX509Bundles:input_type -> X509BundlesRequest - 5, // 8: SpiffeWorkloadAPI.FetchJWTSVID:input_type -> JWTSVIDRequest - 8, // 9: SpiffeWorkloadAPI.FetchJWTBundles:input_type -> JWTBundlesRequest - 10, // 10: SpiffeWorkloadAPI.ValidateJWTSVID:input_type -> ValidateJWTSVIDRequest - 1, // 11: SpiffeWorkloadAPI.FetchX509SVID:output_type -> X509SVIDResponse - 4, // 12: SpiffeWorkloadAPI.FetchX509Bundles:output_type -> X509BundlesResponse - 6, // 13: SpiffeWorkloadAPI.FetchJWTSVID:output_type -> JWTSVIDResponse - 9, // 14: SpiffeWorkloadAPI.FetchJWTBundles:output_type -> JWTBundlesResponse - 11, // 15: SpiffeWorkloadAPI.ValidateJWTSVID:output_type -> ValidateJWTSVIDResponse - 11, // [11:16] is the sub-list for method output_type - 6, // [6:11] is the sub-list for method input_type - 6, // [6:6] is the sub-list for extension type_name - 6, // [6:6] is the sub-list for extension extendee - 0, // [0:6] is the sub-list for field type_name + 19, // 4: JWTBundlesResponse.bundles:type_name -> JWTBundlesResponse.BundlesEntry + 21, // 5: ValidateJWTSVIDResponse.claims:type_name -> google.protobuf.Struct + 14, // 6: WITSVIDResponse.svids:type_name -> WITSVID + 20, // 7: WITBundlesResponse.bundles:type_name -> WITBundlesResponse.BundlesEntry + 0, // 8: SpiffeWorkloadAPI.FetchX509SVID:input_type -> X509SVIDRequest + 3, // 9: SpiffeWorkloadAPI.FetchX509Bundles:input_type -> X509BundlesRequest + 5, // 10: SpiffeWorkloadAPI.FetchJWTSVID:input_type -> JWTSVIDRequest + 8, // 11: SpiffeWorkloadAPI.FetchJWTBundles:input_type -> JWTBundlesRequest + 10, // 12: SpiffeWorkloadAPI.ValidateJWTSVID:input_type -> ValidateJWTSVIDRequest + 12, // 13: SpiffeWorkloadAPI.FetchWITSVID:input_type -> WITSVIDRequest + 15, // 14: SpiffeWorkloadAPI.FetchWITBundles:input_type -> WITBundlesRequest + 1, // 15: SpiffeWorkloadAPI.FetchX509SVID:output_type -> X509SVIDResponse + 4, // 16: SpiffeWorkloadAPI.FetchX509Bundles:output_type -> X509BundlesResponse + 6, // 17: SpiffeWorkloadAPI.FetchJWTSVID:output_type -> JWTSVIDResponse + 9, // 18: SpiffeWorkloadAPI.FetchJWTBundles:output_type -> JWTBundlesResponse + 11, // 19: SpiffeWorkloadAPI.ValidateJWTSVID:output_type -> ValidateJWTSVIDResponse + 13, // 20: SpiffeWorkloadAPI.FetchWITSVID:output_type -> WITSVIDResponse + 16, // 21: SpiffeWorkloadAPI.FetchWITBundles:output_type -> WITBundlesResponse + 15, // [15:22] is the sub-list for method output_type + 8, // [8:15] is the sub-list for method input_type + 8, // [8:8] is the sub-list for extension type_name + 8, // [8:8] is the sub-list for extension extendee + 0, // [0:8] is the sub-list for field type_name } func init() { file_workload_proto_init() } @@ -800,7 +1083,7 @@ func file_workload_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_workload_proto_rawDesc), len(file_workload_proto_rawDesc)), NumEnums: 0, - NumMessages: 15, + NumMessages: 21, NumExtensions: 0, NumServices: 1, }, diff --git a/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload.proto b/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload.proto index b9b8db0153..7c5a6ec7cc 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload.proto +++ b/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload.proto @@ -36,6 +36,20 @@ service SpiffeWorkloadAPI { // Validates a JWT-SVID against the requested audience. Returns the SPIFFE // ID of the JWT-SVID and JWT claims. rpc ValidateJWTSVID(ValidateJWTSVIDRequest) returns (ValidateJWTSVIDResponse); + + ///////////////////////////////////////////////////////////////////////// + // WIT-SVID Profile + ///////////////////////////////////////////////////////////////////////// + + // Fetch WIT-SVIDs for all SPIFFE identities the workload is entitled to. + // As this information changes, subsequent messages will be streamed from + // the server. + rpc FetchWITSVID(WITSVIDRequest) returns (stream WITSVIDResponse); + + // Fetch WIT bundles, formatted as JWKS documents, keyed by the SPIFFE ID + // of the trust domain. As this information changes, subsequent messages + // will be streamed from the server. + rpc FetchWITBundles(WITBundlesRequest) returns (stream WITBundlesResponse); } // The X509SVIDRequest message conveys parameters for requesting an X.509-SVID. @@ -163,4 +177,45 @@ message ValidateJWTSVIDResponse { google.protobuf.Struct claims = 2; } +// WITSVIDRequest conveys parameters for requesting WIT-SVIDs. +message WITSVIDRequest { + // Optional. The requested SPIFFE ID for the WIT-SVID. If unset, all + // WIT-SVIDs to which the workload is entitled are requested. + string spiffe_id = 1; +} + +// WITSVIDResponse conveys WIT-SVIDs. +message WITSVIDResponse { + // Required. The list of returned WIT-SVIDs. + repeated WITSVID svids = 1; +} + +// WITSVID carries a single WIT-SVID and associated metadata. +message WITSVID { + // Required. The SPIFFE ID of the WIT-SVID. + string spiffe_id = 1; + + // Required. Encoded WIT-SVID using JWS Compact Serialization. + string wit_svid = 2; + + // Required. JWK-encoded private key bound to this WIT-SVID. + string wit_svid_key = 3; + + // Optional. An operator-specified string used to provide guidance on how + // this identity should be used by a workload when more than one SVID is + // returned. + string hint = 4; +} + +// WITBundlesRequest conveys parameters for requesting WIT bundles. +// There are currently no such parameters. +message WITBundlesRequest { } + +// WITBundlesResponse conveys WIT bundles. +message WITBundlesResponse { + // Required. JWK encoded WIT bundles, keyed by the SPIFFE ID of the trust + // domain. + map bundles = 1; +} + option go_package = "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload;workload"; diff --git a/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload_grpc.pb.go b/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload_grpc.pb.go index 0203d5f7a4..4e03a6aeec 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload_grpc.pb.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/workload_grpc.pb.go @@ -24,6 +24,8 @@ const ( SpiffeWorkloadAPI_FetchJWTSVID_FullMethodName = "/SpiffeWorkloadAPI/FetchJWTSVID" SpiffeWorkloadAPI_FetchJWTBundles_FullMethodName = "/SpiffeWorkloadAPI/FetchJWTBundles" SpiffeWorkloadAPI_ValidateJWTSVID_FullMethodName = "/SpiffeWorkloadAPI/ValidateJWTSVID" + SpiffeWorkloadAPI_FetchWITSVID_FullMethodName = "/SpiffeWorkloadAPI/FetchWITSVID" + SpiffeWorkloadAPI_FetchWITBundles_FullMethodName = "/SpiffeWorkloadAPI/FetchWITBundles" ) // SpiffeWorkloadAPIClient is the client API for SpiffeWorkloadAPI service. @@ -51,6 +53,14 @@ type SpiffeWorkloadAPIClient interface { // Validates a JWT-SVID against the requested audience. Returns the SPIFFE // ID of the JWT-SVID and JWT claims. ValidateJWTSVID(ctx context.Context, in *ValidateJWTSVIDRequest, opts ...grpc.CallOption) (*ValidateJWTSVIDResponse, error) + // Fetch WIT-SVIDs for all SPIFFE identities the workload is entitled to. + // As this information changes, subsequent messages will be streamed from + // the server. + FetchWITSVID(ctx context.Context, in *WITSVIDRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WITSVIDResponse], error) + // Fetch WIT bundles, formatted as JWKS documents, keyed by the SPIFFE ID + // of the trust domain. As this information changes, subsequent messages + // will be streamed from the server. + FetchWITBundles(ctx context.Context, in *WITBundlesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WITBundlesResponse], error) } type spiffeWorkloadAPIClient struct { @@ -138,6 +148,44 @@ func (c *spiffeWorkloadAPIClient) ValidateJWTSVID(ctx context.Context, in *Valid return out, nil } +func (c *spiffeWorkloadAPIClient) FetchWITSVID(ctx context.Context, in *WITSVIDRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WITSVIDResponse], error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + stream, err := c.cc.NewStream(ctx, &SpiffeWorkloadAPI_ServiceDesc.Streams[3], SpiffeWorkloadAPI_FetchWITSVID_FullMethodName, cOpts...) + if err != nil { + return nil, err + } + x := &grpc.GenericClientStream[WITSVIDRequest, WITSVIDResponse]{ClientStream: stream} + if err := x.ClientStream.SendMsg(in); err != nil { + return nil, err + } + if err := x.ClientStream.CloseSend(); err != nil { + return nil, err + } + return x, nil +} + +// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. +type SpiffeWorkloadAPI_FetchWITSVIDClient = grpc.ServerStreamingClient[WITSVIDResponse] + +func (c *spiffeWorkloadAPIClient) FetchWITBundles(ctx context.Context, in *WITBundlesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[WITBundlesResponse], error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + stream, err := c.cc.NewStream(ctx, &SpiffeWorkloadAPI_ServiceDesc.Streams[4], SpiffeWorkloadAPI_FetchWITBundles_FullMethodName, cOpts...) + if err != nil { + return nil, err + } + x := &grpc.GenericClientStream[WITBundlesRequest, WITBundlesResponse]{ClientStream: stream} + if err := x.ClientStream.SendMsg(in); err != nil { + return nil, err + } + if err := x.ClientStream.CloseSend(); err != nil { + return nil, err + } + return x, nil +} + +// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. +type SpiffeWorkloadAPI_FetchWITBundlesClient = grpc.ServerStreamingClient[WITBundlesResponse] + // SpiffeWorkloadAPIServer is the server API for SpiffeWorkloadAPI service. // All implementations must embed UnimplementedSpiffeWorkloadAPIServer // for forward compatibility. @@ -163,6 +211,14 @@ type SpiffeWorkloadAPIServer interface { // Validates a JWT-SVID against the requested audience. Returns the SPIFFE // ID of the JWT-SVID and JWT claims. ValidateJWTSVID(context.Context, *ValidateJWTSVIDRequest) (*ValidateJWTSVIDResponse, error) + // Fetch WIT-SVIDs for all SPIFFE identities the workload is entitled to. + // As this information changes, subsequent messages will be streamed from + // the server. + FetchWITSVID(*WITSVIDRequest, grpc.ServerStreamingServer[WITSVIDResponse]) error + // Fetch WIT bundles, formatted as JWKS documents, keyed by the SPIFFE ID + // of the trust domain. As this information changes, subsequent messages + // will be streamed from the server. + FetchWITBundles(*WITBundlesRequest, grpc.ServerStreamingServer[WITBundlesResponse]) error mustEmbedUnimplementedSpiffeWorkloadAPIServer() } @@ -188,6 +244,12 @@ func (UnimplementedSpiffeWorkloadAPIServer) FetchJWTBundles(*JWTBundlesRequest, func (UnimplementedSpiffeWorkloadAPIServer) ValidateJWTSVID(context.Context, *ValidateJWTSVIDRequest) (*ValidateJWTSVIDResponse, error) { return nil, status.Errorf(codes.Unimplemented, "method ValidateJWTSVID not implemented") } +func (UnimplementedSpiffeWorkloadAPIServer) FetchWITSVID(*WITSVIDRequest, grpc.ServerStreamingServer[WITSVIDResponse]) error { + return status.Errorf(codes.Unimplemented, "method FetchWITSVID not implemented") +} +func (UnimplementedSpiffeWorkloadAPIServer) FetchWITBundles(*WITBundlesRequest, grpc.ServerStreamingServer[WITBundlesResponse]) error { + return status.Errorf(codes.Unimplemented, "method FetchWITBundles not implemented") +} func (UnimplementedSpiffeWorkloadAPIServer) mustEmbedUnimplementedSpiffeWorkloadAPIServer() {} func (UnimplementedSpiffeWorkloadAPIServer) testEmbeddedByValue() {} @@ -278,6 +340,28 @@ func _SpiffeWorkloadAPI_ValidateJWTSVID_Handler(srv interface{}, ctx context.Con return interceptor(ctx, in, info, handler) } +func _SpiffeWorkloadAPI_FetchWITSVID_Handler(srv interface{}, stream grpc.ServerStream) error { + m := new(WITSVIDRequest) + if err := stream.RecvMsg(m); err != nil { + return err + } + return srv.(SpiffeWorkloadAPIServer).FetchWITSVID(m, &grpc.GenericServerStream[WITSVIDRequest, WITSVIDResponse]{ServerStream: stream}) +} + +// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. +type SpiffeWorkloadAPI_FetchWITSVIDServer = grpc.ServerStreamingServer[WITSVIDResponse] + +func _SpiffeWorkloadAPI_FetchWITBundles_Handler(srv interface{}, stream grpc.ServerStream) error { + m := new(WITBundlesRequest) + if err := stream.RecvMsg(m); err != nil { + return err + } + return srv.(SpiffeWorkloadAPIServer).FetchWITBundles(m, &grpc.GenericServerStream[WITBundlesRequest, WITBundlesResponse]{ServerStream: stream}) +} + +// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. +type SpiffeWorkloadAPI_FetchWITBundlesServer = grpc.ServerStreamingServer[WITBundlesResponse] + // SpiffeWorkloadAPI_ServiceDesc is the grpc.ServiceDesc for SpiffeWorkloadAPI service. // It's only intended for direct use with grpc.RegisterService, // and not to be introspected or modified (even as a copy) @@ -310,6 +394,16 @@ var SpiffeWorkloadAPI_ServiceDesc = grpc.ServiceDesc{ Handler: _SpiffeWorkloadAPI_FetchJWTBundles_Handler, ServerStreams: true, }, + { + StreamName: "FetchWITSVID", + Handler: _SpiffeWorkloadAPI_FetchWITSVID_Handler, + ServerStreams: true, + }, + { + StreamName: "FetchWITBundles", + Handler: _SpiffeWorkloadAPI_FetchWITBundles_Handler, + ServerStreams: true, + }, }, Metadata: "workload.proto", } diff --git a/vendor/github.com/spiffe/go-spiffe/v2/svid/x509svid/svid.go b/vendor/github.com/spiffe/go-spiffe/v2/svid/x509svid/svid.go index c2e234d77a..75ae48d4dd 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/svid/x509svid/svid.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/svid/x509svid/svid.go @@ -166,6 +166,10 @@ func validateLeafCertificate(leaf *x509.Certificate) (*spiffeid.ID, error) { if err != nil { return nil, fmt.Errorf("cannot get leaf certificate SPIFFE ID: %v", err) } + + if leafID.Path() == "" { + return nil, errors.New("leaf certificate SPIFFE ID must have a non-root path") + } if leaf.IsCA { return nil, errors.New("leaf certificate must not have CA flag set to true") } diff --git a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/client.go b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/client.go index 7739798b5d..ddd63c7134 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/client.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/client.go @@ -4,10 +4,14 @@ import ( "context" "crypto/x509" "errors" + "fmt" "time" + "github.com/go-jose/go-jose/v4" "github.com/spiffe/go-spiffe/v2/bundle/jwtbundle" "github.com/spiffe/go-spiffe/v2/bundle/x509bundle" + "github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle" + "github.com/spiffe/go-spiffe/v2/exp/svid/witsvid" "github.com/spiffe/go-spiffe/v2/logger" "github.com/spiffe/go-spiffe/v2/proto/spiffe/workload" "github.com/spiffe/go-spiffe/v2/spiffeid" @@ -252,6 +256,265 @@ func (c *Client) ValidateJWTSVID(ctx context.Context, token, audience string) (* return jwtsvid.ParseInsecure(token, []string{audience}) } +// FetchWITSVID fetches the default WIT-SVID (i.e. the first in the list +// returned by the Workload API). An optional SPIFFE ID may be provided to +// request a specific WIT-SVID. +// +// Experimental: subject to change. +func (c *Client) FetchWITSVID(ctx context.Context, spiffeID string) (*witsvid.SVID, error) { + svids, err := c.fetchWITSVIDs(ctx, spiffeID, true) + if err != nil { + return nil, err + } + return svids[0], nil +} + +// FetchWITSVIDs fetches all WIT-SVIDs. An optional SPIFFE ID may be provided +// to request a specific WIT-SVID. +// +// Experimental: subject to change. +func (c *Client) FetchWITSVIDs(ctx context.Context, spiffeID string) ([]*witsvid.SVID, error) { + return c.fetchWITSVIDs(ctx, spiffeID, false) +} + +// WatchWITSVIDs watches for WIT-SVID updates. The watcher receives the updated +// WIT-SVIDs. The optional spiffeID filters updates to a specific identity. +// +// If the server returns codes.Unimplemented, the watch loop terminates without +// retrying per the SPIFFE Workload API spec §7 (WIT-SVID Profile). +// +// Experimental: subject to change. +func (c *Client) WatchWITSVIDs(ctx context.Context, watcher WITSVIDWatcher, spiffeID string) error { + backoff := c.config.backoffStrategy.NewBackoff() + for { + err := c.watchWITSVIDs(ctx, watcher, backoff, spiffeID) + watcher.OnWITSVIDsWatchError(err) + if status.Code(err) == codes.Unimplemented { + c.config.log.Errorf("WIT-SVID profile not supported by server: %v", err) + return err + } + if err = c.handleWatchError(ctx, err, backoff); err != nil { + return err + } + } +} + +// FetchWITBundles fetches the WIT bundles for WIT-SVID validation, keyed by +// the SPIFFE ID of the trust domain to which they belong. +// +// Experimental: subject to change. +func (c *Client) FetchWITBundles(ctx context.Context) (*witbundle.Set, error) { + ctx, cancel := context.WithCancel(withHeader(ctx)) + defer cancel() + + stream, err := c.wlClient.FetchWITBundles(ctx, &workload.WITBundlesRequest{}) + if err != nil { + return nil, err + } + + resp, err := stream.Recv() + if err != nil { + return nil, err + } + + return parseWITBundles(resp) +} + +// WatchWITBundles watches for changes to the WIT bundles. The watcher receives +// the updated WIT bundle set. +// +// If the server returns codes.Unimplemented, the watch loop terminates without +// retrying per the SPIFFE Workload API spec §7 (WIT-SVID Profile). +// +// Experimental: subject to change. +func (c *Client) WatchWITBundles(ctx context.Context, watcher WITBundleWatcher) error { + backoff := c.config.backoffStrategy.NewBackoff() + for { + err := c.watchWITBundles(ctx, watcher, backoff) + watcher.OnWITBundlesWatchError(err) + if status.Code(err) == codes.Unimplemented { + c.config.log.Errorf("WIT bundle profile not supported by server: %v", err) + return err + } + if err = c.handleWatchError(ctx, err, backoff); err != nil { + return err + } + } +} + +func (c *Client) fetchWITSVIDs(ctx context.Context, spiffeID string, firstOnly bool) ([]*witsvid.SVID, error) { + ctx, cancel := context.WithCancel(withHeader(ctx)) + defer cancel() + + stream, err := c.wlClient.FetchWITSVID(ctx, &workload.WITSVIDRequest{ + SpiffeId: spiffeID, + }) + if err != nil { + return nil, err + } + + resp, err := stream.Recv() + if err != nil { + return nil, err + } + + return parseWITSVIDs(resp, firstOnly) +} + +func (c *Client) watchWITSVIDs(ctx context.Context, watcher WITSVIDWatcher, backoff Backoff, spiffeID string) error { + ctx, cancel := context.WithCancel(withHeader(ctx)) + defer cancel() + + c.config.log.Debugf("Watching WIT-SVIDs") + stream, err := c.wlClient.FetchWITSVID(ctx, &workload.WITSVIDRequest{ + SpiffeId: spiffeID, + }) + if err != nil { + return err + } + + for { + resp, err := stream.Recv() + if err != nil { + return err + } + + backoff.Reset() + svids, err := parseWITSVIDs(resp, false) + if err != nil { + c.config.log.Errorf("Failed to parse WIT-SVID response: %v", err) + watcher.OnWITSVIDsWatchError(err) + continue + } + watcher.OnWITSVIDsUpdate(svids) + } +} + +func (c *Client) watchWITBundles(ctx context.Context, watcher WITBundleWatcher, backoff Backoff) error { + ctx, cancel := context.WithCancel(withHeader(ctx)) + defer cancel() + + c.config.log.Debugf("Watching WIT bundles") + stream, err := c.wlClient.FetchWITBundles(ctx, &workload.WITBundlesRequest{}) + if err != nil { + return err + } + + for { + resp, err := stream.Recv() + if err != nil { + return err + } + + backoff.Reset() + bundleSet, err := parseWITBundles(resp) + if err != nil { + c.config.log.Errorf("Failed to parse WIT bundle response: %v", err) + watcher.OnWITBundlesWatchError(err) + continue + } + watcher.OnWITBundlesUpdate(bundleSet) + } +} + +func parseWITSVIDs(resp *workload.WITSVIDResponse, firstOnly bool) ([]*witsvid.SVID, error) { + n := len(resp.Svids) + if n == 0 { + return nil, errors.New("no WIT-SVIDs in response") + } + if firstOnly { + n = 1 + } + + hints := make(map[string]struct{}, n) + svids := make([]*witsvid.SVID, 0, n) + for i := range n { + s := resp.Svids[i] + // In the event of more than one WITSVID with the same hint value set, + // the first message in the list SHOULD be selected. + if _, ok := hints[s.Hint]; ok && s.Hint != "" { + continue + } + hints[s.Hint] = struct{}{} + + if s.WitSvidKey == "" { + return nil, fmt.Errorf("missing private key for SVID with SPIFFE ID %q", s.SpiffeId) + } + + svid, err := witsvid.ParseInsecure(s.WitSvid) + if err != nil { + return nil, err + } + + privKey, err := parseJWKPrivateKey(s.WitSvidKey) + if err != nil { + return nil, err + } + svid.PrivateKey = privKey + + svid.Hint = s.Hint + svids = append(svids, svid) + } + + return svids, nil +} + +func parseWITBundles(resp *workload.WITBundlesResponse) (*witbundle.Set, error) { + bundles := make([]*witbundle.Bundle, 0, len(resp.Bundles)) + + for tdID, bundleStr := range resp.Bundles { + td, err := spiffeid.TrustDomainFromString(tdID) + if err != nil { + return nil, err + } + + b, err := witbundle.Parse(td, []byte(bundleStr)) + if err != nil { + return nil, err + } + bundles = append(bundles, b) + } + + return witbundle.NewSet(bundles...), nil +} + +func parseJWKPrivateKey(jwkStr string) (any, error) { + var jwkKey jose.JSONWebKey + if err := jwkKey.UnmarshalJSON([]byte(jwkStr)); err != nil { + return nil, fmt.Errorf("unable to parse private key JWK: %w", err) + } + if jwkKey.IsPublic() { + return nil, errors.New("expected private key JWK, got public key") + } + return jwkKey.Key, nil +} + +// WITSVIDWatcher receives WIT-SVID updates from the Workload API. +// +// Experimental: subject to change. +type WITSVIDWatcher interface { + // OnWITSVIDsUpdate is called with the latest WIT-SVIDs retrieved from + // the Workload API. + OnWITSVIDsUpdate([]*witsvid.SVID) + + // OnWITSVIDsWatchError is called when there is a problem establishing + // or maintaining connectivity with the Workload API. + OnWITSVIDsWatchError(error) +} + +// WITBundleWatcher receives WIT bundle updates from the Workload API. +// +// Experimental: subject to change. +type WITBundleWatcher interface { + // OnWITBundlesUpdate is called with the latest WIT bundle set retrieved + // from the Workload API. + OnWITBundlesUpdate(*witbundle.Set) + + // OnWITBundlesWatchError is called when there is a problem establishing + // or maintaining connectivity with the Workload API. + OnWITBundlesWatchError(error) +} + func (c *Client) newConn(ctx context.Context) (*grpc.ClientConn, error) { c.config.dialOptions = append(c.config.dialOptions, grpc.WithTransportCredentials(insecure.NewCredentials())) c.appendDialOptionsOS() diff --git a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/convenience.go b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/convenience.go index f42c226fa1..c82cc57bfa 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/convenience.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/convenience.go @@ -5,6 +5,8 @@ import ( "github.com/spiffe/go-spiffe/v2/bundle/jwtbundle" "github.com/spiffe/go-spiffe/v2/bundle/x509bundle" + "github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle" + "github.com/spiffe/go-spiffe/v2/exp/svid/witsvid" "github.com/spiffe/go-spiffe/v2/svid/jwtsvid" "github.com/spiffe/go-spiffe/v2/svid/x509svid" ) @@ -122,3 +124,39 @@ func ValidateJWTSVID(ctx context.Context, token, audience string, options ...Cli defer c.Close() return c.ValidateJWTSVID(ctx, token, audience) } + +// FetchWITSVID fetches the default WIT-SVID using a short-lived client. +// +// Experimental: subject to change. +func FetchWITSVID(ctx context.Context, spiffeID string, options ...ClientOption) (*witsvid.SVID, error) { + c, err := New(ctx, options...) + if err != nil { + return nil, err + } + defer c.Close() + return c.FetchWITSVID(ctx, spiffeID) +} + +// FetchWITSVIDs fetches all WIT-SVIDs using a short-lived client. +// +// Experimental: subject to change. +func FetchWITSVIDs(ctx context.Context, spiffeID string, options ...ClientOption) ([]*witsvid.SVID, error) { + c, err := New(ctx, options...) + if err != nil { + return nil, err + } + defer c.Close() + return c.FetchWITSVIDs(ctx, spiffeID) +} + +// FetchWITBundles fetches WIT bundles using a short-lived client. +// +// Experimental: subject to change. +func FetchWITBundles(ctx context.Context, options ...ClientOption) (*witbundle.Set, error) { + c, err := New(ctx, options...) + if err != nil { + return nil, err + } + defer c.Close() + return c.FetchWITBundles(ctx) +} diff --git a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/option.go b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/option.go index f596f30c46..cbc316e1c9 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/option.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/option.go @@ -49,6 +49,20 @@ type SourceOption interface { configureX509Source(*x509SourceConfig) configureJWTSource(*jwtSourceConfig) configureBundleSource(*bundleSourceConfig) + configureWITSource(*witSourceConfig) +} + +// WITSourceOption is an option for the WITSource. A SourceOption is also a +// WITSourceOption. +// +// Experimental: subject to change. +type WITSourceOption interface { + configureWITSource(*witSourceConfig) +} + +type witSourceConfig struct { + client *Client + clientOptions []ClientOption } // WithClient provides a Client for the source to use. If unset, a new Client @@ -141,6 +155,10 @@ func (o withClient) configureBundleSource(config *bundleSourceConfig) { config.watcher.client = o.client } +func (o withClient) configureWITSource(config *witSourceConfig) { + config.client = o.client +} + type withClientOptions struct { options []ClientOption } @@ -157,6 +175,10 @@ func (o withClientOptions) configureBundleSource(config *bundleSourceConfig) { config.watcher.clientOptions = o.options } +func (o withClientOptions) configureWITSource(config *witSourceConfig) { + config.clientOptions = o.options +} + type withDefaultX509SVIDPicker struct { picker func([]*x509svid.SVID) *x509svid.SVID } diff --git a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/watcher.go b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/watcher.go index f72e03b2d4..2b4ffd4373 100644 --- a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/watcher.go +++ b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/watcher.go @@ -9,6 +9,67 @@ import ( "github.com/spiffe/go-spiffe/v2/svid/jwtsvid" ) +// watcherBase holds the goroutine lifecycle and update-notification machinery +// shared by watcher and WITSource. +type watcherBase struct { + cancel func() + wg sync.WaitGroup + closeMtx sync.Mutex + closed bool + closeErr error + updatedCh chan struct{} +} + +func newWatcherBase() watcherBase { + return watcherBase{ + cancel: func() {}, + updatedCh: make(chan struct{}, 1), + } +} + +func (b *watcherBase) drainUpdated() { + select { + case <-b.updatedCh: + default: + } +} + +func (b *watcherBase) triggerUpdated() { + select { + case b.updatedCh <- struct{}{}: + default: + } +} + +func (b *watcherBase) waitUntilUpdated(ctx context.Context) error { + select { + case <-b.updatedCh: + return nil + case <-ctx.Done(): + return ctx.Err() + } +} + +func (b *watcherBase) updated() <-chan struct{} { + return b.updatedCh +} + +// closeBase cancels the background goroutines, waits for them to exit, and +// optionally closes the client. It is idempotent. +func (b *watcherBase) closeBase(clientCloser func() error) error { + b.closeMtx.Lock() + defer b.closeMtx.Unlock() + if !b.closed { + b.cancel() + b.wg.Wait() + if clientCloser != nil { + b.closeErr = clientCloser() + } + b.closed = true + } + return b.closeErr +} + type sourceClient interface { WatchX509Context(context.Context, X509ContextWatcher) error WatchJWTBundles(context.Context, JWTBundleWatcher) error @@ -23,18 +84,11 @@ type watcherConfig struct { } type watcher struct { - updatedCh chan struct{} + watcherBase client sourceClient ownsClient bool - cancel func() - wg sync.WaitGroup - - closeMtx sync.Mutex - closed bool - closeErr error - x509ContextFn func(*X509Context) x509ContextSet chan struct{} x509ContextSetOnce sync.Once @@ -46,9 +100,8 @@ type watcher struct { func newWatcher(ctx context.Context, config watcherConfig, x509ContextFn func(*X509Context), jwtBundlesFn func(*jwtbundle.Set)) (_ *watcher, err error) { w := &watcher{ - updatedCh: make(chan struct{}, 1), + watcherBase: newWatcherBase(), client: config.client, - cancel: func() {}, x509ContextFn: x509ContextFn, x509ContextSet: make(chan struct{}), jwtBundlesFn: jwtBundlesFn, @@ -122,21 +175,13 @@ func newWatcher(ctx context.Context, config watcherConfig, x509ContextFn func(*X // Close closes the watcher, dropping the connection to the Workload API. func (w *watcher) Close() error { - w.closeMtx.Lock() - defer w.closeMtx.Unlock() - - if !w.closed { - w.cancel() - w.wg.Wait() - - // Close() can be called by New() to close a partially initialized source. - // Only close the client if it has been set and the source owns it. - if w.client != nil && w.ownsClient { - w.closeErr = w.client.Close() - } - w.closed = true + // Close() can be called by New() to close a partially initialized source. + // Only close the client if it has been set and the source owns it. + var closer func() error + if w.client != nil && w.ownsClient { + closer = w.client.Close } - return w.closeErr + return w.closeBase(closer) } func (w *watcher) OnX509ContextUpdate(x509Context *X509Context) { @@ -166,26 +211,9 @@ func (w *watcher) OnJWTBundlesWatchError(error) { } func (w *watcher) WaitUntilUpdated(ctx context.Context) error { - select { - case <-w.updatedCh: - return nil - case <-ctx.Done(): - return ctx.Err() - } + return w.waitUntilUpdated(ctx) } func (w *watcher) Updated() <-chan struct{} { - return w.updatedCh -} - -func (w *watcher) drainUpdated() { - select { - case <-w.updatedCh: - default: - } -} - -func (w *watcher) triggerUpdated() { - w.drainUpdated() - w.updatedCh <- struct{}{} + return w.updated() } diff --git a/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/witsource.go b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/witsource.go new file mode 100644 index 0000000000..2fd4c55bec --- /dev/null +++ b/vendor/github.com/spiffe/go-spiffe/v2/workloadapi/witsource.go @@ -0,0 +1,217 @@ +package workloadapi + +import ( + "context" + "errors" + "fmt" + "sync" + + "github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle" + "github.com/spiffe/go-spiffe/v2/exp/svid/witsvid" + "github.com/spiffe/go-spiffe/v2/spiffeid" +) + +// WITSource is a source of WIT-SVIDs and WIT bundles maintained via the +// Workload API. It implements both witsvid.Source and witbundle.Source. +// +// Experimental: subject to change. +type WITSource struct { + watcherBase + + client *Client + ownsClient bool + + mtx sync.RWMutex + svids []*witsvid.SVID + bundles *witbundle.Set + + svidsSet chan struct{} + svidsSetOnce sync.Once + bundlesSet chan struct{} + bundlesSetOnce sync.Once +} + +// NewWITSource creates a new WITSource. It blocks until the initial updates +// have been received from the Workload API. The source should be closed when +// no longer in use to free underlying resources. +// +// Experimental: subject to change. +func NewWITSource(ctx context.Context, options ...WITSourceOption) (_ *WITSource, err error) { + config := &witSourceConfig{} + for _, option := range options { + option.configureWITSource(config) + } + + var client *Client + var ownsClient bool + if config.client != nil { + client = config.client + } else { + client, err = New(ctx, config.clientOptions...) + if err != nil { + return nil, err + } + ownsClient = true + } + + s := &WITSource{ + watcherBase: newWatcherBase(), + client: client, + ownsClient: ownsClient, + bundles: witbundle.NewSet(), + svidsSet: make(chan struct{}), + bundlesSet: make(chan struct{}), + } + + defer func() { + if err != nil { + err = errors.Join(err, s.Close()) + } + }() + + if err := s.waitForInitial(ctx); err != nil { + return nil, err + } + s.drainUpdated() + return s, nil +} + +func (s *WITSource) waitForInitial(ctx context.Context) error { + errCh := make(chan error, 2) + + var watchCtx context.Context + watchCtx, s.cancel = context.WithCancel(context.Background()) + + s.wg.Add(1) + go func() { + defer s.wg.Done() + errCh <- s.client.WatchWITSVIDs(watchCtx, s, "") + }() + + s.wg.Add(1) + go func() { + defer s.wg.Done() + errCh <- s.client.WatchWITBundles(watchCtx, s) + }() + + waitFor := func(has <-chan struct{}) error { + select { + case <-has: + return nil + case err := <-errCh: + return err + case <-ctx.Done(): + return ctx.Err() + } + } + + if err := waitFor(s.svidsSet); err != nil { + return err + } + if err := waitFor(s.bundlesSet); err != nil { + return err + } + return nil +} + +// Close closes the source, dropping the connection to the Workload API. +// +// Experimental: subject to change. +func (s *WITSource) Close() error { + var closer func() error + if s.ownsClient && s.client != nil { + closer = s.client.Close + } + return s.closeBase(closer) +} + +// GetWITSVIDForID returns the WIT-SVID for the given SPIFFE ID. +// It implements the witsvid.Source interface. +// +// Experimental: subject to change. +func (s *WITSource) GetWITSVIDForID(id spiffeid.ID) (*witsvid.SVID, error) { + if err := s.checkClosed(); err != nil { + return nil, err + } + + s.mtx.RLock() + defer s.mtx.RUnlock() + + for _, svid := range s.svids { + if svid.ID == id { + return svid, nil + } + } + return nil, fmt.Errorf("witsource: no WIT-SVID found for SPIFFE ID %q", id) +} + +// GetWITBundleForTrustDomain returns the WIT bundle for the given trust domain. +// It implements the witbundle.Source interface. +// +// Experimental: subject to change. +func (s *WITSource) GetWITBundleForTrustDomain(trustDomain spiffeid.TrustDomain) (*witbundle.Bundle, error) { + if err := s.checkClosed(); err != nil { + return nil, err + } + + s.mtx.RLock() + defer s.mtx.RUnlock() + + return s.bundles.GetWITBundleForTrustDomain(trustDomain) +} + +// WaitUntilUpdated waits until the source is updated or the context is done, +// in which case ctx.Err() is returned. +// +// Experimental: subject to change. +func (s *WITSource) WaitUntilUpdated(ctx context.Context) error { + return s.waitUntilUpdated(ctx) +} + +// Updated returns a channel that is sent on whenever the source is updated. +// +// Experimental: subject to change. +func (s *WITSource) Updated() <-chan struct{} { + return s.updated() +} + +// OnWITSVIDsUpdate implements WITSVIDWatcher. +func (s *WITSource) OnWITSVIDsUpdate(svids []*witsvid.SVID) { + s.mtx.Lock() + s.svids = svids + s.mtx.Unlock() + + s.triggerUpdated() + s.svidsSetOnce.Do(func() { close(s.svidsSet) }) +} + +// OnWITSVIDsWatchError implements WITSVIDWatcher. +func (s *WITSource) OnWITSVIDsWatchError(error) { + // The watcher doesn't do anything special with the error. If logging is + // desired, it should be provided to the Workload API client. +} + +// OnWITBundlesUpdate implements WITBundleWatcher. +func (s *WITSource) OnWITBundlesUpdate(bundles *witbundle.Set) { + s.mtx.Lock() + s.bundles = bundles + s.mtx.Unlock() + + s.triggerUpdated() + s.bundlesSetOnce.Do(func() { close(s.bundlesSet) }) +} + +// OnWITBundlesWatchError implements WITBundleWatcher. +func (s *WITSource) OnWITBundlesWatchError(error) { + // The watcher doesn't do anything special with the error. If logging is + // desired, it should be provided to the Workload API client. +} + +func (s *WITSource) checkClosed() error { + s.closeMtx.Lock() + defer s.closeMtx.Unlock() + if s.closed { + return errors.New("witsource: source is closed") + } + return nil +} diff --git a/vendor/go.opentelemetry.io/contrib/detectors/gcp/cloud-function.go b/vendor/go.opentelemetry.io/contrib/detectors/gcp/cloud-function.go index 524a0421b1..3eea78e52e 100644 --- a/vendor/go.opentelemetry.io/contrib/detectors/gcp/cloud-function.go +++ b/vendor/go.opentelemetry.io/contrib/detectors/gcp/cloud-function.go @@ -10,7 +10,7 @@ import ( "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/sdk/resource" - semconv "go.opentelemetry.io/otel/semconv/v1.40.0" + semconv "go.opentelemetry.io/otel/semconv/v1.41.0" ) const ( diff --git a/vendor/go.opentelemetry.io/contrib/detectors/gcp/cloud-run.go b/vendor/go.opentelemetry.io/contrib/detectors/gcp/cloud-run.go index 914d22dc96..98bcfdb952 100644 --- a/vendor/go.opentelemetry.io/contrib/detectors/gcp/cloud-run.go +++ b/vendor/go.opentelemetry.io/contrib/detectors/gcp/cloud-run.go @@ -12,7 +12,7 @@ import ( "cloud.google.com/go/compute/metadata" "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/sdk/resource" - semconv "go.opentelemetry.io/otel/semconv/v1.40.0" + semconv "go.opentelemetry.io/otel/semconv/v1.41.0" ) const serviceNamespace = "cloud-run-managed" diff --git a/vendor/go.opentelemetry.io/contrib/detectors/gcp/detector.go b/vendor/go.opentelemetry.io/contrib/detectors/gcp/detector.go index 35bdceaea0..11b0d67314 100644 --- a/vendor/go.opentelemetry.io/contrib/detectors/gcp/detector.go +++ b/vendor/go.opentelemetry.io/contrib/detectors/gcp/detector.go @@ -12,7 +12,7 @@ import ( "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp" "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/sdk/resource" - semconv "go.opentelemetry.io/otel/semconv/v1.40.0" + semconv "go.opentelemetry.io/otel/semconv/v1.41.0" ) // NewDetector returns a resource detector which detects resource attributes on: diff --git a/vendor/go.opentelemetry.io/contrib/detectors/gcp/gce.go b/vendor/go.opentelemetry.io/contrib/detectors/gcp/gce.go index 42c69ba208..800ca29a8f 100644 --- a/vendor/go.opentelemetry.io/contrib/detectors/gcp/gce.go +++ b/vendor/go.opentelemetry.io/contrib/detectors/gcp/gce.go @@ -13,7 +13,7 @@ import ( "cloud.google.com/go/compute/metadata" "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/sdk/resource" - semconv "go.opentelemetry.io/otel/semconv/v1.40.0" + semconv "go.opentelemetry.io/otel/semconv/v1.41.0" ) // GCE collects resource information of GCE computing instances. diff --git a/vendor/go.opentelemetry.io/contrib/detectors/gcp/gke.go b/vendor/go.opentelemetry.io/contrib/detectors/gcp/gke.go index b5c3c3379f..f284f4d2c4 100644 --- a/vendor/go.opentelemetry.io/contrib/detectors/gcp/gke.go +++ b/vendor/go.opentelemetry.io/contrib/detectors/gcp/gke.go @@ -11,7 +11,7 @@ import ( "cloud.google.com/go/compute/metadata" "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/sdk/resource" - semconv "go.opentelemetry.io/otel/semconv/v1.40.0" + semconv "go.opentelemetry.io/otel/semconv/v1.41.0" ) // GKE collects resource information of GKE computing instances. diff --git a/vendor/go.opentelemetry.io/contrib/detectors/gcp/version.go b/vendor/go.opentelemetry.io/contrib/detectors/gcp/version.go index 1b98a97f14..60344e17f9 100644 --- a/vendor/go.opentelemetry.io/contrib/detectors/gcp/version.go +++ b/vendor/go.opentelemetry.io/contrib/detectors/gcp/version.go @@ -5,7 +5,7 @@ package gcp // import "go.opentelemetry.io/contrib/detectors/gcp" // Version is the current release version of the GCP resource detector. func Version() string { - return "1.43.0" + return "1.44.0" // This string is updated by the pre_release.sh script during release } diff --git a/vendor/golang.org/x/net/http2/hpack/encode.go b/vendor/golang.org/x/net/http2/hpack/encode.go index 46219da2b0..e6d0c265ac 100644 --- a/vendor/golang.org/x/net/http2/hpack/encode.go +++ b/vendor/golang.org/x/net/http2/hpack/encode.go @@ -39,7 +39,6 @@ func NewEncoder(w io.Writer) *Encoder { tableSizeUpdate: false, w: w, } - e.dynTab.table.init() e.dynTab.setMaxSize(initialHeaderTableSize) return e } diff --git a/vendor/golang.org/x/net/http2/hpack/hpack.go b/vendor/golang.org/x/net/http2/hpack/hpack.go index 7a1d976696..ecd3eeca99 100644 --- a/vendor/golang.org/x/net/http2/hpack/hpack.go +++ b/vendor/golang.org/x/net/http2/hpack/hpack.go @@ -105,7 +105,6 @@ func NewDecoder(maxDynamicTableSize uint32, emitFunc func(f HeaderField)) *Decod emitEnabled: true, firstField: true, } - d.dynTab.table.init() d.dynTab.allowedMaxSize = maxDynamicTableSize d.dynTab.setMaxSize(maxDynamicTableSize) return d diff --git a/vendor/golang.org/x/net/http2/hpack/tables.go b/vendor/golang.org/x/net/http2/hpack/tables.go index 8cbdf3f019..3bd7eb7533 100644 --- a/vendor/golang.org/x/net/http2/hpack/tables.go +++ b/vendor/golang.org/x/net/http2/hpack/tables.go @@ -31,10 +31,18 @@ type headerFieldTable struct { // byName maps a HeaderField name to the unique id of the newest entry with // the same name. See above for a definition of "unique id". + // + // byName and byNameValue are used only by search, which is only called + // for tables used by encoders. For tables used only by decoders, the + // maps are never built, as a memory optimization for servers with many + // mostly-idle connections, each pinning a dynamic table. The maps are + // built lazily by the first search call and are nil until then. The two + // maps are always both nil or both non-nil. byName map[string]uint64 // byNameValue maps a HeaderField name/value pair to the unique id of the newest // entry with the same name and value. See above for a definition of "unique id". + // See byName for when this map is non-nil. byNameValue map[pairNameValue]uint64 } @@ -42,9 +50,17 @@ type pairNameValue struct { name, value string } -func (t *headerFieldTable) init() { - t.byName = make(map[string]uint64) - t.byNameValue = make(map[pairNameValue]uint64) +// buildMaps initializes byName and byNameValue from ents. +func (t *headerFieldTable) buildMaps() { + t.byName = make(map[string]uint64, len(t.ents)) + t.byNameValue = make(map[pairNameValue]uint64, len(t.ents)) + for k, f := range t.ents { + // Map to the newest matching entry: later (newer) entries + // overwrite earlier ones, matching addEntry's behavior. + id := t.evictCount + uint64(k) + 1 + t.byName[f.Name] = id + t.byNameValue[pairNameValue{f.Name, f.Value}] = id + } } // len reports the number of entries in the table. @@ -54,9 +70,11 @@ func (t *headerFieldTable) len() int { // addEntry adds a new entry. func (t *headerFieldTable) addEntry(f HeaderField) { - id := uint64(t.len()) + t.evictCount + 1 - t.byName[f.Name] = id - t.byNameValue[pairNameValue{f.Name, f.Value}] = id + if t.byName != nil { + id := uint64(t.len()) + t.evictCount + 1 + t.byName[f.Name] = id + t.byNameValue[pairNameValue{f.Name, f.Value}] = id + } t.ents = append(t.ents, f) } @@ -65,14 +83,16 @@ func (t *headerFieldTable) evictOldest(n int) { if n > t.len() { panic(fmt.Sprintf("evictOldest(%v) on table with %v entries", n, t.len())) } - for k := 0; k < n; k++ { - f := t.ents[k] - id := t.evictCount + uint64(k) + 1 - if t.byName[f.Name] == id { - delete(t.byName, f.Name) - } - if p := (pairNameValue{f.Name, f.Value}); t.byNameValue[p] == id { - delete(t.byNameValue, p) + if t.byName != nil { + for k := 0; k < n; k++ { + f := t.ents[k] + id := t.evictCount + uint64(k) + 1 + if t.byName[f.Name] == id { + delete(t.byName, f.Name) + } + if p := (pairNameValue{f.Name, f.Value}); t.byNameValue[p] == id { + delete(t.byNameValue, p) + } } } copy(t.ents, t.ents[n:]) @@ -100,6 +120,9 @@ func (t *headerFieldTable) evictOldest(n int) { // // See Section 2.3.3. func (t *headerFieldTable) search(f HeaderField) (i uint64, nameValueMatch bool) { + if t.byName == nil { + t.buildMaps() + } if !f.Sensitive { if id := t.byNameValue[pairNameValue{f.Name, f.Value}]; id != 0 { return t.idToIndex(id), true diff --git a/vendor/golang.org/x/net/http2/transport_wrap.go b/vendor/golang.org/x/net/http2/transport_wrap.go index 534e77ab96..741fb97062 100644 --- a/vendor/golang.org/x/net/http2/transport_wrap.go +++ b/vendor/golang.org/x/net/http2/transport_wrap.go @@ -237,32 +237,40 @@ type ClientConn struct { } func (cc *ClientConn) roundTrip(req *http.Request) (*http.Response, error) { - err := func() error { + haveReservation, err := func() (bool, error) { cc.mu.Lock() defer cc.mu.Unlock() if cc.doNotReuse { - return errClientConnUnusable - } - cc.roundTrips++ - if cc.reserved > 0 { - // We've already reserved a concurrency slot for this request. - cc.reserved-- - } else if cc.cc.Reserve() != nil { - // We don't seem to have an available concurrency slot, - // so bump the pending count (requests waiting for a slot). - cc.pending++ + return false, errClientConnUnusable } + // ClientConn.Shutdown will not shut down the conn while // cc.starting > 0 or cc.cc.InFlight() > 0. // // The starting state covers the gap between us deciding to // start sending the request, and actually sending it. cc.starting++ - return nil + + cc.roundTrips++ + if cc.reserved == 0 { + // We do not have a concurrency slot reserved for this request. + return false, nil + } + cc.reserved-- + return true, nil }() if err != nil { return nil, err } + // If we have no reservation, try to acquire one. + // (This must be done without cc.mu held, since Reserve may call back to the state hook.) + if !haveReservation && cc.cc.Reserve() != nil { + // We could not acquire a concurrency slot, so bump the pending count + // (requests waiting for a slot). + cc.mu.Lock() + cc.pending++ + cc.mu.Unlock() + } resp, err := cc.cc.RoundTrip(req) cc.mu.Lock() cc.starting-- @@ -293,16 +301,21 @@ func (cc *ClientConn) ping(ctx context.Context) error { } func (cc *ClientConn) reserveNewRequest() bool { + if err := cc.cc.Reserve(); err != nil { + return false + } + reserved := true cc.mu.Lock() - defer cc.mu.Unlock() if cc.doNotReuse { - return false + reserved = false + } else { + cc.reserved++ } - if err := cc.cc.Reserve(); err != nil { - return false + cc.mu.Unlock() + if !reserved { + cc.cc.Release() } - cc.reserved++ - return true + return reserved } func (cc *ClientConn) setDoNotReuse() { diff --git a/vendor/golang.org/x/tools/go/analysis/passes/fieldalignment/fieldalignment.go b/vendor/golang.org/x/tools/go/analysis/passes/fieldalignment/fieldalignment.go index 53c746344e..02791bc73e 100644 --- a/vendor/golang.org/x/tools/go/analysis/passes/fieldalignment/fieldalignment.go +++ b/vendor/golang.org/x/tools/go/analysis/passes/fieldalignment/fieldalignment.go @@ -14,6 +14,7 @@ import ( "go/token" "go/types" "sort" + "strings" "golang.org/x/tools/go/analysis" "golang.org/x/tools/go/analysis/passes/inspect" @@ -68,37 +69,66 @@ var Analyzer = &analysis.Analyzer{ func run(pass *analysis.Pass) (any, error) { inspect := pass.ResultOf[inspect.Analyzer].(*inspector.Inspector) - nodeFilter := []ast.Node{ - (*ast.StructType)(nil), - } - inspect.Preorder(nodeFilter, func(node ast.Node) { - var s *ast.StructType - var ok bool - if s, ok = node.(*ast.StructType); !ok { - return - } - if tv, ok := pass.TypesInfo.Types[s]; ok { - fieldalignment(pass, s, tv.Type.(*types.Struct)) + for curStruct := range inspect.Root().Preorder((*ast.StructType)(nil)) { + s := curStruct.Node().(*ast.StructType) + // For every named struct defined as "type Name struct { ... }", + // the *ast.StructType node has a parent *ast.TypeSpec, + // which contains the struct's name in its Name field. + name := "struct" // (anonymous) + if spec, ok := curStruct.Parent().Node().(*ast.TypeSpec); ok { + name = spec.Name.Name } - }) + fieldalignment(pass, s, name) + } + return nil, nil } -var unsafePointerTyp = types.Unsafe.Scope().Lookup("Pointer").(*types.TypeName).Type() +func fieldalignment(pass *analysis.Pass, node *ast.StructType, name string) { + var ( + sizes = &gcSizes{ + wordSize: pass.TypesSizes.Sizeof(types.Typ[types.UnsafePointer]), + maxAlign: pass.TypesSizes.Alignof(types.Typ[types.UnsafePointer]), + } -func fieldalignment(pass *analysis.Pass, node *ast.StructType, typ *types.Struct) { - wordSize := pass.TypesSizes.Sizeof(unsafePointerTyp) - maxAlign := pass.TypesSizes.Alignof(unsafePointerTyp) + typ = pass.TypesInfo.TypeOf(node).(*types.Struct) + optimal, indexes = optimalOrder(typ, sizes) + + actualSize = sizes.sizeof(typ) + actualPtrs = sizes.ptrdata(typ) + + optimalSize = sizes.sizeof(optimal) + optimalPtrs = sizes.ptrdata(optimal) + ) + + var message strings.Builder + if actualSize != optimalSize { + // Struct could be smaller. + // TODO(adonovan): IMHO the criterion should be "significantly smaller". + fmt.Fprintf(&message, "%s has size %d", name, actualSize) + actualClass := classSize(actualSize) + if actualClass == -1 { + actualClass = actualSize + fmt.Fprint(&message, " (uses global allocator)") + } else if actualClass != actualSize { + fmt.Fprintf(&message, " (allocator size class %d)", actualClass) + } - s := gcSizes{wordSize, maxAlign} - optimal, indexes := optimalOrder(typ, &s) - optsz, optptrs := s.Sizeof(optimal), s.ptrdata(optimal) + fmt.Fprintf(&message, " but the optimal size is %d", optimalSize) + optimalClass := classSize(optimalSize) + if optimalClass == -1 { + optimalClass = optimalSize + } else if optimalClass != optimalSize { + fmt.Fprintf(&message, " (allocator size class %d)", optimalClass) + } - var message string - if sz := s.Sizeof(typ); sz != optsz { - message = fmt.Sprintf("struct of size %d could be %d", sz, optsz) - } else if ptrs := s.ptrdata(typ); ptrs != optptrs { - message = fmt.Sprintf("struct with %d pointer bytes could be %d", ptrs, optptrs) + wastage := actualClass - optimalClass + if percentage := wastage * 100 / actualClass; percentage > 25 { + fmt.Fprintf(&message, " leading to a waste of %d bytes (%d%%)", wastage, percentage) + } + } else if actualPtrs != optimalPtrs { + // Struct could place pointers more efficiently for GC marking. + fmt.Fprintf(&message, "%s has %d leading bytes of pointer data but optimal value is %d", name, actualPtrs, optimalPtrs) } else { // Already optimal order. return @@ -151,7 +181,7 @@ func fieldalignment(pass *analysis.Pass, node *ast.StructType, typ *types.Struct pass.Report(analysis.Diagnostic{ Pos: node.Pos(), End: node.Pos() + token.Pos(len("struct")), - Message: message, + Message: message.String(), SuggestedFixes: []analysis.SuggestedFix{{ Message: "Rearrange fields", TextEdits: []analysis.TextEdit{{ @@ -179,8 +209,8 @@ func optimalOrder(str *types.Struct, sizes *gcSizes) (*types.Struct, []int) { ft := field.Type() elems[i] = elem{ i, - sizes.Alignof(ft), - sizes.Sizeof(ft), + sizes.alignof(ft), + sizes.sizeof(ft), sizes.ptrdata(ft), } } @@ -240,40 +270,42 @@ func optimalOrder(str *types.Struct, sizes *gcSizes) (*types.Struct, []int) { return types.NewStruct(fields, nil), indexes } -// Code below based on go/types.StdSizes. +// gcSizes implements cmd/compile layout rules, providing ptrdata (GC +// scanning limits) and trailing zero-size field padding not available +// in [types.Sizes]. type gcSizes struct { - WordSize int64 - MaxAlign int64 + wordSize int64 + maxAlign int64 } -func (s *gcSizes) Alignof(T types.Type) int64 { +func (s *gcSizes) alignof(T types.Type) int64 { // For arrays and structs, alignment is defined in terms // of alignment of the elements and fields, respectively. switch t := T.Underlying().(type) { case *types.Array: // spec: "For a variable x of array type: unsafe.Alignof(x) // is the same as unsafe.Alignof(x[0]), but at least 1." - return s.Alignof(t.Elem()) + return s.alignof(t.Elem()) case *types.Struct: // spec: "For a variable x of struct type: unsafe.Alignof(x) // is the largest of the values unsafe.Alignof(x.f) for each // field f of x, but at least 1." max := int64(1) for i, nf := 0, t.NumFields(); i < nf; i++ { - if a := s.Alignof(t.Field(i).Type()); a > max { + if a := s.alignof(t.Field(i).Type()); a > max { max = a } } return max } - a := s.Sizeof(T) // may be 0 + a := s.sizeof(T) // may be 0 // spec: "For a variable x of any type: unsafe.Alignof(x) is at least 1." if a < 1 { return 1 } - if a > s.MaxAlign { - return s.MaxAlign + if a > s.maxAlign { + return s.maxAlign } return a } @@ -294,7 +326,7 @@ var basicSizes = [...]byte{ types.Complex128: 16, } -func (s *gcSizes) Sizeof(T types.Type) int64 { +func (s *gcSizes) sizeof(T types.Type) int64 { switch t := T.Underlying().(type) { case *types.Basic: k := t.Kind() @@ -304,12 +336,12 @@ func (s *gcSizes) Sizeof(T types.Type) int64 { } } if k == types.String { - return s.WordSize * 2 + return s.wordSize * 2 } case *types.Array: - return t.Len() * s.Sizeof(t.Elem()) + return t.Len() * s.sizeof(t.Elem()) case *types.Slice: - return s.WordSize * 3 + return s.wordSize * 3 case *types.Struct: nf := t.NumFields() if nf == 0 { @@ -320,7 +352,7 @@ func (s *gcSizes) Sizeof(T types.Type) int64 { max := int64(1) for i := range nf { ft := t.Field(i).Type() - a, sz := s.Alignof(ft), s.Sizeof(ft) + a, sz := s.alignof(ft), s.sizeof(ft) if a > max { max = a } @@ -331,9 +363,9 @@ func (s *gcSizes) Sizeof(T types.Type) int64 { } return align(o, max) case *types.Interface: - return s.WordSize * 2 + return s.wordSize * 2 } - return s.WordSize // catch-all + return s.wordSize // catch-all } // align returns the smallest y >= x such that y % a == 0. @@ -347,13 +379,13 @@ func (s *gcSizes) ptrdata(T types.Type) int64 { case *types.Basic: switch t.Kind() { case types.String, types.UnsafePointer: - return s.WordSize + return s.wordSize } return 0 case *types.Chan, *types.Map, *types.Pointer, *types.Signature, *types.Slice: - return s.WordSize + return s.wordSize case *types.Interface: - return 2 * s.WordSize + return 2 * s.wordSize case *types.Array: n := t.Len() if n == 0 { @@ -363,7 +395,7 @@ func (s *gcSizes) ptrdata(T types.Type) int64 { if a == 0 { return 0 } - z := s.Sizeof(t.Elem()) + z := s.sizeof(t.Elem()) return (n-1)*z + a case *types.Struct: nf := t.NumFields() @@ -374,7 +406,7 @@ func (s *gcSizes) ptrdata(T types.Type) int64 { var o, p int64 for i := range nf { ft := t.Field(i).Type() - a, sz := s.Alignof(ft), s.Sizeof(ft) + a, sz := s.alignof(ft), s.sizeof(ft) fp := s.ptrdata(ft) o = align(o, a) if fp != 0 { @@ -387,3 +419,16 @@ func (s *gcSizes) ptrdata(T types.Type) int64 { panic("impossible") } + +// Code below based on tools/gopls/internal/golang/hover.go + +// classSize reports the size class for a struct of the specified size, or -1 if unknown. +// See GOROOT/src/runtime/msize.go for details. +func classSize(size int64) int64 { + if size > 1<<15 { + return -1 // avoid allocation + } + // We assume that bytes.Clone doesn't trim, + // and reports the underlying size class + return int64(cap(bytes.Clone(make([]byte, size)))) +} diff --git a/vendor/golang.org/x/tools/go/analysis/passes/printf/printf.go b/vendor/golang.org/x/tools/go/analysis/passes/printf/printf.go index f82d2eaea7..6573c3fc77 100644 --- a/vendor/golang.org/x/tools/go/analysis/passes/printf/printf.go +++ b/vendor/golang.org/x/tools/go/analysis/passes/printf/printf.go @@ -1184,15 +1184,6 @@ func checkPrint(pass *analysis.Pass, call *ast.CallExpr, name string) { } } } - if strings.HasSuffix(name, "ln") { - // The last item, if a string, should not have a newline. - arg = args[len(args)-1] - if s, ok := stringConstantExpr(pass, arg); ok { - if strings.HasSuffix(s, "\n") { - pass.ReportRangef(call, "%s arg list ends with redundant newline", name) - } - } - } for _, arg := range args { if isFunctionValue(pass, arg) { pass.ReportRangef(call, "%s arg %s is a func value, not called", name, astutil.Format(pass.Fset, arg)) diff --git a/vendor/golang.org/x/tools/go/analysis/passes/stdversion/stdversion.go b/vendor/golang.org/x/tools/go/analysis/passes/stdversion/stdversion.go index d1fda880e8..3d44c4e86d 100644 --- a/vendor/golang.org/x/tools/go/analysis/passes/stdversion/stdversion.go +++ b/vendor/golang.org/x/tools/go/analysis/passes/stdversion/stdversion.go @@ -15,6 +15,7 @@ import ( "golang.org/x/tools/go/analysis" "golang.org/x/tools/go/analysis/passes/inspect" "golang.org/x/tools/go/ast/inspector" + "golang.org/x/tools/internal/stdlib" "golang.org/x/tools/internal/typesinternal" "golang.org/x/tools/internal/versions" ) @@ -64,8 +65,8 @@ func run(pass *analysis.Pass) (any, error) { pkg *types.Package version string } - memo := make(map[key]map[types.Object]string) // records symbol's minimum Go version - disallowedSymbols := func(pkg *types.Package, version string) map[types.Object]string { + memo := make(map[key]map[types.Object]stdlib.Symbol) + disallowedSymbols := func(pkg *types.Package, version string) map[types.Object]stdlib.Symbol { k := key{pkg, version} disallowed, ok := memo[k] if !ok { @@ -98,20 +99,12 @@ func run(pass *analysis.Pass) (any, error) { if fileVersion != "" { if obj, ok := pass.TypesInfo.Uses[n]; ok && obj.Pkg() != nil { disallowed := disallowedSymbols(obj.Pkg(), fileVersion) - if minVersion, ok := disallowed[origin(obj)]; ok { - // Some symbols are accessible before their release but - // only with specific build tags unknown to us here. - // Avoid false positives in such cases. - // TODO(mkalil): move this check into typesinternal.TooNewStdSymbols. - if obj.Pkg().Path() == "testing/synctest" && versions.AtLeast(fileVersion, "go1.24") { - break // requires go1.24 && goexperiment.synctest || go1.25 - } - noun := "module" - if fileVersion != pkgVersion { - noun = "file" - } + if sym, ok := disallowed[origin(obj)]; ok { pass.ReportRangef(n, "%s.%s requires %v or later (%s is %s)", - obj.Pkg().Name(), obj.Name(), minVersion, noun, fileVersion) + obj.Pkg().Name(), sym.Name, + sym.Version, + cond(fileVersion != pkgVersion, "file", "module"), + fileVersion) } } } @@ -134,3 +127,11 @@ func origin(obj types.Object) types.Object { } return obj } + +func cond[T any](cond bool, t, f T) T { + if cond { + return t + } else { + return f + } +} diff --git a/vendor/golang.org/x/tools/go/analysis/passes/unusedresult/unusedresult.go b/vendor/golang.org/x/tools/go/analysis/passes/unusedresult/unusedresult.go index bd32d58690..82968f4649 100644 --- a/vendor/golang.org/x/tools/go/analysis/passes/unusedresult/unusedresult.go +++ b/vendor/golang.org/x/tools/go/analysis/passes/unusedresult/unusedresult.go @@ -16,7 +16,6 @@ package unusedresult import ( _ "embed" "go/ast" - "go/token" "go/types" "sort" "strings" @@ -27,6 +26,7 @@ import ( "golang.org/x/tools/go/types/typeutil" "golang.org/x/tools/internal/analysis/analyzerutil" "golang.org/x/tools/internal/astutil" + "golang.org/x/tools/internal/typesinternal" ) //go:embed doc.go @@ -172,7 +172,7 @@ func run(pass *analysis.Pass) (any, error) { } // func() string -var sigNoArgsStringResult = types.NewSignatureType(nil, nil, nil, nil, types.NewTuple(types.NewParam(token.NoPos, nil, "", types.Typ[types.String])), false) +var sigNoArgsStringResult = types.NewSignatureType(nil, nil, nil, nil, typesinternal.TupleOf(types.Typ[types.String]), false) type stringSetFlag map[string]bool diff --git a/vendor/golang.org/x/tools/go/ast/inspector/cursor.go b/vendor/golang.org/x/tools/go/ast/inspector/cursor.go index 239b10c4da..1c482252da 100644 --- a/vendor/golang.org/x/tools/go/ast/inspector/cursor.go +++ b/vendor/golang.org/x/tools/go/ast/inspector/cursor.go @@ -10,6 +10,7 @@ import ( "go/token" "iter" "reflect" + "strings" "golang.org/x/tools/go/ast/edge" ) @@ -110,6 +111,46 @@ func (c Cursor) String() string { return reflect.TypeOf(c.Node()).String() } +// GoString returns a string describing the cursor's path from the +// root, if any. +func (c Cursor) GoString() string { + if !c.Valid() { + return "(invalid)" + } + if c.index < 0 { + return "(root)" + } + // e.g "File.Decls[1].(*ast.GenDecl).Specs[0].(*ast.TypeSpec)" + // + // In hindsight even the File node should have reported a + // virtual ParentEdge of (Root_Files, i) where i is the index + // among the files passed to NewInspector. Then the path would + // read "(root).Files[i]", etc; but we missed the boat. + var buf strings.Builder + buf.WriteString("File") + var visit func(Cursor) + visit = func(c Cursor) { + ek, idx := c.ParentEdge() + if ek == edge.Invalid { + return // File + } + visit(c.Parent()) + fmt.Fprintf(&buf, ".%s", ek.FieldName()) + if idx >= 0 { + fmt.Fprintf(&buf, "[%d]", idx) + } + ftype := ek.FieldType() + if idx >= 0 { + ftype = ftype.Elem() // []T -> T + } + if ftype.Kind() == reflect.Interface { + fmt.Fprintf(&buf, ".