Merge pull request #4708 from containers/dependabot/go_modules/github.com/containers/image/v5-5.1.0

build(deps): bump github.com/containers/image/v5 from 5.0.0 to 5.1.0

139 files changed, 7528 insertions, 2904 deletions

diff --git a/vendor/github.com/containers/image/v5/copy/copy.go b/vendor/github.com/containers/image/v5/copy/copy.go
index 090d862d5..29660b6b2 100644
--- a/vendor/github.com/containers/image/v5/copy/copy.go
+++ b/vendor/github.com/containers/image/v5/copy/copy.go
@@ -21,12 +21,14 @@ import (
 	"github.com/containers/image/v5/signature"
 	"github.com/containers/image/v5/transports"
 	"github.com/containers/image/v5/types"
+	"github.com/containers/ocicrypt"
+	encconfig "github.com/containers/ocicrypt/config"
 	digest "github.com/opencontainers/go-digest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"github.com/vbauerster/mpb"
-	"github.com/vbauerster/mpb/decor"
+	"github.com/vbauerster/mpb/v4"
+	"github.com/vbauerster/mpb/v4/decor"
 	"golang.org/x/crypto/ssh/terminal"
 	"golang.org/x/sync/semaphore"
 )
@@ -39,9 +41,14 @@ type digestingReader struct {
 	validationSucceeded bool
 }
 
-// maxParallelDownloads is used to limit the maxmimum number of parallel
-// downloads.  Let's follow Firefox by limiting it to 6.
-var maxParallelDownloads = 6
+var (
+	// ErrDecryptParamsMissing is returned if there is missing decryption parameters
+	ErrDecryptParamsMissing = errors.New("Necessary DecryptParameters not present")
+
+	// maxParallelDownloads is used to limit the maxmimum number of parallel
+	// downloads.  Let's follow Firefox by limiting it to 6.
+	maxParallelDownloads = 6
+)
 
 // compressionBufferSize is the buffer size used to compress a blob
 var compressionBufferSize = 1048576
@@ -50,6 +57,7 @@ var compressionBufferSize = 1048576
 // or set validationSucceeded/validationFailed to true if the source stream does/does not match expectedDigest.
 // (neither is set if EOF is never reached).
 func newDigestingReader(source io.Reader, expectedDigest digest.Digest) (*digestingReader, error) {
+	var digester digest.Digester
 	if err := expectedDigest.Validate(); err != nil {
 		return nil, errors.Errorf("Invalid digest specification %s", expectedDigest)
 	}
@@ -57,9 +65,11 @@ func newDigestingReader(source io.Reader, expectedDigest digest.Digest) (*digest
 	if !digestAlgorithm.Available() {
 		return nil, errors.Errorf("Invalid digest specification %s: unsupported digest algorithm %s", expectedDigest, digestAlgorithm)
 	}
+	digester = digestAlgorithm.Digester()
+
 	return &digestingReader{
 		source:           source,
-		digester:         digestAlgorithm.Digester(),
+		digester:         digester,
 		expectedDigest:   expectedDigest,
 		validationFailed: false,
 	}, nil
@@ -99,6 +109,8 @@ type copier struct {
 	copyInParallel    bool
 	compressionFormat compression.Algorithm
 	compressionLevel  *int
+	ociDecryptConfig  *encconfig.DecryptConfig
+	ociEncryptConfig  *encconfig.EncryptConfig
 }
 
 // imageCopier tracks state specific to a single image (possibly an item of a manifest list)
@@ -109,6 +121,9 @@ type imageCopier struct {
 	diffIDsAreNeeded   bool
 	canModifyManifest  bool
 	canSubstituteBlobs bool
+	ociDecryptConfig   *encconfig.DecryptConfig
+	ociEncryptConfig   *encconfig.EncryptConfig
+	ociEncryptLayers   *[]int
 }
 
