Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package regclient for openSUSE:Factory 
checked in at 2025-07-01 11:34:39
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/regclient (Old)
 and      /work/SRC/openSUSE:Factory/.regclient.new.7067 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "regclient"

Tue Jul  1 11:34:39 2025 rev:7 rq:1289300 version:0.9.0

Changes:
--------
--- /work/SRC/openSUSE:Factory/regclient/regclient.changes      2025-04-25 
22:20:15.365923804 +0200
+++ /work/SRC/openSUSE:Factory/.regclient.new.7067/regclient.changes    
2025-07-01 11:35:57.257791193 +0200
@@ -1,0 +2,18 @@
+Mon Jun 30 14:33:28 UTC 2025 - Johannes Kastl 
<opensuse_buildserv...@ojkastl.de>
+
+- Update to version 0.9.0:
+  * Breaking:
+    - Drop support for 3rd Go release because of upstream forced
+      upgrades (see golang/go#69095). (PR 948)
+  * Features:
+    - Add a script to reproduce regclient images. (PR 940)
+    - Support IPv6 hosts. (PR 956)
+  * Fixes:
+    - Convert docker attestations built with oci-artifact=true. (PR
+      949)
+    - Allow duplicate keys in yaml config. (PR 952)
+  * Miscellaneous:
+    - Migrate yaml library. (PR 947)
+    - Convert the build to use OCI style attestations. (PR 950)
+
+-------------------------------------------------------------------

Old:
----
  regclient-0.8.3.obscpio

New:
----
  regclient-0.9.0.obscpio

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ regclient.spec ++++++
--- /var/tmp/diff_new_pack.TeS9lv/_old  2025-07-01 11:35:58.185829957 +0200
+++ /var/tmp/diff_new_pack.TeS9lv/_new  2025-07-01 11:35:58.185829957 +0200
@@ -17,7 +17,7 @@
 
 
 Name:           regclient
-Version:        0.8.3
+Version:        0.9.0
 Release:        0
 Summary:        OCI Registry Client in Go and tooling using those libraries
 License:        Apache-2.0

++++++ _service ++++++
--- /var/tmp/diff_new_pack.TeS9lv/_old  2025-07-01 11:35:58.225831628 +0200
+++ /var/tmp/diff_new_pack.TeS9lv/_new  2025-07-01 11:35:58.229831795 +0200
@@ -3,7 +3,7 @@
     <param name="url">https://github.com/regclient/regclient</param>
     <param name="scm">git</param>
     <param name="package-meta">yes</param>
-    <param name="revision">v0.8.3</param>
+    <param name="revision">v0.9.0</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">v(.*)</param>
     <param name="changesgenerate">enable</param>

++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.TeS9lv/_old  2025-07-01 11:35:58.253832797 +0200
+++ /var/tmp/diff_new_pack.TeS9lv/_new  2025-07-01 11:35:58.257832965 +0200
@@ -1,6 +1,6 @@
 <servicedata>
 <service name="tar_scm">
                 <param 
name="url">https://github.com/regclient/regclient</param>
-              <param 
name="changesrevision">ba184b305aaad55b40bf517d06e4d8d1afd35bf9</param></service></servicedata>
+              <param 
name="changesrevision">ad4e3d926030f76419211838494434974f17db67</param></service></servicedata>
 (No newline at EOF)
 

++++++ regclient-0.8.3.obscpio -> regclient-0.9.0.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/HEAD 
new/regclient-0.9.0/.git/HEAD
--- old/regclient-0.8.3/.git/HEAD       2025-04-23 21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/HEAD       2025-06-30 16:25:30.000000000 +0200
@@ -1 +1 @@
-ba184b305aaad55b40bf517d06e4d8d1afd35bf9
+ad4e3d926030f76419211838494434974f17db67
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/ORIG_HEAD 
new/regclient-0.9.0/.git/ORIG_HEAD
--- old/regclient-0.8.3/.git/ORIG_HEAD  2025-04-23 21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/ORIG_HEAD  2025-06-30 16:25:30.000000000 +0200
@@ -1 +1 @@
-ba184b305aaad55b40bf517d06e4d8d1afd35bf9
+ad4e3d926030f76419211838494434974f17db67
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/applypatch-msg.sample 
new/regclient-0.9.0/.git/hooks/applypatch-msg.sample
--- old/regclient-0.8.3/.git/hooks/applypatch-msg.sample        2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/applypatch-msg.sample        2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to check the commit log message taken by
 # applypatch from an e-mail message.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/commit-msg.sample 
new/regclient-0.9.0/.git/hooks/commit-msg.sample
--- old/regclient-0.8.3/.git/hooks/commit-msg.sample    2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/commit-msg.sample    2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to check the commit log message.
 # Called by "git commit" with one argument, the name of the file
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/fsmonitor-watchman.sample 
new/regclient-0.9.0/.git/hooks/fsmonitor-watchman.sample
--- old/regclient-0.8.3/.git/hooks/fsmonitor-watchman.sample    2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/fsmonitor-watchman.sample    2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/q29g3j8qnyl14nv40rrk62g7wxbaz80q-perl-5.40.0/bin/perl
+#!/nix/store/al9x8cr5xifp3qd2f5cdzh6z603kb5ps-perl-5.40.0/bin/perl
 
 use strict;
 use warnings;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/post-update.sample 
new/regclient-0.9.0/.git/hooks/post-update.sample
--- old/regclient-0.8.3/.git/hooks/post-update.sample   2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/post-update.sample   2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to prepare a packed repository for use over
 # dumb transports.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/pre-applypatch.sample 
new/regclient-0.9.0/.git/hooks/pre-applypatch.sample
--- old/regclient-0.8.3/.git/hooks/pre-applypatch.sample        2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/pre-applypatch.sample        2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to verify what is about to be committed
 # by applypatch from an e-mail message.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/pre-commit.sample 
new/regclient-0.9.0/.git/hooks/pre-commit.sample
--- old/regclient-0.8.3/.git/hooks/pre-commit.sample    2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/pre-commit.sample    2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to verify what is about to be committed.
 # Called by "git commit" with no arguments.  The hook should
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/pre-merge-commit.sample 
new/regclient-0.9.0/.git/hooks/pre-merge-commit.sample
--- old/regclient-0.8.3/.git/hooks/pre-merge-commit.sample      2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/pre-merge-commit.sample      2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to verify what is about to be committed.
 # Called by "git merge" with no arguments.  The hook should
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/pre-push.sample 
new/regclient-0.9.0/.git/hooks/pre-push.sample
--- old/regclient-0.8.3/.git/hooks/pre-push.sample      2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/pre-push.sample      2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 
 # An example hook script to verify what is about to be pushed.  Called by "git
 # push" after it has checked the remote status, but before anything has been
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/pre-rebase.sample 
new/regclient-0.9.0/.git/hooks/pre-rebase.sample
--- old/regclient-0.8.3/.git/hooks/pre-rebase.sample    2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/pre-rebase.sample    2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # Copyright (c) 2006, 2008 Junio C Hamano
 #
@@ -65,7 +65,7 @@
        fi
 else
        not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"`
-       /nix/store/q29g3j8qnyl14nv40rrk62g7wxbaz80q-perl-5.40.0/bin/perl -e '
+       /nix/store/al9x8cr5xifp3qd2f5cdzh6z603kb5ps-perl-5.40.0/bin/perl -e '
                my $topic = $ARGV[0];
                my $msg = "* $topic has commits already merged to public 
branch:\n";
                my (%not_in_next) = map {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/pre-receive.sample 
new/regclient-0.9.0/.git/hooks/pre-receive.sample
--- old/regclient-0.8.3/.git/hooks/pre-receive.sample   2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/pre-receive.sample   2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to make use of push options.
 # The example simply echoes all push options that start with 'echoback='
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/prepare-commit-msg.sample 
new/regclient-0.9.0/.git/hooks/prepare-commit-msg.sample
--- old/regclient-0.8.3/.git/hooks/prepare-commit-msg.sample    2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/prepare-commit-msg.sample    2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to prepare the commit log message.
 # Called by "git commit" with the name of the file that has the
@@ -24,11 +24,11 @@
 COMMIT_SOURCE=$2
 SHA1=$3
 
-/nix/store/q29g3j8qnyl14nv40rrk62g7wxbaz80q-perl-5.40.0/bin/perl -i.bak -ne 
'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE"
+/nix/store/al9x8cr5xifp3qd2f5cdzh6z603kb5ps-perl-5.40.0/bin/perl -i.bak -ne 
'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE"
 