(%T)", c.Node()) + } + } + visit(c) + return buf.String() +} + // indices return the [start, end) half-open interval of event indices. func (c Cursor) indices() (int32, int32) { if c.index < 0 { diff --git a/vendor/golang.org/x/tools/go/loader/loader.go b/vendor/golang.org/x/tools/go/loader/loader.go index 9c5f7db1df..3c9d4fe752 100644 --- a/vendor/golang.org/x/tools/go/loader/loader.go +++ b/vendor/golang.org/x/tools/go/loader/loader.go @@ -738,7 +738,9 @@ func (conf *Config) parsePackageFiles(bp *build.Package, which rune) ([]*ast.Fil // Preprocess CgoFiles and parse the outputs (sequentially). if which == 'g' && bp.CgoFiles != nil { + ioLimit <- true cgofiles, err := cgo.ProcessFiles(bp, conf.fset(), conf.DisplayPath, conf.ParserMode) + <-ioLimit if err != nil { errs = append(errs, err) } else { diff --git a/vendor/golang.org/x/tools/go/packages/visit.go b/vendor/golang.org/x/tools/go/packages/visit.go index c546b1b63e..06747a9df7 100644 --- a/vendor/golang.org/x/tools/go/packages/visit.go +++ b/vendor/golang.org/x/tools/go/packages/visit.go @@ -5,11 +5,11 @@ package packages import ( - "cmp" "fmt" "iter" "os" - "slices" + + "golang.org/x/tools/internal/moremaps" ) // Visit visits all the packages in the import graph whose roots are @@ -40,7 +40,7 @@ func Visit(pkgs []*Package, pre func(*Package) bool, post func(*Package)) { seen[pkg] = true if pre == nil || pre(pkg) { - for _, imp := range sorted(pkg.Imports) { // for determinism + for _, imp := range moremaps.Sorted(pkg.Imports) { // for determinism visit(imp) } } @@ -88,7 +88,7 @@ func Postorder(pkgs []*Package) iter.Seq[*Package] { visit = func(pkg *Package) bool { if !seen[pkg] { seen[pkg] = true - for _, imp := range sorted(pkg.Imports) { // for determinism + for _, imp := range moremaps.Sorted(pkg.Imports) { // for determinism if !visit(imp) { return false } @@ -106,28 +106,3 @@ func Postorder(pkgs []*Package) iter.Seq[*Package] { } } } - -// -- copied from golang.org.x/tools/gopls/internal/util/moremaps -- - -// sorted returns an iterator over the entries of m in key order. -func sorted[M ~map[K]V, K cmp.Ordered, V any](m M) iter.Seq2[K, V] { - // TODO(adonovan): use maps.Sorted if proposal #68598 is accepted. - return func(yield func(K, V) bool) { - keys := keySlice(m) - slices.Sort(keys) - for _, k := range keys { - if !yield(k, m[k]) { - break - } - } - } -} - -// KeySlice returns the keys of the map M, like slices.Collect(maps.Keys(m)). -func keySlice[M ~map[K]V, K comparable, V any](m M) []K { - r := make([]K, 0, len(m)) - for k := range m { - r = append(r, k) - } - return r -} diff --git a/vendor/golang.org/x/tools/go/ssa/builder.go b/vendor/golang.org/x/tools/go/ssa/builder.go index 1669d80b3f..a663af8f3e 100644 --- a/vendor/golang.org/x/tools/go/ssa/builder.go +++ b/vendor/golang.org/x/tools/go/ssa/builder.go @@ -85,6 +85,7 @@ import ( "slices" "golang.org/x/tools/internal/typeparams" + "golang.org/x/tools/internal/typesinternal" "golang.org/x/tools/internal/versions" ) @@ -124,7 +125,7 @@ var ( // The ssa:deferstack intrinsic returns the current function's defer stack. vDeferStack = &Builtin{ name: "ssa:deferstack", - sig: types.NewSignatureType(nil, nil, nil, nil, types.NewTuple(anonVar(tDeferStack)), false), + sig: types.NewSignatureType(nil, nil, nil, nil, typesinternal.TupleOf(tDeferStack), false), } ) @@ -1719,7 +1720,7 @@ func (b *builder) selectStmt(fn *Function, s *ast.SelectStmt, label *lblock) { for _, st := range states { if st.Dir == types.RecvOnly { chtyp := typeparams.CoreType(fn.typ(st.Chan.Type())).(*types.Chan) - vars = append(vars, anonVar(chtyp.Elem())) + vars = append(vars, newVar("", chtyp.Elem())) } } sel.setType(types.NewTuple(vars...)) diff --git a/vendor/golang.org/x/tools/go/ssa/methods.go b/vendor/golang.org/x/tools/go/ssa/methods.go index 82faadeb66..8de0785ca9 100644 --- a/vendor/golang.org/x/tools/go/ssa/methods.go +++ b/vendor/golang.org/x/tools/go/ssa/methods.go @@ -167,10 +167,18 @@ func (prog *Program) RuntimeTypes() []types.Type { // eliminates the need to eagerly compute all the element // types during SSA building. var runtimeTypes []types.Type - add := func(t types.Type) { runtimeTypes = append(runtimeTypes, t) } var set typeutil.Map // for de-duping identical types for t := range prog.makeInterfaceTypes { - typesinternal.ForEachElement(&set, &prog.MethodSets, t, add) + typesinternal.ForEachElement(prog.MethodSets.MethodSet, t, func(t types.Type, access bool) bool { + if !access { + return false // inaccessible to reflection + } + seen, _ := set.Set(t, true).(bool) + if !seen { + runtimeTypes = append(runtimeTypes, t) + } + return seen + }) } return runtimeTypes diff --git a/vendor/golang.org/x/tools/go/ssa/util.go b/vendor/golang.org/x/tools/go/ssa/util.go index 42f9621c3f..5dfca72062 100644 --- a/vendor/golang.org/x/tools/go/ssa/util.go +++ b/vendor/golang.org/x/tools/go/ssa/util.go @@ -181,19 +181,13 @@ func newVar(name string, typ types.Type) *types.Var { return types.NewParam(token.NoPos, nil, name, typ) } -// anonVar creates an anonymous 'var' for use in a types.Tuple. -func anonVar(typ types.Type) *types.Var { - return newVar("", typ) -} - -var lenResults = types.NewTuple(anonVar(tInt)) +var lenResults = typesinternal.TupleOf(tInt) // makeLen returns the len builtin specialized to type func(T)int. func makeLen(T types.Type) *Builtin { - lenParams := types.NewTuple(anonVar(T)) return &Builtin{ name: "len", - sig: types.NewSignatureType(nil, nil, nil, lenParams, lenResults, false), + sig: types.NewSignatureType(nil, nil, nil, typesinternal.TupleOf(T), lenResults, false), } } diff --git a/vendor/golang.org/x/tools/go/ssa/wrappers.go b/vendor/golang.org/x/tools/go/ssa/wrappers.go index 6cadd04979..fbb067437b 100644 --- a/vendor/golang.org/x/tools/go/ssa/wrappers.go +++ b/vendor/golang.org/x/tools/go/ssa/wrappers.go @@ -26,6 +26,7 @@ import ( "go/types" "golang.org/x/tools/internal/typeparams" + "golang.org/x/tools/internal/typesinternal" ) // -- wrappers ----------------------------------------------------------- @@ -118,10 +119,12 @@ func (b *builder) buildWrapper(fn *Function) { // For simple indirection wrappers, perform an informative nil-check: // "value method (T).f called using nil *T pointer" if len(indices) == 1 && !isPointer(recvType(fn.object)) { + params := typesinternal.TupleOf(fn.method.recv, tString, tString) + results := typesinternal.TupleOf(fn.method.recv) var c Call c.Call.Value = &Builtin{ name: "ssa:wrapnilchk", - sig: types.NewSignatureType(nil, nil, nil, types.NewTuple(anonVar(fn.method.recv), anonVar(tString), anonVar(tString)), types.NewTuple(anonVar(fn.method.recv)), false), + sig: types.NewSignatureType(nil, nil, nil, params, results, false), } c.Call.Args = []Value{ v, diff --git a/vendor/golang.org/x/tools/go/types/typeutil/callee.go b/vendor/golang.org/x/tools/go/types/typeutil/callee.go index 3d24a8c637..b64a8f4549 100644 --- a/vendor/golang.org/x/tools/go/types/typeutil/callee.go +++ b/vendor/golang.org/x/tools/go/types/typeutil/callee.go @@ -7,7 +7,8 @@ package typeutil import ( "go/ast" "go/types" - _ "unsafe" // for linkname + + "golang.org/x/tools/internal/typesinternal" ) // Callee returns the named target of a function call, if any: @@ -19,14 +20,7 @@ import ( // Note: for calls of instantiated functions and methods, Callee returns // the corresponding generic function or method on the generic type. func Callee(info *types.Info, call *ast.CallExpr) types.Object { - obj := info.Uses[usedIdent(info, call.Fun)] - if obj == nil { - return nil - } - if _, ok := obj.(*types.TypeName); ok { - return nil - } - return obj + return typesinternal.Callee(info, call) } // StaticCallee returns the target (function or method) of a static function @@ -35,52 +29,5 @@ func Callee(info *types.Info, call *ast.CallExpr) types.Object { // Note: for calls of instantiated functions and methods, StaticCallee returns // the corresponding generic function or method on the generic type. func StaticCallee(info *types.Info, call *ast.CallExpr) *types.Func { - obj := info.Uses[usedIdent(info, call.Fun)] - fn, _ := obj.(*types.Func) - if fn == nil || interfaceMethod(fn) { - return nil - } - return fn -} - -// usedIdent is the implementation of [internal/typesinternal.UsedIdent]. -// It returns the identifier associated with e. -// See typesinternal.UsedIdent for a fuller description. -// This function should live in typesinternal, but cannot because it would -// create an import cycle. -// -//go:linkname usedIdent golang.org/x/tools/go/types/typeutil.usedIdent -func usedIdent(info *types.Info, e ast.Expr) *ast.Ident { - if info.Types == nil || info.Uses == nil { - panic("one of info.Types or info.Uses is nil; both must be populated") - } - // Look through type instantiation if necessary. - switch d := ast.Unparen(e).(type) { - case *ast.IndexExpr: - if info.Types[d.Index].IsType() { - e = d.X - } - case *ast.IndexListExpr: - e = d.X - } - - switch e := ast.Unparen(e).(type) { - // info.Uses always has the object we want, even for selector expressions. - // We don't need info.Selections. - // See go/types/recording.go:recordSelection. - case *ast.Ident: - return e - case *ast.SelectorExpr: - return e.Sel - } - return nil -} - -// interfaceMethod reports whether its argument is a method of an interface. -// This function should live in typesinternal, but cannot because it would create an import cycle. -// -//go:linkname interfaceMethod golang.org/x/tools/go/types/typeutil.interfaceMethod -func interfaceMethod(f *types.Func) bool { - recv := f.Signature().Recv() - return recv != nil && types.IsInterface(recv.Type()) + return typesinternal.StaticCallee(info, call) } diff --git a/vendor/golang.org/x/tools/internal/analysis/analyzerutil/version.go b/vendor/golang.org/x/tools/internal/analysis/analyzerutil/version.go index 700d53effc..60d7253c0e 100644 --- a/vendor/golang.org/x/tools/internal/analysis/analyzerutil/version.go +++ b/vendor/golang.org/x/tools/internal/analysis/analyzerutil/version.go @@ -38,7 +38,7 @@ func FileUsesGoVersion(pass *analysis.Pass, file *ast.File, version string) (_re // The bootstrap rule does not cover tests, // and some tests (e.g. debug/elf/file_test.go) rely on this. pkgpath := pass.Pkg.Path() - if packagepath.IsStdPackage(pkgpath) && + if packagepath.MaybeStdPackage(pkgpath) && stdlib.IsBootstrapPackage(pkgpath) && // (excludes "*_test" external test packages) !strings.HasSuffix(pass.Fset.File(file.Pos()).Name(), "_test.go") { // (excludes all tests) fileVersion = stdlib.BootstrapVersion.String() // package must bootstrap diff --git a/vendor/golang.org/x/tools/internal/moremaps/maps.go b/vendor/golang.org/x/tools/internal/moremaps/maps.go new file mode 100644 index 0000000000..a1bae078b1 --- /dev/null +++ b/vendor/golang.org/x/tools/internal/moremaps/maps.go @@ -0,0 +1,116 @@ +// Copyright 2023 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +// Package moremaps contains more functions for working with maps. +package moremaps + +import ( + "cmp" + "iter" + "maps" + "slices" +) + +// Arbitrary returns an arbitrary (key, value) entry from the map and ok is true, if +// the map is not empty. Otherwise, it returns zero values for K and V, and false. +func Arbitrary[K comparable, V any](m map[K]V) (_ K, _ V, ok bool) { + for k, v := range m { + return k, v, true + } + return +} + +// Group returns a new non-nil map containing the elements of s grouped by the +// keys returned from the key func. +func Group[K comparable, V any](s []V, key func(V) K) map[K][]V { + m := make(map[K][]V) + for _, v := range s { + k := key(v) + m[k] = append(m[k], v) + } + return m +} + +// KeySlice returns the keys of the map M, like slices.Collect(maps.Keys(m)). +func KeySlice[M ~map[K]V, K comparable, V any](m M) []K { + r := make([]K, 0, len(m)) + for k := range m { + r = append(r, k) + } + return r +} + +// ValueSlice returns the values of the map M, like slices.Collect(maps.Values(m)). +func ValueSlice[M ~map[K]V, K comparable, V any](m M) []V { + r := make([]V, 0, len(m)) + for _, v := range m { + r = append(r, v) + } + return r +} + +// SameKeys reports whether x and y have equal sets of keys. +func SameKeys[K comparable, V1, V2 any](x map[K]V1, y map[K]V2) bool { + ignoreValues := func(V1, V2) bool { return true } + return maps.EqualFunc(x, y, ignoreValues) +} + +// Sorted returns an iterator over the entries of m in key order. +func Sorted[M ~map[K]V, K cmp.Ordered, V any](m M) iter.Seq2[K, V] { + // TODO(adonovan): use maps.Sorted if proposal #68598 is accepted. + return func(yield func(K, V) bool) { + keys := KeySlice(m) + slices.Sort(keys) + for _, k := range keys { + if !yield(k, m[k]) { + break + } + } + } +} + +// SortedFunc returns an iterator over the entries of m in the key order determined by cmp. +func SortedFunc[M ~map[K]V, K comparable, V any](m M, cmp func(x, y K) int) iter.Seq2[K, V] { + // TODO(adonovan): use maps.SortedFunc if proposal #68598 is accepted. + return func(yield func(K, V) bool) { + keys := KeySlice(m) + slices.SortFunc(keys, cmp) + for _, k := range keys { + if !yield(k, m[k]) { + break + } + } + } +} + +// Delete is like delete(m, k) but reports whether deletion occurred. +func Delete[M ~map[K]V, K comparable, V any](m M, k K) bool { + pre := len(m) + delete(m, k) + return pre != len(m) +} + +// Entry is a key-value pair obtained from a map. +type Entry[K comparable, V any] struct { + Key K + Value V +} + +// Entries returns a new unordered array of the entries of a map. +func Entries[M ~map[K]V, K comparable, V any](m M) []Entry[K, V] { + entries := make([]Entry[K, V], 0, len(m)) + for k, v := range m { + entries = append(entries, Entry[K, V]{k, v}) + } + return entries +} + +// FromEntries returns a new map into which the entries have been inserted in order. +func FromEntries[K comparable, V any](entries []Entry[K, V]) map[K]V { + m := make(map[K]V, len(entries)) + for _, e := range entries { + m[e.Key] = e.Value + } + return m +} diff --git a/vendor/golang.org/x/tools/internal/packagepath/packagepath.go b/vendor/golang.org/x/tools/internal/packagepath/packagepath.go index fa39a13f9e..7b25340da4 100644 --- a/vendor/golang.org/x/tools/internal/packagepath/packagepath.go +++ b/vendor/golang.org/x/tools/internal/packagepath/packagepath.go @@ -36,9 +36,19 @@ func CanImport(from, to string) bool { return true } -// IsStdPackage reports whether the specified package path belongs to a -// package in the standard library (including internal dependencies). -func IsStdPackage(path string) bool { +// MaybeStdPackage reports whether the specified package path might +// belong to a package in the standard library (including internal +// dependencies), based only on its form. +// +// It may spuriously return true, but a result of false is definitive: +// +// MaybeStdPackage("fmt") = true +// MaybeStdPackage("maybe/tomorrow") = true // false positive +// MaybeStdPackage("example.com/foo") = false +// +// For a definitive answer, use [stdlib.HasPackage], which consults a +// huge table. +func MaybeStdPackage(path string) bool { // A standard package has no dot in its first segment. // (It may yet have a dot, e.g. "vendor/golang.org/x/foo".) slash := strings.IndexByte(path, '/') diff --git a/vendor/golang.org/x/tools/internal/refactor/imports.go b/vendor/golang.org/x/tools/internal/refactor/imports.go index 5ce70aee83..046038cc85 100644 --- a/vendor/golang.org/x/tools/internal/refactor/imports.go +++ b/vendor/golang.org/x/tools/internal/refactor/imports.go @@ -125,13 +125,13 @@ func AddImportEdits(file *ast.File, name, pkgpath string) []Edit { var pos token.Pos if gd, ok := decl0.(*ast.GenDecl); ok && gd.Tok == token.IMPORT && gd.Rparen.IsValid() { // Have existing grouped import ( ... ) decl. - if packagepath.IsStdPackage(pkgpath) && len(gd.Specs) > 0 { + if packagepath.MaybeStdPackage(pkgpath) && len(gd.Specs) > 0 { // Add spec for a std package before // first existing spec, followed by // a blank line if the next one is non-std. first := gd.Specs[0].(*ast.ImportSpec) pos = first.Pos() - if !packagepath.IsStdPackage(first.Path.Value) { + if !packagepath.MaybeStdPackage(first.Path.Value) { newText += "\n" } newText += "\n\t" diff --git a/vendor/golang.org/x/tools/internal/typesinternal/assignedaddress.go b/vendor/golang.org/x/tools/internal/typesinternal/assignedaddress.go new file mode 100644 index 0000000000..020defc383 --- /dev/null +++ b/vendor/golang.org/x/tools/internal/typesinternal/assignedaddress.go @@ -0,0 +1,128 @@ +// Copyright 2026 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +package typesinternal + +import ( + "go/ast" + "go/token" + "go/types" + + "golang.org/x/tools/go/ast/edge" + "golang.org/x/tools/go/ast/inspector" +) + +// IsAssignedOrAddressTaken reports whether the expression cur denotes a +// variable and appears in a context that assigns it or that takes its address, +// potentially leading to indirect assignment. +// +// These examples cause IsAssignedOrAddressTaken on the identifier for x to +// return true: +// +// x = 1 +// x++ +// x[i] = 1 (assume x is an array) +// x.a[i] = 1 (assume x.a is a non-pointer struct field) +// use(&x) +// +// whereas these cause it to return false: +// +// y = x +// f(x) +// use(x.a[i]) +// use(*x) +// +// The expression may itself be a compound, for example: +// +// use(&(*ptr)) => IsAssignedOrAddressTaken("*ptr") = true +// x.a[i] = 1 => IsAssignedOrAddressTaken("x.a") = true +// _ = x.a[i] => IsAssignedOrAddressTaken("x.a") = false +// +// A variable's declaration is not considered to be an assignment: +// +// var x int => IsAssignedOrAddressTaken(x) = false +// x := 1 => IsAssignedOrAddressTaken(x) = false +// +// TODO(adonovan): revisit the surprising behavior for declarations. +func IsAssignedOrAddressTaken(info *types.Info, cur inspector.Cursor) bool { + // Unfortunately we can't simply use info.Types[e].Assignable() + // as it is always true for a variable even when that variable is + // used only as an r-value. So we must inspect enclosing syntax. +outer: + // Ascend to outermost aggregate of which + // original cur is a part: + // x -> (x) | x.f | x[i] | x[i:j] + for cur = range cur.Enclosing() { + switch cur.ParentEdgeKind() { + case edge.ParenExpr_X: + // If x is an lvalue, then (x) is an lvalue. + case edge.SelectorExpr_X: + // If x is an lvalue, then x.f is an lvalue iff + // the selection does not traverse a pointer. + sel := cur.Parent().Node().(*ast.SelectorExpr) + if seln, ok := info.Selections[sel]; ok { + // Note: there is a bug in Indirect() where it spuriously returns true + // when both the selection receiver and parameter are pointers. However, + // it's okay in this case because there is no address taken when a + // pointer receiver method is called on a pointer type. + if seln.Indirect() { + return false + } + if seln.Kind() == types.MethodVal { + sig := seln.Obj().Type().(*types.Signature) + if is[*types.Pointer](sig.Recv().Type().Underlying()) { + t := seln.Recv() + // The receiver may be an embedded field, so we need + // to get the inner-most type (right before the method + // call in seln.Index()) + for _, idx := range seln.Index()[:len(seln.Index())-1] { + t = t.Underlying().(*types.Struct).Field(idx).Type() + } + if !is[*types.Pointer](t.Underlying()) { + return true // takes address of receiver + } + } + return false + } + } + case edge.IndexExpr_X, edge.SliceExpr_X: + // If x[i] or x[i:j] is an lvalue, + // then x is an lvalue iff x is an array. + if !is[*types.Array](info.TypeOf(cur.Node().(ast.Expr)).Underlying()) { + return false + } + default: + break outer + } + } + switch cur.ParentEdgeKind() { + case edge.AssignStmt_Lhs: + assign := cur.Parent().Node().(*ast.AssignStmt) + if assign.Tok != token.DEFINE { + return true // x = j or x += j + } + id := cur.Node().(*ast.Ident) + // Re-assigned identifiers are recorded in the Uses map. + if _, ok := info.Uses[id]; ok { + return true // reassignment of x (x, y := 1, 2) + } + case edge.RangeStmt_Key, edge.RangeStmt_Value: + rng := cur.Parent().Node().(*ast.RangeStmt) + if rng.Tok == token.ASSIGN { + return true // "for k, v = range x" is like an AssignStmt to k, v + } + case edge.IncDecStmt_X: + return true // x++, x-- + case edge.UnaryExpr_X: + if cur.Parent().Node().(*ast.UnaryExpr).Op == token.AND { + return true // &x + } + } + return false +} + +func is[T any](x any) bool { + _, ok := x.(T) + return ok +} diff --git a/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go b/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go index 7ebe9768bc..d5c40a2e50 100644 --- a/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go +++ b/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go @@ -8,7 +8,6 @@ import ( "fmt" "go/ast" "go/types" - _ "unsafe" // for go:linkname hack ) // CallKind describes the function position of an [*ast.CallExpr]. @@ -72,11 +71,15 @@ func ClassifyCall(info *types.Info, call *ast.CallExpr) CallKind { if tv.IsBuiltin() { return CallBuiltin } - obj := info.Uses[UsedIdent(info, call.Fun)] + id := UsedIdent(info, call.Fun) + if id == nil { + return CallDynamic + } + obj := info.Uses[id] // Classify the call by the type of the object, if any. switch obj := obj.(type) { case *types.Func: - if interfaceMethod(obj) { + if isInterfaceMethod(obj) { return CallInterface } return CallStatic @@ -127,11 +130,69 @@ func ClassifyCall(info *types.Info, call *ast.CallExpr) CallKind { // Note: if e is an instantiated function or method, UsedIdent returns // the corresponding generic function or method on the generic type. func UsedIdent(info *types.Info, e ast.Expr) *ast.Ident { - return usedIdent(info, e) + if info.Types == nil || info.Uses == nil { + panic("one of info.Types or info.Uses is nil; both must be populated") + } + // Look through type instantiation if necessary. + switch d := ast.Unparen(e).(type) { + case *ast.IndexExpr: + if info.Types[d.Index].IsType() { + e = d.X + } + case *ast.IndexListExpr: + e = d.X + } + + switch e := ast.Unparen(e).(type) { + // info.Uses always has the object we want, even for selector expressions. + // We don't need info.Selections. + // See go/types/recording.go:recordSelection. + case *ast.Ident: + return e + case *ast.SelectorExpr: + return e.Sel + } + return nil +} + +// See [golang.org/x/tools/go/types/typeutil.Callee]. +func Callee(info *types.Info, call *ast.CallExpr) types.Object { + id := UsedIdent(info, call.Fun) + if id == nil { + return nil + } + obj := info.Uses[id] + if obj == nil { + return nil + } + if _, ok := obj.(*types.TypeName); ok { + return nil + } + if fn, ok := obj.(*types.Func); ok { + return fn.Origin() + } + return obj } -//go:linkname usedIdent golang.org/x/tools/go/types/typeutil.usedIdent -func usedIdent(info *types.Info, e ast.Expr) *ast.Ident +// See [golang.org/x/tools/go/types/typeutil.StaticCallee]. +func StaticCallee(info *types.Info, call *ast.CallExpr) *types.Func { + id := UsedIdent(info, call.Fun) + if id == nil { + return nil + } + obj := info.Uses[id] + if obj == nil { + return nil + } + fn, _ := obj.(*types.Func) + if fn == nil || isInterfaceMethod(fn) { + return nil + } + return fn.Origin() +} -//go:linkname interfaceMethod golang.org/x/tools/go/types/typeutil.interfaceMethod -func interfaceMethod(f *types.Func) bool +// isInterfaceMethod reports whether its argument is a method of an interface. +func isInterfaceMethod(f *types.Func) bool { + recv := f.Signature().Recv() + return recv != nil && types.IsInterface(recv.Type()) +} diff --git a/vendor/golang.org/x/tools/internal/typesinternal/element.go b/vendor/golang.org/x/tools/internal/typesinternal/element.go index 89eeea1653..bab37fbfe0 100644 --- a/vendor/golang.org/x/tools/internal/typesinternal/element.go +++ b/vendor/golang.org/x/tools/internal/typesinternal/element.go @@ -7,8 +7,6 @@ package typesinternal import ( "fmt" "go/types" - - "golang.org/x/tools/go/types/typeutil" ) // ForEachElement calls f for type T and each type reachable from its @@ -16,25 +14,24 @@ import ( // type constructors; in addition, for each named type N, the type *N // is added to the result as it may have additional methods. // -// The caller must provide an initially empty set used to de-duplicate -// identical types, potentially across multiple calls to ForEachElement. -// (Its final value holds all the elements seen, matching the arguments -// passed to f.) +// The access argument passed to f indicates whether the type is +// inaccessible to reflection (for example, intermediate tuple types +// or underlying types of named types). // -// TODO(adonovan): share/harmonize with go/callgraph/rta. -func ForEachElement(rtypes *typeutil.Map, msets *typeutil.MethodSetCache, T types.Type, f func(types.Type)) { - var visit func(T types.Type, skip bool) - visit = func(T types.Type, skip bool) { - if !skip { - if seen, _ := rtypes.Set(T, true).(bool); seen { - return // de-dup - } - - f(T) // notify caller of new element type +// The result of f indicates whether the caller has seen this type +// already, so we can prune the traversal. +// +// methodSetOf abstracts (*typeutil.MethodSetCache).MethodSet, +// avoiding an import cycle. +func ForEachElement(methodSetOf func(types.Type) *types.MethodSet, T types.Type, f func(T types.Type, access bool) bool) { + var visit func(T types.Type, access bool) + visit = func(T types.Type, access bool) { + if f(T, access) { + return // duplicate; prune descent } // Recursion over signatures of each method. - tmset := msets.MethodSet(T) + tmset := methodSetOf(T) for method := range tmset.Methods() { sig := method.Type().(*types.Signature) if sig.TypeParams() != nil { @@ -65,13 +62,13 @@ func ForEachElement(rtypes *typeutil.Map, msets *typeutil.MethodSetCache, T type // // TODO(adonovan): document whether or not it is // safe to skip non-exported methods (as RTA does). - visit(sig.Params(), true) // skip the Tuple - visit(sig.Results(), true) // skip the Tuple + visit(sig.Params(), false) // the Tuple is inaccessible + visit(sig.Results(), false) // the Tuple is inaccessible } switch T := T.(type) { case *types.Alias: - visit(types.Unalias(T), skip) // emulates the pre-Alias behavior + visit(types.Unalias(T), access) // emulates the pre-Alias behavior case *types.Basic: // nop @@ -80,49 +77,49 @@ func ForEachElement(rtypes *typeutil.Map, msets *typeutil.MethodSetCache, T type // nop---handled by recursion over method set. case *types.Pointer: - visit(T.Elem(), false) + visit(T.Elem(), true) case *types.Slice: - visit(T.Elem(), false) + visit(T.Elem(), true) case *types.Chan: - visit(T.Elem(), false) + visit(T.Elem(), true) case *types.Map: - visit(T.Key(), false) - visit(T.Elem(), false) + visit(T.Key(), true) + visit(T.Elem(), true) case *types.Signature: if T.Recv() != nil { panic(fmt.Sprintf("Signature %s has Recv %s", T, T.Recv())) } - visit(T.Params(), true) // skip the Tuple - visit(T.Results(), true) // skip the Tuple + visit(T.Params(), false) // the Tuple is inaccessible + visit(T.Results(), false) // the Tuple is inaccessible case *types.Named: // A pointer-to-named type can be derived from a named // type via reflection. It may have methods too. - visit(types.NewPointer(T), false) + visit(types.NewPointer(T), true) // Consider 'type T struct{S}' where S has methods. // Reflection provides no way to get from T to struct{S}, // only to S, so the method set of struct{S} is unwanted, - // so set 'skip' flag during recursion. - visit(T.Underlying(), true) // skip the unnamed type + // so mark it inaccessible during recursion. + visit(T.Underlying(), false) // skip the unnamed type case *types.Array: - visit(T.Elem(), false) + visit(T.Elem(), true) case *types.Struct: for i, n := 0, T.NumFields(); i < n; i++ { // TODO(adonovan): document whether or not // it is safe to skip non-exported fields. - visit(T.Field(i).Type(), false) + visit(T.Field(i).Type(), true) } case *types.Tuple: for i, n := 0, T.Len(); i < n; i++ { - visit(T.At(i).Type(), false) + visit(T.At(i).Type(), true) } case *types.TypeParam, *types.Union: @@ -133,5 +130,5 @@ func ForEachElement(rtypes *typeutil.Map, msets *typeutil.MethodSetCache, T type panic(fmt.Sprintf("ForEachElement called on unexpected type %T", T)) } } - visit(T, false) + visit(T, true) } diff --git a/vendor/golang.org/x/tools/internal/typesinternal/toonew.go b/vendor/golang.org/x/tools/internal/typesinternal/toonew.go index cc86487eaa..386c59c740 100644 --- a/vendor/golang.org/x/tools/internal/typesinternal/toonew.go +++ b/vendor/golang.org/x/tools/internal/typesinternal/toonew.go @@ -13,20 +13,30 @@ import ( // TooNewStdSymbols computes the set of package-level symbols // exported by pkg that are not available at the specified version. -// The result maps each symbol to its minimum version. // // The pkg is allowed to contain type errors. -func TooNewStdSymbols(pkg *types.Package, version string) map[types.Object]string { - disallowed := make(map[types.Object]string) +func TooNewStdSymbols(pkg *types.Package, version string) map[types.Object]stdlib.Symbol { + disallowed := make(map[types.Object]stdlib.Symbol) + + // Some symbols are accessible before their release but + // only with specific build tags unknown to us here. + // Avoid false positives in such cases. + if pkg.Path() == "testing/synctest" && versions.AtLeast(version, "go1.24") { + // requires go1.24 && goexperiment.synctest || go1.25 + return disallowed + } + if (pkg.Path() == "encoding/json/v2" || pkg.Path() == "encoding/json/jsontext") && versions.AtLeast(version, "go1.25") { + // requires go1.25 && goexperiment.jsonv2 || go1.27 + return disallowed + } // Pass 1: package-level symbols. symbols := stdlib.PackageSymbols[pkg.Path()] for _, sym := range symbols { - symver := sym.Version.String() - if versions.Before(version, symver) { + if versions.Before(version, sym.Version.String()) { switch sym.Kind { case stdlib.Func, stdlib.Var, stdlib.Const, stdlib.Type: - disallowed[pkg.Scope().Lookup(sym.Name)] = symver + disallowed[pkg.Scope().Lookup(sym.Name)] = sym } } } @@ -60,28 +70,36 @@ func TooNewStdSymbols(pkg *types.Package, version string) map[types.Object]strin // spuriously cause the analyzer to report a reference to a // too-new symbol even though this expression compiles just // fine (with the fake implementation) using go1.21. + var noSym stdlib.Symbol + depth := make(map[types.Object]int) for _, sym := range symbols { - symVersion := sym.Version.String() - if !versions.Before(version, symVersion) { + if !versions.Before(version, sym.Version.String()) { continue // allowed } var obj types.Object + var indices []int switch sym.Kind { case stdlib.Field: typename, name := sym.SplitField() - if t := pkg.Scope().Lookup(typename); t != nil && disallowed[t] == "" { - obj, _, _ = types.LookupFieldOrMethod(t.Type(), false, pkg, name) + if t := pkg.Scope().Lookup(typename); t != nil && disallowed[t] == noSym { + obj, indices, _ = types.LookupFieldOrMethod(t.Type(), false, pkg, name) } case stdlib.Method: ptr, recvname, name := sym.SplitMethod() - if t := pkg.Scope().Lookup(recvname); t != nil && disallowed[t] == "" { - obj, _, _ = types.LookupFieldOrMethod(t.Type(), ptr, pkg, name) + if t := pkg.Scope().Lookup(recvname); t != nil && disallowed[t] == noSym { + obj, indices, _ = types.LookupFieldOrMethod(t.Type(), ptr, pkg, name) } } if obj != nil { - disallowed[obj] = symVersion + // In the presence of embedding, two or more "pkg.T.name" + // strings may map to the same types.Object. + // Prefer the Object with the shorter index path. + if min, ok := depth[obj]; !ok || len(indices) < min { + depth[obj] = len(indices) + disallowed[obj] = sym + } } } diff --git a/vendor/golang.org/x/tools/internal/typesinternal/types.go b/vendor/golang.org/x/tools/internal/typesinternal/types.go index d2c0b4c5ff..9fd48b088f 100644 --- a/vendor/golang.org/x/tools/internal/typesinternal/types.go +++ b/vendor/golang.org/x/tools/internal/typesinternal/types.go @@ -270,3 +270,11 @@ func ImplicitFieldSelections(seln types.Selection) iter.Seq2[*types.Var, bool] { } } } + +func TupleOf(elems ...types.Type) *types.Tuple { + params := make([]*types.Var, len(elems)) + for i, elem := range elems { + params[i] = types.NewParam(token.NoPos, nil, "", elem) + } + return types.NewTuple(params...) +} diff --git a/vendor/golang.org/x/tools/refactor/satisfy/find.go b/vendor/golang.org/x/tools/refactor/satisfy/find.go index 720ecc17d7..4299868717 100644 --- a/vendor/golang.org/x/tools/refactor/satisfy/find.go +++ b/vendor/golang.org/x/tools/refactor/satisfy/find.go @@ -11,7 +11,7 @@ // It requires well-typed inputs, and may panic otherwise. // // This package reimplements parts of the type checker. See -// https://go.dev/issue/70638 for a proposal to expose the the work +// https://go.dev/issue/70638 for a proposal to expose the work // already done by the type checker, which would make this package // redundant. package satisfy @@ -355,7 +355,8 @@ func (f *Finder) expr(e ast.Expr) types.Type { if e.Name == "_" { // e.g. "for _ = range x" return tInvalid } - panic("undefined ident: " + e.Name) + // There could be a missing definition, return an invalid type + return tInvalid case *ast.Ellipsis: if e.Elt != nil { @@ -374,7 +375,14 @@ func (f *Finder) expr(e ast.Expr) types.Type { case *types.Struct: for i, elem := range e.Elts { if kv, ok := elem.