 const (
@@ -155,6 +170,20 @@ type Options struct {
 	ForceManifestMIMEType string
 	ImageListSelection    ImageListSelection // set to either CopySystemImage (the default), CopyAllImages, or CopySpecificImages to control which instances we copy when the source reference is a list; ignored if the source reference is not a list
 	Instances             []digest.Digest    // if ImageListSelection is CopySpecificImages, copy only these instances and the list itself
+	// If OciEncryptConfig is non-nil, it indicates that an image should be encrypted.
+	// The encryption options is derived from the construction of EncryptConfig object.
+	// Note: During initial encryption process of a layer, the resultant digest is not known
+	// during creation, so newDigestingReader has to be set with validateDigest = false
+	OciEncryptConfig *encconfig.EncryptConfig
+	// OciEncryptLayers represents the list of layers to encrypt.
+	// If nil, don't encrypt any layers.
+	// If non-nil and len==0, denotes encrypt all layers.
+	// integers in the slice represent 0-indexed layer indices, with support for negative
+	// indexing. i.e. 0 is the first layer, -1 is the last (top-most) layer.
+	OciEncryptLayers *[]int
+	// OciDecryptConfig contains the config that can be used to decrypt an image if it is
+	// encrypted if non-nil. If nil, it does not attempt to decrypt an image.
+	OciDecryptConfig *encconfig.DecryptConfig
 }
 
 // validateImageListSelection returns an error if the passed-in value is not one that we recognize as a valid ImageListSelection value
@@ -493,6 +522,15 @@ func (c *copier) copyOneImage(ctx context.Context, policyContext *signature.Poli
 		return nil, "", "", errors.Wrapf(err, "Error initializing image from source %s", transports.ImageName(c.rawSource.Reference()))
 	}
 
+	// TODO: Remove src.SupportsEncryption call and interface once copyUpdatedConfigAndManifest does not depend on source Image manifest type
+	// Currently, the way copyUpdatedConfigAndManifest updates the manifest is to apply updates to the source manifest and call PutManifest
+	// of the modified source manifest. The implication is that schemas like docker2 cannot be encrypted even though the destination
+	// supports encryption because docker2 struct does not have annotations, which are required.
+	// Reference to issue: https://github.com/containers/image/issues/746
+	if options.OciEncryptLayers != nil && !src.SupportsEncryption(ctx) {
+		return nil, "", "", errors.Errorf("Encryption request but not supported by source transport %s", src.Reference().Transport().Name())
+	}
+
 	// If the destination is a digested reference, make a note of that, determine what digest value we're
 	// expecting, and check that the source manifest matches it.  If the source manifest doesn't, but it's
 	// one item from a manifest list that matches it, accept that as a match.
@@ -524,7 +562,7 @@ func (c *copier) copyOneImage(ctx context.Context, policyContext *signature.Poli
 		}
 	}
 
-	if err := checkImageDestinationForCurrentRuntimeOS(ctx, options.DestinationCtx, src, c.dest); err != nil {
+	if err := checkImageDestinationForCurrentRuntime(ctx, options.DestinationCtx, src, c.dest); err != nil {
 		return nil, "", "", err
 	}
 
@@ -552,6 +590,9 @@ func (c *copier) copyOneImage(ctx context.Context, policyContext *signature.Poli
 		src:             src,
 		// diffIDsAreNeeded is computed later
 		canModifyManifest: len(sigs) == 0 && !destIsDigestedReference,
+		ociDecryptConfig:  options.OciDecryptConfig,
+		ociEncryptConfig:  options.OciEncryptConfig,
+		ociEncryptLayers:  options.OciEncryptLayers,
 	}
 	// Ensure _this_ copy sees exactly the intended data when either processing a signed image or signing it.
 	// This may be too conservative, but for now, better safe than sorry, _especially_ on the SignBy path:
@@ -565,15 +606,19 @@ func (c *copier) copyOneImage(ctx context.Context, policyContext *signature.Poli
 		return nil, "", "", err
 	}
 
+	destRequiresOciEncryption := (isEncrypted(src) && ic.ociDecryptConfig != nil) || options.OciEncryptLayers != nil
+
 	// We compute preferredManifestMIMEType only to show it in error messages.
 	// Without having to add this context in an error message, we would be happy enough to know only that no conversion is needed.
-	preferredManifestMIMEType, otherManifestMIMETypeCandidates, err := ic.determineManifestConversion(ctx, c.dest.SupportedManifestMIMETypes(), options.ForceManifestMIMEType)
+	preferredManifestMIMEType, otherManifestMIMETypeCandidates, err := ic.determineManifestConversion(ctx, c.dest.SupportedManifestMIMETypes(), options.ForceManifestMIMEType, destRequiresOciEncryption)
 	if err != nil {
 		return nil, "", "", err
 	}
 