 # case "$COMMIT_SOURCE,$SHA1" in
 #  ,|template,)
-#    /nix/store/q29g3j8qnyl14nv40rrk62g7wxbaz80q-perl-5.40.0/bin/perl -i.bak 
-pe '
+#    /nix/store/al9x8cr5xifp3qd2f5cdzh6z603kb5ps-perl-5.40.0/bin/perl -i.bak 
-pe '
 #       print "\n" . `git diff --cached --name-status -r`
 #       if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;;
 #  *) ;;
@@ -38,5 +38,5 @@
 # git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE"
 # if test -z "$COMMIT_SOURCE"
 # then
-#   /nix/store/q29g3j8qnyl14nv40rrk62g7wxbaz80q-perl-5.40.0/bin/perl -i.bak 
-pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE"
+#   /nix/store/al9x8cr5xifp3qd2f5cdzh6z603kb5ps-perl-5.40.0/bin/perl -i.bak 
-pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE"
 # fi
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/push-to-checkout.sample 
new/regclient-0.9.0/.git/hooks/push-to-checkout.sample
--- old/regclient-0.8.3/.git/hooks/push-to-checkout.sample      2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/push-to-checkout.sample      2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 
 # An example hook script to update a checked-out tree on a git push.
 #
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/sendemail-validate.sample 
new/regclient-0.9.0/.git/hooks/sendemail-validate.sample
--- old/regclient-0.8.3/.git/hooks/sendemail-validate.sample    2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/sendemail-validate.sample    2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 
 # An example hook script to validate a patch (and/or patch series) before
 # sending it via email.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/hooks/update.sample 
new/regclient-0.9.0/.git/hooks/update.sample
--- old/regclient-0.8.3/.git/hooks/update.sample        2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/hooks/update.sample        2025-06-30 
16:25:30.000000000 +0200
@@ -1,4 +1,4 @@
-#!/nix/store/mc4485g4apaqzjx59dsmqscls1zc3p2w-bash-5.2p37/bin/bash
+#!/nix/store/xy4jjgw87sbgwylm5kn047d9gkbhsr9x-bash-5.2p37/bin/bash
 #
 # An example hook script to block unannotated tags from entering.
 # Called by "git receive-pack" with arguments: refname sha1-old sha1-new
Binary files old/regclient-0.8.3/.git/index and new/regclient-0.9.0/.git/index 
differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/logs/HEAD 
new/regclient-0.9.0/.git/logs/HEAD
--- old/regclient-0.8.3/.git/logs/HEAD  2025-04-23 21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/logs/HEAD  2025-06-30 16:25:30.000000000 +0200
@@ -1,2 +1,2 @@
-0000000000000000000000000000000000000000 
c75f218d36ea873ee6d791066ca72dd303e92d0f Johannes Kastl 
<ojka...@baghira.oberhinkofen.ojkastl.de> 1745508663 +0200    clone: from 
https://github.com/regclient/regclient
-c75f218d36ea873ee6d791066ca72dd303e92d0f 
ba184b305aaad55b40bf517d06e4d8d1afd35bf9 Johannes Kastl 
<ojka...@baghira.oberhinkofen.ojkastl.de> 1745508663 +0200    checkout: moving 
from main to v0.8.3
+0000000000000000000000000000000000000000 
34a3470a35433200295de35494febfdde6a65b9d kastl <kastl@baten.(none)> 1751294008 
+0200  clone: from https://github.com/regclient/regclient
+34a3470a35433200295de35494febfdde6a65b9d 
ad4e3d926030f76419211838494434974f17db67 kastl <kastl@baten.(none)> 1751294008 
+0200  checkout: moving from main to v0.9.0
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/logs/refs/heads/main 
new/regclient-0.9.0/.git/logs/refs/heads/main
--- old/regclient-0.8.3/.git/logs/refs/heads/main       2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/logs/refs/heads/main       2025-06-30 
16:25:30.000000000 +0200
@@ -1 +1 @@
-0000000000000000000000000000000000000000 
c75f218d36ea873ee6d791066ca72dd303e92d0f Johannes Kastl 
<ojka...@baghira.oberhinkofen.ojkastl.de> 1745508663 +0200    clone: from 
https://github.com/regclient/regclient
+0000000000000000000000000000000000000000 
34a3470a35433200295de35494febfdde6a65b9d kastl <kastl@baten.(none)> 1751294008 
+0200  clone: from https://github.com/regclient/regclient
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/logs/refs/remotes/origin/HEAD 
new/regclient-0.9.0/.git/logs/refs/remotes/origin/HEAD
--- old/regclient-0.8.3/.git/logs/refs/remotes/origin/HEAD      2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.git/logs/refs/remotes/origin/HEAD      2025-06-30 
16:25:30.000000000 +0200
@@ -1 +1 @@
-0000000000000000000000000000000000000000 
c75f218d36ea873ee6d791066ca72dd303e92d0f Johannes Kastl 
<ojka...@baghira.oberhinkofen.ojkastl.de> 1745508663 +0200    clone: from 
https://github.com/regclient/regclient
+0000000000000000000000000000000000000000 
34a3470a35433200295de35494febfdde6a65b9d kastl <kastl@baten.(none)> 1751294008 
+0200  clone: from https://github.com/regclient/regclient
Binary files 
old/regclient-0.8.3/.git/objects/pack/pack-8d0343ce5c3df8b2389334dfd22ed618f7f7869e.idx
 and 
new/regclient-0.9.0/.git/objects/pack/pack-8d0343ce5c3df8b2389334dfd22ed618f7f7869e.idx
 differ
Binary files 
old/regclient-0.8.3/.git/objects/pack/pack-8d0343ce5c3df8b2389334dfd22ed618f7f7869e.pack
 and 
new/regclient-0.9.0/.git/objects/pack/pack-8d0343ce5c3df8b2389334dfd22ed618f7f7869e.pack
 differ
Binary files 
old/regclient-0.8.3/.git/objects/pack/pack-8d0343ce5c3df8b2389334dfd22ed618f7f7869e.rev
 and 
new/regclient-0.9.0/.git/objects/pack/pack-8d0343ce5c3df8b2389334dfd22ed618f7f7869e.rev
 differ
Binary files 
old/regclient-0.8.3/.git/objects/pack/pack-95bba161e97c815614f6e72094960e73ebea4924.idx
 and 
new/regclient-0.9.0/.git/objects/pack/pack-95bba161e97c815614f6e72094960e73ebea4924.idx
 differ
Binary files 
old/regclient-0.8.3/.git/objects/pack/pack-95bba161e97c815614f6e72094960e73ebea4924.pack
 and 
new/regclient-0.9.0/.git/objects/pack/pack-95bba161e97c815614f6e72094960e73ebea4924.pack
 differ
Binary files 
old/regclient-0.8.3/.git/objects/pack/pack-95bba161e97c815614f6e72094960e73ebea4924.rev
 and 
new/regclient-0.9.0/.git/objects/pack/pack-95bba161e97c815614f6e72094960e73ebea4924.rev
 differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/packed-refs 
new/regclient-0.9.0/.git/packed-refs
--- old/regclient-0.8.3/.git/packed-refs        2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/.git/packed-refs        2025-06-30 16:25:30.000000000 
+0200
@@ -1,5 +1,5 @@
 # pack-refs with: peeled fully-peeled sorted 
-c75f218d36ea873ee6d791066ca72dd303e92d0f refs/remotes/origin/main
+34a3470a35433200295de35494febfdde6a65b9d refs/remotes/origin/main
 daa734a0b4dc9c19231cfe691a241f0ce2a7b2f4 refs/remotes/origin/releases/0.0
 4c6dd972a3c609f7c0997bb6e464aee431f8c971 refs/remotes/origin/releases/0.2
 6a1a13c410f734f5e18a6032936bc6764814eae7 refs/remotes/origin/releases/0.3
@@ -8,6 +8,7 @@
 766ee6291f882778207ff42207f9ca8b1da54e57 refs/remotes/origin/releases/0.6
 6b1f7bd9a3b2972605f04a534143f7fed522b680 refs/remotes/origin/releases/0.7
 ba184b305aaad55b40bf517d06e4d8d1afd35bf9 refs/remotes/origin/releases/0.8
+ad4e3d926030f76419211838494434974f17db67 refs/remotes/origin/releases/0.9
 54d924682eb6425847db8dd4acdfcd2beea4c83a refs/tags/v0.0.1
 ^f4dd0b8c5836798787b73dbec754be1d8a93695f
 4fc2fa04faba545e279745f2afd8faad7ca7d296 refs/tags/v0.0.2
@@ -98,3 +99,5 @@
 ^e7e5436b4e93a897084aceca6b118b8002b20122
 772a4826c467460108d789f017cf697aeecbbae5 refs/tags/v0.8.3
 ^ba184b305aaad55b40bf517d06e4d8d1afd35bf9
+ecf7b1e0da3315e5601ce8c01e82d3dcd4916c7d refs/tags/v0.9.0
+^ad4e3d926030f76419211838494434974f17db67
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.git/refs/heads/main 
new/regclient-0.9.0/.git/refs/heads/main
--- old/regclient-0.8.3/.git/refs/heads/main    2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/.git/refs/heads/main    2025-06-30 16:25:30.000000000 
+0200
@@ -1 +1 @@
-c75f218d36ea873ee6d791066ca72dd303e92d0f
+34a3470a35433200295de35494febfdde6a65b9d
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.github/workflows/ci-registry.yml 
new/regclient-0.9.0/.github/workflows/ci-registry.yml
--- old/regclient-0.8.3/.github/workflows/ci-registry.yml       2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.github/workflows/ci-registry.yml       2025-06-30 
16:25:30.000000000 +0200
@@ -26,7 +26,7 @@
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: "Set up Go ${{ env.RELEASE_GO_VER }}"
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: "${{ env.RELEASE_GO_VER }}"
         check-latest: true
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.github/workflows/docker.yml 
new/regclient-0.9.0/.github/workflows/docker.yml
--- old/regclient-0.8.3/.github/workflows/docker.yml    2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.github/workflows/docker.yml    2025-06-30 
16:25:30.000000000 +0200
@@ -29,7 +29,7 @@
 
     env:
       ALPINE_NAME: "alpine:3"
-      ALPINE_DIGEST: 
"sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c" # 
3.21.3
+      ALPINE_DIGEST: 
"sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715" # 
3.22.0
 
     steps:
     - name: Check out code
@@ -85,7 +85,7 @@
         echo "repo_url=${REPO_URL}" >>$GITHUB_OUTPUT
 
     - name: Set up Docker Buildx
-      uses: 
docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+      uses: 
docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
     - name: Login to DockerHub
       if: github.repository_owner == 'regclient'
@@ -103,14 +103,14 @@
         password: ${{ secrets.GHCR_TOKEN }}
 
     - name: Build
-      uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 
# v6.15.0
+      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 
# v6.18.0
       id: build
       with:
         context: .
         file: ./build/Dockerfile.${{ matrix.image }}.buildkit
         platforms: 
linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
         target: release-${{ matrix.type }}
-        outputs: type=oci,dest=output/${{matrix.image}}-${{matrix.type}}.tar
+        outputs: 
type=oci,oci-artifact=true,dest=output/${{matrix.image}}-${{matrix.type}}.tar
         build-args: |
           SOURCE_DATE_EPOCH=${{ steps.prep.outputs.vcs_sec }}
           BUILD_DATE=${{ steps.prep.outputs.created }}
@@ -119,20 +119,20 @@
 
     - name: Install cosign
       if: github.event_name != 'pull_request' && github.repository_owner == 
'regclient'
-      uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a 
# v3.8.1
+      uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac 
# v3.9.1
       with:
-        cosign-release: "v2.5.0"
+        cosign-release: "v2.5.2"
     
     - name: Install syft
       if: github.event_name != 'pull_request' && github.repository_owner == 
'regclient'
-      uses: 
anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # 
v0.18.0
+      uses: 
anchore/sbom-action/download-syft@9246b90769f852b3a8921f330c59e0b3f439d6e9 # 
v0.20.1
       id: syft
       with:
-        syft-version: "v1.22.0"
+        syft-version: "v1.27.1"
     
     # Dogfooding, use regctl to modify regclient images to improve 
reproducibility
     - name: Install regctl
-      uses: 
regclient/actions/regctl-installer@ed3ac54990fbd1b78be04a978e4a928fbc7b2dea # 
main
+      uses: 
regclient/actions/regctl-installer@0a960cee89b1ef446f3d33b58064083fdd7728cb # 
main
       if: github.event_name != 'pull_request' && github.repository_owner == 
'regclient'
       with:
         release: main
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.github/workflows/go.yml 
new/regclient-0.9.0/.github/workflows/go.yml
--- old/regclient-0.8.3/.github/workflows/go.yml        2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.github/workflows/go.yml        2025-06-30 
16:25:30.000000000 +0200
@@ -19,7 +19,7 @@
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        gover: ["1.22", "1.23", "1.24"]
+        gover: ["1.23", "1.24"]
 
     env:
       RELEASE_GO_VER: "1.24"
@@ -35,7 +35,7 @@
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: "Set up Go ${{ matrix.gover }}"
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: "${{ matrix.gover }}"
         check-latest: true
@@ -60,10 +60,10 @@
 