(*ast.KeyValueExpr); ok { - f.assign(f.info.Uses[kv.Key.(*ast.Ident)].Type(), f.expr(kv.Value)) + // in weird code, kv.Key might not be an identifier + id, ok := kv.Key.(*ast.Ident) + if !ok || f.info.Uses[id] == nil { + f.expr(kv.Value) + continue + + } + f.assign(f.info.Uses[id].Type(), f.expr(kv.Value)) } else { f.assign(T.Field(i).Type(), f.expr(elem)) } @@ -412,7 +420,10 @@ func (f *Finder) expr(e ast.Expr) types.Type { f.expr(e.X) } } else { - return f.info.Uses[e.Sel].Type() // qualified identifier + if obj, ok := f.info.Uses[e.Sel]; ok { + return obj.Type() // qualified identifier + } + return tInvalid } case *ast.IndexExpr: diff --git a/vendor/google.golang.org/api/internal/version.go b/vendor/google.golang.org/api/internal/version.go index c2c2c9beed..ed568f1f6c 100644 --- a/vendor/google.golang.org/api/internal/version.go +++ b/vendor/google.golang.org/api/internal/version.go @@ -5,4 +5,4 @@ package internal // Version is the current tagged release of the library. -const Version = "0.290.0" +const Version = "0.295.0" diff --git a/vendor/google.golang.org/api/storage/v1/storage-api.json b/vendor/google.golang.org/api/storage/v1/storage-api.json index e376149745..f03a05af0f 100644 --- a/vendor/google.golang.org/api/storage/v1/storage-api.json +++ b/vendor/google.golang.org/api/storage/v1/storage-api.json @@ -253,7 +253,7 @@ "location": "northamerica-south1" } ], - "etag": "\"3137393330363130333534383930343731333832\"", + "etag": "\"3138323634323934313536353633333331373333\"", "icons": { "x16": "https://www.google.com/images/icons/product/cloud_storage-16.png", "x32": "https://www.google.com/images/icons/product/cloud_storage-32.png" @@ -2316,6 +2316,53 @@ "https://www.googleapis.com/auth/devstorage.read_only", "https://www.googleapis.com/auth/devstorage.read_write" ] + }, + "update": { + "description": "Updates a managed folder using patch semantics.", + "httpMethod": "PATCH", + "id": "storage.managedFolders.update", + "parameterOrder": [ + "bucket", + "managedFolder" + ], + "parameters": { + "bucket": { + "description": "The name of the bucket containing the managed folder.", + "location": "path", + "required": true, + "type": "string" + }, + "ifMetagenerationMatch": { + "description": "Makes the operation conditional on whether the metageneration of the managed folder matches the specified value.", + "format": "int64", + "location": "query", + "type": "string" + }, + "ifMetagenerationNotMatch": { + "description": "Makes the operation conditional on whether the metageneration of the managed folder doesn't match the specified value.", + "format": "int64", + "location": "query", + "type": "string" + }, + "managedFolder": { + "description": "The name of the managed folder.", + "location": "path", + "required": true, + "type": "string" + } + }, + "path": "b/{bucket}/managedFolders/{managedFolder}", + "request": { + "$ref": "ManagedFolder" + }, + "response": { + "$ref": "ManagedFolder" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform", + "https://www.googleapis.com/auth/devstorage.full_control", + "https://www.googleapis.com/auth/devstorage.read_write" + ] } } }, @@ -2824,7 +2871,7 @@ "type": "string" }, "dropContextGroups": { - "description": "Specifies which groups of Object Contexts from the source object(s) should be dropped from the destination object.", + "description": "Specifies which object context groups to drop from the source object(s) during a compose operation. The accepted value is 'custom'.\nDestination contexts behave as follows:\n- When request body contexts are provided, they override all source contexts.\n- When no request body contexts are provided, source contexts are preserved unless 'dropContextGroups' contains 'custom', in which case all contexts are dropped.", "location": "query", "repeated": true, "type": "string" @@ -3800,7 +3847,7 @@ "type": "string" }, "dropContextGroups": { - "description": "Specifies which groups of Object Contexts from the source object should be dropped from the destination object.", + "description": "Specifies which object context groups to drop from the source object during a copy operation. The accepted value is 'custom'.\nDestination contexts behave as follows:\n- When request body contexts are provided, they override all source contexts.\n- When no request body contexts are provided, source contexts are preserved unless 'dropContextGroups' contains 'custom', in which case all contexts are dropped.", "location": "query", "repeated": true, "type": "string" @@ -4510,9 +4557,181 @@ } } } + }, + "rapidCaches": { + "methods": { + "disable": { + "description": "Disables a Rapid Cache instance.", + "httpMethod": "POST", + "id": "storage.rapidCaches.disable", + "parameterOrder": [ + "bucket", + "rapidCacheId" + ], + "parameters": { + "bucket": { + "description": "Name of the parent bucket.", + "location": "path", + "required": true, + "type": "string" + }, + "rapidCacheId": { + "description": "The ID of the requested Rapid Cache instance.", + "location": "path", + "required": true, + "type": "string" + } + }, + "path": "b/{bucket}/rapidCaches/{rapidCacheId}/disable", + "response": { + "$ref": "GoogleLongrunningOperation" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform", + "https://www.googleapis.com/auth/devstorage.full_control", + "https://www.googleapis.com/auth/devstorage.read_write" + ] + }, + "get": { + "description": "Returns the metadata of a Rapid Cache instance.", + "httpMethod": "GET", + "id": "storage.rapidCaches.get", + "parameterOrder": [ + "bucket", + "rapidCacheId" + ], + "parameters": { + "bucket": { + "description": "Name of the parent bucket.", + "location": "path", + "required": true, + "type": "string" + }, + "rapidCacheId": { + "description": "The ID of the requested Rapid Cache instance.", + "location": "path", + "required": true, + "type": "string" + } + }, + "path": "b/{bucket}/rapidCaches/{rapidCacheId}", + "response": { + "$ref": "RapidCache" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform", + "https://www.googleapis.com/auth/cloud-platform.read-only", + "https://www.googleapis.com/auth/devstorage.full_control", + "https://www.googleapis.com/auth/devstorage.read_only", + "https://www.googleapis.com/auth/devstorage.read_write" + ] + }, + "insert": { + "description": "Creates a Rapid Cache instance.", + "httpMethod": "POST", + "id": "storage.rapidCaches.insert", + "parameterOrder": [ + "bucket" + ], + "parameters": { + "bucket": { + "description": "Name of the parent bucket.", + "location": "path", + "required": true, + "type": "string" + } + }, + "path": "b/{bucket}/rapidCaches", + "request": { + "$ref": "RapidCache" + }, + "response": { + "$ref": "GoogleLongrunningOperation" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform", + "https://www.googleapis.com/auth/devstorage.full_control", + "https://www.googleapis.com/auth/devstorage.read_write" + ] + }, + "list": { + "description": "Returns a list of Rapid Cache instances of the bucket.", + "httpMethod": "GET", + "id": "storage.rapidCaches.list", + "parameterOrder": [ + "bucket" + ], + "parameters": { + "bucket": { + "description": "Name of the parent bucket.", + "location": "path", + "required": true, + "type": "string" + }, + "pageSize": { + "description": "Maximum number of items to return in a single page of responses.", + "format": "int32", + "location": "query", + "minimum": "0", + "type": "integer" + }, + "pageToken": { + "description": "A previously-returned page token representing part of the larger set of results to view.", + "location": "query", + "type": "string" + } + }, + "path": "b/{bucket}/rapidCaches", + "response": { + "$ref": "RapidCaches" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform", + "https://www.googleapis.com/auth/cloud-platform.read-only", + "https://www.googleapis.com/auth/devstorage.full_control", + "https://www.googleapis.com/auth/devstorage.read_only", + "https://www.googleapis.com/auth/devstorage.read_write" + ] + }, + "update": { + "description": "Updates the configuration of a Rapid Cache instance.", + "httpMethod": "PATCH", + "id": "storage.rapidCaches.update", + "parameterOrder": [ + "bucket", + "rapidCacheId" + ], + "parameters": { + "bucket": { + "description": "Name of the parent bucket.", + "location": "path", + "required": true, + "type": "string" + }, + "rapidCacheId": { + "description": "The ID of the requested Rapid Cache instance.", + "location": "path", + "required": true, + "type": "string" + } + }, + "path": "b/{bucket}/rapidCaches/{rapidCacheId}", + "request": { + "$ref": "RapidCache" + }, + "response": { + "$ref": "GoogleLongrunningOperation" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform", + "https://www.googleapis.com/auth/devstorage.full_control", + "https://www.googleapis.com/auth/devstorage.read_write" + ] + } + } } }, - "revision": "20260625", + "revision": "20260821", "rootUrl": "https://storage.googleapis.com/", "schemas": { "AdvanceRelocateBucketOperationRequest": { @@ -5849,6 +6068,10 @@ "description": "The name of the managed folder. Required if not specified by URL parameter.", "type": "string" }, + "rapidCacheConfig": { + "$ref": "RapidCacheConfig", + "description": "The rapid cache configuration for the managed folder." + }, "selfLink": { "description": "The link to this managed folder.", "type": "string" @@ -6414,6 +6637,133 @@ }, "type": "object" }, + "RapidCache": { + "description": "A Rapid Cache instance.", + "id": "RapidCache", + "properties": { + "admissionPolicy": { + "description": "The cache-level entry admission policy.", + "type": "string" + }, + "bucket": { + "description": "The name of the bucket containing this cache instance.", + "type": "string" + }, + "cacheType": { + "description": "The type of Rapid Cache this represents. Valid values include: \"rapid-cache\" and \"rapid-cache-ultra\".", + "type": "string" + }, + "createTime": { + "description": "The creation time of the cache instance in RFC 3339 format.", + "format": "date-time", + "type": "string" + }, + "id": { + "description": "The ID of the resource, including the project number, bucket name and rapid cache ID.", + "type": "string" + }, + "ingestOnWrite": { + "description": "Specifies whether objects are ingested into the cache upon write.", + "type": "boolean" + }, + "kind": { + "default": "storage#rapidCache", + "description": "The kind of item this is. For Rapid Cache, this is always storage#rapidCache.", + "type": "string" + }, + "pendingUpdate": { + "description": "True if the cache instance has an active Update long-running operation.", + "type": "boolean" + }, + "rapidCacheId": { + "description": "The ID of the Rapid cache instance.", + "type": "string" + }, + "selfLink": { + "description": "The link to this cache instance.", + "type": "string" + }, + "state": { + "description": "The current state of the cache instance.", + "type": "string" + }, + "ttl": { + "description": "The TTL of all cache entries in whole seconds. e.g., \"7200s\".", + "format": "google-duration", + "type": "string" + }, + "updateTime": { + "description": "The modification time of the cache instance metadata in RFC 3339 format.", + "format": "date-time", + "type": "string" + }, + "zone": { + "description": "The zone in which the cache instance is running. For example, us-central1-a.", + "type": "string" + } + }, + "type": "object" + }, + "RapidCacheConfig": { + "description": "Configuration options for the rapid cache of a managed folder.", + "id": "RapidCacheConfig", + "properties": { + "policies": { + "additionalProperties": { + "$ref": "RapidCachePolicy" + }, + "description": "A map of rapid cache IDs to the corresponding `RapidCachePolicy` configurations for a managed folder.", + "type": "object" + } + }, + "type": "object" + }, + "RapidCachePolicy": { + "description": "The rapid cache policy configuration for a managed folder.", + "id": "RapidCachePolicy", + "properties": { + "ingestOnWrite": { + "description": "The ingest-on-write policy for objects in the managed folder. When set to `enabled`, objects are automatically ingested into the cache when they are written to the managed folder.", + "enum": [ + "enabled", + "unspecified" + ], + "enumDescriptions": [ + "Ingestion on write is explicitly enabled for the managed folder.", + "Ingestion on write isn't specified at the managed folder level and is inherited from the parent resource's configuration. This is the default value." + ], + "type": "string" + }, + "rapidCacheId": { + "description": "The unique identifier of the rapid cache.", + "type": "string" + } + }, + "type": "object" + }, + "RapidCaches": { + "description": "A list of Rapid Caches.", + "id": "RapidCaches", + "properties": { + "items": { + "description": "The list of items.", + "items": { + "$ref": "RapidCache" + }, + "type": "array" + }, + "kind": { + "default": "storage#rapidCaches", + "description": "The kind of item this is. For lists of Rapid Caches, this is always storage#rapidCaches.", + "type": "string" + }, + "nextPageToken": { + "description": "The continuation token, used to page through large result sets. Provide this value in a subsequent request to return the next page of results.", + "type": "string" + } + }, + "type": "object" + }, "RelocateBucketRequest": { "description": "A Relocate Bucket request.", "id": "RelocateBucketRequest", diff --git a/vendor/google.golang.org/api/storage/v1/storage-gen.go b/vendor/google.golang.org/api/storage/v1/storage-gen.go index 632149c51e..e1415b44c2 100644 --- a/vendor/google.golang.org/api/storage/v1/storage-gen.go +++ b/vendor/google.golang.org/api/storage/v1/storage-gen.go @@ -155,6 +155,7 @@ func NewService(ctx context.Context, opts ...option.ClientOption) (*Service, err s.Objects = NewObjectsService(s) s.Operations = NewOperationsService(s) s.Projects = NewProjectsService(s) + s.RapidCaches = NewRapidCachesService(s) if endpoint != "" { s.BasePath = endpoint } @@ -202,6 +203,8 @@ type Service struct { Operations *OperationsService Projects *ProjectsService + + RapidCaches *RapidCachesService } func (s *Service) userAgent() string { @@ -343,6 +346,15 @@ type ProjectsServiceAccountService struct { s *Service } +func NewRapidCachesService(s *Service) *RapidCachesService { + rs := &RapidCachesService{s: s} + return rs +} + +type RapidCachesService struct { + s *Service +} + // AdvanceRelocateBucketOperationRequest: An AdvanceRelocateBucketOperation // request. type AdvanceRelocateBucketOperationRequest struct { @@ -2202,6 +2214,8 @@ type ManagedFolder struct { // Name: The name of the managed folder. Required if not specified by URL // parameter. Name string `json:"name,omitempty"` + // RapidCacheConfig: The rapid cache configuration for the managed folder. + RapidCacheConfig *RapidCacheConfig `json:"rapidCacheConfig,omitempty"` // SelfLink: The link to this managed folder. SelfLink string `json:"selfLink,omitempty"` // UpdateTime: The last update time of the managed folder metadata in RFC 3339 @@ -2880,6 +2894,153 @@ func (s PolicyBindings) MarshalJSON() ([]byte, error) { return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields) } +// RapidCache: A Rapid Cache instance. +type RapidCache struct { + // AdmissionPolicy: The cache-level entry admission policy. + AdmissionPolicy string `json:"admissionPolicy,omitempty"` + // Bucket: The name of the bucket containing this cache instance. + Bucket string `json:"bucket,omitempty"` + // CacheType: The type of Rapid Cache this represents. Valid values include: + // "rapid-cache" and "rapid-cache-ultra". + CacheType string `json:"cacheType,omitempty"` + // CreateTime: The creation time of the cache instance in RFC 3339 format. + CreateTime string `json:"createTime,omitempty"` + // Id: The ID of the resource, including the project number, bucket name and + // rapid cache ID. + Id string `json:"id,omitempty"` + // IngestOnWrite: Specifies whether objects are ingested into the cache upon + // write. + IngestOnWrite bool `json:"ingestOnWrite,omitempty"` + // Kind: The kind of item this is. For Rapid Cache, this is always + // storage#rapidCache. + Kind string `json:"kind,omitempty"` + // PendingUpdate: True if the cache instance has an active Update long-running + // operation. + PendingUpdate bool `json:"pendingUpdate,omitempty"` + // RapidCacheId: The ID of the Rapid cache instance. + RapidCacheId string `json:"rapidCacheId,omitempty"` + // SelfLink: The link to this cache instance. + SelfLink string `json:"selfLink,omitempty"` + // State: The current state of the cache instance. + State string `json:"state,omitempty"` + // Ttl: The TTL of all cache entries in whole seconds. e.g., "7200s". + Ttl string `json:"ttl,omitempty"` + // UpdateTime: The modification time of the cache instance metadata in RFC 3339 + // format. + UpdateTime string `json:"updateTime,omitempty"` + // Zone: The zone in which the cache instance is running. For example, + // us-central1-a. + Zone string `json:"zone,omitempty"` + + // ServerResponse contains the HTTP response code and headers from the server. + googleapi.ServerResponse `json:"-"` + // ForceSendFields is a list of field names (e.g. "AdmissionPolicy") to + // unconditionally include in API requests. By default, fields with empty or + // default values are omitted from API requests. See + // https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more + // details. + ForceSendFields []string `json:"-"` + // NullFields is a list of field names (e.g. "AdmissionPolicy") to include in + // API requests with the JSON null value. By default, fields with empty values + // are omitted from API requests. See + // https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details. + NullFields []string `json:"-"` +} + +func (s RapidCache) MarshalJSON() ([]byte, error) { + type NoMethod RapidCache + return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields) +} + +// RapidCacheConfig: Configuration options for the rapid cache of a managed +// folder. +type RapidCacheConfig struct { + // Policies: A map of rapid cache IDs to the corresponding `RapidCachePolicy` + // configurations for a managed folder. + Policies map[string]RapidCachePolicy `json:"policies,omitempty"` + // ForceSendFields is a list of field names (e.g. "Policies") to + // unconditionally include in API requests. By default, fields with empty or + // default values are omitted from API requests. See + // https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more + // details. + ForceSendFields []string `json:"-"` + // NullFields is a list of field names (e.g. "Policies") to include in API + // requests with the JSON null value. By default, fields with empty values are + // omitted from API requests. See + // https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details. + NullFields []string `json:"-"` +} + +func (s RapidCacheConfig) MarshalJSON() ([]byte, error) { + type NoMethod RapidCacheConfig + return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields) +} + +// RapidCachePolicy: The rapid cache policy configuration for a managed folder. +type RapidCachePolicy struct { + // IngestOnWrite: The ingest-on-write policy for objects in the managed folder. + // When set to `enabled`, objects are automatically ingested into the cache + // when they are written to the managed folder. + // + // Possible values: + // "enabled" - Ingestion on write is explicitly enabled for the managed + // folder. + // "unspecified" - Ingestion on write isn't specified at the managed folder + // level and is inherited from the parent resource's configuration. This is the + // default value. + IngestOnWrite string `json:"ingestOnWrite,omitempty"` + // RapidCacheId: The unique identifier of the rapid cache. + RapidCacheId string `json:"rapidCacheId,omitempty"` + // ForceSendFields is a list of field names (e.g. "IngestOnWrite") to + // unconditionally include in API requests. By default, fields with empty or + // default values are omitted from API requests. See + // https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more + // details. + ForceSendFields []string `json:"-"` + // NullFields is a list of field names (e.g. "IngestOnWrite") to include in API + // requests with the JSON null value. By default, fields with empty values are + // omitted from API requests. See + // https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details. + NullFields []string `json:"-"` +} + +func (s RapidCachePolicy) MarshalJSON() ([]byte, error) { + type NoMethod RapidCachePolicy + return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields) +} + +// RapidCaches: A list of Rapid Caches. +type RapidCaches struct { + // Items: The list of items. + Items []*RapidCache `json:"items,omitempty"` + // Kind: The kind of item this is. For lists of Rapid Caches, this is always + // storage#rapidCaches. + Kind string `json:"kind,omitempty"` + // NextPageToken: The continuation token, used to page through large result + // sets. Provide this value in a subsequent request to return the next page of + // results. + NextPageToken string `json:"nextPageToken,omitempty"` + + // ServerResponse contains the HTTP response code and headers from the server. + googleapi.ServerResponse `json:"-"` + // ForceSendFields is a list of field names (e.g. "Items") to unconditionally + // include in API requests. By default, fields with empty or default values are + // omitted from API requests. See + // https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more + // details. + ForceSendFields []string `json:"-"` + // NullFields is a list of field names (e.g. "Items") to include in API + // requests with the JSON null value. By default, fields with empty values are + // omitted from API requests. See + // https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details. + NullFields []string `json:"-"` +} + +func (s RapidCaches) MarshalJSON() ([]byte, error) { + type NoMethod RapidCaches + return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields) +} + // RelocateBucketRequest: A Relocate Bucket request. type RelocateBucketRequest struct { // DestinationCustomPlacementConfig: The bucket's new custom placement @@ -8694,6 +8855,129 @@ func (c *ManagedFoldersTestIamPermissionsCall) Do(opts ...googleapi.CallOption) return ret, nil } +type ManagedFoldersUpdateCall struct { + s *Service + bucket string + managedFolder string + managedfolder *ManagedFolder + urlParams_ gensupport.URLParams + ctx_ context.Context + header_ http.Header +} + +// Update: Updates a managed folder using patch semantics. +// +// - bucket: The name of the bucket containing the managed folder. +// - managedFolder: The name of the managed folder. +func (r *ManagedFoldersService) Update(bucket string, managedFolder string, managedfolder *ManagedFolder) *ManagedFoldersUpdateCall { + c := &ManagedFoldersUpdateCall{s: r.s, urlParams_: make(gensupport.URLParams)} + c.bucket = bucket + c.managedFolder = managedFolder + c.managedfolder = managedfolder + return c +} + +// IfMetagenerationMatch sets the optional parameter "ifMetagenerationMatch": +// Makes the operation conditional on whether the metageneration of the managed +// folder matches the specified value. +func (c *ManagedFoldersUpdateCall) IfMetagenerationMatch(ifMetagenerationMatch int64) *ManagedFoldersUpdateCall { + c.urlParams_.Set("ifMetagenerationMatch", fmt.Sprint(ifMetagenerationMatch)) + return c +} + +// IfMetagenerationNotMatch sets the optional parameter +// "ifMetagenerationNotMatch": Makes the operation conditional on whether the +// metageneration of the managed folder doesn't match the specified value. +func (c *ManagedFoldersUpdateCall) IfMetagenerationNotMatch(ifMetagenerationNotMatch int64) *ManagedFoldersUpdateCall { + c.urlParams_.Set("ifMetagenerationNotMatch", fmt.Sprint(ifMetagenerationNotMatch)) + return c +} + +// Fields allows partial responses to be retrieved. See +// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more +// details. +func (c *ManagedFoldersUpdateCall) Fields(s ...googleapi.Field) *ManagedFoldersUpdateCall { + c.urlParams_.Set("fields", googleapi.CombineFields(s)) + return c +} + +// Context sets the context to be used in this call's Do method. +func (c *ManagedFoldersUpdateCall) Context(ctx context.Context) *ManagedFoldersUpdateCall { + c.ctx_ = ctx + return c +} + +// Header returns a http.Header that can be modified by the caller to add +// headers to the request. +func (c *ManagedFoldersUpdateCall) Header() http.Header { + if c.header_ == nil { + c.header_ = make(http.Header) + } + return c.header_ +} + +func (c *ManagedFoldersUpdateCall) doRequest(alt string) (*http.Response, error) { + reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "application/json", c.header_) + body, err := googleapi.WithoutDataWrapper.JSONBuffer(c.managedfolder) + if err != nil { + return nil, err + } + c.urlParams_.Set("alt", alt) + c.urlParams_.Set("prettyPrint", "false") + urls := googleapi.ResolveRelative(c.s.BasePath, "b/{bucket}/managedFolders/{managedFolder}") + urls += "?" + c.urlParams_.Encode() + req, err := http.NewRequest("PATCH", urls, body) + if err != nil { + return nil, err + } + req.Header = reqHeaders + googleapi.Expand(req.URL, map[string]string{ + "bucket": c.bucket, + "managedFolder": c.managedFolder, + }) + c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "storage.managedFolders.update", "request", internallog.HTTPRequest(req, body.Bytes())) + return gensupport.SendRequest(c.ctx_, c.s.client, req) +} + +// Do executes the "storage.managedFolders.update" call. +// Any non-2xx status code is an error. Response headers are in either +// *ManagedFolder.ServerResponse.Header or (if a response was returned at all) +// in error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check +// whether the returned error was because http.StatusNotModified was returned. +func (c *ManagedFoldersUpdateCall) Do(opts ...googleapi.CallOption) (*ManagedFolder, error) { + gensupport.SetOptions(c.urlParams_, opts...) + res, err := c.doRequest("json") + if res != nil && res.StatusCode == http.StatusNotModified { + if res.Body != nil { + res.Body.Close() + } + return nil, gensupport.WrapError(&googleapi.Error{ + Code: res.StatusCode, + Header: res.Header, + }) + } + if err != nil { + return nil, err + } + defer googleapi.CloseBody(res) + if err := googleapi.CheckResponse(res); err != nil { + return nil, gensupport.WrapError(err) + } + ret := &ManagedFolder{ + ServerResponse: googleapi.ServerResponse{ + Header: res.Header, + HTTPStatusCode: res.StatusCode, + }, + } + target := &ret + b, err := gensupport.DecodeResponseBytes(target, res) + if err != nil { + return nil, err + } + c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "storage.managedFolders.update", "response", internallog.HTTPResponse(res, b)) + return ret, nil +} + type NotificationsDeleteCall struct { s *Service bucket string @@ -10043,8 +10327,14 @@ func (c *ObjectsComposeCall) DestinationPredefinedAcl(destinationPredefinedAcl s } // DropContextGroups sets the optional parameter "dropContextGroups": Specifies -// which groups of Object Contexts from the source object(s) should be dropped -// from the destination object. +// which object context groups to drop from the source object(s) during a +// compose operation. The accepted value is 'custom'. +// Destination contexts behave as follows: +// - When request body contexts are provided, they override all source +// contexts. +// - When no request body contexts are provided, source contexts are preserved +// unless 'dropContextGroups' contains 'custom', in which case all contexts are +// dropped. func (c *ObjectsComposeCall) DropContextGroups(dropContextGroups ...string) *ObjectsComposeCall { c.urlParams_.SetMulti("dropContextGroups", append([]string{}, dropContextGroups...)) return c @@ -12155,8 +12445,14 @@ func (c *ObjectsRewriteCall) DestinationPredefinedAcl(destinationPredefinedAcl s } // DropContextGroups sets the optional parameter "dropContextGroups": Specifies -// which groups of Object Contexts from the source object should be dropped -// from the destination object. +// which object context groups to drop from the source object during a copy +// operation. The accepted value is 'custom'. +// Destination contexts behave as follows: +// - When request body contexts are provided, they override all source +// contexts. +// - When no request body contexts are provided, source contexts are preserved +// unless 'dropContextGroups' contains 'custom', in which case all contexts are +// dropped. func (c *ObjectsRewriteCall) DropContextGroups(dropContextGroups ...string) *ObjectsRewriteCall { c.urlParams_.SetMulti("dropContextGroups", append([]string{}, dropContextGroups...)) return c @@ -13986,3 +14282,574 @@ func (c *ProjectsServiceAccountGetCall) Do(opts ...googleapi.CallOption) (*Servi c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "storage.projects.serviceAccount.get", "response", internallog.HTTPResponse(res, b)) return ret, nil } + +type RapidCachesDisableCall struct { + s *Service + bucket string + rapidCacheId string + urlParams_ gensupport.URLParams + ctx_ context.Context + header_ http.Header +} + +// Disable: Disables a Rapid Cache instance. +// +// - bucket: Name of the parent bucket. +// - rapidCacheId: The ID of the requested Rapid Cache instance. +func (r *RapidCachesService) Disable(bucket string, rapidCacheId string) *RapidCachesDisableCall { + c := &RapidCachesDisableCall{s: r.s, urlParams_: make(gensupport.URLParams)} + c.bucket = bucket + c.rapidCacheId = rapidCacheId + return c +} + +// Fields allows partial responses to be retrieved. See +// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more +// details. +func (c *RapidCachesDisableCall) Fields(s ...googleapi.Field) *RapidCachesDisableCall { + c.urlParams_.Set("fields", googleapi.CombineFields(s)) + return c +} + +// Context sets the context to be used in this call's Do method. +func (c *RapidCachesDisableCall) Context(ctx context.Context) *RapidCachesDisableCall { + c.ctx_ = ctx + return c +} + +// Header returns a http.Header that can be modified by the caller to add +// headers to the request. +func (c *RapidCachesDisableCall) Header() http.Header { + if c.header_ == nil { + c.header_ = make(http.Header) + } + return c.header_ +} + +func (c *RapidCachesDisableCall) doRequest(alt string) (*http.Response, error) { + reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "", c.header_) + c.urlParams_.Set("alt", alt) + c.urlParams_.Set("prettyPrint", "false") + urls := googleapi.ResolveRelative(c.s.BasePath, "b/{bucket}/rapidCaches/{rapidCacheId}/disable") + urls += "?" + c.urlParams_.Encode() + req, err := http.NewRequest("POST", urls, nil) + if err != nil { + return nil, err + } + req.Header = reqHeaders + googleapi.Expand(req.URL, map[string]string{ + "bucket": c.bucket, + "rapidCacheId": c.rapidCacheId, + }) + c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "storage.rapidCaches.disable", "request", internallog.HTTPRequest(req, nil)) + return gensupport.SendRequest(c.ctx_, c.s.client, req) +} + +// Do executes the "storage.rapidCaches.disable" call. +// Any non-2xx status code is an error. Response headers are in either +// *GoogleLongrunningOperation.ServerResponse.Header or (if a response was +// returned at all) in error.