 	// If src.UpdatedImageNeedsLayerDiffIDs(ic.manifestUpdates) will be true, it needs to be true by the time we get here.
 	ic.diffIDsAreNeeded = src.UpdatedImageNeedsLayerDiffIDs(*ic.manifestUpdates)
+	// If encrypted and decryption keys provided, we should try to decrypt
+	ic.diffIDsAreNeeded = ic.diffIDsAreNeeded || (isEncrypted(src) && ic.ociDecryptConfig != nil) || ic.ociEncryptConfig != nil
 
 	if err := ic.copyLayers(ctx); err != nil {
 		return nil, "", "", err
@@ -651,21 +696,28 @@ func (c *copier) Printf(format string, a ...interface{}) {
 	fmt.Fprintf(c.reportWriter, format, a...)
 }
 
-func checkImageDestinationForCurrentRuntimeOS(ctx context.Context, sys *types.SystemContext, src types.Image, dest types.ImageDestination) error {
+// checkImageDestinationForCurrentRuntime enforces dest.MustMatchRuntimeOS, if necessary.
+func checkImageDestinationForCurrentRuntime(ctx context.Context, sys *types.SystemContext, src types.Image, dest types.ImageDestination) error {
 	if dest.MustMatchRuntimeOS() {
+		c, err := src.OCIConfig(ctx)
+		if err != nil {
+			return errors.Wrapf(err, "Error parsing image configuration")
+		}
+
 		wantedOS := runtime.GOOS
 		if sys != nil && sys.OSChoice != "" {
 			wantedOS = sys.OSChoice
 		}
-		c, err := src.OCIConfig(ctx)
-		if err != nil {
-			return errors.Wrapf(err, "Error parsing image configuration")
+		if wantedOS != c.OS {
+			return fmt.Errorf("Image operating system mismatch: image uses %q, expecting %q", c.OS, wantedOS)
 		}
-		osErr := fmt.Errorf("image operating system %q cannot be used on %q", c.OS, wantedOS)
-		if wantedOS == "windows" && c.OS == "linux" {
-			return osErr
-		} else if wantedOS != "windows" && c.OS == "windows" {
-			return osErr
+
+		wantedArch := runtime.GOARCH
+		if sys != nil && sys.ArchitectureChoice != "" {
+			wantedArch = sys.ArchitectureChoice
+		}
+		if wantedArch != c.Architecture {
+			return fmt.Errorf("Image architecture mismatch: image uses %q, expecting %q", c.Architecture, wantedArch)
 		}
 	}
 	return nil
@@ -709,6 +761,7 @@ func (ic *imageCopier) copyLayers(ctx context.Context) error {
 		return err
 	}
 	srcInfosUpdated := false
+	// If we only need to check authorization, no updates required.
 	if updatedSrcInfos != nil && !reflect.DeepEqual(srcInfos, updatedSrcInfos) {
 		if !ic.canModifyManifest {
 			return errors.Errorf("Internal error: copyLayers() needs to use an updated manifest but that was known to be forbidden")
@@ -737,7 +790,7 @@ func (ic *imageCopier) copyLayers(ctx context.Context) error {
 	}
 
 	data := make([]copyLayerData, numLayers)
-	copyLayerHelper := func(index int, srcLayer types.BlobInfo, pool *mpb.Progress) {
+	copyLayerHelper := func(index int, srcLayer types.BlobInfo, toEncrypt bool, pool *mpb.Progress) {
 		defer copySemaphore.Release(1)
 		defer copyGroup.Done()
 		cld := copyLayerData{}
@@ -752,18 +805,39 @@ func (ic *imageCopier) copyLayers(ctx context.Context) error {
 				logrus.Debugf("Skipping foreign layer %q copy to %s", cld.destInfo.Digest, ic.c.dest.Reference().Transport().Name())
 			}
 		} else {
-			cld.destInfo, cld.diffID, cld.err = ic.copyLayer(ctx, srcLayer, pool)
+			cld.destInfo, cld.diffID, cld.err = ic.copyLayer(ctx, srcLayer, toEncrypt, pool)
 		}
 		data[index] = cld
 	}
 