     - name: Install syft
       if: startsWith( github.ref, 'refs/tags/v' ) || github.ref == 
'refs/heads/main'
-      uses: 
anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # 
v0.18.0
+      uses: 
anchore/sbom-action/download-syft@9246b90769f852b3a8921f330c59e0b3f439d6e9 # 
v0.20.1
       id: syft
       with:
-        syft-version: "v1.22.0"
+        syft-version: "v1.27.1"
 
     - name: Build artifacts
       if: startsWith( github.ref, 'refs/tags/v' ) || github.ref == 
'refs/heads/main'
@@ -71,9 +71,9 @@
 
     - name: Install cosign
       if: ( startsWith( github.ref, 'refs/tags/v' ) || github.ref == 
'refs/heads/main' ) && matrix.gover == env.RELEASE_GO_VER
-      uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a 
# v3.8.1
+      uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac 
# v3.9.1
       with:
-        cosign-release: "v2.5.0"
+        cosign-release: "v2.5.2"
 
     - name: Package artifacts
       if: ( startsWith( github.ref, 'refs/tags/v' ) || github.ref == 
'refs/heads/main' ) && matrix.gover == env.RELEASE_GO_VER
@@ -121,7 +121,7 @@
     - name: Create release
       if: steps.release_details.outputs.valid == 'true' && matrix.gover == 
env.RELEASE_GO_VER
       id: release_create
-      uses: 
softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
+      uses: 
softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.github/workflows/vulnscans.yml 
new/regclient-0.9.0/.github/workflows/vulnscans.yml
--- old/regclient-0.8.3/.github/workflows/vulnscans.yml 2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/.github/workflows/vulnscans.yml 2025-06-30 
16:25:30.000000000 +0200
@@ -20,7 +20,7 @@
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: "Set up Go"
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: "${{ env.RELEASE_GO_VER }}"
         check-latest: true
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.osv-scanner.toml 
new/regclient-0.9.0/.osv-scanner.toml
--- old/regclient-0.8.3/.osv-scanner.toml       2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/.osv-scanner.toml       2025-06-30 16:25:30.000000000 
+0200
@@ -1 +1 @@
-GoVersionOverride = "1.24.2"
+GoVersionOverride = "1.24.4"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.version-bump.lock 
new/regclient-0.9.0/.version-bump.lock
--- old/regclient-0.8.3/.version-bump.lock      2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/.version-bump.lock      2025-06-30 16:25:30.000000000 
+0200
@@ -1,52 +1,52 @@
-{"name":"docker-arg-alpine-digest","key":"docker.io/library/alpine:3.21.3","version":"sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c"}
-{"name":"docker-arg-alpine-tag","key":"docker.io/library/alpine","version":"3.21.3"}
-{"name":"docker-arg-ecr","key":"https://github.com/awslabs/amazon-ecr-credential-helper.git:main","version":"cd2afdedf490100366f90313283ff8a1b240c419"}
-{"name":"docker-arg-gcr","key":"https://github.com/GoogleCloudPlatform/docker-credential-gcr.git","version":"v2.1.28"}
-{"name":"docker-arg-go-digest","key":"docker.io/library/golang:1.24.2-alpine","version":"sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754ce3f2f00041ccee"}
-{"name":"docker-arg-go-tag","key":"docker.io/library/golang","version":"1.24.2"}
+{"name":"docker-arg-alpine-digest","key":"docker.io/library/alpine:3.22.0","version":"sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715"}
+{"name":"docker-arg-alpine-tag","key":"docker.io/library/alpine","version":"3.22.0"}
+{"name":"docker-arg-ecr","key":"https://github.com/awslabs/amazon-ecr-credential-helper.git:main","version":"96d88b484b17635a8ce06b0605e9ba1b2a0c85f6"}
+{"name":"docker-arg-gcr","key":"https://github.com/GoogleCloudPlatform/docker-credential-gcr.git","version":"v2.1.30"}
+{"name":"docker-arg-go-digest","key":"docker.io/library/golang:1.24.4-alpine","version":"sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a"}
+{"name":"docker-arg-go-tag","key":"docker.io/library/golang","version":"1.24.4"}
 
{"name":"docker-arg-lunajson","key":"https://github.com/grafi-tt/lunajson.git:master","version":"3d10600874527d71519b33ecbb314eb93ccd1df6"}
 
{"name":"docker-arg-semver","key":"https://github.com/kikito/semver.lua.git:master","version":"a4b708ba243208d46e575da870af969dca46a94d"}
-{"name":"gha-alpine-digest","key":"docker.io/library/alpine:3.21.3","version":"sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c"}
+{"name":"gha-alpine-digest","key":"docker.io/library/alpine:3.22.0","version":"sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715"}
 {"name":"gha-alpine-tag-base","key":"docker.io/library/alpine","version":"3"}
-{"name":"gha-alpine-tag-comment","key":"docker.io/library/alpine","version":"3.21.3"}
-{"name":"gha-cosign-version","key":"https://github.com/sigstore/cosign.git","version":"v2.5.0"}
-{"name":"gha-golang-matrix","key":"golang-matrix","version":"[\"1.22\", 
\"1.23\", \"1.24\"]"}
+{"name":"gha-alpine-tag-comment","key":"docker.io/library/alpine","version":"3.22.0"}
+{"name":"gha-cosign-version","key":"https://github.com/sigstore/cosign.git","version":"v2.5.2"}
+{"name":"gha-golang-matrix","key":"golang-matrix","version":"[\"1.23\", 
\"1.24\"]"}
 {"name":"gha-golang-release","key":"golang-latest","version":"1.24"}
-{"name":"gha-syft-version","key":"docker.io/anchore/syft","version":"v1.22.0"}
+{"name":"gha-syft-version","key":"docker.io/anchore/syft","version":"v1.27.1"}
 
{"name":"gha-uses-commit","key":"https://github.com/actions/checkout.git:v4.2.2","version":"11bd71901bbe5b1630ceea73d27597364c9af683"}
-{"name":"gha-uses-commit","key":"https://github.com/actions/setup-go.git:v5.4.0","version":"0aaccfd150d50ccaeb58ebd88d36e91967a5f35b"}
+{"name":"gha-uses-commit","key":"https://github.com/actions/setup-go.git:v5.5.0","version":"d35c59abb061a4a6fb18e82ac0862c26744d6ab5"}
 
{"name":"gha-uses-commit","key":"https://github.com/actions/stale.git:v9.1.0","version":"5bef64f19d7facfb25b37b414482c7164d639639"}
 
{"name":"gha-uses-commit","key":"https://github.com/actions/upload-artifact.git:v4.6.2","version":"ea165f8d65b6e75b540449e92b4886f43607fa02"}
-{"name":"gha-uses-commit","key":"https://github.com/anchore/sbom-action.git:v0.18.0","version":"f325610c9f50a54015d37c8d16cb3b0e2c8f4de0"}
-{"name":"gha-uses-commit","key":"https://github.com/docker/build-push-action.git:v6.15.0","version":"471d1dc4e07e5cdedd4c2171150001c434f0b7a4"}
+{"name":"gha-uses-commit","key":"https://github.com/anchore/sbom-action.git:v0.20.1","version":"9246b90769f852b3a8921f330c59e0b3f439d6e9"}
+{"name":"gha-uses-commit","key":"https://github.com/docker/build-push-action.git:v6.18.0","version":"263435318d21b8e681c14492fe198d362a7d2c83"}
 
{"name":"gha-uses-commit","key":"https://github.com/docker/login-action.git:v3.4.0","version":"74a5d142397b4f367a81961eba4e8cd7edddf772"}
-{"name":"gha-uses-commit","key":"https://github.com/docker/setup-buildx-action.git:v3.10.0","version":"b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2"}
-{"name":"gha-uses-commit","key":"https://github.com/regclient/actions.git:main","version":"ed3ac54990fbd1b78be04a978e4a928fbc7b2dea"}
-{"name":"gha-uses-commit","key":"https://github.com/sigstore/cosign-installer.git:v3.8.1","version":"d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a"}
-{"name":"gha-uses-commit","key":"https://github.com/softprops/action-gh-release.git:v2.2.2","version":"da05d552573ad5aba039eaac05058a918a7bf631"}
+{"name":"gha-uses-commit","key":"https://github.com/docker/setup-buildx-action.git:v3.11.1","version":"e468171a9de216ec08956ac3ada2f0791b6bd435"}
+{"name":"gha-uses-commit","key":"https://github.com/regclient/actions.git:main","version":"0a960cee89b1ef446f3d33b58064083fdd7728cb"}
+{"name":"gha-uses-commit","key":"https://github.com/sigstore/cosign-installer.git:v3.9.1","version":"398d4b0eeef1380460a10c8013a76f728fb906ac"}
+{"name":"gha-uses-commit","key":"https://github.com/softprops/action-gh-release.git:v2.3.2","version":"72f2c25fcb47643c292f7107632f7a47c1df5cd8"}
 
{"name":"gha-uses-semver","key":"https://github.com/actions/checkout.git","version":"v4.2.2"}
-{"name":"gha-uses-semver","key":"https://github.com/actions/setup-go.git","version":"v5.4.0"}
+{"name":"gha-uses-semver","key":"https://github.com/actions/setup-go.git","version":"v5.5.0"}
 
{"name":"gha-uses-semver","key":"https://github.com/actions/stale.git","version":"v9.1.0"}
 
{"name":"gha-uses-semver","key":"https://github.com/actions/upload-artifact.git","version":"v4.6.2"}
-{"name":"gha-uses-semver","key":"https://github.com/anchore/sbom-action.git","version":"v0.18.0"}
-{"name":"gha-uses-semver","key":"https://github.com/docker/build-push-action.git","version":"v6.15.0"}
+{"name":"gha-uses-semver","key":"https://github.com/anchore/sbom-action.git","version":"v0.20.1"}
+{"name":"gha-uses-semver","key":"https://github.com/docker/build-push-action.git","version":"v6.18.0"}
 
{"name":"gha-uses-semver","key":"https://github.com/docker/login-action.git","version":"v3.4.0"}
-{"name":"gha-uses-semver","key":"https://github.com/docker/setup-buildx-action.git","version":"v3.10.0"}
-{"name":"gha-uses-semver","key":"https://github.com/sigstore/cosign-installer.git","version":"v3.8.1"}
-{"name":"gha-uses-semver","key":"https://github.com/softprops/action-gh-release.git","version":"v2.2.2"}
-{"name":"go-mod-golang-release","key":"golang-oldest","version":"1.22"}
+{"name":"gha-uses-semver","key":"https://github.com/docker/setup-buildx-action.git","version":"v3.11.1"}
+{"name":"gha-uses-semver","key":"https://github.com/sigstore/cosign-installer.git","version":"v3.9.1"}
+{"name":"gha-uses-semver","key":"https://github.com/softprops/action-gh-release.git","version":"v2.3.2"}
+{"name":"go-mod-golang-release","key":"golang-oldest","version":"1.23.0"}
 