(*googleapi.Error).Header. Use +// googleapi.IsNotModified to check whether the returned error was because +// http.StatusNotModified was returned. +func (c *RapidCachesDisableCall) Do(opts ...googleapi.CallOption) (*GoogleLongrunningOperation, error) { + gensupport.SetOptions(c.urlParams_, opts...) + res, err := c.doRequest("json") + if res != nil && res.StatusCode == http.StatusNotModified { + if res.Body != nil { + res.Body.Close() + } + return nil, gensupport.WrapError(&googleapi.Error{ + Code: res.StatusCode, + Header: res.Header, + }) + } + if err != nil { + return nil, err + } + defer googleapi.CloseBody(res) + if err := googleapi.CheckResponse(res); err != nil { + return nil, gensupport.WrapError(err) + } + ret := &GoogleLongrunningOperation{ + ServerResponse: googleapi.ServerResponse{ + Header: res.Header, + HTTPStatusCode: res.StatusCode, + }, + } + target := &ret + b, err := gensupport.DecodeResponseBytes(target, res) + if err != nil { + return nil, err + } + c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "storage.rapidCaches.disable", "response", internallog.HTTPResponse(res, b)) + return ret, nil +} + +type RapidCachesGetCall struct { + s *Service + bucket string + rapidCacheId string + urlParams_ gensupport.URLParams + ifNoneMatch_ string + ctx_ context.Context + header_ http.Header +} + +// Get: Returns the metadata of a Rapid Cache instance. +// +// - bucket: Name of the parent bucket. +// - rapidCacheId: The ID of the requested Rapid Cache instance. +func (r *RapidCachesService) Get(bucket string, rapidCacheId string) *RapidCachesGetCall { + c := &RapidCachesGetCall{s: r.s, urlParams_: make(gensupport.URLParams)} + c.bucket = bucket + c.rapidCacheId = rapidCacheId + return c +} + +// Fields allows partial responses to be retrieved. See +// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more +// details. +func (c *RapidCachesGetCall) Fields(s ...googleapi.Field) *RapidCachesGetCall { + c.urlParams_.Set("fields", googleapi.CombineFields(s)) + return c +} + +// IfNoneMatch sets an optional parameter which makes the operation fail if the +// object's ETag matches the given value. This is useful for getting updates +// only after the object has changed since the last request. +func (c *RapidCachesGetCall) IfNoneMatch(entityTag string) *RapidCachesGetCall { + c.ifNoneMatch_ = entityTag + return c +} + +// Context sets the context to be used in this call's Do method. +func (c *RapidCachesGetCall) Context(ctx context.Context) *RapidCachesGetCall { + c.ctx_ = ctx + return c +} + +// Header returns a http.Header that can be modified by the caller to add +// headers to the request. +func (c *RapidCachesGetCall) Header() http.Header { + if c.header_ == nil { + c.header_ = make(http.Header) + } + return c.header_ +} + +func (c *RapidCachesGetCall) doRequest(alt string) (*http.Response, error) { + reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "", c.header_) + if c.ifNoneMatch_ != "" { + reqHeaders.Set("If-None-Match", c.ifNoneMatch_) + } + c.urlParams_.Set("alt", alt) + c.urlParams_.Set("prettyPrint", "false") + urls := googleapi.ResolveRelative(c.s.BasePath, "b/{bucket}/rapidCaches/{rapidCacheId}") + urls += "?" + c.urlParams_.Encode() + req, err := http.NewRequest("GET", urls, nil) + if err != nil { + return nil, err + } + req.Header = reqHeaders + googleapi.Expand(req.URL, map[string]string{ + "bucket": c.bucket, + "rapidCacheId": c.rapidCacheId, + }) + c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "storage.rapidCaches.get", "request", internallog.HTTPRequest(req, nil)) + return gensupport.SendRequest(c.ctx_, c.s.client, req) +} + +// Do executes the "storage.rapidCaches.get" call. +// Any non-2xx status code is an error. Response headers are in either +// *RapidCache.ServerResponse.Header or (if a response was returned at all) in +// error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check +// whether the returned error was because http.StatusNotModified was returned. +func (c *RapidCachesGetCall) Do(opts ...googleapi.CallOption) (*RapidCache, error) { + gensupport.SetOptions(c.urlParams_, opts...) + res, err := c.doRequest("json") + if res != nil && res.StatusCode == http.StatusNotModified { + if res.Body != nil { + res.Body.Close() + } + return nil, gensupport.WrapError(&googleapi.Error{ + Code: res.StatusCode, + Header: res.Header, + }) + } + if err != nil { + return nil, err + } + defer googleapi.CloseBody(res) + if err := googleapi.CheckResponse(res); err != nil { + return nil, gensupport.WrapError(err) + } + ret := &RapidCache{ + ServerResponse: googleapi.ServerResponse{ + Header: res.Header, + HTTPStatusCode: res.StatusCode, + }, + } + target := &ret + b, err := gensupport.DecodeResponseBytes(target, res) + if err != nil { + return nil, err + } + c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "storage.rapidCaches.get", "response", internallog.HTTPResponse(res, b)) + return ret, nil +} + +type RapidCachesInsertCall struct { + s *Service + bucket string + rapidcache *RapidCache + urlParams_ gensupport.URLParams + ctx_ context.Context + header_ http.Header +} + +// Insert: Creates a Rapid Cache instance. +// +// - bucket: Name of the parent bucket. +func (r *RapidCachesService) Insert(bucket string, rapidcache *RapidCache) *RapidCachesInsertCall { + c := &RapidCachesInsertCall{s: r.s, urlParams_: make(gensupport.URLParams)} + c.bucket = bucket + c.rapidcache = rapidcache + return c +} + +// Fields allows partial responses to be retrieved. See +// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more +// details. +func (c *RapidCachesInsertCall) Fields(s ...googleapi.Field) *RapidCachesInsertCall { + c.urlParams_.Set("fields", googleapi.CombineFields(s)) + return c +} + +// Context sets the context to be used in this call's Do method. +func (c *RapidCachesInsertCall) Context(ctx context.Context) *RapidCachesInsertCall { + c.ctx_ = ctx + return c +} + +// Header returns a http.Header that can be modified by the caller to add +// headers to the request. +func (c *RapidCachesInsertCall) Header() http.Header { + if c.header_ == nil { + c.header_ = make(http.Header) + } + return c.header_ +} + +func (c *RapidCachesInsertCall) doRequest(alt string) (*http.Response, error) { + reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "application/json", c.header_) + body, err := googleapi.WithoutDataWrapper.JSONBuffer(c.rapidcache) + if err != nil { + return nil, err + } + c.urlParams_.Set("alt", alt) + c.urlParams_.Set("prettyPrint", "false") + urls := googleapi.ResolveRelative(c.s.BasePath, "b/{bucket}/rapidCaches") + urls += "?" + c.urlParams_.Encode() + req, err := http.NewRequest("POST", urls, body) + if err != nil { + return nil, err + } + req.Header = reqHeaders + googleapi.Expand(req.URL, map[string]string{ + "bucket": c.bucket, + }) + c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "storage.rapidCaches.insert", "request", internallog.HTTPRequest(req, body.Bytes())) + return gensupport.SendRequest(c.ctx_, c.s.client, req) +} + +// Do executes the "storage.rapidCaches.insert" call. +// Any non-2xx status code is an error. Response headers are in either +// *GoogleLongrunningOperation.ServerResponse.Header or (if a response was +// returned at all) in error.(*googleapi.Error).Header. Use +// googleapi.IsNotModified to check whether the returned error was because +// http.StatusNotModified was returned. +func (c *RapidCachesInsertCall) Do(opts ...googleapi.CallOption) (*GoogleLongrunningOperation, error) { + gensupport.SetOptions(c.urlParams_, opts...) + res, err := c.doRequest("json") + if res != nil && res.StatusCode == http.StatusNotModified { + if res.Body != nil { + res.Body.Close() + } + return nil, gensupport.WrapError(&googleapi.Error{ + Code: res.StatusCode, + Header: res.Header, + }) + } + if err != nil { + return nil, err + } + defer googleapi.CloseBody(res) + if err := googleapi.CheckResponse(res); err != nil { + return nil, gensupport.WrapError(err) + } + ret := &GoogleLongrunningOperation{ + ServerResponse: googleapi.ServerResponse{ + Header: res.Header, + HTTPStatusCode: res.StatusCode, + }, + } + target := &ret + b, err := gensupport.DecodeResponseBytes(target, res) + if err != nil { + return nil, err + } + c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "storage.rapidCaches.insert", "response", internallog.HTTPResponse(res, b)) + return ret, nil +} + +type RapidCachesListCall struct { + s *Service + bucket string + urlParams_ gensupport.URLParams + ifNoneMatch_ string + ctx_ context.Context + header_ http.Header +} + +// List: Returns a list of Rapid Cache instances of the bucket. +// +// - bucket: Name of the parent bucket. +func (r *RapidCachesService) List(bucket string) *RapidCachesListCall { + c := &RapidCachesListCall{s: r.s, urlParams_: make(gensupport.URLParams)} + c.bucket = bucket + return c +} + +// PageSize sets the optional parameter "pageSize": Maximum number of items to +// return in a single page of responses. +func (c *RapidCachesListCall) PageSize(pageSize int64) *RapidCachesListCall { + c.urlParams_.Set("pageSize", fmt.Sprint(pageSize)) + return c +} + +// PageToken sets the optional parameter "pageToken": A previously-returned +// page token representing part of the larger set of results to view. +func (c *RapidCachesListCall) PageToken(pageToken string) *RapidCachesListCall { + c.urlParams_.Set("pageToken", pageToken) + return c +} + +// Fields allows partial responses to be retrieved. See +// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more +// details. +func (c *RapidCachesListCall) Fields(s ...googleapi.Field) *RapidCachesListCall { + c.urlParams_.Set("fields", googleapi.CombineFields(s)) + return c +} + +// IfNoneMatch sets an optional parameter which makes the operation fail if the +// object's ETag matches the given value. This is useful for getting updates +// only after the object has changed since the last request. +func (c *RapidCachesListCall) IfNoneMatch(entityTag string) *RapidCachesListCall { + c.ifNoneMatch_ = entityTag + return c +} + +// Context sets the context to be used in this call's Do method. +func (c *RapidCachesListCall) Context(ctx context.Context) *RapidCachesListCall { + c.ctx_ = ctx + return c +} + +// Header returns a http.Header that can be modified by the caller to add +// headers to the request. +func (c *RapidCachesListCall) Header() http.Header { + if c.header_ == nil { + c.header_ = make(http.Header) + } + return c.header_ +} + +func (c *RapidCachesListCall) doRequest(alt string) (*http.Response, error) { + reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "", c.header_) + if c.ifNoneMatch_ != "" { + reqHeaders.Set("If-None-Match", c.ifNoneMatch_) + } + c.urlParams_.Set("alt", alt) + c.urlParams_.Set("prettyPrint", "false") + urls := googleapi.ResolveRelative(c.s.BasePath, "b/{bucket}/rapidCaches") + urls += "?" + c.urlParams_.Encode() + req, err := http.NewRequest("GET", urls, nil) + if err != nil { + return nil, err + } + req.Header = reqHeaders + googleapi.Expand(req.URL, map[string]string{ + "bucket": c.bucket, + }) + c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "storage.rapidCaches.list", "request", internallog.HTTPRequest(req, nil)) + return gensupport.SendRequest(c.ctx_, c.s.client, req) +} + +// Do executes the "storage.rapidCaches.list" call. +// Any non-2xx status code is an error. Response headers are in either +// *RapidCaches.ServerResponse.Header or (if a response was returned at all) in +// error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check +// whether the returned error was because http.StatusNotModified was returned. +func (c *RapidCachesListCall) Do(opts ...googleapi.CallOption) (*RapidCaches, error) { + gensupport.SetOptions(c.urlParams_, opts...) + res, err := c.doRequest("json") + if res != nil && res.StatusCode == http.StatusNotModified { + if res.Body != nil { + res.Body.Close() + } + return nil, gensupport.WrapError(&googleapi.Error{ + Code: res.StatusCode, + Header: res.Header, + }) + } + if err != nil { + return nil, err + } + defer googleapi.CloseBody(res) + if err := googleapi.CheckResponse(res); err != nil { + return nil, gensupport.WrapError(err) + } + ret := &RapidCaches{ + ServerResponse: googleapi.ServerResponse{ + Header: res.Header, + HTTPStatusCode: res.StatusCode, + }, + } + target := &ret + b, err := gensupport.DecodeResponseBytes(target, res) + if err != nil { + return nil, err + } + c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "storage.rapidCaches.list", "response", internallog.HTTPResponse(res, b)) + return ret, nil +} + +// Pages invokes f for each page of results. +// A non-nil error returned from f will halt the iteration. +// The provided context supersedes any context provided to the Context method. +func (c *RapidCachesListCall) Pages(ctx context.Context, f func(*RapidCaches) error) error { + c.ctx_ = ctx + defer c.PageToken(c.urlParams_.Get("pageToken")) + for { + x, err := c.Do() + if err != nil { + return err + } + if err := f(x); err != nil { + return err + } + if x.NextPageToken == "" { + return nil + } + c.PageToken(x.NextPageToken) + } +} + +type RapidCachesUpdateCall struct { + s *Service + bucket string + rapidCacheId string + rapidcache *RapidCache + urlParams_ gensupport.URLParams + ctx_ context.Context + header_ http.Header +} + +// Update: Updates the configuration of a Rapid Cache instance. +// +// - bucket: Name of the parent bucket. +// - rapidCacheId: The ID of the requested Rapid Cache instance. +func (r *RapidCachesService) Update(bucket string, rapidCacheId string, rapidcache *RapidCache) *RapidCachesUpdateCall { + c := &RapidCachesUpdateCall{s: r.s, urlParams_: make(gensupport.URLParams)} + c.bucket = bucket + c.rapidCacheId = rapidCacheId + c.rapidcache = rapidcache + return c +} + +// Fields allows partial responses to be retrieved. See +// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more +// details. +func (c *RapidCachesUpdateCall) Fields(s ...googleapi.Field) *RapidCachesUpdateCall { + c.urlParams_.Set("fields", googleapi.CombineFields(s)) + return c +} + +// Context sets the context to be used in this call's Do method. +func (c *RapidCachesUpdateCall) Context(ctx context.Context) *RapidCachesUpdateCall { + c.ctx_ = ctx + return c +} + +// Header returns a http.Header that can be modified by the caller to add +// headers to the request. +func (c *RapidCachesUpdateCall) Header() http.Header { + if c.header_ == nil { + c.header_ = make(http.Header) + } + return c.header_ +} + +func (c *RapidCachesUpdateCall) doRequest(alt string) (*http.Response, error) { + reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "application/json", c.header_) + body, err := googleapi.WithoutDataWrapper.JSONBuffer(c.rapidcache) + if err != nil { + return nil, err + } + c.urlParams_.Set("alt", alt) + c.urlParams_.Set("prettyPrint", "false") + urls := googleapi.ResolveRelative(c.s.BasePath, "b/{bucket}/rapidCaches/{rapidCacheId}") + urls += "?" + c.urlParams_.Encode() + req, err := http.NewRequest("PATCH", urls, body) + if err != nil { + return nil, err + } + req.Header = reqHeaders + googleapi.Expand(req.URL, map[string]string{ + "bucket": c.bucket, + "rapidCacheId": c.rapidCacheId, + }) + c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "storage.rapidCaches.update", "request", internallog.HTTPRequest(req, body.Bytes())) + return gensupport.SendRequest(c.ctx_, c.s.client, req) +} + +// Do executes the "storage.rapidCaches.update" call. +// Any non-2xx status code is an error. Response headers are in either +// *GoogleLongrunningOperation.ServerResponse.Header or (if a response was +// returned at all) in error.(*googleapi.Error).Header. Use +// googleapi.IsNotModified to check whether the returned error was because +// http.StatusNotModified was returned. +func (c *RapidCachesUpdateCall) Do(opts ...googleapi.CallOption) (*GoogleLongrunningOperation, error) { + gensupport.SetOptions(c.urlParams_, opts...) + res, err := c.doRequest("json") + if res != nil && res.StatusCode == http.StatusNotModified { + if res.Body != nil { + res.Body.Close() + } + return nil, gensupport.WrapError(&googleapi.Error{ + Code: res.StatusCode, + Header: res.Header, + }) + } + if err != nil { + return nil, err + } + defer googleapi.CloseBody(res) + if err := googleapi.CheckResponse(res); err != nil { + return nil, gensupport.WrapError(err) + } + ret := &GoogleLongrunningOperation{ + ServerResponse: googleapi.ServerResponse{ + Header: res.Header, + HTTPStatusCode: res.StatusCode, + }, + } + target := &ret + b, err := gensupport.DecodeResponseBytes(target, res) + if err != nil { + return nil, err + } + c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "storage.rapidCaches.update", "response", internallog.HTTPResponse(res, b)) + return ret, nil +} diff --git a/vendor/google.golang.org/api/transport/grpc/dial.go b/vendor/google.golang.org/api/transport/grpc/dial.go index d0a4aca36e..7c6bf402b7 100644 --- a/vendor/google.golang.org/api/transport/grpc/dial.go +++ b/vendor/google.golang.org/api/transport/grpc/dial.go @@ -230,7 +230,7 @@ func dialPoolNewAuth(ctx context.Context, secure bool, poolSize int, ds *interna SkipValidation: skipValidation, TelemetryAttributes: ds.TelemetryAttributes, }, - UniverseDomain: ds.UniverseDomain, + UniverseDomain: ds.GetUniverseDomain(), Logger: ds.Logger, }) return pool, err diff --git a/vendor/google.golang.org/api/transport/http/dial.go b/vendor/google.golang.org/api/transport/http/dial.go index bd44cfa057..02a8a7410f 100644 --- a/vendor/google.golang.org/api/transport/http/dial.go +++ b/vendor/google.golang.org/api/transport/http/dial.go @@ -135,7 +135,7 @@ func newClientNewAuth(ctx context.Context, base http.RoundTripper, ds *internal. SkipValidation: skipValidation, TelemetryAttributes: ds.TelemetryAttributes, }, - UniverseDomain: ds.UniverseDomain, + UniverseDomain: ds.GetUniverseDomain(), Logger: ds.Logger, }) if err != nil { diff --git a/vendor/google.golang.org/grpc/clientconn.go b/vendor/google.golang.org/grpc/clientconn.go index c4bca5203e..b27c7e84a3 100644 --- a/vendor/google.golang.org/grpc/clientconn.go +++ b/vendor/google.golang.org/grpc/clientconn.go @@ -24,12 +24,10 @@ import ( "fmt" "math" "net/url" - "os" "slices" "strings" "sync" "sync/atomic" - "syscall" "time" "google.golang.org/grpc/balancer" @@ -1573,26 +1571,13 @@ func (ac *addrConn) createTransport(ctx context.Context, addr resolver.Address, // to the provided transport.GoAwayInfo, as specified by gRFC A94: // https://github.com/grpc/proposal/blob/master/A94-grpc-subchannel-disconnections-metrics.md func disconnectErrorString(info transport.GoAwayInfo) string { - err := info.Err - var sysErr syscall.Errno - switch { - case info.Reason != transport.GoAwayInvalid: + if info.Reason != transport.GoAwayInvalid { return fmt.Sprintf("GOAWAY %s", info.GoAwayCode.String()) - case err == nil: - return "unknown" - case errors.Is(err, context.Canceled): - return "subchannel shutdown" - case errors.Is(err, syscall.ECONNRESET): - return "connection reset" - case errors.Is(err, syscall.ETIMEDOUT), errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded): - return "connection timed out" - case errors.Is(err, syscall.ECONNABORTED): - return "connection aborted" - case errors.As(err, &sysErr): - return "socket error" - default: + } + if info.Err == nil { return "unknown" } + return disconnectErrorLabel(info.Err) } // startHealthCheck starts the health checking stream (RPC) to watch the health diff --git a/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go b/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go new file mode 100644 index 0000000000..f0fcd88423 --- /dev/null +++ b/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go @@ -0,0 +1,48 @@ +//go:build !plan9 + +/* + * + * Copyright 2026 gRPC authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +package grpc + +import ( + "context" + "errors" + "os" + "syscall" +) + +// disconnectErrorLabel returns the grpc.disconnect_error metric label for a +// transport error, as specified by gRFC A94. +func disconnectErrorLabel(err error) string { + var sysErr syscall.Errno + switch { + case errors.Is(err, context.Canceled): + return "subchannel shutdown" + case errors.Is(err, syscall.ECONNRESET): + return "connection reset" + case errors.Is(err, syscall.ETIMEDOUT), errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded): + return "connection timed out" + case errors.Is(err, syscall.ECONNABORTED): + return "connection aborted" + case errors.As(err, &sysErr): + return "socket error" + default: + return "unknown" + } +} diff --git a/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go b/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go new file mode 100644 index 0000000000..930b12664c --- /dev/null +++ b/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go @@ -0,0 +1,39 @@ +/* + * + * Copyright 2026 gRPC authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +package grpc + +import ( + "context" + "errors" + "os" +) + +// disconnectErrorLabel returns the grpc.disconnect_error metric label for a +// transport error, as specified by gRFC A94. syscall.Errno does not exist on +// plan9, so only the portable classifications are available. +func disconnectErrorLabel(err error) string { + switch { + case errors.Is(err, context.Canceled): + return "subchannel shutdown" + case errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded): + return "connection timed out" + default: + return "unknown" + } +} diff --git a/vendor/google.golang.org/grpc/credentials/alts/internal/conn/record.go b/vendor/google.golang.org/grpc/credentials/alts/internal/conn/record.go index 89bf22691e..022416b260 100644 --- a/vendor/google.golang.org/grpc/credentials/alts/internal/conn/record.go +++ b/vendor/google.golang.org/grpc/credentials/alts/internal/conn/record.go @@ -257,6 +257,9 @@ func (p *conn) ReadOnReady(bufSize int, pool mem.BufferPool) (*[]byte, int, erro } // Now we have a complete frame, decrypted it. msg := framedMsg[MsgLenFieldSize:] + if len(msg) < msgTypeFieldSize { + return nil, 0, fmt.Errorf("received frame with size %v which is shorter than message type field size %v", len(msg), msgTypeFieldSize) + } msgType := binary.LittleEndian.Uint32(msg[:msgTypeFieldSize]) if msgType&0xff != altsRecordMsgType { return nil, 0, fmt.Errorf("received frame with incorrect message type %v, expected lower byte %v", diff --git a/vendor/google.golang.org/grpc/credentials/google/gcp_service_account_identity_credentials.go b/vendor/google.golang.org/grpc/credentials/google/gcp_service_account_identity_credentials.go new file mode 100644 index 0000000000..160ec81dc3 --- /dev/null +++ b/vendor/google.golang.org/grpc/credentials/google/gcp_service_account_identity_credentials.go @@ -0,0 +1,278 @@ +/* +* +* Copyright 2026 gRPC authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +* + */ + +package google + +import ( + "context" + "errors" + "fmt" + "sync" + "time" + + "cloud.google.com/go/auth" + "cloud.google.com/go/auth/credentials/idtoken" + "cloud.google.com/go/compute/metadata" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/credentials" + "google.golang.org/grpc/credentials/google/internal" + "google.golang.org/grpc/internal/backoff" + "google.golang.org/grpc/internal/transport" + "google.golang.org/grpc/status" +) + +const ( + // preemptiveRefresh is the window before a token's actual expiration during + // which the token is considered stale. Requests using a stale but still + // valid token will trigger a background asynchronous refresh. This avoids + // blocking the current RPC, preventing periodic latency spikes during token + // refresh. + preemptiveRefresh = 1 * time.Minute + + // metadataTimeout is the timeout for the call to the metadata server to + // prevent the background token fetch from hanging indefinitely in case + // of connection issues. + metadataTimeout = 60 * time.Second +) + +type gcpServiceAccountIdentityCallCreds struct { + // The following fields are initialized at creation time and are read-only + // after that. + ctx context.Context + audience string + creds *auth.Credentials + backoff backoff.Strategy + + // The following fields are protected by mu. + mu sync.Mutex + token *auth.Token + tokenExpiry time.Time // timestamp after which the cached token is considered invalid + preemptiveTokenRefresh time.Time // timestamp after which background preemptive refresh is triggered + fetching chan struct{} // used to ensure a single in-progress background token fetch + nextRetryTime time.Time // timestamp after which we can attempt the next token fetch + retryAttempt int // consecutive fetch failure count used to compute backoff delay + lastErr error // cached error returned from the most recent token fetch attempt +} + +func init() { + internal.BackoffStrategy = backoff.DefaultExponential + internal.NewIDTokenCredentials = func(opts *idtoken.Options) (*auth.Credentials, error) { + return idtoken.NewCredentials(opts) + } +} + +// NewServiceAccountIdentityCredentials creates a PerRPCCredentials that +// authenticates using a GCP Service Account Identity JWT token for the given +// audience. +// +// This credential fetches the ID token from the GCE metadata server and is +// only valid for use in environments running on GCP. The ctx and audience +// parameters cannot be empty. +// +// The credentials object starts asynchronous background token fetches to +// refresh expired tokens. The provided context propagates cancellation to +// these background tasks. Users should not pass an RPC-scoped context here, +// but rather a context that is valid for the entire lifetime of the +// credentials and should cancel the context when they are done. +// +// # Experimental +// +// Notice: This API is EXPERIMENTAL and may be changed or removed in a +// later release. +func NewServiceAccountIdentityCredentials(ctx context.Context, audience string) (credentials.PerRPCCredentials, error) { + if ctx == nil { + return nil, fmt.Errorf("credentials: ctx cannot be nil") + } + + if audience == "" { + return nil, fmt.Errorf("credentials: audience cannot be empty") + } + + creds, err := internal.NewIDTokenCredentials(&idtoken.Options{Audience: audience}) + if err != nil { + return nil, fmt.Errorf("credentials: failed to create ID token credentials: %v", err) + } + + return &gcpServiceAccountIdentityCallCreds{ + ctx: ctx, + audience: audience, + creds: creds, + backoff: internal.BackoffStrategy, + }, nil +} + +// GetRequestMetadata gets the current request metadata, refreshing tokens if +// required. This implementation follows the PerRPCCredentials interface. +// +// It guarantees that only one underlying token fetch will be executed +// concurrently. If a valid token is cached, it is returned immediately. If +// a fetch recently failed, the cached error is returned until the backoff +// interval expires. Otherwise, it initiates a new token fetch or blocks +// waiting for an already-in-progress fetch to complete. +func (c *gcpServiceAccountIdentityCallCreds) GetRequestMetadata(ctx context.Context, _ ...string) (map[string]string, error) { + ri, _ := credentials.RequestInfoFromContext(ctx) + if err := credentials.CheckSecurityLevel(ri.AuthInfo, credentials.PrivacyAndIntegrity); err != nil { + return nil, fmt.Errorf("credentials: cannot send secure credentials on an insecure connection: %v", err) + } + + if md, err := c.cachedRequestMetadata(true); md != nil || err != nil { + return md, err + } + + c.mu.Lock() + // Now that we have the lock, did someone else finish the fetch while we + // were waiting for the lock? + md, err := c.cachedRequestMetadataLocked(false) + if md != nil || err != nil { + c.mu.Unlock() + return md, err + } + + // If no one is fetching, start it. + if c.fetching == nil { + c.fetching = make(chan struct{}) + go c.startFetch() + } + wait := c.fetching + c.mu.Unlock() + + select { + case <-wait: + // Return the new cached result from the most recent fetch. + md, err := c.cachedRequestMetadata(false) + if md == nil && err == nil { + return nil, status.Error(codes.Unavailable, "credentials: fetched token is expired") + } + return md, err + case <-ctx.Done(): + return nil, ctx.Err() + } +} + +// cachedRequestMetadata handles its own locking for the "fast path". +func (c *gcpServiceAccountIdentityCallCreds) cachedRequestMetadata(attemptPreemptiveRefresh bool) (map[string]string, error) { + c.mu.Lock() + defer c.mu.Unlock() + return c.cachedRequestMetadataLocked(attemptPreemptiveRefresh) +} + +// cachedRequestMetadataLocked returns the cached token if it is valid, or nil +// if it is not. If attemptPreemptiveRefresh is true, it will also trigger a +// background refresh if the token is stale but still valid. It returns the +// cached error if the last fetch failed and the backoff interval has not +// expired. +// +// Returns (nil, nil) if the token is not valid and a new fetch is required. The +// caller is responsible for initiating the fetch or waiting for an in-progress +// fetch to complete. +// +// It must be called with mu locked. +func (c *gcpServiceAccountIdentityCallCreds) cachedRequestMetadataLocked(attemptPreemptiveRefresh bool) (map[string]string, error) { + if c.token != nil && c.isTokenValidLocked() { + if attemptPreemptiveRefresh && c.isTokenStaleLocked() && c.fetching == nil { + c.fetching = make(chan struct{}) + go c.startFetch() + } + + return map[string]string{"authorization": "Bearer " + c.token.Value}, nil + } + + if c.lastErr != nil && time.Now().Before(c.nextRetryTime) { + return nil, c.lastErr + } + + return nil, nil +} + +// RequireTransportSecurity indicates whether the credentials requires +// transport security. +func (c *gcpServiceAccountIdentityCallCreds) RequireTransportSecurity() bool { + return true +} + +// isTokenStaleLocked checks if the token falls within the +// preemptiveRefresh window. It must be called with mu locked. +func (c *gcpServiceAccountIdentityCallCreds) isTokenStaleLocked() bool { + return c.preemptiveTokenRefresh.Before(time.Now()) +} + +// isTokenValidLocked checks if the token is not expired yet. It must be called +// with mu locked. +func (c *gcpServiceAccountIdentityCallCreds) isTokenValidLocked() bool { + return c.tokenExpiry.After(time.Now()) +} + +// startFetch initiates a token fetch and updates the credential +// state upon completion. +func (c *gcpServiceAccountIdentityCallCreds) startFetch() { + ctx, cancel := context.WithTimeout(c.ctx, metadataTimeout) + defer cancel() + token, err := c.creds.TokenProvider.Token(ctx) + + c.mu.Lock() + defer c.mu.Unlock() + + close(c.fetching) + c.fetching = nil + c.updateStateLocked(token, err) +} + +// updateStateLocked updates the credentials local token cache and +// backoff state based on the outcome of a background fetch attempt. +// +// If the fetch succeeded, the cached token is updated, and the backoff timers +// and error are reset. +// +// If the fetch failed, backoff attempts are calculated and the error is mapped +// to a gRPC status. +// - If the HTTP request fails with a status that maps to gRPC UNAVAILABLE +// according to HTTP to gRPC status code mappings, it returns UNAVAILABLE. +// - All other HTTP error status codes map to UNAUTHENTICATED. +// - Non-HTTP request failures are mapped to UNAVAILABLE. +// +// It must be called with mu locked. +func (c *gcpServiceAccountIdentityCallCreds) updateStateLocked(token *auth.Token, err error) { + if err != nil { + var mappedErr error + var metadataErr *metadata.Error + if errors.As(err, &metadataErr) { + switch transport.HTTPStatusConvTab[metadataErr.Code] { + case codes.Unavailable: + mappedErr = status.Errorf(codes.Unavailable, "credentials: failed to fetch token from metadata server: %v", err) + default: + mappedErr = status.Errorf(codes.Unauthenticated, "credentials: failed to fetch token from metadata server: %v", err) + } + } else { + mappedErr = status.Errorf(codes.Unavailable, "credentials: failed to fetch ID token: %v", err) + } + + c.lastErr = mappedErr + backoffDelay := c.backoff.Backoff(c.retryAttempt) + c.retryAttempt++ + c.nextRetryTime = time.Now().Add(backoffDelay) + return + } + c.lastErr = nil + c.retryAttempt = 0 + c.nextRetryTime = time.Time{} + c.token = token + // Per gRFC A83, the cached token is considered invalid 30 seconds before its + // actual expiration time to accommodate for clock skew. + c.tokenExpiry = token.Expiry.Add(-30 * time.Second) + c.preemptiveTokenRefresh = c.tokenExpiry.Add(-preemptiveRefresh) +} diff --git a/vendor/google.golang.org/grpc/credentials/google/internal/internal.go b/vendor/google.golang.org/grpc/credentials/google/internal/internal.go new file mode 100644 index 0000000000..9557d264d2 --- /dev/null +++ b/vendor/google.golang.org/grpc/credentials/google/internal/internal.go @@ -0,0 +1,35 @@ +/* +* +* Copyright 2026 gRPC authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +* + */ + +// Package internal contains functionality internal to the google package. +package internal + +import ( + "cloud.google.com/go/auth" + "cloud.google.com/go/auth/credentials/idtoken" + "google.golang.org/grpc/internal/backoff" +) + +// The following variables are overridden in tests. +var ( + // BackoffStrategy is the backoff strategy to use when token fetch fails. + BackoffStrategy backoff.Strategy + + // NewIDTokenCredentials builds idtoken credentials using specified options. + NewIDTokenCredentials func(opts *idtoken.Options) (*auth.Credentials, error) +) diff --git a/vendor/google.golang.org/grpc/internal/credentials/xds/handshake_info.go b/vendor/google.golang.org/grpc/internal/credentials/xds/handshake_info.go index 637254eb42..404b9cc9e2 100644 --- a/vendor/google.golang.org/grpc/internal/credentials/xds/handshake_info.go +++ b/vendor/google.golang.org/grpc/internal/credentials/xds/handshake_info.go @@ -210,6 +210,9 @@ func (hi *HandshakeInfo) ClientSideTLSConfig(ctx context.Context, hostname strin func (hi *HandshakeInfo) buildVerifyFunc(km *certprovider.KeyMaterial, isClient bool, sni string) func(rawCerts [][]byte, _ [][]*x509.Certificate) error { return func(rawCerts [][]byte, _ [][]*x509.Certificate) error { + if len(rawCerts) == 0 { + return fmt.Errorf("xds: no peer certificates presented") + } // Parse all raw certificates presented by the peer. var certs []*x509.Certificate for _, rc := range rawCerts { diff --git a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go index 29d332e7b6..3334481274 100644 --- a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go +++ b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go @@ -150,8 +150,18 @@ var ( // throttling limit if unforeseen issues arise, and it will be removed in a // future release. // - // TODO: Remove this env var once v1.83.0 is release. + // TODO: Remove this env var once v1.83.0 is released. ControlBufferThrottleLimit = uint64FromEnv("GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT", 100, 1, 10000) + + // EnableReceiveBufferCompaction enables the compaction of data buffers + // to reduce the number of buffers in the receive buffer. + // + // This environment variable serves as an escape hatch to disable the + // feature if unforeseen issues arise, and it will be removed in a future + // release. + // + // TODO: Remove this env var once v1.85.0 is released. + EnableReceiveBufferCompaction = boolFromEnv("GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION", true) ) func boolFromEnv(envVar string, def bool) bool { diff --git a/vendor/google.golang.org/grpc/internal/envconfig/xds.go b/vendor/google.golang.org/grpc/internal/envconfig/xds.go index a2312f8eac..e4b6919138 100644 --- a/vendor/google.golang.org/grpc/internal/envconfig/xds.go +++ b/vendor/google.golang.org/grpc/internal/envconfig/xds.go @@ -69,9 +69,8 @@ var ( // https://github.com/grpc/proposal/blob/master/A87-mtls-spiffe-support.md XDSSPIFFEEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_MTLS_SPIFFE", false) - // XDSHTTPConnectEnabled is true if gRPC should parse custom Metadata - // configuring use of an HTTP CONNECT proxy via xDS from cluster resources. - // For more details, see: + // XDSHTTPConnectEnabled controls support for dynamic HTTP CONNECT proxying + // configured via the xDS control plane. For more details, see: // https://github.com/grpc/proposal/blob/master/A86-xds-http-connect.md XDSHTTPConnectEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT", false) @@ -88,7 +87,7 @@ var ( // XDSORCAToLRSPropEnabled controls whether ORCA metrics are explicitly // filtered and prefix-propagated to the LRS server. For more details, see: // https://github.com/grpc/proposal/blob/master/A85-lrs-custom-metrics-changes.md - XDSORCAToLRSPropEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION", false) + XDSORCAToLRSPropEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION", true) // XDSClientExtProcEnabled indicates whether ExtProc filter is enabled on // the client side. For more details, see: diff --git a/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go b/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go index 9b6d8a1fa3..d4999fcca8 100644 --- a/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go +++ b/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go @@ -20,10 +20,15 @@ package grpcsync import ( "context" + "errors" "google.golang.org/grpc/internal/buffer" ) +// ErrSerializerClosed is returned by ScheduleAndWait if the CallbackSerializer +// was closed before the callback could be scheduled. +var ErrSerializerClosed = errors.New("callback serializer is closed") + // CallbackSerializer provides a mechanism to schedule callbacks in a // synchronized manner. It provides a FIFO guarantee on the order of execution // of scheduled callbacks. New callbacks can be scheduled by invoking the @@ -77,6 +82,27 @@ func (cs *CallbackSerializer) ScheduleOr(f func(ctx context.Context), onFailure } } +// ScheduleAndWait schedules the provided callback function f to be executed in +// the order it was added and blocks until f has run. If the context passed to +// NewCallbackSerializer was canceled before this method is called, f is not run +// and ScheduleAndWait returns ErrSerializerClosed. +// +// Callbacks are expected to honor the context when performing any blocking +// operations, and should return early when the context is canceled. +func (cs *CallbackSerializer) ScheduleAndWait(f func(ctx context.Context)) error { + done := make(chan struct{}) + var err error + cs.ScheduleOr(func(ctx context.Context) { + f(ctx) + close(done) + }, func() { + err = ErrSerializerClosed + close(done) + }) + <-done + return err +} + func (cs *CallbackSerializer) run(ctx context.Context) { defer close(cs.done) diff --git a/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go b/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go index 2d83b2eced..00aeca419f 100644 --- a/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go +++ b/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go @@ -26,12 +26,26 @@ import ( "slices" "sort" "sync" + + "google.golang.org/grpc/internal" ) const ( goPageSize = 4 * 1024 // 4KiB. N.B. this must be a power of 2. ) +var ( + // BufferPoolingThreshold is the minimum size of a buffer that can be pooled. + // This is used to determine whether to pool buffers or allocate them directly. + BufferPoolingThreshold = 1 << 10 +) + +func init() { + internal.SetBufferPoolingThresholdForTesting = func(threshold int) { + BufferPoolingThreshold = threshold + } +} + var uintSize = bits.UintSize // use a variable for mocking during tests. // bufferPool is a copy of the public bufferPool interface used to avoid diff --git a/vendor/google.golang.org/grpc/internal/resolver/config_selector.go b/vendor/google.golang.org/grpc/internal/resolver/config_selector.go index 6320e9b576..238950bbbf 100644 --- a/vendor/google.golang.org/grpc/internal/resolver/config_selector.go +++ b/vendor/google.golang.org/grpc/internal/resolver/config_selector.go @@ -24,7 +24,6 @@ import ( "sync" "google.golang.org/grpc/internal/serviceconfig" - "google.golang.org/grpc/metadata" "google.golang.org/grpc/resolver" ) @@ -52,82 +51,7 @@ type RPCConfig struct { Context context.Context MethodConfig serviceconfig.MethodConfig // configuration to use for this RPC OnCommitted func() // Called when the RPC has been committed (retries no longer possible) - Interceptor ClientInterceptor -} - -// ClientStream is the same as grpc.ClientStream, but defined here for circular -// dependency reasons. -type ClientStream interface { - // Header returns the header metadata received from the server if there - // is any. It blocks if the metadata is not ready to read. - Header() (metadata.MD, error) - // Trailer returns the trailer metadata from the server, if there is any. - // It must only be called after stream.CloseAndRecv has returned, or - // stream.Recv has returned a non-nil error (including io.EOF). - Trailer() metadata.MD - // CloseSend closes the send direction of the stream. It closes the stream - // when non-nil error is met. It is also not safe to call CloseSend - // concurrently with SendMsg. - CloseSend() error - // Context returns the context for this stream. - // - // It should not be called until after Header or RecvMsg has returned. Once - // called, subsequent client-side retries are disabled. - Context() context.Context - // SendMsg is generally called by generated code. On error, SendMsg aborts - // the stream. If the error was generated by the client, the status is - // returned directly; otherwise, io.EOF is returned and the status of - // the stream may be discovered using RecvMsg. - // - // SendMsg blocks until: - // - There is sufficient flow control to schedule m with the transport, or - // - The stream is done, or - // - The stream breaks. - // - // SendMsg does not wait until the message is received by the server. An - // untimely stream closure may result in lost messages. To ensure delivery, - // users should ensure the RPC completed successfully using RecvMsg. - // - // It is safe to have a goroutine calling SendMsg and another goroutine - // calling RecvMsg on the same stream at the same time, but it is not safe - // to call SendMsg on the same stream in different goroutines. It is also - // not safe to call CloseSend concurrently with SendMsg. - SendMsg(m any) error - // RecvMsg blocks until it receives a message into m or the stream is - // done. It returns io.EOF when the stream completes successfully. On - // any other error, the stream is aborted and the error contains the RPC - // status. - // - // It is safe to have a goroutine calling SendMsg and another goroutine - // calling RecvMsg on the same stream at the same time, but it is not - // safe to call RecvMsg on the same stream in different goroutines. - RecvMsg(m any) error -} - -// ClientInterceptor is an interceptor for gRPC client streams. -type ClientInterceptor interface { - // NewStream creates a ClientStream for an RPC. - // - // Implementations must delegate stream creation to the provided newStream - // function. To intercept or override stream behavior, implementations - // may wrap the ClientStream returned by the delegate. - // - // Note: RPCInfo.Context is currently unused and will be nil. - // - // The done function is invoked when the RPC has finished using its - // underlying connection or if a connection could not be assigned. Because - // interceptors operate at the application layer, RPC operations may - // continue on the ClientStream even after done has been called. The - // caller must ensure done is non-nil. - // - // To ensure RPC completion notifications propagate through the entire - // interceptor chain, implementations must ensure that the done function - // passed to the delegate newStream invokes the done function passed to - // NewStream. - NewStream(ctx context.Context, ri RPCInfo, done func(), newStream func(ctx context.Context, done func()) (ClientStream, error)) (ClientStream, error) - // Close closes the interceptor. Once called, no new calls to NewStream are - // accepted. Ongoing calls to NewStream are allowed to complete. - Close() + Interceptor any } // ServerInterceptor is an interceptor for incoming RPC's on gRPC server side. diff --git a/vendor/google.golang.org/grpc/internal/transport/client_stream.go b/vendor/google.golang.org/grpc/internal/transport/client_stream.go index ad382b0fda..046f0a5557 100644 --- a/vendor/google.golang.org/grpc/internal/transport/client_stream.go +++ b/vendor/google.golang.org/grpc/internal/transport/client_stream.go @@ -39,9 +39,8 @@ const nonGRPCDataMaxLen = 1024 type ClientStream struct { Stream // Embed for common stream functionality. - ct *http2Client - done chan struct{} // closed at the end of stream to unblock writers. - doneFunc func() // invoked at the end of stream. + ct *http2Client + done chan struct{} // closed at the end of stream to unblock writers. headerChan chan struct{} // closed to indicate the end of header metadata. header metadata.MD // the received header metadata diff --git a/vendor/google.golang.org/grpc/internal/transport/handler_server.go b/vendor/google.golang.org/grpc/internal/transport/handler_server.go index a8356c9adb..9cd8d28d33 100644 --- a/vendor/google.golang.org/grpc/internal/transport/handler_server.go +++ b/vendor/google.golang.org/grpc/internal/transport/handler_server.go @@ -424,7 +424,7 @@ func (ht *serverHandlerTransport) HandleStreams(ctx context.Context, startStream st: ht, headerWireLength: 0, // won't have access to header wire length until golang/go#18997. } - s.Stream.buf.init() + s.Stream.buf.init(ht.bufferPool) s.readRequester = s s.trReader = transportReader{ reader: recvBufferReader{ctx: s.ctx, ctxDone: s.ctx.Done(), recv: &s.buf}, diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_client.go b/vendor/google.golang.org/grpc/internal/transport/http2_client.go index 822c09ba62..10d1977415 100644 --- a/vendor/google.golang.org/grpc/internal/transport/http2_client.go +++ b/vendor/google.golang.org/grpc/internal/transport/http2_client.go @@ -498,10 +498,9 @@ func (t *http2Client) newStream(ctx context.Context, callHdr *CallHdr, handler s ct: t, done: make(chan struct{}), headerChan: make(chan struct{}), - doneFunc: callHdr.DoneFunc, statsHandler: handler, } - s.Stream.buf.init() + s.Stream.buf.init(t.bufferPool) s.Stream.wq.init(defaultWriteQuota, s.done) s.readRequester = s // The client side stream context should have exactly the same life cycle with the user provided context. @@ -998,9 +997,6 @@ func (t *http2Client) closeStream(s *ClientStream, err error, rst bool, rstCode t.controlBuf.executeAndPut(addBackStreamQuota, cleanup) // This will unblock write. close(s.done) - if s.doneFunc != nil { - s.doneFunc() - } } // Close kicks off the shutdown process of the transport. This should be called diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/vendor/google.golang.org/grpc/internal/transport/http2_server.go index 8e9cbd37d8..82e13e64aa 100644 --- a/vendor/google.golang.org/grpc/internal/transport/http2_server.go +++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go @@ -407,7 +407,7 @@ func (t *http2Server) operateHeaders(ctx context.Context, frame *http2.MetaHeade st: t, headerWireLength: int(frame.Header().Length), } - s.Stream.buf.init() + s.Stream.buf.init(t.bufferPool) var ( // if false, content-type was missing or invalid isGRPC = false diff --git a/vendor/google.golang.org/grpc/internal/transport/transport.go b/vendor/google.golang.org/grpc/internal/transport/transport.go index 6dfae39849..5fc901e5cf 100644 --- a/vendor/google.golang.org/grpc/internal/transport/transport.go +++ b/vendor/google.golang.org/grpc/internal/transport/transport.go @@ -30,11 +30,14 @@ import ( "sync" "sync/atomic" "time" + "unsafe" "golang.org/x/net/http2" "google.golang.org/grpc/codes" "google.golang.org/grpc/credentials" "google.golang.org/grpc/internal/channelz" + "google.golang.org/grpc/internal/envconfig" + imem "google.golang.org/grpc/internal/mem" "google.golang.org/grpc/internal/transport/internal" "google.golang.org/grpc/keepalive" "google.golang.org/grpc/mem" @@ -45,7 +48,30 @@ import ( "google.golang.org/grpc/tap" ) -const logLevel = 2 +const ( + logLevel = 2 + // recvMsgSize estimates the memory overhead of a recvMsg in the backlog. + // It accounts for the recvMsg struct itself and the slice header of the + // underlying buffer's data. + recvMsgSize = int(unsafe.Sizeof(recvMsg{}) + unsafe.Sizeof([]byte{})) + + // utilizationFactor controls when we consider memory utilization acceptable. + // When backlogHeapSize / payloadSize <= utilizationFactor (meaning at least + // 50% of the heap memory is actual payload data), compaction is skipped. + utilizationFactor = 2 +) + +var ( + // compactionThreshold is approx 57KB (on 64-bit systems). It allows + // accumulating up to 1024 1-byte payloads before triggering compaction. + // + // Because individual payloads <= 1024 bytes are allocated on the heap + // outside mem.BufferPool, waiting for at least 1024 bytes to accumulate + // ensures that compaction coalesces those small heap allocations into a + // single large buffer from mem.BufferPool, enabling buffer reuse while + // avoiding frequent copying for small bursts of frames. + compactionThreshold = imem.BufferPoolingThreshold * (recvMsgSize + 1) +) func init() { internal.TimeNowFunc = func() int64 { return time.Now().UnixNano() } @@ -71,23 +97,31 @@ type recvBuffer struct { c chan recvMsg mu sync.Mutex backlog []recvMsg - err error + // uncompactedSuffixLen tracks the number of consecutive data messages at + // the tail of backlog that have not been compacted. + uncompactedSuffixLen int + // uncompactedBytes tracks the total payload bytes across the trailing + // uncompactedSuffixLen messages. + uncompactedBytes int + err error + bufPool mem.BufferPool } // init allows a recvBuffer to be initialized in-place, which is useful // for resetting a buffer or for avoiding a heap allocation when the buffer // is embedded in another struct. -func (b *recvBuffer) init() { +func (b *recvBuffer) init(pool mem.BufferPool) { b.c = make(chan recvMsg, 1) + b.bufPool = pool } func (b *recvBuffer) put(r recvMsg) { b.mu.Lock() + defer b.mu.Unlock() if b.err != nil { // drop the buffer on the floor. Since b.err is not nil, any subsequent reads // will always return an error, making this buffer inaccessible. r.buffer.Free() - b.mu.Unlock() // An error had occurred earlier, don't accept more // data or errors. return @@ -96,13 +130,70 @@ func (b *recvBuffer) put(r recvMsg) { if len(b.backlog) == 0 { select { case b.c <- r: - b.mu.Unlock() return default: } } b.backlog = append(b.backlog, r) - b.mu.Unlock() + b.compactBacklogLocked(r) +} + +func (b *recvBuffer) compactBacklogLocked(r recvMsg) { + if !envconfig.EnableReceiveBufferCompaction { + return + } + if r.buffer == nil { + b.uncompactedBytes = 0 + b.uncompactedSuffixLen = 0 + return + } + + b.uncompactedSuffixLen++ + b.uncompactedBytes += r.buffer.Len() + backlogHeapSize := b.uncompactedSuffixLen*recvMsgSize + b.uncompactedBytes + + // If the memory overhead is less than 50% of the heap usage (e.g., because + // a large DATA frame arrived), the average message size in the suffix is + // large enough that memory bloat is not a concern. Reset suffix tracking. + if backlogHeapSize <= utilizationFactor*b.uncompactedBytes { + b.uncompactedBytes = 0 + b.uncompactedSuffixLen = 0 + return + } + // Avoid compacting too frequently for short bursts of small frames. + // Wait until we have accumulated at least ~1024 small messages (~57 KB). + if backlogHeapSize <= compactionThreshold { + // Still can accumulate more payloads. + return + } + + // Since the memory utilization is less than 50%, the average payload size + // of each recvMsg must be less than recvMsgSize (approx 56 bytes). + // In the worst case for bytes copied (where the average payload is just + // below recvMsgSize), compaction will occur once every: + // compactionThreshold / (recvMsgSize + avg_payload) = ~520 messages, + // copying ~29KB of data. + + start := 0 + newBuf := b.bufPool.Get(b.uncompactedBytes) + startIdx := len(b.backlog) - b.uncompactedSuffixLen + + for i := startIdx; i < len(b.backlog); i++ { + m := b.backlog[i] + b.backlog[i] = recvMsg{} + start += copy((*newBuf)[start:], m.buffer.ReadOnlyData()) + m.buffer.Free() + } + b.backlog[startIdx] = recvMsg{ + buffer: mem.NewBuffer(newBuf, b.bufPool), + } + b.backlog = b.backlog[:startIdx+1] + // After compaction, the suffix is replaced with a single message containing + // the combined payload. The new utilization is close to 1.0 (overhead of + // one recvMsg relative to the large compacted payload), which is well + // below the utilization factor of 2. + b.uncompactedBytes = 0 + b.uncompactedSuffixLen = 0 } func (b *recvBuffer) load() { @@ -110,6 +201,13 @@ func (b *recvBuffer) load() { if len(b.backlog) > 0 { select { case b.c <- b.backlog[0]: + // backlog[0] is only part of the tracked uncompacted suffix if the + // entire backlog currently consists of the suffix. If an earlier + // compaction or reset occurred, backlog[0] is already compacted. + if envconfig.EnableReceiveBufferCompaction && b.uncompactedSuffixLen == len(b.backlog) { + b.uncompactedSuffixLen-- + b.uncompactedBytes -= b.backlog[0].buffer.Len() + } b.backlog[0] = recvMsg{} b.backlog = b.backlog[1:] default: @@ -594,8 +692,6 @@ type CallHdr struct { PreviousAttempts int // value of grpc-previous-rpc-attempts header to set - DoneFunc func() // called when the stream is finished - // Authority is used to explicitly override the `:authority` header. // // This value comes from one of two sources: diff --git a/vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go b/vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go index 336d240004..6efeeb14b6 100644 --- a/vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go +++ b/vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go @@ -28,6 +28,7 @@ import ( "google.golang.org/grpc/experimental/balancer/weight" "google.golang.org/grpc/internal/envconfig" "google.golang.org/grpc/internal/hierarchy" + "google.golang.org/grpc/internal/proxyattributes" internalserviceconfig "google.golang.org/grpc/internal/serviceconfig" xdsinternal "google.golang.org/grpc/internal/xds" "google.golang.org/grpc/internal/xds/balancer/clusterimpl" @@ -294,6 +295,24 @@ func priorityLocalitiesToClusterImpl(localities []xdsresource.Locality, priority resolverEndpoint := endpoint.ResolverEndpoint resolverEndpoint.Addresses = slices.Clone(endpoint.ResolverEndpoint.Addresses) + if clusterUpdate.IsHTTP11ProxyEnabled { + var proxyAddrStr string + if val, ok := endpoint.Metadata["envoy.http11_proxy_transport_socket.proxy_address"].(xdsresource.ProxyAddressMetadataValue); ok { + proxyAddrStr = val.Address + } else if val, ok := locality.Metadata["envoy.http11_proxy_transport_socket.proxy_address"].(xdsresource.ProxyAddressMetadataValue); ok { + proxyAddrStr = val.Address + } + if proxyAddrStr != "" { + for idx, addr := range resolverEndpoint.Addresses { + connectAddr := addr.Addr + addr.Addr = proxyAddrStr + resolverEndpoint.Addresses[idx] = proxyattributes.Set(addr, proxyattributes.Options{ + ConnectAddr: connectAddr, + }) + } + } + } + resolverEndpoint = hierarchy.SetInEndpoint(resolverEndpoint, []string{priorityName, localityStr}) resolverEndpoint = xdsinternal.SetLocalityIDInEndpoint(resolverEndpoint, locality.ID) // "To provide the xds_wrr_locality load balancer information about diff --git a/vendor/google.golang.org/grpc/internal/xds/balancer/clustermanager/picker.go b/vendor/google.golang.org/grpc/internal/xds/balancer/clustermanager/picker.go index 015cd2b7af..97a167075b 100644 --- a/vendor/google.golang.org/grpc/internal/xds/balancer/clustermanager/picker.go +++ b/vendor/google.golang.org/grpc/internal/xds/balancer/clustermanager/picker.go @@ -43,7 +43,7 @@ func newPickerGroup(idToPickerState map[string]*subBalancerState) *pickerGroup { } func (pg *pickerGroup) Pick(info balancer.PickInfo) (balancer.PickResult, error) { - cluster := getPickedCluster(info.Ctx) + cluster := PickedCluster(info.Ctx) if p := pg.pickers[cluster]; p != nil { return p.Pick(info) } @@ -52,17 +52,12 @@ func (pg *pickerGroup) Pick(info balancer.PickInfo) (balancer.PickResult, error) type clusterKey struct{} -func getPickedCluster(ctx context.Context) string { +// PickedCluster returns the cluster name stored in the context. +func PickedCluster(ctx context.Context) string { cluster, _ := ctx.Value(clusterKey{}).