bump docker/docker to a30990b3c8d0d42280fa501287859e1d2393a951

full diff: moby/moby@b6684a4...a30990b

relevant changes:

- moby/moby#39995 Update containerd binary to v1.2.10
- moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884)
- moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276)
- moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596)
- moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix.
  This is to ensure that users of the homedir package cannot compile statically
  (`CGO_ENABLED=0`) without also setting the `osusergo` build tag.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Makefile

@@ -12,14 +12,14 @@ clean: ## remove build artifacts
 
 .PHONY: test-unit
 test-unit: ## run unit tests, to change the output format use: GOTESTSUM_FORMAT=(dots|short|standard-quiet|short-verbose|standard-verbose) make test-unit 
-	gotestsum $(TESTFLAGS) -- $${TESTDIRS:-$(shell go list ./... | grep -vE '/vendor/|/e2e/')}
+	gotestsum $(TESTFLAGS) -- -tags osusergo $${TESTDIRS:-$(shell go list ./... | grep -vE '/vendor/|/e2e/')}
 
 .PHONY: test
 test: test-unit ## run tests
 
 .PHONY: test-coverage
 test-coverage: ## run test coverage
-	gotestsum -- -coverprofile=coverage.txt $(shell go list ./... | grep -vE '/vendor/|/e2e/')
+	gotestsum -- -tags osusergo -coverprofile=coverage.txt $(shell go list ./... | grep -vE '/vendor/|/e2e/')
 
 .PHONY: fmt
 fmt:

cli/command/container/hijack.go

@@ -185,7 +185,6 @@ func setRawTerminal(streams command.Streams) error {
 	return streams.Out().SetRawTerminal()
 }
 
-// nolint: unparam
 func restoreTerminal(streams command.Streams, in io.Closer) error {
 	streams.In().RestoreTerminal()
 	streams.Out().RestoreTerminal()

cli/command/formatter/reflect_test.go

@@ -12,7 +12,7 @@ func (d *dummy) Func1() string {
 	return "Func1"
 }
 
-func (d *dummy) func2() string { // nolint: unused
+func (d *dummy) func2() string {
 	return "func2(should not be marshalled)"
 }
 

cli/command/image/trust.go

@@ -344,7 +344,6 @@ func convertTarget(t client.Target) (target, error) {
 }
 
 // TagTrusted tags a trusted ref
-// nolint: interfacer
 func TagTrusted(ctx context.Context, cli command.Cli, trustedRef reference.Canonical, ref reference.NamedTagged) error {
 	// Use familiar references when interacting with client and output
 	familiarRef := reference.FamiliarString(ref)

cli/command/manifest/push.go

@@ -208,7 +208,6 @@ func buildBlobRequestList(imageManifest types.ImageManifest, repoName reference.
 	return blobReqs, nil
 }
 
-// nolint: interfacer
 func buildPutManifestRequest(imageManifest types.ImageManifest, targetRef reference.Named) (mountRequest, error) {
 	refWithoutTag, err := reference.WithName(targetRef.Name())
 	if err != nil {

cli/command/trust/signer_remove.go

@@ -78,7 +78,6 @@ func isLastSignerForReleases(roleWithSig data.Role, allRoles []client.RoleWithSi
 
 // removeSingleSigner attempts to remove a single signer and returns whether signer removal happened.
 // The signer not being removed doesn't necessarily raise an error e.g. user choosing "No" when prompted for confirmation.
-// nolint: unparam
 func removeSingleSigner(cli command.Cli, repoName, signerName string, forceYes bool) (bool, error) {
 	ctx := context.Background()
 	imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, nil, image.AuthResolver(cli), repoName)

cli/config/config.go

@@ -6,11 +6,13 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
+
+	"github.com/docker/docker/pkg/homedir"
 
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/cli/config/credentials"
 	"github.com/docker/cli/cli/config/types"
-	"github.com/docker/docker/pkg/homedir"
 	"github.com/pkg/errors"
 )
 
@@ -23,17 +25,20 @@ const (
 )
 
 var (
-	configDir = os.Getenv("DOCKER_CONFIG")
+	initConfigDir sync.Once
+	configDir     string
 )
 
-func init() {
+func setConfigDir() {
+	configDir = os.Getenv("DOCKER_CONFIG")
 	if configDir == "" {
 		configDir = filepath.Join(homedir.Get(), configFileDir)
 	}
 }
 