{"name":"makefile-ci-distribution","key":"docker.io/library/registry","version":"3.0.0"}
-{"name":"makefile-ci-zot","key":"ghcr.io/project-zot/zot-linux-amd64","version":"v2.1.2"}
+{"name":"makefile-ci-zot","key":"ghcr.io/project-zot/zot-linux-amd64","version":"v2.1.5"}
 
{"name":"makefile-go-vulncheck","key":"https://go.googlesource.com/vuln.git","version":"v1.1.4"}
 
{"name":"makefile-gomajor","key":"https://github.com/icholy/gomajor.git","version":"v0.14.0"}
-{"name":"makefile-gosec","key":"https://github.com/securego/gosec.git","version":"v2.22.3"}
-{"name":"makefile-markdown-lint","key":"docker.io/davidanson/markdownlint-cli2","version":"v0.17.2"}
-{"name":"makefile-osv-scanner","key":"https://github.com/google/osv-scanner.git","version":"v2.0.1"}
+{"name":"makefile-gosec","key":"https://github.com/securego/gosec.git","version":"v2.22.5"}
+{"name":"makefile-markdown-lint","key":"docker.io/davidanson/markdownlint-cli2","version":"v0.18.1"}
+{"name":"makefile-osv-scanner","key":"https://github.com/google/osv-scanner.git","version":"v2.0.3"}
 
{"name":"makefile-staticcheck","key":"https://github.com/dominikh/go-tools.git","version":"v0.6.1"}
-{"name":"makefile-syft-container-digest","key":"anchore/syft:v1.22.0","version":"sha256:b7b38b51897feb0a8118bbfe8e43a1eb94aaef31f8d0e4663354e42834a12126"}
-{"name":"makefile-syft-container-tag","key":"anchore/syft","version":"v1.22.0"}
-{"name":"makefile-syft-version","key":"docker.io/anchore/syft","version":"v1.22.0"}
-{"name":"osv-golang-release","key":"docker.io/library/golang","version":"1.24.2"}
-{"name":"shell-alpine-digest","key":"docker.io/library/alpine:3.21.3","version":"sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c"}
+{"name":"makefile-syft-container-digest","key":"anchore/syft:v1.27.1","version":"sha256:844ed6a928ef9396fac26d1de374e71dcaf80df14f05841670ed41619c5a718f"}
+{"name":"makefile-syft-container-tag","key":"anchore/syft","version":"v1.27.1"}
+{"name":"makefile-syft-version","key":"docker.io/anchore/syft","version":"v1.27.1"}
+{"name":"osv-golang-release","key":"docker.io/library/golang","version":"1.24.4"}
+{"name":"shell-alpine-digest","key":"docker.io/library/alpine:3.22.0","version":"sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715"}
 {"name":"shell-alpine-tag-base","key":"docker.io/library/alpine","version":"3"}
-{"name":"shell-alpine-tag-comment","key":"docker.io/library/alpine","version":"3.21.3"}
+{"name":"shell-alpine-tag-comment","key":"docker.io/library/alpine","version":"3.22.0"}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/.version-bump.yml 
new/regclient-0.9.0/.version-bump.yml
--- old/regclient-0.8.3/.version-bump.yml       2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/.version-bump.yml       2025-06-30 16:25:30.000000000 
+0200
@@ -162,7 +162,7 @@
       repo: "docker.io/library/golang"
     filter:
       expr: '^v?\d+\.\d+$'
-    template: '["{{ index .VerMap ( index .VerList 2 ) }}", "{{ index .VerMap 
( index .VerList 1 ) }}", "{{ index .VerMap ( index .VerList 0 ) }}"]'
+    template: '["{{ index .VerMap ( index .VerList 1 ) }}", "{{ index .VerMap 
( index .VerList 0 ) }}"]'
   gha-golang-release:
     <<: *registry-tag-semver
     key: "golang-latest"
@@ -209,7 +209,7 @@
       repo: "docker.io/library/golang"
     filter:
       expr: '^\d+\.\d+$'
-    template: '{{ index .VerMap ( index .VerList 2 ) }}'
+    template: '{{ index .VerMap ( index .VerList 1 ) }}.0'
 
   makefile-ci-distribution:
     <<: *registry-tag-semver
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/Makefile new/regclient-0.9.0/Makefile
--- old/regclient-0.8.3/Makefile        2025-04-23 21:16:08.000000000 +0200
+++ new/regclient-0.9.0/Makefile        2025-06-30 16:25:30.000000000 +0200
@@ -33,15 +33,15 @@
                -u "$(shell id -u):$(shell id -g)" \
                $(VER_BUMP_CONTAINER)
 endif
-MARKDOWN_LINT_VER?=v0.17.2
+MARKDOWN_LINT_VER?=v0.18.1
 GOMAJOR_VER?=v0.14.0
-GOSEC_VER?=v2.22.3
+GOSEC_VER?=v2.22.5
 GO_VULNCHECK_VER?=v1.1.4
-OSV_SCANNER_VER?=v2.0.1
+OSV_SCANNER_VER?=v2.0.3
 SYFT?=$(shell command -v syft 2>/dev/null)
 SYFT_CMD_VER:=$(shell [ -x "$(SYFT)" ] && echo "v$$($(SYFT) version | awk 
'/^Version: / {print $$2}')" || echo "0")
-SYFT_VERSION?=v1.22.0
-SYFT_CONTAINER?=anchore/syft:v1.22.0@sha256:b7b38b51897feb0a8118bbfe8e43a1eb94aaef31f8d0e4663354e42834a12126
+SYFT_VERSION?=v1.27.1
+SYFT_CONTAINER?=anchore/syft:v1.27.1@sha256:844ed6a928ef9396fac26d1de374e71dcaf80df14f05841670ed41619c5a718f
 ifneq "$(SYFT_CMD_VER)" "$(SYFT_VERSION)"
        SYFT=docker run --rm \
                -v "$(shell pwd)/:$(shell pwd)/" -w "$(shell pwd)" \
@@ -50,7 +50,7 @@
 endif
 STATICCHECK_VER?=v0.6.1
 CI_DISTRIBUTION_VER?=3.0.0
-CI_ZOT_VER?=v2.1.2
+CI_ZOT_VER?=v2.1.5
 
 .PHONY: .FORCE
 .FORCE:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/build/Dockerfile.regbot 
new/regclient-0.9.0/build/Dockerfile.regbot
--- old/regclient-0.8.3/build/Dockerfile.regbot 2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/build/Dockerfile.regbot 2025-06-30 16:25:30.000000000 
+0200
@@ -1,8 +1,8 @@
 ARG REGISTRY=docker.io
-ARG 
ALPINE_VER=3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
-ARG 
GO_VER=1.24.2-alpine@sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754ce3f2f00041ccee
-ARG ECR_HELPER_VER=cd2afdedf490100366f90313283ff8a1b240c419
-ARG GCR_HELPER_VER=v2.1.28
+ARG 
ALPINE_VER=3.22.0@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715
+ARG 
GO_VER=1.24.4-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a
+ARG ECR_HELPER_VER=96d88b484b17635a8ce06b0605e9ba1b2a0c85f6
+ARG GCR_HELPER_VER=v2.1.30
 ARG LUNAJSON_COMMIT=3d10600874527d71519b33ecbb314eb93ccd1df6
 ARG SEMVER_COMMIT=a4b708ba243208d46e575da870af969dca46a94d
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/build/Dockerfile.regbot.buildkit 
new/regclient-0.9.0/build/Dockerfile.regbot.buildkit
--- old/regclient-0.8.3/build/Dockerfile.regbot.buildkit        2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/build/Dockerfile.regbot.buildkit        2025-06-30 
16:25:30.000000000 +0200
@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1
 
 ARG REGISTRY=docker.io
-ARG 
ALPINE_VER=3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
-ARG 
GO_VER=1.24.2-alpine@sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754ce3f2f00041ccee
-ARG ECR_HELPER_VER=cd2afdedf490100366f90313283ff8a1b240c419
-ARG GCR_HELPER_VER=v2.1.28
+ARG 
ALPINE_VER=3.22.0@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715
+ARG 
GO_VER=1.24.4-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a
+ARG ECR_HELPER_VER=96d88b484b17635a8ce06b0605e9ba1b2a0c85f6
+ARG GCR_HELPER_VER=v2.1.30
 ARG LUNAJSON_COMMIT=3d10600874527d71519b33ecbb314eb93ccd1df6
 ARG SEMVER_COMMIT=a4b708ba243208d46e575da870af969dca46a94d
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/build/Dockerfile.regctl 
new/regclient-0.9.0/build/Dockerfile.regctl
--- old/regclient-0.8.3/build/Dockerfile.regctl 2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/build/Dockerfile.regctl 2025-06-30 16:25:30.000000000 
+0200
@@ -1,8 +1,8 @@
 ARG REGISTRY=docker.io
-ARG 
ALPINE_VER=3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
-ARG 
GO_VER=1.24.2-alpine@sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754ce3f2f00041ccee
-ARG ECR_HELPER_VER=cd2afdedf490100366f90313283ff8a1b240c419
-ARG GCR_HELPER_VER=v2.1.28
+ARG 
ALPINE_VER=3.22.0@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715
+ARG 
GO_VER=1.24.4-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a
+ARG ECR_HELPER_VER=96d88b484b17635a8ce06b0605e9ba1b2a0c85f6
+ARG GCR_HELPER_VER=v2.1.30
 
 FROM ${REGISTRY}/library/golang:${GO_VER} AS golang
 RUN apk add --no-cache \
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/build/Dockerfile.regctl.buildkit 
new/regclient-0.9.0/build/Dockerfile.regctl.buildkit
--- old/regclient-0.8.3/build/Dockerfile.regctl.buildkit        2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/build/Dockerfile.regctl.buildkit        2025-06-30 
16:25:30.000000000 +0200
@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1
 
 ARG REGISTRY=docker.io
-ARG 
ALPINE_VER=3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
-ARG 
GO_VER=1.24.2-alpine@sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754ce3f2f00041ccee
-ARG ECR_HELPER_VER=cd2afdedf490100366f90313283ff8a1b240c419
-ARG GCR_HELPER_VER=v2.1.28
+ARG 
ALPINE_VER=3.22.0@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715
+ARG 
GO_VER=1.24.4-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a
+ARG ECR_HELPER_VER=96d88b484b17635a8ce06b0605e9ba1b2a0c85f6
+ARG GCR_HELPER_VER=v2.1.30
 