+	// Create layer Encryption map
+	encLayerBitmap := map[int]bool{}
+	var encryptAll bool
+	if ic.ociEncryptLayers != nil {
+		encryptAll = len(*ic.ociEncryptLayers) == 0
+		totalLayers := len(srcInfos)
+		for _, l := range *ic.ociEncryptLayers {
+			// if layer is negative, it is reverse indexed.
+			encLayerBitmap[(totalLayers+l)%totalLayers] = true
+		}
+
+		if encryptAll {
+			for i := 0; i < len(srcInfos); i++ {
+				encLayerBitmap[i] = true
+			}
+		}
+	}
+
 	func() { // A scope for defer
 		progressPool, progressCleanup := ic.c.newProgressPool(ctx)
 		defer progressCleanup()
 
 		for i, srcLayer := range srcInfos {
-			copySemaphore.Acquire(ctx, 1)
-			go copyLayerHelper(i, srcLayer, progressPool)
+			err = copySemaphore.Acquire(ctx, 1)
+			if err != nil {
+				logrus.Debug("Can't acquire semaphoer", err)
+			}
+			go copyLayerHelper(i, srcLayer, encLayerBitmap[i], progressPool)
 		}
 
 		// Wait for all layers to be copied
@@ -854,7 +928,7 @@ func (ic *imageCopier) copyUpdatedConfigAndManifest(ctx context.Context, instanc
 // The caller must eventually call the returned cleanup function after the pool will no longer be updated.
 func (c *copier) newProgressPool(ctx context.Context) (*mpb.Progress, func()) {
 	ctx, cancel := context.WithCancel(ctx)
-	pool := mpb.New(mpb.WithWidth(40), mpb.WithOutput(c.progressOutput), mpb.WithContext(ctx))
+	pool := mpb.NewWithContext(ctx, mpb.WithWidth(40), mpb.WithOutput(c.progressOutput))
 	return pool, func() {
 		cancel()
 		pool.Wait()
@@ -874,6 +948,9 @@ func (c *copier) createProgressBar(pool *mpb.Progress, info types.BlobInfo, kind
 		prefix = prefix[:maxPrefixLen]
 	}
 
+	// onComplete will replace prefix once the bar/spinner has completed
+	onComplete = prefix + " " + onComplete
+
 	// Use a normal progress bar when we know the size (i.e., size > 0).
 	// Otherwise, use a spinner to indicate that something's happening.
 	var bar *mpb.Bar
@@ -881,10 +958,10 @@ func (c *copier) createProgressBar(pool *mpb.Progress, info types.BlobInfo, kind
 		bar = pool.AddBar(info.Size,
 			mpb.BarClearOnComplete(),
 			mpb.PrependDecorators(
-				decor.Name(prefix),
+				decor.OnComplete(decor.Name(prefix), onComplete),
 			),
 			mpb.AppendDecorators(
-				decor.OnComplete(decor.CountersKibiByte("%.1f / %.1f"), " "+onComplete),
+				decor.OnComplete(decor.CountersKibiByte("%.1f / %.1f"), ""),
 			),
 		)
 	} else {
@@ -893,10 +970,7 @@ func (c *copier) createProgressBar(pool *mpb.Progress, info types.BlobInfo, kind
 			mpb.BarClearOnComplete(),
 			mpb.SpinnerStyle([]string{".", "..", "...", "....", ""}),
 			mpb.PrependDecorators(
-				decor.Name(prefix),
-			),
-			mpb.AppendDecorators(
-				decor.OnComplete(decor.Name(""), " "+onComplete),
+				decor.OnComplete(decor.Name(prefix), onComplete),
 			),
 		)
 	}
@@ -919,7 +993,7 @@ func (c *copier) copyConfig(ctx context.Context, src types.Image) error {
 			progressPool, progressCleanup := c.newProgressPool(ctx)
 			defer progressCleanup()
 			bar := c.createProgressBar(progressPool, srcInfo, "config", "done")
-			destInfo, err := c.copyBlobFromStream(ctx, bytes.NewReader(configBlob), srcInfo, nil, false, true, bar)
+			destInfo, err := c.copyBlobFromStream(ctx, bytes.NewReader(configBlob), srcInfo, nil, false, true, false, bar)
 			if err != nil {
 				return types.BlobInfo{}, err
 			}
@@ -945,9 +1019,10 @@ type diffIDResult struct {
 