 // Dir returns the directory the configuration file is stored in
 func Dir() string {
+	initConfigDir.Do(setConfigDir)
 	return configDir
 }
 

gometalinter.json

@@ -2,12 +2,17 @@
   "Vendor": true,
   "Deadline": "2m",
   "Sort": ["linter", "severity", "path", "line"],
-  "Exclude": [
+  "Skip": [
       "cli/compose/schema/bindata.go",
       "cli/command/stack/kubernetes/api/openapi",
       "cli/command/stack/kubernetes/api/client",
       ".*generated.*",
-      "parameter .* always receives"
+      "vendor"
+  ],
+  "Exclude": [
+    "Get not declared by package homedir",
+    "parameter .* always receives",
+    "_esc(Dir|FS|FSString|FSMustString) is unused"
   ],
   "EnableGC": true,
   "Linters": {

internal/pkg/containerized/snapshot.go

@@ -92,7 +92,6 @@ type revision struct {
 	mounts    []mount.Mount
 }
 
-// nolint: interfacer
 func create(ctx context.Context, client *containerd.Client, i containerd.Image, id string, previous string) (*revision, error) {
 	diffIDs, err := i.RootFS(ctx)
 	if err != nil {
@@ -135,7 +134,6 @@ func save(ctx context.Context, client *containerd.Client, updatedImage container
 	return snapshot, nil
 }
 
-// nolint: interfacer
 func previous(ctx context.Context, client *containerd.Client, c *containers.Container) (*revision, error) {
 	service := client.SnapshotService(c.Snapshotter)
 	sInfo, err := service.Stat(ctx, c.SnapshotKey)

scripts/build/binary

@@ -9,6 +9,7 @@ source ./scripts/build/.variables
 
 echo "Building statically linked $TARGET"
 export CGO_ENABLED=0
-go build -o "${TARGET}" --ldflags "${LDFLAGS}" "${SOURCE}"
+echo go build -o "${TARGET}" -tags osusergo --ldflags "${LDFLAGS}" "${SOURCE}"
+go build -o "${TARGET}" -tags osusergo --ldflags "${LDFLAGS}" "${SOURCE}"
 
 ln -sf "$(basename "${TARGET}")" build/docker

scripts/build/plugins

@@ -17,5 +17,5 @@ for p in cli-plugins/examples/* "$@" ; do
 
     echo "Building statically linked $TARGET"
     export CGO_ENABLED=0
-    go build -o "${TARGET}" --ldflags "${LDFLAGS}" "github.com/docker/cli/${p}"
+    go build -o "${TARGET}" -tags osusergo --ldflags "${LDFLAGS}" "github.com/docker/cli/${p}"
 done

scripts/docs/generate-man.sh

@@ -7,7 +7,7 @@ mkdir -p ./man/man1
 go install ./vendor/github.com/cpuguy83/go-md2man
 
 # Generate man pages from cobra commands
-go build -o /tmp/gen-manpages github.com/docker/cli/man
+go build -tags osusergo -o /tmp/gen-manpages github.com/docker/cli/man
 /tmp/gen-manpages --root "$(pwd)" --target "$(pwd)/man/man1"
 
 # Generate legacy pages from markdown

scripts/docs/generate-yaml.sh

@@ -4,5 +4,5 @@ set -eu -o pipefail
 
 mkdir -p docs/yaml/gen
 
-go build -o build/yaml-docs-generator github.com/docker/cli/docs/yaml
+go build -tags osusergo -o build/yaml-docs-generator github.com/docker/cli/docs/yaml
 build/yaml-docs-generator --root "$(pwd)" --target "$(pwd)/docs/yaml/gen"

vendor.conf

@@ -16,7 +16,7 @@ github.com/davecgh/go-spew                          8991bc29aa16c548c550c7ff7826
 github.com/dgrijalva/jwt-go                         a2c85815a77d0f951e33ba4db5ae93629a1530af
 github.com/docker/compose-on-kubernetes             cc4914dfd1b6684a9750a59f3613fc0a95291824 # v0.4.23
 github.com/docker/distribution                      0d3efadf0154c2b8a4e7b6621fff9809655cc580
-github.com/docker/docker                            b6684a403c99aaf6be5b8ce0bef3c6650fcdcd12
+github.com/docker/docker                            a30990b3c8d0d42280fa501287859e1d2393a951
 github.com/docker/docker-credential-helpers         54f0238b6bf101fc3ad3b34114cb5520beb562f5 # v0.6.3
 github.com/docker/go                                d30aec9fd63c35133f8f79c3412ad91a3b08be06 # Contains a customized version of canonical/json and is used by Notary. The package is periodically rebased on current Go versions.
 github.com/docker/go-connections                    7395e3f8aa162843a74ed6d48e79627d9792ac55 # v0.4.0