 FROM --platform=$BUILDPLATFORM ${REGISTRY}/library/golang:${GO_VER} AS golang
 RUN apk add --no-cache \
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/build/Dockerfile.regsync 
new/regclient-0.9.0/build/Dockerfile.regsync
--- old/regclient-0.8.3/build/Dockerfile.regsync        2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/build/Dockerfile.regsync        2025-06-30 
16:25:30.000000000 +0200
@@ -1,8 +1,8 @@
 ARG REGISTRY=docker.io
-ARG 
ALPINE_VER=3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
-ARG 
GO_VER=1.24.2-alpine@sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754ce3f2f00041ccee
-ARG ECR_HELPER_VER=cd2afdedf490100366f90313283ff8a1b240c419
-ARG GCR_HELPER_VER=v2.1.28
+ARG 
ALPINE_VER=3.22.0@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715
+ARG 
GO_VER=1.24.4-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a
+ARG ECR_HELPER_VER=96d88b484b17635a8ce06b0605e9ba1b2a0c85f6
+ARG GCR_HELPER_VER=v2.1.30
 
 FROM ${REGISTRY}/library/golang:${GO_VER} AS golang
 RUN apk add --no-cache \
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/build/Dockerfile.regsync.buildkit 
new/regclient-0.9.0/build/Dockerfile.regsync.buildkit
--- old/regclient-0.8.3/build/Dockerfile.regsync.buildkit       2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/build/Dockerfile.regsync.buildkit       2025-06-30 
16:25:30.000000000 +0200
@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1
 
 ARG REGISTRY=docker.io
-ARG 
ALPINE_VER=3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
-ARG 
GO_VER=1.24.2-alpine@sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754ce3f2f00041ccee
-ARG ECR_HELPER_VER=cd2afdedf490100366f90313283ff8a1b240c419
-ARG GCR_HELPER_VER=v2.1.28
+ARG 
ALPINE_VER=3.22.0@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715
+ARG 
GO_VER=1.24.4-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a
+ARG ECR_HELPER_VER=96d88b484b17635a8ce06b0605e9ba1b2a0c85f6
+ARG GCR_HELPER_VER=v2.1.30
 
 FROM --platform=$BUILDPLATFORM ${REGISTRY}/library/golang:${GO_VER} AS golang
 RUN apk add --no-cache \
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/build/oci-image.sh 
new/regclient-0.9.0/build/oci-image.sh
--- old/regclient-0.8.3/build/oci-image.sh      2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/build/oci-image.sh      2025-06-30 16:25:30.000000000 
+0200
@@ -7,7 +7,7 @@
 release="scratch"
 push_tags=""
 ALPINE_NAME="alpine:3"
-ALPINE_DIGEST="sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c"
 # 3.21.3
+ALPINE_DIGEST="sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715"
 # 3.22.0
 
 # CLI options to override image, platform, base digest, and comma separated 
list of tags to push
 opt_c=0
@@ -81,7 +81,7 @@
 fi
 docker buildx build --platform="$platforms" \
   -f "build/Dockerfile.${image}.buildkit" \
-  -o "type=oci,dest=output/${image}-${release}.tar" \
+  -o "type=oci,oci-artifact=true,dest=output/${image}-${release}.tar" \
   --target "release-${release}" \
   --build-arg "SOURCE_DATE_EPOCH=${vcs_sec}" \
   --build-arg "BUILD_DATE=${vcs_date}" \
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/build/reproduce.sh 
new/regclient-0.9.0/build/reproduce.sh
--- old/regclient-0.8.3/build/reproduce.sh      1970-01-01 01:00:00.000000000 
+0100
+++ new/regclient-0.9.0/build/reproduce.sh      2025-06-30 16:25:30.000000000 
+0200
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+set -e
+cd "$(dirname $0)/.."
+
+if [ $# != 1 ] || [ "$1" !=  "${1##-}" ]; then
+  echo "usage: $0 [regclient_image_name]" >&2
+  exit 1
+fi
+
+image_info="$(regctl manifest get "$1" --format '
+  {{- println ( index .Annotations "org.opencontainers.image.revision" ) }} 
+  {{- println ( index .Annotations "org.opencontainers.image.title" ) }} 
+  {{- println ( index .Annotations "org.opencontainers.image.description" ) }} 
+  {{- println .GetDescriptor.Digest }}')"
+
+commit="$(echo "${image_info}" | sed -n 1p)"
+sub_image="$(echo "${image_info}" | sed -n 2p)"
+description="$(echo "${image_info}" | sed -n 3p)"
+digest="$(echo "${image_info}" | sed -n 4p)"
+
+# checkout the repo at the commit to reproduce
+git switch -d "$commit" >/dev/null
+
+# make the oci images
+make "oci-image-${sub_image}"
+
+scratch_desc="$(regctl manifest get ocidir://output/${sub_image}:scratch 
--format '{{ index .Annotations "org.opencontainers.image.description" }}')"
+scratch_digest="$(regctl image digest ocidir://output/${sub_image}:scratch)"
+alpine_desc="$(regctl manifest get ocidir://output/${sub_image}:alpine 
--format '{{ index .Annotations "org.opencontainers.image.description" }}')"
+alpine_digest="$(regctl image digest ocidir://output/${sub_image}:alpine)"
+
+rc=0
+if [ "$description" = "$scratch_desc" ] && [ "$digest" = "$scratch_digest" ]; 
then
+  echo "\033[32mScratch image reproduced.\033[0m"
+  echo "$digest: $description"
+elif [ "$description" = "$alpine_desc" ] && [ "$digest" = "$alpine_digest" ]; 
then
+  echo "\033[32mAlpine image reproduced.\033[0m"
+  echo "$digest: $description"
+else
+  echo "\033[31mFailed to reproduce!\033[0m"
+  echo "Expected: $digest: $description"
+  echo "Found:    $scratch_digest: $scratch_desc"
+  echo "Found:    $alpine_digest: $alpine_desc"
+  rc=2
+fi
+
+# revert the git repo
+git switch - >/dev/null
+
+exit $rc
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/cmd/regbot/config.go 
new/regclient-0.9.0/cmd/regbot/config.go
--- old/regclient-0.8.3/cmd/regbot/config.go    2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/cmd/regbot/config.go    2025-06-30 16:25:30.000000000 
+0200
@@ -6,7 +6,7 @@
        "os"
        "time"
 
-       "gopkg.in/yaml.v3"
+       "github.com/goccy/go-yaml"
 
        "github.com/regclient/regclient/config"
        "github.com/regclient/regclient/pkg/template"
@@ -53,7 +53,7 @@
 // ConfigLoadReader reads the config from an io.Reader
 func ConfigLoadReader(r io.Reader) (*Config, error) {
        c := ConfigNew()
-       if err := yaml.NewDecoder(r).Decode(c); err != nil && !errors.Is(err, 
io.EOF) {
+       if err := yaml.NewDecoder(r, yaml.AllowDuplicateMapKey()).Decode(c); 
err != nil && !errors.Is(err, io.EOF) {
                return nil, err
        }
        // verify loaded version is not higher than supported version
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/cmd/regbot/testdata/config1.yml 
new/regclient-0.9.0/cmd/regbot/testdata/config1.yml
--- old/regclient-0.8.3/cmd/regbot/testdata/config1.yml 2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/cmd/regbot/testdata/config1.yml 2025-06-30 
16:25:30.000000000 +0200
@@ -6,9 +6,12 @@
   parallel: 2
   interval: 60m
   timeout: 600s
+x-anchor: &anchor
+  name: this is overridden
+  timeout: 1m
 scripts:
-  - name: hello world
-    timeout: 1m
+  - <<: *anchor
+    name: hello world
     script: |
       log("hello world")
   - name: top of the hour
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/cmd/regsync/config.go 
new/regclient-0.9.0/cmd/regsync/config.go
--- old/regclient-0.8.3/cmd/regsync/config.go   2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/cmd/regsync/config.go   2025-06-30 16:25:30.000000000 
+0200
@@ -6,7 +6,7 @@
        "os"
        "time"
 
-       "gopkg.in/yaml.v3"
+       "github.com/goccy/go-yaml"
 
        "github.com/regclient/regclient/config"
        "github.com/regclient/regclient/pkg/template"
@@ -122,7 +122,7 @@
 // ConfigLoadReader reads the config from an io.Reader
 func ConfigLoadReader(r io.Reader) (*Config, error) {
        c := ConfigNew()
-       if err := yaml.NewDecoder(r).Decode(c); err != nil && !errors.Is(err, 
io.EOF) {
+       if err := yaml.NewDecoder(r, yaml.AllowDuplicateMapKey()).Decode(c); 
err != nil && !errors.Is(err, io.EOF) {
                return nil, err
        }
        // verify loaded version is not higher than supported version
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/cmd/regsync/testdata/config1.yml 
new/regclient-0.9.0/cmd/regsync/testdata/config1.yml
--- old/regclient-0.8.3/cmd/regsync/testdata/config1.yml        2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/cmd/regsync/testdata/config1.yml        2025-06-30 
16:25:30.000000000 +0200
@@ -14,6 +14,7 @@
   cacheTime: "5m"
 x-sync-hub: &sync-hub
   target: registry:5000/hub/{{ .Sync.Source }}
+  type: image
 x-sync-gcr: &sync-gcr
   target: registry:5000/gcr/{{ index (split .Sync.Source "gcr.io/") 1 }}
 sync:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/go.mod new/regclient-0.9.0/go.mod
--- old/regclient-0.8.3/go.mod  2025-04-23 21:16:08.000000000 +0200
+++ new/regclient-0.9.0/go.mod  2025-06-30 16:25:30.000000000 +0200
@@ -1,9 +1,10 @@
 module github.com/regclient/regclient
 