 // copyLayer copies a layer with srcInfo (with known Digest and Annotations and possibly known Size) in src to dest, perhaps compressing it if canCompress,
 // and returns a complete blobInfo of the copied layer, and a value for LayerDiffIDs if diffIDIsNeeded
-func (ic *imageCopier) copyLayer(ctx context.Context, srcInfo types.BlobInfo, pool *mpb.Progress) (types.BlobInfo, digest.Digest, error) {
+func (ic *imageCopier) copyLayer(ctx context.Context, srcInfo types.BlobInfo, toEncrypt bool, pool *mpb.Progress) (types.BlobInfo, digest.Digest, error) {
 	cachedDiffID := ic.c.blobInfoCache.UncompressedDigest(srcInfo.Digest) // May be ""
-	diffIDIsNeeded := ic.diffIDsAreNeeded && cachedDiffID == ""
+	// Diffs are needed if we are encrypting an image or trying to decrypt an image
+	diffIDIsNeeded := ic.diffIDsAreNeeded && cachedDiffID == "" || toEncrypt || (isOciEncrypted(srcInfo.MediaType) && ic.ociDecryptConfig != nil)
 
 	// If we already have the blob, and we don't need to compute the diffID, then we don't need to read it from the source.
 	if !diffIDIsNeeded {
@@ -972,7 +1047,7 @@ func (ic *imageCopier) copyLayer(ctx context.Context, srcInfo types.BlobInfo, po
 
 	bar := ic.c.createProgressBar(pool, srcInfo, "blob", "done")
 
-	blobInfo, diffIDChan, err := ic.copyLayerFromStream(ctx, srcStream, types.BlobInfo{Digest: srcInfo.Digest, Size: srcBlobSize, Annotations: srcInfo.Annotations}, diffIDIsNeeded, bar)
+	blobInfo, diffIDChan, err := ic.copyLayerFromStream(ctx, srcStream, types.BlobInfo{Digest: srcInfo.Digest, Size: srcBlobSize, MediaType: srcInfo.MediaType, Annotations: srcInfo.Annotations}, diffIDIsNeeded, toEncrypt, bar)
 	if err != nil {
 		return types.BlobInfo{}, "", err
 	}
@@ -1003,7 +1078,7 @@ func (ic *imageCopier) copyLayer(ctx context.Context, srcInfo types.BlobInfo, po
 // perhaps compressing the stream if canCompress,
 // and returns a complete blobInfo of the copied blob and perhaps a <-chan diffIDResult if diffIDIsNeeded, to be read by the caller.
 func (ic *imageCopier) copyLayerFromStream(ctx context.Context, srcStream io.Reader, srcInfo types.BlobInfo,
-	diffIDIsNeeded bool, bar *mpb.Bar) (types.BlobInfo, <-chan diffIDResult, error) {
+	diffIDIsNeeded bool, toEncrypt bool, bar *mpb.Bar) (types.BlobInfo, <-chan diffIDResult, error) {
 	var getDiffIDRecorder func(compression.DecompressorFunc) io.Writer // = nil
 	var diffIDChan chan diffIDResult
 