(string) return cluster } -// GetPickedClusterForTesting returns the cluster in the context; to be used -// for testing only. -func GetPickedClusterForTesting(ctx context.Context) string { - return getPickedCluster(ctx) -} - // SetPickedCluster adds the selected cluster to the context for the // xds_cluster_manager LB policy to pick. func SetPickedCluster(ctx context.Context, cluster string) context.Context { diff --git a/vendor/google.golang.org/grpc/internal/xds/httpfilter/fault/fault.go b/vendor/google.golang.org/grpc/internal/xds/httpfilter/fault/fault.go index 2d6f8afb80..58f3486369 100644 --- a/vendor/google.golang.org/grpc/internal/xds/httpfilter/fault/fault.go +++ b/vendor/google.golang.org/grpc/internal/xds/httpfilter/fault/fault.go @@ -29,6 +29,7 @@ import ( "sync/atomic" "time" + "google.golang.org/grpc" "google.golang.org/grpc/codes" iresolver "google.golang.org/grpc/internal/resolver" "google.golang.org/grpc/internal/xds/httpfilter" @@ -104,7 +105,7 @@ func (builder) IsTerminal() bool { return false } -func (builder) BuildClientFilter() httpfilter.ClientFilter { +func (builder) BuildClientFilter(httpfilter.ClientFilterOptions) httpfilter.ClientFilter { return clientFilter{} } @@ -114,7 +115,7 @@ type clientFilter struct{} func (clientFilter) Close() {} -func (clientFilter) BuildClientInterceptor(cfg, override httpfilter.FilterConfig) (iresolver.ClientInterceptor, error) { +func (clientFilter) BuildClientInterceptor(cfg, override httpfilter.FilterConfig) (httpfilter.ClientInterceptor, error) { if cfg == nil { return nil, fmt.Errorf("fault: nil config provided") } @@ -147,12 +148,12 @@ type interceptor struct { var activeFaults uint32 // global active faults; accessed atomically -func (i *interceptor) NewStream(ctx context.Context, _ iresolver.RPCInfo, done func(), newStream func(ctx context.Context, done func()) (iresolver.ClientStream, error)) (iresolver.ClientStream, error) { +func (i *interceptor) NewStream(ctx context.Context, _ iresolver.RPCInfo, newStream func(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStream, error), opts ...grpc.CallOption) (grpc.ClientStream, error) { if maxAF := i.config.GetMaxActiveFaults(); maxAF != nil { defer atomic.AddUint32(&activeFaults, ^uint32(0)) // decrement counter if af := atomic.AddUint32(&activeFaults, 1); af > maxAF.GetValue() { // Would exceed maximum active fault limit. - return newStream(ctx, done) + return newStream(ctx, opts...) } } @@ -166,7 +167,7 @@ func (i *interceptor) NewStream(ctx context.Context, _ iresolver.RPCInfo, done f } return nil, err } - return newStream(ctx, done) + return newStream(ctx, opts...) } func (i *interceptor) Close() {} diff --git a/vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go b/vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go index b37ed9d151..cc31e755ea 100644 --- a/vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go +++ b/vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go @@ -21,6 +21,9 @@ package httpfilter import ( + "context" + + "google.golang.org/grpc" iresolver "google.golang.org/grpc/internal/resolver" "google.golang.org/protobuf/proto" ) @@ -66,11 +69,34 @@ type Builder interface { IsTerminal() bool } +// ClientInterceptor is an interceptor for gRPC client streams. +type ClientInterceptor interface { + // NewStream creates a ClientStream for an RPC. + // + // Implementations may delegate stream creation to the provided newStream + // function, passing the provided CallOption slice along with any new + // CallOption instances they wish to add. To intercept or override stream + // behavior, implementations may wrap the ClientStream returned by the + // delegate. + // + // Note: RPCInfo.Context is currently unused and will be nil. + NewStream(ctx context.Context, ri iresolver.RPCInfo, newStream func(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStream, error), opts ...grpc.CallOption) (grpc.ClientStream, error) + + // Close closes the interceptor. Once called, no new calls to NewStream are + // accepted. Ongoing calls to NewStream are allowed to complete. + Close() +} + +// ClientFilterOptions contains options for building a client filter. +type ClientFilterOptions struct { + FilterName string // FilterName is the filter name from the xDS configuration. +} + // ClientFilterBuilder is an optional interface that a Builder can implement to // indicate its capability to build client-side filters. type ClientFilterBuilder interface { // BuildClientFilter constructs a ClientFilter. - BuildClientFilter() ClientFilter + BuildClientFilter(opts ClientFilterOptions) ClientFilter } // ClientFilter represents the actual filter implementation on the client side. @@ -84,7 +110,7 @@ type ClientFilter interface { // // It is valid for this method to return a nil Interceptor and a nil error. // In this case, the RPC will not be intercepted by this filter. - BuildClientInterceptor(config, override FilterConfig) (iresolver.ClientInterceptor, error) + BuildClientInterceptor(config, override FilterConfig) (ClientInterceptor, error) // Close is called when the filter is no longer needed. Close() diff --git a/vendor/google.golang.org/grpc/internal/xds/httpfilter/rbac/rbac.go b/vendor/google.golang.org/grpc/internal/xds/httpfilter/rbac/rbac.go index eb42a7fb1f..1af2c2065b 100644 --- a/vendor/google.golang.org/grpc/internal/xds/httpfilter/rbac/rbac.go +++ b/vendor/google.golang.org/grpc/internal/xds/httpfilter/rbac/rbac.go @@ -32,6 +32,7 @@ import ( "google.golang.org/protobuf/types/known/anypb" v3rbacpb "github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3" + v3routepb "github.com/envoyproxy/go-control-plane/envoy/config/route/v3" rpb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rbac/v3" ) @@ -68,36 +69,25 @@ func parseConfig(rbacCfg *rpb.RBAC) (httpfilter.FilterConfig, error) { } // "It is also a validation failure if Permission or Principal has a - // header matcher for a grpc- prefixed header name or :scheme." - A41 - for _, principal := range policy.Principals { - name := principal.GetHeader().GetName() - if name == ":scheme" || strings.HasPrefix(name, "grpc-") { - return nil, fmt.Errorf("rbac: principal header matcher for %v is :scheme or starts with grpc", name) + // header matcher for a grpc- prefixed header name or :scheme." - A41. + // + // "Envoy aliases :authority and Host in its header map implementation, + // so they should be treated equivalent for the RBAC matchers; there must + // be no behavior change depending on which of the two header names is + // used in the RBAC policy." - A41. Any header matcher with value "host" + // is rewritten to ":authority", as that is what grpc-go shifts both + // headers to in the transport layer. + // + // Both rules apply to header matchers nested inside and/or/not rules, so + // the whole permission and principal trees are walked. + for _, principal := range policy.GetPrincipals() { + if err := normalizePrincipalHeaders(principal); err != nil { + return nil, err } } - for _, permission := range policy.Permissions { - name := permission.GetHeader().GetName() - if name == ":scheme" || strings.HasPrefix(name, "grpc-") { - return nil, fmt.Errorf("rbac: permission header matcher for %v is :scheme or starts with grpc", name) - } - } - } - - // "Envoy aliases :authority and Host in its header map implementation, so - // they should be treated equivalent for the RBAC matchers; there must be no - // behavior change depending on which of the two header names is used in the - // RBAC policy." - A41. Loop through config's principals and policies, change - // any header matcher with value "host" to :authority", as that is what - // grpc-go shifts both headers to in transport layer. - for _, policy := range rbacCfg.GetRules().GetPolicies() { - for _, principal := range policy.Principals { - if principal.GetHeader().GetName() == "host" { - principal.GetHeader().Name = ":authority" - } - } - for _, permission := range policy.Permissions { - if permission.GetHeader().GetName() == "host" { - permission.GetHeader().Name = ":authority" + for _, permission := range policy.GetPermissions() { + if err := normalizePermissionHeaders(permission); err != nil { + return nil, err } } } @@ -126,6 +116,82 @@ func parseConfig(rbacCfg *rpb.RBAC) (httpfilter.FilterConfig, error) { return config{chainEngine: ce}, nil } +// normalizePermissionHeaders applies the A41 header-name rules to every header +// matcher reachable from permission, including those nested inside and/or/not +// rules. +func normalizePermissionHeaders(permission *v3rbacpb.Permission) error { + switch p := permission.GetRule().(type) { + case *v3rbacpb.Permission_Header: + return normalizeHeaderMatcher(p.Header) + case *v3rbacpb.Permission_AndRules: + for _, rule := range p.AndRules.GetRules() { + if err := normalizePermissionHeaders(rule); err != nil { + return err + } + } + case *v3rbacpb.Permission_OrRules: + for _, rule := range p.OrRules.GetRules() { + if err := normalizePermissionHeaders(rule); err != nil { + return err + } + } + case *v3rbacpb.Permission_NotRule: + return normalizePermissionHeaders(p.NotRule) + } + return nil +} + +// normalizePrincipalHeaders applies the A41 header-name rules to every header +// matcher reachable from principal, including those nested inside and/or/not +// ids. +func normalizePrincipalHeaders(principal *v3rbacpb.Principal) error { + switch p := principal.GetIdentifier().(type) { + case *v3rbacpb.Principal_Header: + return normalizeHeaderMatcher(p.Header) + case *v3rbacpb.Principal_AndIds: + for _, id := range p.AndIds.GetIds() { + if err := normalizePrincipalHeaders(id); err != nil { + return err + } + } + case *v3rbacpb.Principal_OrIds: + for _, id := range p.OrIds.GetIds() { + if err := normalizePrincipalHeaders(id); err != nil { + return err + } + } + case *v3rbacpb.Principal_NotId: + return normalizePrincipalHeaders(p.NotId) + } + return nil +} + +// normalizeHeaderMatcher lowercases the name of a header matcher, rejects the +// names that A41 forbids (:scheme or a grpc- prefixed name) and rewrites a +// "host" matcher to ":authority". +func normalizeHeaderMatcher(header *v3routepb.HeaderMatcher) error { + // The keys of the metadata the matchers run against are always lowercase, + // so a name that contains an uppercase character matches no header at all + // and the rule using it never fires. Lowercase the name, as Envoy and + // grpc-java do, both to make it match and to keep the checks below from + // being evaded by the case of the name. + name := header.GetName() + lowerName := strings.ToLower(name) + if lowerName != name { + header.Name = lowerName + } + if lowerName == ":scheme" { + return fmt.Errorf("rbac: header matcher for %q is %q", name, ":scheme") + } + if strings.HasPrefix(lowerName, "grpc-") { + return fmt.Errorf("rbac: header matcher for %q starts with %q", name, "grpc-") + } + if lowerName == "host" { + header.Name = ":authority" + } + return nil +} + func (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) { if cfg == nil { return nil, fmt.Errorf("rbac: nil configuration message provided") diff --git a/vendor/google.golang.org/grpc/internal/xds/httpfilter/router/router.go b/vendor/google.golang.org/grpc/internal/xds/httpfilter/router/router.go index 7118ea14b4..954528227a 100644 --- a/vendor/google.golang.org/grpc/internal/xds/httpfilter/router/router.go +++ b/vendor/google.golang.org/grpc/internal/xds/httpfilter/router/router.go @@ -76,7 +76,7 @@ func (builder) IsTerminal() bool { return true } -func (builder) BuildClientFilter() httpfilter.ClientFilter { +func (builder) BuildClientFilter(httpfilter.ClientFilterOptions) httpfilter.ClientFilter { return filter{} } @@ -91,7 +91,7 @@ type filter struct{} func (filter) Close() {} -func (filter) BuildClientInterceptor(cfg, override httpfilter.FilterConfig) (iresolver.ClientInterceptor, error) { +func (filter) BuildClientInterceptor(cfg, override httpfilter.FilterConfig) (httpfilter.ClientInterceptor, error) { if _, ok := cfg.(config); !ok { return nil, fmt.Errorf("router: incorrect config type provided (%T): %v", cfg, cfg) } diff --git a/vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go b/vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go index b19bb7e375..94801b77de 100644 --- a/vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go +++ b/vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go @@ -35,6 +35,7 @@ import ( "google.golang.org/grpc/internal/wrr" "google.golang.org/grpc/internal/xds/balancer/clusterimpl" "google.golang.org/grpc/internal/xds/balancer/clustermanager" + "google.golang.org/grpc/internal/xds/httpfilter" "google.golang.org/grpc/internal/xds/xdsclient/xdsresource" "google.golang.org/grpc/metadata" "google.golang.org/grpc/status" @@ -104,15 +105,15 @@ type virtualHost struct { // routeCluster holds information about a cluster as referenced by a route. type routeCluster struct { - name string // Name of the cluster. - interceptor iresolver.ClientInterceptor // HTTP filters to run for RPCs matching this route. + name string // Name of the cluster. + interceptor httpfilter.ClientInterceptor // HTTP filters to run for RPCs matching this route. } type route struct { - m *xdsresource.CompositeMatcher // converted from route matchers - actionType xdsresource.RouteActionType // holds route action type - clusters wrr.WRR // holds *routeCluster entries - interceptors []iresolver.ClientInterceptor // Interceptors across clusters belonging to this route + m *xdsresource.CompositeMatcher // converted from route matchers + actionType xdsresource.RouteActionType // holds route action type + clusters wrr.WRR // holds *routeCluster entries + interceptors []httpfilter.ClientInterceptor // Interceptors across clusters belonging to this route maxStreamDuration time.Duration retryConfig *xdsresource.RetryConfig hashPolicies []*xdsresource.HashPolicy diff --git a/vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go b/vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go index 3d4932bc29..8dfa684a5f 100644 --- a/vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go +++ b/vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go @@ -27,6 +27,7 @@ import ( "strings" "sync/atomic" + "google.golang.org/grpc" estats "google.golang.org/grpc/experimental/stats" "google.golang.org/grpc/internal" "google.golang.org/grpc/internal/grpclog" @@ -414,7 +415,7 @@ func (r *xdsResolver) newConfigSelector() (_ *configSelector, err error) { for i, rt := range r.xdsConfig.VirtualHost.Routes { clusters := rinternal.NewWRR.(func() wrr.WRR)() - interceptors := []iresolver.ClientInterceptor{} + interceptors := []httpfilter.ClientInterceptor{} // TODO: Carve out the common logic between the ClusterSpecifierPlugin // and WeightedClusters. if rt.ClusterSpecifierPlugin != "" { @@ -594,8 +595,8 @@ func (r *xdsResolver) onResourceError(err error) { // followed by the route override, and finally the virtual host override. // // Only executed in the context of a serializer callback. -func (r *xdsResolver) newInterceptor(filters []xdsresource.HTTPFilter, clusterOverride, routeOverride, virtualHostOverride map[string]httpfilter.FilterConfig) (_ iresolver.ClientInterceptor, err error) { - interceptors := make([]iresolver.ClientInterceptor, 0, len(filters)) +func (r *xdsResolver) newInterceptor(filters []xdsresource.HTTPFilter, clusterOverride, routeOverride, virtualHostOverride map[string]httpfilter.FilterConfig) (_ httpfilter.ClientInterceptor, err error) { + interceptors := make([]httpfilter.ClientInterceptor, 0, len(filters)) defer func() { // Clean up any interceptors that were successfully built before the // error occurred, to avoid leaking resources. @@ -652,18 +653,18 @@ func (r *xdsResolver) newInterceptor(filters []xdsresource.HTTPFilter, clusterOv // interceptorList is a client interceptor that contains a list of client // interceptors to execute in order. type interceptorList struct { - interceptors []iresolver.ClientInterceptor + interceptors []httpfilter.ClientInterceptor } -func (il *interceptorList) NewStream(ctx context.Context, ri iresolver.RPCInfo, _ func(), newStream func(ctx context.Context, _ func()) (iresolver.ClientStream, error)) (iresolver.ClientStream, error) { +func (il *interceptorList) NewStream(ctx context.Context, ri iresolver.RPCInfo, newStream func(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStream, error), opts ...grpc.CallOption) (grpc.ClientStream, error) { for idx := len(il.interceptors) - 1; idx >= 0; idx-- { ns := newStream i := il.interceptors[idx] - newStream = func(ctx context.Context, done func()) (iresolver.ClientStream, error) { - return i.NewStream(ctx, ri, done, ns) + newStream = func(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStream, error) { + return i.NewStream(ctx, ri, ns, opts...) } } - return newStream(ctx, func() {}) + return newStream(ctx, opts...) } func (il *interceptorList) Close() { @@ -684,7 +685,7 @@ func (r *xdsResolver) getOrCreateClientFilter(builder httpfilter.ClientFilterBui return clientFilter } - cf := builder.BuildClientFilter() + cf := builder.BuildClientFilter(httpfilter.ClientFilterOptions{FilterName: key.name}) r.httpFilters[key] = cf return cf } diff --git a/vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go b/vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go index 92b654b60d..e53a4bd2d2 100644 --- a/vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go +++ b/vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go @@ -439,7 +439,13 @@ func (lw *ldsWatcher) ResourceChanged(update *xdsresource.ListenerUpdate, onDone } l := lw.parent ilc := update.TCPListener - // Make sure that the socket address on the received Listener resource + + // A server-side listener update must contain inbound listener configuration + // (TCPListener). If it is nil, it indicates that a client-side listener (API + // Listener) resource was received instead. In this case, we transition the + // server to non-serving mode. + // + // Also, make sure that the socket address on the received Listener resource // matches the address of the net.Listener passed to us by the user. This // check is done here instead of at the XDSClient layer because of the // following couple of reasons: @@ -451,11 +457,16 @@ func (lw *ldsWatcher) ResourceChanged(update *xdsresource.ListenerUpdate, onDone // What this means is that the XDSClient has ACKed a resource which can push // the server into a "not serving" mode. This is not ideal, but this is // what we have decided to do. - if ilc.Address != l.addr || ilc.Port != l.port { + if ilc == nil || (ilc.Address != l.addr || ilc.Port != l.port) { // TODO(purnesh42h): Are there any other cases where this can be // treated as an ambient error? l.mu.Lock() - err := fmt.Errorf("[xDS node id: %v]: %w", l.xdsNodeID, fmt.Errorf("address (%s:%s) in Listener update does not match listening address: (%s:%s)", ilc.Address, ilc.Port, l.addr, l.port)) + var err error + if ilc == nil { + err = fmt.Errorf("[xDS node id: %v]: %w", l.xdsNodeID, fmt.Errorf("received client-side listener resource %q on server-side", lw.name)) + } else { + err = fmt.Errorf("[xDS node id: %v]: %w", l.xdsNodeID, fmt.Errorf("address (%s:%s) in Listener update does not match listening address: (%s:%s)", ilc.Address, ilc.Port, l.addr, l.port)) + } l.switchModeLocked(connectivity.ServingModeNotServing, err) l.mu.Unlock() return diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher.go index c9202fc31e..3eef12f23c 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher.go @@ -50,14 +50,8 @@ func RouteToMatcher(r *Route) *CompositeMatcher { var matcherT matcher.HeaderMatcher invert := h.InvertMatch != nil && *h.InvertMatch switch { - case h.ExactMatch != nil && *h.ExactMatch != "": - matcherT = matcher.NewHeaderExactMatcher(h.Name, *h.ExactMatch, invert) case h.RegexMatch != nil: matcherT = matcher.NewHeaderRegexMatcher(h.Name, h.RegexMatch, invert) - case h.PrefixMatch != nil && *h.PrefixMatch != "": - matcherT = matcher.NewHeaderPrefixMatcher(h.Name, *h.PrefixMatch, invert) - case h.SuffixMatch != nil && *h.SuffixMatch != "": - matcherT = matcher.NewHeaderSuffixMatcher(h.Name, *h.SuffixMatch, invert) case h.RangeMatch != nil: matcherT = matcher.NewHeaderRangeMatcher(h.Name, h.RangeMatch.Start, h.RangeMatch.End, invert) case h.PresentMatch != nil: diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go index 4d915c5e45..bde5eb76f4 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go @@ -22,6 +22,7 @@ import ( "net/netip" "google.golang.org/grpc/internal/envconfig" + "google.golang.org/grpc/internal/xds/xdsclient/xdsresource/version" "google.golang.org/protobuf/types/known/anypb" v3corepb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" @@ -30,10 +31,10 @@ import ( func init() { if envconfig.XDSHTTPConnectEnabled { - registerMetadataConverter("type.googleapis.com/envoy.config.core.v3.Address", proxyAddressConvertor{}) + registerMetadataConverter(version.V3AddressURL, proxyAddressConverter{}) } if envconfig.GCPAuthenticationFilterEnabled { - registerMetadataConverter("type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.Audience", audienceConverter{}) + registerMetadataConverter(version.V3AudienceURL, audienceConverter{}) } } @@ -61,10 +62,41 @@ func metadataConverterForType(typeURL string) metadataConverter { return metadataRegistry[typeURL] } -// unregisterMetadataConverterForTesting removes a converter from the registry. -// For testing only. -func unregisterMetadataConverterForTesting(typeURL string) { +// RegisterMetadataConverterForTesting registers the converter for testing +// purposes and returns a cleanup function to restore the registry to its +// previous state. +func RegisterMetadataConverterForTesting(typeURL string) (func(), error) { + var conv metadataConverter + switch typeURL { + case version.V3AddressURL: + conv = proxyAddressConverter{} + case version.V3AudienceURL: + conv = audienceConverter{} + default: + return nil, fmt.Errorf("unknown typeURL for testing: %s", typeURL) + } + curConverter, found := metadataRegistry[typeURL] + registerMetadataConverter(typeURL, conv) + return func() { + if found { + metadataRegistry[typeURL] = curConverter + return + } + delete(metadataRegistry, typeURL) + }, nil +} + +// UnregisterMetadataConverterForTesting unregisters the converter for testing +// purposes and returns a cleanup function to restore the registry to its +// previous state. +func UnregisterMetadataConverterForTesting(typeURL string) func() { + curConverter, found := metadataRegistry[typeURL] delete(metadataRegistry, typeURL) + return func() { + if found { + metadataRegistry[typeURL] = curConverter + } + } } // StructMetadataValue stores the values in a google.protobuf.Struct from @@ -85,9 +117,9 @@ type ProxyAddressMetadataValue struct { // proxyAddressConvertor implements the metadataConverter interface to handle // the conversion of envoy.config.core.v3.Address protobuf messages into an // internal representation. -type proxyAddressConvertor struct{} +type proxyAddressConverter struct{} -func (proxyAddressConvertor) convert(anyProto *anypb.Any) (any, error) { +func (proxyAddressConverter) convert(anyProto *anypb.Any) (any, error) { addressProto := &v3corepb.Address{} if err := anyProto.UnmarshalTo(addressProto); err != nil { return nil, fmt.Errorf("failed to unmarshal resource from Any proto: %v", err) diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go index f2063827e3..6c35905286 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go @@ -86,6 +86,10 @@ type ClusterUpdate struct { // Metadata contains the metadata from the cluster resource. Metadata map[string]any + + // IsHTTP11ProxyEnabled is true if the cluster transport socket is wrapped + // in Http11ProxyUpstreamTransport. + IsHTTP11ProxyEnabled bool } // LRSReportEndpointMetricsConfig holds the configuration for propagating ORCA diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_rds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_rds.go index 48e8051b32..1cddfa5aff 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_rds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_rds.go @@ -166,14 +166,12 @@ type WeightedCluster struct { HTTPFilterConfigOverride map[string]httpfilter.FilterConfig } -// HeaderMatcher represents header matchers. +// HeaderMatcher represents header matchers. Exact, prefix, suffix and contains +// matches are represented as a StringMatch. type HeaderMatcher struct { Name string InvertMatch *bool - ExactMatch *string RegexMatch *regexp.Regexp - PrefixMatch *string - SuffixMatch *string RangeMatch *Int64Range PresentMatch *bool StringMatch *matcher.StringMatcher diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go index 151143a16f..ea6d001d9e 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go @@ -29,6 +29,7 @@ import ( v3clusterpb "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3" v3corepb "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" v3aggregateclusterpb "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/aggregate/v3" + v3http11proxypb "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3" v3tlspb "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3" "google.golang.org/grpc/internal/envconfig" @@ -161,7 +162,8 @@ func validateClusterAndConstructClusterUpdate(cluster *v3clusterpb.Cluster, serv // Process security configuration received from the control plane iff the // corresponding environment variable is set. var sc *SecurityConfig - if sc, err = securityConfigFromCluster(cluster); err != nil { + var isHTTP11ProxyEnabled bool + if sc, isHTTP11ProxyEnabled, err = securityConfigFromCluster(cluster); err != nil { return ClusterUpdate{}, err } @@ -232,6 +234,7 @@ func validateClusterAndConstructClusterUpdate(cluster *v3clusterpb.Cluster, serv TelemetryLabels: telemetryLabels, LRSReportEndpointMetrics: lrsReportEndpointMetrics, Metadata: metadata, + IsHTTP11ProxyEnabled: isHTTP11ProxyEnabled, } if lrs := cluster.GetLrsServer(); lrs != nil { @@ -318,50 +321,67 @@ func dnsHostNameFromCluster(cluster *v3clusterpb.Cluster) (string, error) { // securityConfigFromCluster extracts the relevant security configuration from // the received Cluster resource. -func securityConfigFromCluster(cluster *v3clusterpb.Cluster) (*SecurityConfig, error) { +func securityConfigFromCluster(cluster *v3clusterpb.Cluster) (*SecurityConfig, bool, error) { if tsm := cluster.GetTransportSocketMatches(); len(tsm) != 0 { - return nil, fmt.Errorf("unsupported transport_socket_matches field is non-empty: %+v", tsm) + return nil, false, fmt.Errorf("unsupported transport_socket_matches field is non-empty: %+v", tsm) } // The Cluster resource contains a `transport_socket` field, which contains // a oneof `typed_config` field of type `protobuf.Any`. The any proto // contains a marshaled representation of an `UpstreamTlsContext` message. ts := cluster.GetTransportSocket() if ts == nil { - return nil, nil + return nil, false, nil } + var isHTTP11ProxyEnabled bool + tc := ts.GetTypedConfig() + typeURL := tc.GetTypeUrl() + + if envconfig.XDSHTTPConnectEnabled && typeURL == version.V3HTTP11ProxyUpstreamTransportURL { + isHTTP11ProxyEnabled = true + http11Proxy := &v3http11proxypb.Http11ProxyUpstreamTransport{} + if err := proto.Unmarshal(tc.GetValue(), http11Proxy); err != nil { + return nil, false, fmt.Errorf("failed to unmarshal Http11ProxyUpstreamTransport in CDS response: %v", err) + } + ts = http11Proxy.GetTransportSocket() + if ts == nil { + return nil, true, nil + } + tc = ts.GetTypedConfig() + typeURL = tc.GetTypeUrl() + } + if name := ts.GetName(); name != transportSocketName { - return nil, fmt.Errorf("transport_socket field has unexpected name: %s", name) + return nil, false, fmt.Errorf("transport_socket field has unexpected name: %s", name) } - tc := ts.GetTypedConfig() - if typeURL := tc.GetTypeUrl(); typeURL != version.V3UpstreamTLSContextURL { - return nil, fmt.Errorf("transport_socket missing typed_config or wrong type_url: %q", typeURL) + if typeURL != version.V3UpstreamTLSContextURL { + return nil, false, fmt.Errorf("transport_socket missing typed_config or wrong type_url: %q", typeURL) } upstreamCtx := &v3tlspb.UpstreamTlsContext{} if err := proto.Unmarshal(tc.GetValue(), upstreamCtx); err != nil { - return nil, fmt.Errorf("failed to unmarshal UpstreamTlsContext in CDS response: %v", err) + return nil, false, fmt.Errorf("failed to unmarshal UpstreamTlsContext in CDS response: %v", err) } // The following fields from `UpstreamTlsContext` are ignored: // - allow_renegotiation // - max_session_keys if upstreamCtx.GetCommonTlsContext() == nil { - return nil, errors.New("UpstreamTlsContext in CDS response does not contain a CommonTlsContext") + return nil, false, errors.New("UpstreamTlsContext in CDS response does not contain a CommonTlsContext") } sc, err := securityConfigFromCommonTLSContext(upstreamCtx.GetCommonTlsContext(), false) if err != nil { - return nil, err + return nil, false, err } // Set SNI related fields in SecurityConfig from UpstreamTlsContext if // `GRPC_EXPERIMENTAL_XDS_SNI` is enabled. if envconfig.XDSSNIEnabled { sc.SNI = upstreamCtx.GetSni() if len(sc.SNI) > maxSNILength { - return nil, fmt.Errorf("SNI value %q in UpstreamTlsContext in CDS response exceeds max length of %d", sc.SNI, maxSNILength) + return nil, false, fmt.Errorf("SNI value %q in UpstreamTlsContext in CDS response exceeds max length of %d", sc.SNI, maxSNILength) } sc.UseAutoHostSNI = upstreamCtx.GetAutoHostSni() sc.AutoSNISANValidation = upstreamCtx.GetAutoSniSanValidation() } - return sc, nil + return sc, isHTTP11ProxyEnabled, nil } // common is expected to be not nil. diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go index 15a8e1036d..a053db2235 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go @@ -33,6 +33,7 @@ import ( "google.golang.org/protobuf/types/known/anypb" v3routepb "github.com/envoyproxy/go-control-plane/envoy/config/route/v3" + v3matcherpb "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3" v3typepb "github.com/envoyproxy/go-control-plane/envoy/type/v3" ) @@ -256,9 +257,13 @@ func routesProtoToSlice(routes []*v3routepb.Route, csps map[string]clusterspecif for _, h := range match.GetHeaders() { var header HeaderMatcher + // The deprecated exact/prefix/suffix/contains match fields are + // converted to the equivalent StringMatcher so that + // StringMatcherFromProto owns validation for all of them. + var smProto *v3matcherpb.StringMatcher switch ht := h.GetHeaderMatchSpecifier().(type) { case *v3routepb.HeaderMatcher_ExactMatch: - header.ExactMatch = &ht.ExactMatch + smProto = &v3matcherpb.StringMatcher{MatchPattern: &v3matcherpb.StringMatcher_Exact{Exact: ht.ExactMatch}} case *v3routepb.HeaderMatcher_SafeRegexMatch: regex := ht.SafeRegexMatch.GetRegex() re, err := matcher.CompileSafeRegex(regex) @@ -274,18 +279,26 @@ func routesProtoToSlice(routes []*v3routepb.Route, csps map[string]clusterspecif case *v3routepb.HeaderMatcher_PresentMatch: header.PresentMatch = &ht.PresentMatch case *v3routepb.HeaderMatcher_PrefixMatch: - header.PrefixMatch = &ht.PrefixMatch + smProto = &v3matcherpb.StringMatcher{MatchPattern: &v3matcherpb.StringMatcher_Prefix{Prefix: ht.PrefixMatch}} case *v3routepb.HeaderMatcher_SuffixMatch: - header.SuffixMatch = &ht.SuffixMatch + smProto = &v3matcherpb.StringMatcher{MatchPattern: &v3matcherpb.StringMatcher_Suffix{Suffix: ht.SuffixMatch}} + case *v3routepb.HeaderMatcher_ContainsMatch: + smProto = &v3matcherpb.StringMatcher{MatchPattern: &v3matcherpb.StringMatcher_Contains{Contains: ht.ContainsMatch}} case *v3routepb.HeaderMatcher_StringMatch: - sm, err := matcher.StringMatcherFromProto(ht.StringMatch) - if err != nil { - return nil, nil, fmt.Errorf("route %+v has an invalid string matcher: %v", err, ht.StringMatch) + if ht.StringMatch == nil { + return nil, nil, fmt.Errorf("route %+v has an empty string matcher", r) } - header.StringMatch = &sm + smProto = ht.StringMatch default: return nil, nil, fmt.Errorf("route %+v has an unrecognized header matcher: %+v", r, ht) } + if smProto != nil { + sm, err := matcher.StringMatcherFromProto(smProto) + if err != nil { + return nil, nil, fmt.Errorf("route %+v has an invalid header matcher: %v", r, err) + } + header.StringMatch = &sm + } header.Name = h.GetName() invert := h.GetInvertMatch() header.InvertMatch = &invert diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/version/version.go b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/version/version.go index 82ad5fe52c..b194592559 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/version/version.