-go 1.22
+go 1.23.0
 
 require (
        github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7
+       github.com/goccy/go-yaml v1.18.0
        github.com/klauspost/compress v1.18.0
        github.com/olareg/olareg v0.1.2
        github.com/opencontainers/go-digest v1.0.0
@@ -12,9 +13,8 @@
        github.com/spf13/cobra v1.9.1
        github.com/ulikunitz/xz v0.5.12
        github.com/yuin/gopher-lua v1.1.1
-       golang.org/x/sys v0.30.0
-       golang.org/x/term v0.29.0
-       gopkg.in/yaml.v3 v3.0.1
+       golang.org/x/sys v0.33.0
+       golang.org/x/term v0.32.0
 )
 
 require (
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/go.sum new/regclient-0.9.0/go.sum
--- old/regclient-0.8.3/go.sum  2025-04-23 21:16:08.000000000 +0200
+++ new/regclient-0.9.0/go.sum  2025-06-30 16:25:30.000000000 +0200
@@ -4,6 +4,8 @@
 github.com/davecgh/go-spew v1.1.1/go.mod 
h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 
h1:UhxFibDNY/bfvqU5CAUmr9zpesgbU6SWc8/B4mflAE4=
 github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod 
h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
+github.com/goccy/go-yaml v1.18.0 
h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
+github.com/goccy/go-yaml v1.18.0/go.mod 
h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/inconshreveable/mousetrap v1.1.0 
h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod 
h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/klauspost/compress v1.18.0 
h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
@@ -31,11 +33,10 @@
 github.com/yuin/gopher-lua v1.1.1 
h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
 github.com/yuin/gopher-lua v1.1.1/go.mod 
h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod 
h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
-golang.org/x/term v0.29.0/go.mod 
h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 
h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.32.0/go.mod 
h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod 
h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod 
h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/mod/manifest.go 
new/regclient-0.9.0/mod/manifest.go
--- old/regclient-0.8.3/mod/manifest.go 2025-04-23 21:16:08.000000000 +0200
+++ new/regclient-0.9.0/mod/manifest.go 2025-06-30 16:25:30.000000000 +0200
@@ -528,17 +528,20 @@
                                                return fmt.Errorf("could not 
find digest, convert referrers before other mod actions, digest=%s", 
desc.Annotations[dockerReferenceDigest])
                                        }
                                        // validate the manifest being converted
-                                       _, ok = childDM.m.(manifest.Subjecter)
+                                       sm, ok := childDM.m.(manifest.Subjecter)
                                        if !ok {
                                                return fmt.Errorf("docker 
reference type does not support subject, mt=%s", 
childDM.m.GetDescriptor().MediaType)
                                        }
-                                       am, ok := childDM.m.(manifest.Annotator)
-                                       if !ok {
-                                               return fmt.Errorf("docker 
reference type does not support annotations, mt=%s", 
childDM.m.GetDescriptor().MediaType)
-                                       }
-                                       err := 
am.SetAnnotation(dockerReferenceType, desc.Annotations[dockerReferenceType])
-                                       if err != nil {
-                                               return fmt.Errorf("failed to 
set annotations: %w", err)
+                                       if subj, err := sm.GetSubject(); err != 
nil || subj == nil || subj.Digest.String() != 
desc.Annotations[dockerReferenceDigest] {
+                                               // only add annotation for 
docker's first style of attestations
+                                               am, ok := 
childDM.m.(manifest.Annotator)
+                                               if !ok {
+                                                       return 
fmt.Errorf("docker reference type does not support annotations, mt=%s", 
childDM.m.GetDescriptor().MediaType)
+                                               }
+                                               err := 
am.SetAnnotation(dockerReferenceType, desc.Annotations[dockerReferenceType])
+                                               if err != nil {
+                                                       return 
fmt.Errorf("failed to set annotations: %w", err)
+                                               }
                                        }
                                        // copy childDM to add a referrer entry 
to the targetDM
                                        referrerDM := *childDM
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/release.md 
new/regclient-0.9.0/release.md
--- old/regclient-0.8.3/release.md      2025-04-23 21:16:08.000000000 +0200
+++ new/regclient-0.9.0/release.md      2025-06-30 16:25:30.000000000 +0200
@@ -1,42 +1,33 @@
-# Release v0.8.3
+# Release v0.9.0
+
+Breaking:
+
+- Drop support for 3rd Go release because of upstream forced upgrades (see 
<https://github.com/golang/go/issues/69095>). ([PR 948][pr-948])
 
 Features:
 
-- Add `ref.AddDigest` method that does not unset the tag. ([PR 910][pr-910])
-- Adding a `regctl registry whoami` command. ([PR 912][pr-912])
-- Improve `regctl image check-base` output. ([PR 917][pr-917])
-- regsync option to abort on errors. ([PR 924][pr-924])
-- Improve fallback tag handling. ([PR 925][pr-925])
-- regctl flag to ignore missing images on delete. ([PR 930][pr-930])
+- Add a script to reproduce regclient images. ([PR 940][pr-940])
+- Support IPv6 hosts. ([PR 956][pr-956])
 
 Fixes:
 
-- Validate registry names. ([PR 911][pr-911])
-- Escape regexp example. ([PR 920][pr-920])
-- Auth header parsing. ([PR 936][pr-936])
-
-Changes:
-
-- Update supported Go releases to 1.22, 1.23, and 1.24. ([PR 909][pr-909])
-- Modernize Go to the 1.22 specs. ([PR 910][pr-910])
-- Refactor cobra commands. ([PR 915][pr-915])
-- Include Docker Hub repository documentation. ([PR 918][pr-918])
-- Move documentation pointers to the website. ([PR 939][pr-939])
+- Convert  docker attestations built with `oci-artifact=true`. ([PR 
949][pr-949])
+- Allow duplicate keys in yaml config. ([PR 952][pr-952])
+
+Miscellaneous:
+
+- Migrate yaml library. ([PR 947][pr-947])
+- Convert the build to use OCI style attestations. ([PR 950][pr-950])
 
 Contributors:
 
+- @JimmyMa
 - @sudo-bmitch
 
-[pr-909]: https://github.com/regclient/regclient/pull/909
-[pr-910]: https://github.com/regclient/regclient/pull/910
-[pr-911]: https://github.com/regclient/regclient/pull/911
-[pr-912]: https://github.com/regclient/regclient/pull/912
-[pr-915]: https://github.com/regclient/regclient/pull/915
-[pr-917]: https://github.com/regclient/regclient/pull/917
-[pr-918]: https://github.com/regclient/regclient/pull/918
-[pr-920]: https://github.com/regclient/regclient/pull/920
-[pr-924]: https://github.com/regclient/regclient/pull/924
-[pr-925]: https://github.com/regclient/regclient/pull/925
-[pr-930]: https://github.com/regclient/regclient/pull/930
-[pr-936]: https://github.com/regclient/regclient/pull/936
-[pr-939]: https://github.com/regclient/regclient/pull/939
+[pr-940]: https://github.com/regclient/regclient/pull/940
+[pr-947]: https://github.com/regclient/regclient/pull/947
+[pr-948]: https://github.com/regclient/regclient/pull/948
+[pr-949]: https://github.com/regclient/regclient/pull/949
+[pr-950]: https://github.com/regclient/regclient/pull/950
+[pr-952]: https://github.com/regclient/regclient/pull/952
+[pr-956]: https://github.com/regclient/regclient/pull/956
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/testdata/build-testrepo.sh 
new/regclient-0.9.0/testdata/build-testrepo.sh
--- old/regclient-0.8.3/testdata/build-testrepo.sh      2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/testdata/build-testrepo.sh      2025-06-30 
16:25:30.000000000 +0200
@@ -66,12 +66,18 @@
     --replace "ocidir://testrepo:v${i}"
 done
 
-# create a docker artifact on v1
+# create docker-like attestations on v1
 echo scripted build | regctl artifact put \
   --media-type application/vnd.oci.image.manifest.v1+json \
   --config-type application/vnd.oci.image.config.v1+json \
   --file-media-type application/vnd.example.build-type+json \
   ocidir://testrepo:a-docker
+echo scripted oci build | regctl artifact put \
+  --media-type application/vnd.oci.image.manifest.v1+json \
+  --config-type application/vnd.oci.image.config.v1+json \
+  --file-media-type application/vnd.example.build-type+json \
+  --subject ocidir://testrepo:v1 --platform linux/arm64 \
+  ocidir://testrepo:a-docker-oci
 regctl index add \
   --ref "ocidir://testrepo:a-docker" \
   --desc-annotation "vnd.docker.reference.type=builder" \
@@ -79,7 +85,7 @@
   --desc-platform "unknown/unknown" \
   ocidir://testrepo:v1
 regctl index add \
-  --ref "ocidir://testrepo:a-docker" \
+  --ref "ocidir://testrepo:a-docker-oci" \
   --desc-annotation "vnd.docker.reference.type=builder" \
   --desc-annotation "vnd.docker.reference.digest=$(regctl image digest 
--platform linux/arm64 ocidir://testrepo:v1)" \
   --desc-platform "unknown/unknown" \
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/190c9253f7a319f0d7f7b8cdd8c63894051be55aeb0c319555e5d075b229cf09
 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/190c9253f7a319f0d7f7b8cdd8c63894051be55aeb0c319555e5d075b229cf09
--- 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/190c9253f7a319f0d7f7b8cdd8c63894051be55aeb0c319555e5d075b229cf09
 2025-04-23 21:16:08.000000000 +0200
+++ 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/190c9253f7a319f0d7f7b8cdd8c63894051be55aeb0c319555e5d075b229cf09
 1970-01-01 01:00:00.000000000 +0100
@@ -1 +0,0 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:1effc9d48232693f4584ceb9c5e8d84ddeb5924ea4aff341aa8204510422f668","size":556,"platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:7e87ffc91b9ceafa85be2777b16b1be10e4664fd4f3acc86e4295b97da5163ba","size":556,"platform":{"architecture":"arm64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:43089316cfeec5c2f7897591f5925167afda21932cf71a1a1264684930e7b40a","size":394,"annotations":{"vnd.docker.reference.digest":"sha256:1effc9d48232693f4584ceb9c5e8d84ddeb5924ea4aff341aa8204510422f668","vnd.docker.reference.type":"builder"},"platform":{"architecture":"unknown","os":"unknown"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:43089316cfeec5c2f7897591f5925167afda21932cf71a1a1264684930e7b40a","s
 
ize":394,"annotations":{"vnd.docker.reference.digest":"sha256:7e87ffc91b9ceafa85be2777b16b1be10e4664fd4f3acc86e4295b97da5163ba","vnd.docker.reference.type":"builder"},"platform":{"architecture":"unknown","os":"unknown"}}],"annotations":{"org.example.version":"v1"}}
\ No newline at end of file
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/4351e6ebc634e14112ef5b1d4eee41a52269efdae8856560a74bc5547e01de0a
 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/4351e6ebc634e14112ef5b1d4eee41a52269efdae8856560a74bc5547e01de0a
--- 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/4351e6ebc634e14112ef5b1d4eee41a52269efdae8856560a74bc5547e01de0a
 1970-01-01 01:00:00.000000000 +0100
+++ 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/4351e6ebc634e14112ef5b1d4eee41a52269efdae8856560a74bc5547e01de0a
 2025-06-30 16:25:30.000000000 +0200
@@ -0,0 +1 @@
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:d910434391624641a9398ec921067e2dbd9a76aac69f120257906f811f0eecb8","size":557,"artifactType":"application/vnd.oci.image.config.v1+json"}]}
\ No newline at end of file
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/7ceb9b6bcc274697d0c38be6214b50cec79d601bc61708747d3f6cb772f6c6fa
 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/7ceb9b6bcc274697d0c38be6214b50cec79d601bc61708747d3f6cb772f6c6fa
--- 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/7ceb9b6bcc274697d0c38be6214b50cec79d601bc61708747d3f6cb772f6c6fa
 1970-01-01 01:00:00.000000000 +0100
+++ 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/7ceb9b6bcc274697d0c38be6214b50cec79d601bc61708747d3f6cb772f6c6fa
 2025-06-30 16:25:30.000000000 +0200
@@ -0,0 +1 @@
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:1effc9d48232693f4584ceb9c5e8d84ddeb5924ea4aff341aa8204510422f668","size":556,"platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:7e87ffc91b9ceafa85be2777b16b1be10e4664fd4f3acc86e4295b97da5163ba","size":556,"platform":{"architecture":"arm64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:43089316cfeec5c2f7897591f5925167afda21932cf71a1a1264684930e7b40a","size":394,"annotations":{"vnd.docker.reference.digest":"sha256:1effc9d48232693f4584ceb9c5e8d84ddeb5924ea4aff341aa8204510422f668","vnd.docker.reference.type":"builder"},"platform":{"architecture":"unknown","os":"unknown"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:d910434391624641a9398ec921067e2dbd9a76aac69f120257906f811f0eecb8","s
 