@@ -1012,7 +1087,7 @@ func (ic *imageCopier) copyLayerFromStream(ctx context.Context, srcStream io.Rea
 		diffIDChan = make(chan diffIDResult, 1) // Buffered, so that sending a value after this or our caller has failed and exited does not block.
 		pipeReader, pipeWriter := io.Pipe()
 		defer func() { // Note that this is not the same as {defer pipeWriter.CloseWithError(err)}; we need err to be evaluated lazily.
-			pipeWriter.CloseWithError(err) // CloseWithError(nil) is equivalent to Close()
+			_ = pipeWriter.CloseWithError(err) // CloseWithError(nil) is equivalent to Close(), always returns nil
 		}()
 
 		getDiffIDRecorder = func(decompressor compression.DecompressorFunc) io.Writer {
@@ -1027,7 +1102,10 @@ func (ic *imageCopier) copyLayerFromStream(ctx context.Context, srcStream io.Rea
 			return pipeWriter
 		}
 	}
-	blobInfo, err := ic.c.copyBlobFromStream(ctx, srcStream, srcInfo, getDiffIDRecorder, ic.canModifyManifest, false, bar) // Sets err to nil on success
+	ic.c.ociDecryptConfig = ic.ociDecryptConfig
+	ic.c.ociEncryptConfig = ic.ociEncryptConfig
+
+	blobInfo, err := ic.c.copyBlobFromStream(ctx, srcStream, srcInfo, getDiffIDRecorder, ic.canModifyManifest, false, toEncrypt, bar) // Sets err to nil on success
 	return blobInfo, diffIDChan, err
 	// We need the defer … pipeWriter.CloseWithError() to happen HERE so that the caller can block on reading from diffIDChan
 }
@@ -1064,7 +1142,7 @@ func computeDiffID(stream io.Reader, decompressor compression.DecompressorFunc)
 // and returns a complete blobInfo of the copied blob.
 func (c *copier) copyBlobFromStream(ctx context.Context, srcStream io.Reader, srcInfo types.BlobInfo,
 	getOriginalLayerCopyWriter func(decompressor compression.DecompressorFunc) io.Writer,
-	canModifyBlob bool, isConfig bool, bar *mpb.Bar) (types.BlobInfo, error) {
+	canModifyBlob bool, isConfig bool, toEncrypt bool, bar *mpb.Bar) (types.BlobInfo, error) {
 	// The copying happens through a pipeline of connected io.Readers.
 	// === Input: srcStream
 
@@ -1078,7 +1156,29 @@ func (c *copier) copyBlobFromStream(ctx context.Context, srcStream io.Reader, sr
 	if err != nil {
 		return types.BlobInfo{}, errors.Wrapf(err, "Error preparing to verify blob %s", srcInfo.Digest)
 	}
+
 	var destStream io.Reader = digestingReader
+	var decrypted bool
+	if isOciEncrypted(srcInfo.MediaType) && c.ociDecryptConfig != nil {
+		newDesc := imgspecv1.Descriptor{
+			Annotations: srcInfo.Annotations,
+		}
+
+		var d digest.Digest
+		destStream, d, err = ocicrypt.DecryptLayer(c.ociDecryptConfig, destStream, newDesc, false)
+		if err != nil {
+			return types.BlobInfo{}, errors.Wrapf(err, "Error decrypting layer %s", srcInfo.Digest)
+		}
+
+		srcInfo.Digest = d
+		srcInfo.Size = -1
+		for k := range srcInfo.Annotations {
+			if strings.HasPrefix(k, "org.opencontainers.image.enc") {
+				delete(srcInfo.Annotations, k)
+			}
+		}
+		decrypted = true
+	}
 
 	// === Detect compression of the input stream.
 	// This requires us to “peek ahead” into the stream to read the initial part, which requires us to chain through another io.Reader returned by DetectCompression.
@@ -1101,7 +1201,12 @@ func (c *copier) copyBlobFromStream(ctx context.Context, srcStream io.Reader, sr
 	// === Deal with layer compression/decompression if necessary
 	var inputInfo types.BlobInfo
 	var compressionOperation types.LayerCompression
-	if canModifyBlob && c.dest.DesiredLayerCompression() == types.Compress && !isCompressed {
+	if canModifyBlob && isOciEncrypted(srcInfo.MediaType) {
+		// PreserveOriginal due to any compression not being able to be done on an encrypted blob unless decrypted
+		logrus.Debugf("Using original blob without modification for encrypted blob")
+		compressionOperation = types.PreserveOriginal
+		inputInfo = srcInfo
+	} else if canModifyBlob && c.dest.DesiredLayerCompression() == types.Compress && !isCompressed {
 		logrus.Debugf("Compressing blob on the fly")
 		compressionOperation = types.Compress
 		pipeReader, pipeWriter := io.Pipe()
@@ -1152,15 +1257,51 @@ func (c *copier) copyBlobFromStream(ctx context.Context, srcStream io.Reader, sr
 		inputInfo = srcInfo
 	}
 