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/version/version.go @@ -30,12 +30,15 @@ const ( V3ClusterType = "envoy.config.cluster.v3.Cluster" V3EndpointsType = "envoy.config.endpoint.v3.ClusterLoadAssignment" - V3ResourceWrapperURL = googleapiPrefix + "envoy.service.discovery.v3.Resource" - V3ListenerURL = googleapiPrefix + V3ListenerType - V3RouteConfigURL = googleapiPrefix + V3RouteConfigType - V3ClusterURL = googleapiPrefix + V3ClusterType - V3EndpointsURL = googleapiPrefix + V3EndpointsType - V3HTTPConnManagerURL = googleapiPrefix + "envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager" - V3UpstreamTLSContextURL = googleapiPrefix + "envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext" - V3DownstreamTLSContextURL = googleapiPrefix + "envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext" + V3ResourceWrapperURL = googleapiPrefix + "envoy.service.discovery.v3.Resource" + V3ListenerURL = googleapiPrefix + V3ListenerType + V3RouteConfigURL = googleapiPrefix + V3RouteConfigType + V3ClusterURL = googleapiPrefix + V3ClusterType + V3EndpointsURL = googleapiPrefix + V3EndpointsType + V3HTTPConnManagerURL = googleapiPrefix + "envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager" + V3UpstreamTLSContextURL = googleapiPrefix + "envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext" + V3DownstreamTLSContextURL = googleapiPrefix + "envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext" + V3HTTP11ProxyUpstreamTransportURL = googleapiPrefix + "envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport" + V3AddressURL = googleapiPrefix + "envoy.config.core.v3.Address" + V3AudienceURL = googleapiPrefix + "envoy.extensions.filters.http.gcp_authn.v3.Audience" ) diff --git a/vendor/google.golang.org/grpc/internal/xds/xdsdepmgr/xds_dependency_manager.go b/vendor/google.golang.org/grpc/internal/xds/xdsdepmgr/xds_dependency_manager.go index 7ce0218440..c0a7a58e0e 100644 --- a/vendor/google.golang.org/grpc/internal/xds/xdsdepmgr/xds_dependency_manager.go +++ b/vendor/google.golang.org/grpc/internal/xds/xdsdepmgr/xds_dependency_manager.go @@ -498,6 +498,16 @@ func (m *DependencyManager) applyRouteConfigUpdateLocked(update *xdsresource.Rou } func (m *DependencyManager) onListenerResourceUpdate(update *xdsresource.ListenerUpdate, onDone func()) { + // A client-side listener update must contain API listener configuration. If + // it is nil, it indicates that a server-side listener (TCP Listener) resource + // was received instead. We report this error to the resolver watcher so it + // can transition the channel into TRANSIENT_FAILURE. + if update.APIListener == nil { + err := fmt.Errorf("client-side listener resource %q does not contain API listener configuration", m.ldsResourceName) + m.onListenerResourceError(err, onDone) + return + } + m.mu.Lock() defer m.mu.Unlock() @@ -512,7 +522,7 @@ func (m *DependencyManager) onListenerResourceUpdate(update *xdsresource.Listene m.listenerWatcher.setLastUpdate(update) - if update.APIListener != nil && update.APIListener.InlineRouteConfig != nil { + if update.APIListener.InlineRouteConfig != nil { // If there was a previous route config watcher because of a non-inline // route configuration, cancel it. m.rdsResourceName = "" @@ -527,10 +537,6 @@ func (m *DependencyManager) onListenerResourceUpdate(update *xdsresource.Listene // We get here only if there was no inline route configuration. If the route // config name has not changed, send an update with existing route // configuration and the newly received listener configuration. - if update.APIListener == nil { - m.logger.Errorf("Received a listener resource with no api_listener configuration") - return - } if m.rdsResourceName == update.APIListener.RouteConfigName { m.maybeSendUpdateLocked() return diff --git a/vendor/google.golang.org/grpc/mem/buffer_pool.go b/vendor/google.golang.org/grpc/mem/buffer_pool.go index 3b02b90916..aa121379fd 100644 --- a/vendor/google.golang.org/grpc/mem/buffer_pool.go +++ b/vendor/google.golang.org/grpc/mem/buffer_pool.go @@ -59,10 +59,6 @@ func init() { internal.SetDefaultBufferPool = func(pool BufferPool) { defaultBufferPool = pool } - - internal.SetBufferPoolingThresholdForTesting = func(threshold int) { - bufferPoolingThreshold = threshold - } } // DefaultBufferPool returns the current default buffer pool. It is a BufferPool diff --git a/vendor/google.golang.org/grpc/mem/buffers.go b/vendor/google.golang.org/grpc/mem/buffers.go index 2b410b16eb..9b355d4465 100644 --- a/vendor/google.golang.org/grpc/mem/buffers.go +++ b/vendor/google.golang.org/grpc/mem/buffers.go @@ -29,6 +29,8 @@ import ( "fmt" "sync" "sync/atomic" + + "google.golang.org/grpc/internal/mem" ) // A Buffer represents a reference counted piece of data (in bytes) that can be @@ -63,8 +65,6 @@ type Buffer interface { } var ( - bufferPoolingThreshold = 1 << 10 - bufferObjectPool = sync.Pool{New: func() any { return new(buffer) }} ) @@ -72,7 +72,7 @@ var ( // equal to the threshold for buffer pooling. This is used to determine whether // to pool buffers or allocate them directly. func IsBelowBufferPoolingThreshold(size int) bool { - return size <= bufferPoolingThreshold + return size <= mem.BufferPoolingThreshold } type buffer struct { diff --git a/vendor/google.golang.org/grpc/stream.go b/vendor/google.golang.org/grpc/stream.go index 4aac644a83..51aff85dfb 100644 --- a/vendor/google.golang.org/grpc/stream.go +++ b/vendor/google.golang.org/grpc/stream.go @@ -201,6 +201,15 @@ func endOfClientStream(cc *ClientConn, err error, opts ...CallOption) { } } +// clientInterceptor is structurally identical to the ClientInterceptor defined +// in internal/xds/httpfilter/httpfilter.go. It is defined locally here so that +// we can type-assert the generic Interceptor field in iresolver.RPCConfig +// without introducing a dependency on xDS packages. +type clientInterceptor interface { + NewStream(ctx context.Context, ri iresolver.RPCInfo, newStream func(ctx context.Context, opts ...CallOption) (ClientStream, error), opts ...CallOption) (ClientStream, error) + Close() +} + func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (_ ClientStream, err error) { if channelz.IsOn() { cc.incrCallsStarted() @@ -244,8 +253,11 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth mc := &emptyMethodConfig var onCommit func() - newStream := func(ctx context.Context, done func()) (iresolver.ClientStream, error) { - return newClientStreamWithParams(ctx, desc, cc, method, mc, onCommit, done, nameResolutionDelayed, opts...) + newStream := func(ctx context.Context, filterOpts ...CallOption) (ClientStream, error) { + if filterOpts != nil { + opts = combine(opts, filterOpts) + } + return newClientStreamWithParams(ctx, desc, cc, method, mc, onCommit, nameResolutionDelayed, opts...) } rpcInfo := iresolver.RPCInfo{Context: ctx, Method: method} @@ -270,20 +282,24 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth if rpcConfig.Interceptor != nil { rpcInfo.Context = nil ns := newStream - newStream = func(ctx context.Context, done func()) (iresolver.ClientStream, error) { - cs, err := rpcConfig.Interceptor.NewStream(ctx, rpcInfo, done, ns) - if err != nil { - return nil, toRPCErr(err) + if interceptor, ok := rpcConfig.Interceptor.(clientInterceptor); ok { + newStream = func(ctx context.Context, filterOpts ...CallOption) (ClientStream, error) { + cs, err := interceptor.NewStream(ctx, rpcInfo, ns, filterOpts...) + if err != nil { + return nil, toRPCErr(err) + } + return cs, nil } - return cs, nil + } else { + return nil, status.Errorf(codes.Internal, "invalid client interceptor type %T", rpcConfig.Interceptor) } } } - return newStream(ctx, func() {}) + return newStream(ctx) } -func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, mc *serviceconfig.MethodConfig, onCommit, doneFunc func(), nameResolutionDelayed bool, opts ...CallOption) (_ iresolver.ClientStream, err error) { +func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, mc *serviceconfig.MethodConfig, onCommit func(), nameResolutionDelayed bool, opts ...CallOption) (_ ClientStream, err error) { callInfo := defaultCallInfo() if mc.WaitForReady != nil { callInfo.failFast = !*mc.WaitForReady @@ -321,7 +337,6 @@ func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *Client Host: cc.authority, Method: method, ContentSubtype: callInfo.contentSubtype, - DoneFunc: doneFunc, Authority: callInfo.authority, } if allowed := callInfo.acceptedResponseCompressors; len(allowed) > 0 { diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go index a9dbafb876..835dc07fdc 100644 --- a/vendor/google.golang.org/grpc/version.go +++ b/vendor/google.golang.org/grpc/version.go @@ -19,4 +19,4 @@ package grpc // Version is the current grpc version. -const Version = "1.82.2" +const Version = "1.83.2" diff --git a/vendor/google.golang.org/grpc/xds/googledirectpath/googlec2p.go b/vendor/google.golang.org/grpc/xds/googledirectpath/googlec2p.go index 50f64889a2..ed0e8e22d5 100644 --- a/vendor/google.golang.org/grpc/xds/googledirectpath/googlec2p.go +++ b/vendor/google.golang.org/grpc/xds/googledirectpath/googlec2p.go @@ -136,24 +136,38 @@ func (c2pResolverBuilder) Build(t resolver.Target, cc resolver.ClientConn, opts return nil, fmt.Errorf("google-c2p URI scheme does not support authorities") } - if !runDirectPath() { + isGCE := onGCE() + // We check only for the presence of the "force-xds" query parameter key, + // and do not evaluate its value. + _, forceXDS := t.URL.Query()["force-xds"] + if !forceXDS && !isGCE { // If not xDS, fallback to DNS. t.URL.Scheme = dnsName return resolver.Get(dnsName).Build(t, cc, opts) } - // Note that the following calls to getZone() and getIPv6Capable() does I/O, - // and has 10 seconds timeout each. - // - // This should be fine in most of the cases. In certain error cases, this - // could block Dial() for up to 10 seconds (each blocking call has its own - // goroutine). - zoneCh, ipv6CapableCh := make(chan string), make(chan bool) - go func() { zoneCh <- getZone(httpReqTimeout) }() - go func() { ipv6CapableCh <- getIPv6Capable(httpReqTimeout) }() + var zone string + var ipv6Capable bool + if forceXDS { + // If the force-xds query parameter is present, GCE metadata server + // queries are bypassed. + zone = "" + ipv6Capable = true + } else { + // Note that the following calls to getZone() and getIPv6Capable() does I/O, + // and has 10 seconds timeout each. + // + // This should be fine in most of the cases. In certain error cases, this + // could block Dial() for up to 10 seconds (each blocking call has its own + // goroutine). + var wg sync.WaitGroup + wg.Go(func() { zone = getZone(httpReqTimeout) }) + wg.Go(func() { ipv6Capable = getIPv6Capable(httpReqTimeout) }) + wg.Wait() + } xdsServerURI := getXdsServerURI() - nodeCfg := newNodeConfig(<-zoneCh, <-ipv6CapableCh) + nodeCfg := newNodeConfig(zone, ipv6Capable, forceXDS) xdsServerCfg := newXdsServerConfig(xdsServerURI) authoritiesCfg := newAuthoritiesConfig(xdsServerCfg) @@ -203,10 +217,16 @@ func (b c2pResolverBuilder) Scheme() string { return c2pScheme } -func newNodeConfig(zone string, ipv6Capable bool) map[string]any { +func newNodeConfig(zone string, ipv6Capable bool, forceXDS bool) map[string]any { + prefix := "C2P" + if forceXDS { + prefix = "C2P-non-gcp" + } node := map[string]any{ - "id": fmt.Sprintf("C2P-%d", randInt()), - "locality": map[string]any{"zone": zone}, + "id": fmt.Sprintf("%s-%d", prefix, randInt()), + } + if zone != "" { + node["locality"] = map[string]any{"zone": zone} } // Enable dualstack endpoints in TD. if ipv6Capable { @@ -228,10 +248,3 @@ func newXdsServerConfig(uri string) map[string]any { "server_features": []any{"ignore_resource_deletion"}, } } - -// runDirectPath returns whether this resolver should use direct path. -// -// direct path is enabled if this client is running on GCE. -func runDirectPath() bool { - return onGCE() -} diff --git a/vendor/modules.txt b/vendor/modules.txt index 1587ae24c4..61d398ca12 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -4,7 +4,7 @@ # 4d63.com/gochecknoglobals v0.2.2 ## explicit; go 1.18 4d63.com/gochecknoglobals/checknoglobals -# cel.dev/expr v0.25.1 +# cel.dev/expr v0.25.2 ## explicit; go 1.23.0 cel.dev/expr # cloud.google.com/go v0.123.0 @@ -14,7 +14,7 @@ cloud.google.com/go/internal cloud.google.com/go/internal/optional cloud.google.com/go/internal/trace cloud.google.com/go/internal/version -# cloud.google.com/go/auth v0.20.0 +# cloud.google.com/go/auth v0.23.2 ## explicit; go 1.25.0 cloud.google.com/go/auth cloud.google.com/go/auth/credentials @@ -31,18 +31,18 @@ cloud.google.com/go/auth/internal cloud.google.com/go/auth/internal/compute cloud.google.com/go/auth/internal/credsfile cloud.google.com/go/auth/internal/jwt +cloud.google.com/go/auth/internal/regionalaccessboundary cloud.google.com/go/auth/internal/retry cloud.google.com/go/auth/internal/transport cloud.google.com/go/auth/internal/transport/cert cloud.google.com/go/auth/internal/transport/headers -cloud.google.com/go/auth/internal/trustboundary # cloud.google.com/go/auth/oauth2adapt v0.2.8 ## explicit; go 1.23.0 cloud.google.com/go/auth/oauth2adapt # cloud.google.com/go/compute/metadata v0.9.0 ## explicit; go 1.24.0 cloud.google.com/go/compute/metadata -# cloud.google.com/go/firestore v1.22.0 +# cloud.google.com/go/firestore v1.24.0 ## explicit; go 1.25.0 cloud.google.com/go/firestore/apiv1 cloud.google.com/go/firestore/apiv1/firestorepb @@ -62,7 +62,7 @@ cloud.google.com/go/longrunning cloud.google.com/go/longrunning/autogen cloud.google.com/go/longrunning/autogen/longrunningpb cloud.google.com/go/longrunning/internal -# cloud.google.com/go/monitoring v1.29.0 +# cloud.google.com/go/monitoring v1.30.0 ## explicit; go 1.25.0 cloud.google.com/go/monitoring/apiv3/v2 cloud.google.com/go/monitoring/apiv3/v2/monitoringpb @@ -105,7 +105,7 @@ github.com/Antonboom/testifylint/internal/testify ## explicit github.com/Azure/azure-sdk-for-go/services/preview/containerregistry/runtime/2019-08-15-preview/containerregistry github.com/Azure/azure-sdk-for-go/version -# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 +# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 ## explicit; go 1.25.0 github.com/Azure/azure-sdk-for-go/sdk/azcore github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource @@ -127,7 +127,7 @@ github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime github.com/Azure/azure-sdk-for-go/sdk/azcore/streaming github.com/Azure/azure-sdk-for-go/sdk/azcore/to github.com/Azure/azure-sdk-for-go/sdk/azcore/tracing -# github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 +# github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 ## explicit; go 1.25.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal @@ -179,7 +179,7 @@ github.com/Azure/go-autorest/logger # github.com/Azure/go-autorest/tracing v0.6.0 ## explicit; go 1.12 github.com/Azure/go-autorest/tracing -# github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 +# github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 ## explicit; go 1.18 github.com/AzureAD/microsoft-authentication-library-for-go/apps/cache github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential @@ -219,8 +219,8 @@ github.com/GaijinEntertainment/go-exhaustruct/v3/analyzer github.com/GaijinEntertainment/go-exhaustruct/v3/internal/comment github.com/GaijinEntertainment/go-exhaustruct/v3/internal/pattern github.com/GaijinEntertainment/go-exhaustruct/v3/internal/structure -# github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 -## explicit; go 1.24.0 +# github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 +## explicit; go 1.25.0 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp # github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 ## explicit; go 1.24.0 @@ -341,7 +341,7 @@ github.com/ashanbrown/forbidigo/forbidigo # github.com/ashanbrown/makezero v1.2.0 ## explicit; go 1.12 github.com/ashanbrown/makezero/makezero -# github.com/aws/aws-sdk-go-v2 v1.43.0 +# github.com/aws/aws-sdk-go-v2 v1.46.0 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/aws github.com/aws/aws-sdk-go-v2/aws/defaults @@ -368,11 +368,12 @@ github.com/aws/aws-sdk-go-v2/internal/shareddefaults github.com/aws/aws-sdk-go-v2/internal/strings github.com/aws/aws-sdk-go-v2/internal/sync/singleflight github.com/aws/aws-sdk-go-v2/internal/timeconv -# github.com/aws/aws-sdk-go-v2/config v1.32.31 +github.com/aws/aws-sdk-go-v2/internal/timeouts +# github.com/aws/aws-sdk-go-v2/config v1.33.3 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/config github.com/aws/aws-sdk-go-v2/config/internal/ini -# github.com/aws/aws-sdk-go-v2/credentials v1.19.30 +# github.com/aws/aws-sdk-go-v2/credentials v1.20.3 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/credentials github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds @@ -388,17 +389,17 @@ github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue # github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.8.35 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression -# github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 +# github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.19.2 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/feature/ec2/imds github.com/aws/aws-sdk-go-v2/feature/ec2/imds/internal/config -# github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.31 +# github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.2 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/internal/configsources -# github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.31 +# github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.2 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 -# github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.32 +# github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.2 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/internal/v4a github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto @@ -422,41 +423,41 @@ github.com/aws/aws-sdk-go-v2/service/ecr/types github.com/aws/aws-sdk-go-v2/service/ecrpublic github.com/aws/aws-sdk-go-v2/service/ecrpublic/internal/endpoints github.com/aws/aws-sdk-go-v2/service/ecrpublic/types -# github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 +# github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding # github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.20 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery -# github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.31 +# github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.2 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url -# github.com/aws/aws-sdk-go-v2/service/kms v1.55.0 +# github.com/aws/aws-sdk-go-v2/service/kms v1.57.1 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/service/kms github.com/aws/aws-sdk-go-v2/service/kms/internal/endpoints github.com/aws/aws-sdk-go-v2/service/kms/types -# github.com/aws/aws-sdk-go-v2/service/signin v1.5.0 +# github.com/aws/aws-sdk-go-v2/service/signin v1.9.0 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/service/signin github.com/aws/aws-sdk-go-v2/service/signin/internal/endpoints github.com/aws/aws-sdk-go-v2/service/signin/types -# github.com/aws/aws-sdk-go-v2/service/sso v1.33.0 +# github.com/aws/aws-sdk-go-v2/service/sso v1.37.0 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/service/sso github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints github.com/aws/aws-sdk-go-v2/service/sso/types -# github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.0 +# github.com/aws/aws-sdk-go-v2/service/ssooidc v1.42.0 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/service/ssooidc github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints github.com/aws/aws-sdk-go-v2/service/ssooidc/types -# github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 +# github.com/aws/aws-sdk-go-v2/service/sts v1.49.0 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/service/sts github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints github.com/aws/aws-sdk-go-v2/service/sts/types -# github.com/aws/smithy-go v1.27.3 +# github.com/aws/smithy-go v1.28.1 ## explicit; go 1.24 github.com/aws/smithy-go github.com/aws/smithy-go/auth @@ -672,7 +673,7 @@ github.com/digitorus/timestamp # github.com/dimchansky/utfbom v1.1.1 ## explicit github.com/dimchansky/utfbom -# github.com/docker/cli v29.6.2+incompatible +# github.com/docker/cli v29.7.2+incompatible ## explicit github.com/docker/cli/cli/config github.com/docker/cli/cli/config/configfile @@ -743,6 +744,7 @@ github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/ github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/ring_hash/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/wrr_locality/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/rbac/audit_loggers/stream/v3 +github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/http_11_proxy/v3 github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3 github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3 github.com/envoyproxy/go-control-plane/envoy/service/load_stats/v3 @@ -803,7 +805,7 @@ github.com/go-critic/go-critic/checkers/internal/astwalk github.com/go-critic/go-critic/checkers/internal/lintutil github.com/go-critic/go-critic/checkers/rulesdata github.com/go-critic/go-critic/linter -# github.com/go-jose/go-jose/v4 v4.1.4 +# github.com/go-jose/go-jose/v4 v4.1.5 ## explicit; go 1.24.0 github.com/go-jose/go-jose/v4 github.com/go-jose/go-jose/v4/cipher @@ -1205,12 +1207,13 @@ github.com/google/go-cmp/cmp/internal/diff github.com/google/go-cmp/cmp/internal/flags github.com/google/go-cmp/cmp/internal/function github.com/google/go-cmp/cmp/internal/value -# github.com/google/go-containerregistry v0.21.9 +# github.com/google/go-containerregistry v0.22.1 ## explicit; go 1.25.0 github.com/google/go-containerregistry/internal/and github.com/google/go-containerregistry/internal/compression github.com/google/go-containerregistry/internal/gzip github.com/google/go-containerregistry/internal/httptest +github.com/google/go-containerregistry/internal/ipaddr github.com/google/go-containerregistry/internal/limit github.com/google/go-containerregistry/internal/redact github.com/google/go-containerregistry/internal/retry @@ -1295,11 +1298,11 @@ github.com/google/uuid # github.com/google/wire v0.7.0 ## explicit; go 1.19 github.com/google/wire -# github.com/googleapis/enterprise-certificate-proxy v0.3.18 +# github.com/googleapis/enterprise-certificate-proxy v0.3.20 ## explicit; go 1.25.0 github.com/googleapis/enterprise-certificate-proxy/client github.com/googleapis/enterprise-certificate-proxy/client/util -# github.com/googleapis/gax-go/v2 v2.23.0 +# github.com/googleapis/gax-go/v2 v2.24.0 ## explicit; go 1.25.0 github.com/googleapis/gax-go/v2 github.com/googleapis/gax-go/v2/apierror @@ -1507,7 +1510,7 @@ github.com/kisielk/errcheck/errcheck # github.com/kkHAIKE/contextcheck v1.1.6 ## explicit; go 1.23.0 github.com/kkHAIKE/contextcheck -# github.com/klauspost/compress v1.19.1 +# github.com/klauspost/compress v1.19.2 ## explicit; go 1.24 github.com/klauspost/compress github.com/klauspost/compress/flate @@ -1891,7 +1894,7 @@ github.com/sigstore/cosign/v2/pkg/types # github.com/sigstore/fulcio v1.8.5 ## explicit; go 1.25.0 github.com/sigstore/fulcio/pkg/api -# github.com/sigstore/protobuf-specs v0.5.1 +# github.com/sigstore/protobuf-specs v0.5.2 ## explicit; go 1.23 github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1 github.com/sigstore/protobuf-specs/gen/pb-go/common/v1 @@ -1946,8 +1949,8 @@ github.com/sigstore/rekor-tiles/v2/pkg/verifier/certificate github.com/sigstore/rekor-tiles/v2/pkg/verifier/identity github.com/sigstore/rekor-tiles/v2/pkg/verifier/publickey github.com/sigstore/rekor-tiles/v2/pkg/verify -# github.com/sigstore/sigstore v1.10.9 -## explicit; go 1.25.0 +# github.com/sigstore/sigstore v1.10.10 +## explicit; go 1.27.0 github.com/sigstore/sigstore/pkg/cryptoutils github.com/sigstore/sigstore/pkg/cryptoutils/goodkey github.com/sigstore/sigstore/pkg/fulcioroots @@ -1974,17 +1977,17 @@ github.com/sigstore/sigstore-go/pkg/tlog github.com/sigstore/sigstore-go/pkg/tuf github.com/sigstore/sigstore-go/pkg/util github.com/sigstore/sigstore-go/pkg/verify -# github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.9 -## explicit; go 1.25.0 +# github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.10 +## explicit; go 1.27.0 github.com/sigstore/sigstore/pkg/signature/kms/aws -# github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.9 -## explicit; go 1.25.0 +# github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.10 +## explicit; go 1.27.0 github.com/sigstore/sigstore/pkg/signature/kms/azure -# github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.9 -## explicit; go 1.25.0 +# github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.10 +## explicit; go 1.27.0 github.com/sigstore/sigstore/pkg/signature/kms/gcp -# github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.9 -## explicit; go 1.25.0 +# github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.10 +## explicit; go 1.27.0 github.com/sigstore/sigstore/pkg/signature/kms/hashivault # github.com/sigstore/timestamp-authority/v2 v2.1.2 ## explicit; go 1.25.0 @@ -2029,11 +2032,13 @@ github.com/spf13/viper/internal/encoding/json github.com/spf13/viper/internal/encoding/toml github.com/spf13/viper/internal/encoding/yaml github.com/spf13/viper/internal/features -# github.com/spiffe/go-spiffe/v2 v2.6.0 +# github.com/spiffe/go-spiffe/v2 v2.7.0 ## explicit; go 1.24.0 github.com/spiffe/go-spiffe/v2/bundle/jwtbundle github.com/spiffe/go-spiffe/v2/bundle/spiffebundle github.com/spiffe/go-spiffe/v2/bundle/x509bundle +github.com/spiffe/go-spiffe/v2/exp/bundle/witbundle +github.com/spiffe/go-spiffe/v2/exp/svid/witsvid github.com/spiffe/go-spiffe/v2/internal/cryptoutil github.com/spiffe/go-spiffe/v2/internal/jwtutil github.com/spiffe/go-spiffe/v2/internal/pemutil @@ -2373,7 +2378,7 @@ go.opencensus.io/trace/tracestate ## explicit; go 1.24.0 go.opentelemetry.io/auto/sdk go.opentelemetry.io/auto/sdk/internal/telemetry -# go.opentelemetry.io/contrib/detectors/gcp v1.43.0 +# go.opentelemetry.io/contrib/detectors/gcp v1.44.0 ## explicit; go 1.25.0 go.opentelemetry.io/contrib/detectors/gcp # go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 @@ -2615,7 +2620,7 @@ golang.org/x/exp/slices # golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac ## explicit; go 1.18 golang.org/x/exp/typeparams -# golang.org/x/mod v0.38.0 +# golang.org/x/mod v0.39.0 ## explicit; go 1.25.0 golang.org/x/mod/internal/lazyregexp golang.org/x/mod/modfile @@ -2623,7 +2628,7 @@ golang.org/x/mod/module golang.org/x/mod/semver golang.org/x/mod/sumdb/dirhash golang.org/x/mod/sumdb/note -# golang.org/x/net v0.57.0 +# golang.org/x/net v0.58.0 ## explicit; go 1.25.0 golang.org/x/net/context golang.org/x/net/context/ctxhttp @@ -2694,7 +2699,7 @@ golang.org/x/text/width # golang.org/x/time v0.15.0 ## explicit; go 1.25.0 golang.org/x/time/rate -# golang.org/x/tools v0.48.0 +# golang.org/x/tools v0.49.0 ## explicit; go 1.25.0 golang.org/x/tools/go/analysis golang.org/x/tools/go/analysis/passes/appends @@ -2773,6 +2778,7 @@ golang.org/x/tools/internal/gopathwalk golang.org/x/tools/internal/imports golang.org/x/tools/internal/modindex golang.org/x/tools/internal/moreiters +golang.org/x/tools/internal/moremaps golang.org/x/tools/internal/packagepath golang.org/x/tools/internal/packagesinternal golang.org/x/tools/internal/pkgbits @@ -2790,7 +2796,7 @@ golang.org/x/xerrors/internal # gomodules.xyz/jsonpatch/v2 v2.5.0 ## explicit; go 1.20 gomodules.xyz/jsonpatch/v2 -# google.golang.org/api v0.290.0 +# google.golang.org/api v0.295.0 ## explicit; go 1.25.0 google.golang.org/api/googleapi google.golang.org/api/googleapi/transport @@ -2810,8 +2816,8 @@ google.golang.org/api/storage/v1 google.golang.org/api/transport google.golang.org/api/transport/grpc google.golang.org/api/transport/http -# google.golang.org/genproto v0.0.0-20260622175928-b703f567277d -## explicit; go 1.25.8 +# google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d +## explicit; go 1.25.0 google.golang.org/genproto/googleapis/cloud/location google.golang.org/genproto/googleapis/type/calendarperiod google.golang.org/genproto/googleapis/type/date @@ -2829,12 +2835,12 @@ google.golang.org/genproto/googleapis/api/httpbody google.golang.org/genproto/googleapis/api/label google.golang.org/genproto/googleapis/api/metric google.golang.org/genproto/googleapis/api/monitoredres -# google.golang.org/genproto/googleapis/rpc v0.0.0-20260720155508-bb71a54f79dc +# google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 ## explicit; go 1.25.0 google.golang.org/genproto/googleapis/rpc/code google.golang.org/genproto/googleapis/rpc/errdetails google.golang.org/genproto/googleapis/rpc/status -# google.golang.org/grpc v1.82.2 +# google.golang.org/grpc v1.83.2 ## explicit; go 1.25.0 google.golang.org/grpc google.golang.org/grpc/attributes @@ -2873,6 +2879,7 @@ google.golang.org/grpc/credentials/alts/internal/handshaker google.golang.org/grpc/credentials/alts/internal/handshaker/service google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp google.golang.org/grpc/credentials/google +google.golang.org/grpc/credentials/google/internal google.golang.org/grpc/credentials/insecure google.golang.org/grpc/credentials/jwt google.golang.org/grpc/credentials/oauth