ize":557,"annotations":{"vnd.docker.reference.digest":"sha256:7e87ffc91b9ceafa85be2777b16b1be10e4664fd4f3acc86e4295b97da5163ba","vnd.docker.reference.type":"builder"},"platform":{"architecture":"unknown","os":"unknown"}}],"annotations":{"org.example.version":"v1"}}
\ No newline at end of file
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/a250739e095df37714b62f15180106e98a6981a6d17777c2f30b7bf282015120
 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/a250739e095df37714b62f15180106e98a6981a6d17777c2f30b7bf282015120
--- 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/a250739e095df37714b62f15180106e98a6981a6d17777c2f30b7bf282015120
 1970-01-01 01:00:00.000000000 +0100
+++ 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/a250739e095df37714b62f15180106e98a6981a6d17777c2f30b7bf282015120
 2025-06-30 16:25:30.000000000 +0200
@@ -0,0 +1 @@
+scripted oci build
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/d910434391624641a9398ec921067e2dbd9a76aac69f120257906f811f0eecb8
 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/d910434391624641a9398ec921067e2dbd9a76aac69f120257906f811f0eecb8
--- 
old/regclient-0.8.3/testdata/testrepo/blobs/sha256/d910434391624641a9398ec921067e2dbd9a76aac69f120257906f811f0eecb8
 1970-01-01 01:00:00.000000000 +0100
+++ 
new/regclient-0.9.0/testdata/testrepo/blobs/sha256/d910434391624641a9398ec921067e2dbd9a76aac69f120257906f811f0eecb8
 2025-06-30 16:25:30.000000000 +0200
@@ -0,0 +1 @@
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2},"layers":[{"mediaType":"application/vnd.example.build-type+json","digest":"sha256:a250739e095df37714b62f15180106e98a6981a6d17777c2f30b7bf282015120","size":19}],"subject":{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:7e87ffc91b9ceafa85be2777b16b1be10e4664fd4f3acc86e4295b97da5163ba","size":556}}
\ No newline at end of file
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/testdata/testrepo/index.json 
new/regclient-0.9.0/testdata/testrepo/index.json
--- old/regclient-0.8.3/testdata/testrepo/index.json    2025-04-23 
21:16:08.000000000 +0200
+++ new/regclient-0.9.0/testdata/testrepo/index.json    2025-06-30 
16:25:30.000000000 +0200
@@ -1 +1 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:119b4a63feeda91d4874578e7883994fc45772dd912aa49ba380f87507f6ad07","size":964,"annotations":{"org.opencontainers.image.ref.name":"b1"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:87144634443f628331e98f5c8536a7c20a3aa4e26b1fc8676a0c27e10a545c20","size":964,"annotations":{"org.opencontainers.image.ref.name":"b2"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:caf692c7d56cfd226e5d04b0908b544e926ddf4f34ec888fe7646d39a3e63c28","size":964,"annotations":{"org.opencontainers.image.ref.name":"b3"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:190c9253f7a319f0d7f7b8cdd8c63894051be55aeb0c319555e5d075b229cf09","size":1262,"annotations":{"org.opencontainers.image.ref.name":"v1"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:dfae8f4257
 
35a5e3a72e40d6609e03079995511d48157c74d54801ff4430491e","size":934,"annotations":{"org.opencontainers.image.ref.name":"v2"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:6fe828b32b9b4572f32b16c1c0a4d675660b19ec207d010724309374252c2d6d","size":1153,"annotations":{"org.opencontainers.image.ref.name":"v3"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:43089316cfeec5c2f7897591f5925167afda21932cf71a1a1264684930e7b40a","size":394,"annotations":{"org.opencontainers.image.ref.name":"a-docker"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:0484e93c23cddf24a8400547119558312023295af241d4cd1eaf1b27145c5026","size":583,"annotations":{"org.opencontainers.image.ref.name":"a1"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:955b8a891713a806107edb6dd09410233a9e7926584b1d6fd8b7b5342296188b","size":482,"annotations":{"org.opencontainers.image.ref.name":"sha256-dfae8f425735a5e3a72e40d6609e03
 
079995511d48157c74d54801ff4430491e"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:741132f956e196c3858dab17e50ea977056f2f1ce1ad2900f11f4c8ff2d4203b","size":588,"annotations":{"org.opencontainers.image.ref.name":"a2"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:41d51f3b861a4e941c3768285cdca0d1ffdad6cb25f4614d21ebe5bee700fb4b","size":282,"annotations":{"org.opencontainers.image.ref.name":"sha256-ee378b79279b57eb5ac1f3b892c9ad2a9be9d9ccabe1a29a9cbaed8cad182358"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:98291b121cf58a0e8e0731de7e31b8a5c81e39eb55706cb7710ad6c79d53e996","size":282,"annotations":{"org.opencontainers.image.ref.name":"sha256-36ed7f4ec4545a40ca043f60d76653ef3d2a76f58a051c0f3a256aaab26fb847"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:7ee385b1056dcaf891f34e1eb98b830bb2ad0d75d4c5a9207a2cb4439e9329ac","size":282,"annotations":{"org.opencontainers.image.ref.nam
 
e":"sha256-6bed79d0800a0d3a1d0e0e8105a6a5f7f7758ce09e160a8f142574c418302467"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:df85221e1519ae86965f239606c33730d51602836dc45ad48e15b26383c648e4","size":499,"annotations":{"org.opencontainers.image.ref.name":"ai"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:905693978d033f94767ce99edd9a3b285853343c148a4057cf00d47c67f9fb83","size":417,"annotations":{"org.opencontainers.image.ref.name":"a-example"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:6fe828b32b9b4572f32b16c1c0a4d675660b19ec207d010724309374252c2d6d","size":1153,"annotations":{"org.opencontainers.image.ref.name":"sha256-190c9253f7a319f0d7f7b8cdd8c63894051be55aeb0c319555e5d075b229cf09.6fe828b32b9b4572.meta"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:8e54c6754f08d22f85c7552bb1951b228b8194d29b14a1639dbe50868da0273e","size":415,"annotations":{"org.opencontainers.image.re
 
f.name":"child"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:d69399e05204fac05b0184eef72e984538cdc9c5854a6484e8852e4357c543cb","size":445,"annotations":{"org.opencontainers.image.ref.name":"loop"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:fdc0d9052a90792725e4fd8ba287fca2be6748d8b1e127ac7f82954449399912","size":279,"annotations":{"org.opencontainers.image.ref.name":"sha256-8e54c6754f08d22f85c7552bb1951b228b8194d29b14a1639dbe50868da0273e"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:0514ce64171e869a0b065fa1ce1b533e82808c9228d5b97ea6e3ef2e026d9aed","size":417,"annotations":{"org.opencontainers.image.ref.name":"mirror"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:0514ce64171e869a0b065fa1ce1b533e82808c9228d5b97ea6e3ef2e026d9aed","size":417,"annotations":{"org.opencontainers.image.ref.name":"sha256-0514ce64171e869a0b065fa1ce1b533e82808c9228d5b97ea6e3ef2e026d9aed"}},{
 
"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:2a25aa502b5155860847e5b3528b8839fee45514b3ed1dd67ed8c3d42efefd53","size":876,"annotations":{"org.opencontainers.image.ref.name":"a3"}}]}
\ No newline at end of file
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:119b4a63feeda91d4874578e7883994fc45772dd912aa49ba380f87507f6ad07","size":964,"annotations":{"org.opencontainers.image.ref.name":"b1"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:87144634443f628331e98f5c8536a7c20a3aa4e26b1fc8676a0c27e10a545c20","size":964,"annotations":{"org.opencontainers.image.ref.name":"b2"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:caf692c7d56cfd226e5d04b0908b544e926ddf4f34ec888fe7646d39a3e63c28","size":964,"annotations":{"org.opencontainers.image.ref.name":"b3"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:7ceb9b6bcc274697d0c38be6214b50cec79d601bc61708747d3f6cb772f6c6fa","size":1262,"annotations":{"org.opencontainers.image.ref.name":"v1"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:dfae8f4257
 
35a5e3a72e40d6609e03079995511d48157c74d54801ff4430491e","size":934,"annotations":{"org.opencontainers.image.ref.name":"v2"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:6fe828b32b9b4572f32b16c1c0a4d675660b19ec207d010724309374252c2d6d","size":1153,"annotations":{"org.opencontainers.image.ref.name":"v3"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:43089316cfeec5c2f7897591f5925167afda21932cf71a1a1264684930e7b40a","size":394,"annotations":{"org.opencontainers.image.ref.name":"a-docker"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:d910434391624641a9398ec921067e2dbd9a76aac69f120257906f811f0eecb8","size":557,"annotations":{"org.opencontainers.image.ref.name":"a-docker-oci"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:4351e6ebc634e14112ef5b1d4eee41a52269efdae8856560a74bc5547e01de0a","size":298,"annotations":{"org.opencontainers.image.ref.name":"sha256-7e87ffc91b9ceafa85be
 
2777b16b1be10e4664fd4f3acc86e4295b97da5163ba"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:0484e93c23cddf24a8400547119558312023295af241d4cd1eaf1b27145c5026","size":583,"annotations":{"org.opencontainers.image.ref.name":"a1"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:955b8a891713a806107edb6dd09410233a9e7926584b1d6fd8b7b5342296188b","size":482,"annotations":{"org.opencontainers.image.ref.name":"sha256-dfae8f425735a5e3a72e40d6609e03079995511d48157c74d54801ff4430491e"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:741132f956e196c3858dab17e50ea977056f2f1ce1ad2900f11f4c8ff2d4203b","size":588,"annotations":{"org.opencontainers.image.ref.name":"a2"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:41d51f3b861a4e941c3768285cdca0d1ffdad6cb25f4614d21ebe5bee700fb4b","size":282,"annotations":{"org.opencontainers.image.ref.name":"sha256-ee378b79279b57eb5ac1f3b892c9ad2a9be9d9ccabe1a
 
29a9cbaed8cad182358"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:98291b121cf58a0e8e0731de7e31b8a5c81e39eb55706cb7710ad6c79d53e996","size":282,"annotations":{"org.opencontainers.image.ref.name":"sha256-36ed7f4ec4545a40ca043f60d76653ef3d2a76f58a051c0f3a256aaab26fb847"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:7ee385b1056dcaf891f34e1eb98b830bb2ad0d75d4c5a9207a2cb4439e9329ac","size":282,"annotations":{"org.opencontainers.image.ref.name":"sha256-6bed79d0800a0d3a1d0e0e8105a6a5f7f7758ce09e160a8f142574c418302467"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:2a25aa502b5155860847e5b3528b8839fee45514b3ed1dd67ed8c3d42efefd53","size":876,"annotations":{"org.opencontainers.image.ref.name":"a3"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:df85221e1519ae86965f239606c33730d51602836dc45ad48e15b26383c648e4","size":499,"annotations":{"org.opencontainers.image.ref.name":"ai"}},{"med
 
iaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:905693978d033f94767ce99edd9a3b285853343c148a4057cf00d47c67f9fb83","size":417,"annotations":{"org.opencontainers.image.ref.name":"a-example"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:6fe828b32b9b4572f32b16c1c0a4d675660b19ec207d010724309374252c2d6d","size":1153,"annotations":{"org.opencontainers.image.ref.name":"sha256-7ceb9b6bcc274697d0c38be6214b50cec79d601bc61708747d3f6cb772f6c6fa.6fe828b32b9b4572.meta"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:8e54c6754f08d22f85c7552bb1951b228b8194d29b14a1639dbe50868da0273e","size":415,"annotations":{"org.opencontainers.image.ref.name":"child"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":"sha256:d69399e05204fac05b0184eef72e984538cdc9c5854a6484e8852e4357c543cb","size":445,"annotations":{"org.opencontainers.image.ref.name":"loop"}},{"mediaType":"application/vnd.oci.image.index.v1+json","digest":
 
"sha256:fdc0d9052a90792725e4fd8ba287fca2be6748d8b1e127ac7f82954449399912","size":279,"annotations":{"org.opencontainers.image.ref.name":"sha256-8e54c6754f08d22f85c7552bb1951b228b8194d29b14a1639dbe50868da0273e"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:0514ce64171e869a0b065fa1ce1b533e82808c9228d5b97ea6e3ef2e026d9aed","size":417,"annotations":{"org.opencontainers.image.ref.name":"mirror"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:0514ce64171e869a0b065fa1ce1b533e82808c9228d5b97ea6e3ef2e026d9aed","size":417,"annotations":{"org.opencontainers.image.ref.name":"sha256-0514ce64171e869a0b065fa1ce1b533e82808c9228d5b97ea6e3ef2e026d9aed"}}]}
\ No newline at end of file
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/types/ref/ref.go 
new/regclient-0.9.0/types/ref/ref.go
--- old/regclient-0.8.3/types/ref/ref.go        2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/types/ref/ref.go        2025-06-30 16:25:30.000000000 
+0200
@@ -23,18 +23,29 @@
 )
 
 var (
-       hostPartS   = `(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)`
-       hostPortS   = `(?:` + hostPartS + `(?:` + regexp.QuoteMeta(`.`) + 
hostPartS + `)*` + regexp.QuoteMeta(`.`) + `?` + regexp.QuoteMeta(`:`) + 
`[0-9]+)`
+       hostPartS = `(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)`
+       portS     = `(?:` + regexp.QuoteMeta(`:`) + `[0-9]+)`
+       ipv6PartS = `(?:[0-9a-fA-F]{1,4}:){0,7}[0-9a-fA-F]{1,4}`
+       ipv6S     = `(?:` + regexp.QuoteMeta(`[`) + `(?:` +
+               ipv6PartS + `|` + // uncompressed
+               regexp.QuoteMeta(`::`) + ipv6PartS + `|` + // prefix compressed
+               ipv6PartS + regexp.QuoteMeta(`::`) + ipv6PartS + `|` + // 
middle compressed
+               ipv6PartS + regexp.QuoteMeta(`::`) + // suffix compressed
+               `)` + regexp.QuoteMeta(`]`) + `)`
+       localhostS  = `localhost`
        hostDomainS = `(?:` + hostPartS + `(?:(?:` + regexp.QuoteMeta(`.`) + 
hostPartS + `)+` + regexp.QuoteMeta(`.`) + `?|` + regexp.QuoteMeta(`.`) + `))`
        hostUpperS  = 
`(?:[a-zA-Z0-9]*[A-Z][a-zA-Z0-9-]*[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[A-Z][a-zA-Z0-9]*)`
-       registryS   = `(?:` + hostDomainS + `|` + hostPortS + `|` + hostUpperS 
+ `|localhost(?:` + regexp.QuoteMeta(`:`) + `[0-9]+)?)`
-       repoPartS   = `[a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*`
-       pathS       = `[/a-zA-Z0-9_\-. ~\+]+`
-       tagS        = `[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}`
-       digestS     = 
`[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}`
-       schemeRE    = regexp.MustCompile(`^([a-z]+)://(.+)$`)
-       registryRE  = regexp.MustCompile(`^(` + registryS + `)$`)
-       refRE       = regexp.MustCompile(`^(?:(` + registryS + `)` + 
regexp.QuoteMeta(`/`) + `)?` +
+       registryS   = `(?:` +
+               `(?:` + hostDomainS + `|` + hostUpperS + `|` + ipv6S + `|` + 
localhostS + `)` + portS + `?|` + // name with dotted domain, upper case, or 
IPv6 with optional port
+               hostPartS + portS + // a short name with required port
+               `)`
+       repoPartS  = `[a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*`
+       pathS      = `[/a-zA-Z0-9_\-. ~\+]+`
+       tagS       = `[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}`
+       digestS    = 
`[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}`
+       schemeRE   = regexp.MustCompile(`^([a-z]+)://(.+)$`)
+       registryRE = regexp.MustCompile(`^(` + registryS + `)$`)
+       refRE      = regexp.MustCompile(`^(?:(` + registryS + `)` + 
regexp.QuoteMeta(`/`) + `)?` +
                `(` + repoPartS + `(?:` + regexp.QuoteMeta(`/`) + repoPartS + 
`)*)` +
                `(?:` + regexp.QuoteMeta(`:`) + `(` + tagS + `))?` +
                `(?:` + regexp.QuoteMeta(`@`) + `(` + digestS + `))?$`)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/regclient-0.8.3/types/ref/ref_test.go 
new/regclient-0.9.0/types/ref/ref_test.go
--- old/regclient-0.8.3/types/ref/ref_test.go   2025-04-23 21:16:08.000000000 
+0200
+++ new/regclient-0.9.0/types/ref/ref_test.go   2025-06-30 16:25:30.000000000 
+0200
@@ -222,6 +222,39 @@
                        wantE:      nil,
                },
                {
+                       name:       "ipv6 localhost address registry",
+                       ref:        "[::1]:5000/image:v42",
+                       scheme:     "reg",
+                       registry:   "[::1]:5000",
+                       repository: "image",
+                       tag:        "v42",
+                       digest:     "",
+                       path:       "",
+                       wantE:      nil,
+               },
+               {
+                       name:       "ipv6 address registry",
+                       ref:        
"[fddd:1222:1222:1222::ac29:5a6a]:5000/image:v42",
+                       scheme:     "reg",
+                       registry:   "[fddd:1222:1222:1222::ac29:5a6a]:5000",
+                       repository: "image",
+                       tag:        "v42",
+                       digest:     "",
+                       path:       "",
+                       wantE:      nil,
+               },
+               {
+                       name:       "ipv6 address registry without port",
+                       ref:        
"[fddd:1222:1222:1222::ac29:5a6a]/image:v42",
+                       scheme:     "reg",
+                       registry:   "[fddd:1222:1222:1222::ac29:5a6a]",
+                       repository: "image",
+                       tag:        "v42",
+                       digest:     "",
+                       path:       "",
+                       wantE:      nil,
+               },
+               {
                        name:       "Port registry digest",
                        ref:        "registry:5000/group/image@" + testDigest,
                        scheme:     "reg",
@@ -330,6 +363,16 @@
                        wantE: errs.ErrInvalidReference,
                },
                {
+                       name:  "invalid ipv6 compression",
+                       ref:   "[1::2::3]/project/image:tag",
+                       wantE: errs.ErrInvalidReference,
+               },
+               {
+                       name:  "invalid ipv6 missing brackets",
+                       ref:   "::1/project/image:tag",
+                       wantE: errs.ErrInvalidReference,
+               },
+               {
                        name:  "invalid repo case",
                        ref:   "docker.io/Upper/Case/Repo:tag",
                        wantE: errs.ErrInvalidReference,
@@ -522,6 +565,30 @@
                        wantE:    nil,
                },
                {
+                       name:     "ipv6 compressed address registry",
+                       host:     "[::1]:5000",
+                       scheme:   "reg",
+                       registry: "[::1]:5000",
+                       path:     "",
+                       wantE:    nil,
+               },
+               {
+                       name:     "ipv6 address registry",
+                       host:     "[fddd:1222:1222:1222::ac29:5a6a]:5000",
+                       scheme:   "reg",
+                       registry: "[fddd:1222:1222:1222::ac29:5a6a]:5000",
+                       path:     "",
+                       wantE:    nil,
+               },
+               {
+                       name:     "ipv6 address registry without port",
+                       host:     "[fddd:1222:1222:1222::ac29:5a6a]",
+                       scheme:   "reg",
+                       registry: "[fddd:1222:1222:1222::ac29:5a6a]",
+                       path:     "",
+                       wantE:    nil,
+               },
+               {
                        name:     "OCI file",
                        host:     "ocifile://path",
                        scheme:   "ocifile",
@@ -589,6 +656,16 @@
                        host:  "docker-.io",
                        wantE: errs.ErrParsingFailed,
                },
+               {
+                       name:  "invalid ipv6 compression",
+                       host:  "[1::2::3]:5000",
+                       wantE: errs.ErrParsingFailed,
+               },
+               {
+                       name:  "invalid ipv6 missing brackets",
+                       host:  "::1:5000",
+                       wantE: errs.ErrParsingFailed,
+               },
        }
 
        for _, tc := range tt {

++++++ regclient.obsinfo ++++++
--- /var/tmp/diff_new_pack.TeS9lv/_old  2025-07-01 11:35:58.681850676 +0200
+++ /var/tmp/diff_new_pack.TeS9lv/_new  2025-07-01 11:35:58.685850843 +0200
@@ -1,5 +1,5 @@
 name: regclient
-version: 0.8.3
-mtime: 1745435768
-commit: ba184b305aaad55b40bf517d06e4d8d1afd35bf9
+version: 0.9.0
+mtime: 1751293530
+commit: ad4e3d926030f76419211838494434974f17db67
 

++++++ vendor.tar.gz ++++++
++++ 27927 lines of diff (skipped)

Reply via email to