+	// Perform image encryption for valid mediatypes if ociEncryptConfig provided
+	var (
+		encrypted bool
+		finalizer ocicrypt.EncryptLayerFinalizer
+	)
+	if toEncrypt {
+		if decrypted {
+			return types.BlobInfo{}, errors.New("Unable to support both decryption and encryption in the same copy")
+		}
+
+		if !isOciEncrypted(srcInfo.MediaType) && c.ociEncryptConfig != nil {
+			var annotations map[string]string
+			if !decrypted {
+				annotations = srcInfo.Annotations
+			}
+			desc := imgspecv1.Descriptor{
+				MediaType:   srcInfo.MediaType,
+				Digest:      srcInfo.Digest,
+				Size:        srcInfo.Size,
+				Annotations: annotations,
+			}
+
+			s, fin, err := ocicrypt.EncryptLayer(c.ociEncryptConfig, destStream, desc)
+			if err != nil {
+				return types.BlobInfo{}, errors.Wrapf(err, "Error encrypting blob %s", srcInfo.Digest)
+			}
+
+			destStream = s
+			finalizer = fin
+			inputInfo.Digest = ""
+			inputInfo.Size = -1
+			encrypted = true
+		}
+	}
+
 	// === Report progress using the c.progress channel, if required.
 	if c.progress != nil && c.progressInterval > 0 {
-		destStream = &progressReader{
-			source:   destStream,
-			channel:  c.progress,
-			interval: c.progressInterval,
-			artifact: srcInfo,
-			lastTime: time.Now(),
-		}
+		progressReader := newProgressReader(
+			destStream,
+			c.progress,
+			c.progressInterval,
+			srcInfo,
+		)
+		defer progressReader.reportDone()
+		destStream = progressReader
 	}
 
 	// === Finally, send the layer stream to dest.
@@ -1176,6 +1317,21 @@ func (c *copier) copyBlobFromStream(ctx context.Context, srcStream io.Reader, sr
 	if canModifyBlob && !isConfig {
 		uploadedInfo.CompressionAlgorithm = &desiredCompressionFormat
 	}
+	if decrypted {
+		uploadedInfo.CryptoOperation = types.Decrypt
+	} else if encrypted {
+		encryptAnnotations, err := finalizer()
+		if err != nil {
+			return types.BlobInfo{}, errors.Wrap(err, "Unable to finalize encryption")
+		}
+		uploadedInfo.CryptoOperation = types.Encrypt
+		if uploadedInfo.Annotations == nil {
+			uploadedInfo.Annotations = map[string]string{}
+		}
+		for k, v := range encryptAnnotations {
+			uploadedInfo.Annotations[k] = v
+		}
+	}
 
 	// This is fairly horrible: the writer from getOriginalLayerCopyWriter wants to consumer
 	// all of the input (to compute DiffIDs), even if dest.PutBlob does not need it.
@@ -1218,7 +1374,7 @@ func (c *copier) copyBlobFromStream(ctx context.Context, srcStream io.Reader, sr
 func (c *copier) compressGoroutine(dest *io.PipeWriter, src io.Reader, compressionFormat compression.Algorithm) {
 	err := errors.New("Internal error: unexpected panic in compressGoroutine")
 	defer func() { // Note that this is not the same as {defer dest.CloseWithError(err)}; we need err to be evaluated lazily.
-		dest.CloseWithError(err) // CloseWithError(nil) is equivalent to Close()
+		_ = dest.CloseWithError(err) // CloseWithError(nil) is equivalent to Close(), always returns nil
 	}()
 
 	compressor, err := compression.CompressStream(dest, compressionFormat, c.compressionLevel)
diff --git a/vendor/github.com/containers/image/v5/copy/encrypt.go b/vendor/github.com/containers/image/v5/copy/encrypt.go
new file mode 100644
index 000000000..a18d6f151
--- /dev/null
+++ b/vendor/github.com/containers/image/v5/copy/encrypt.go
@@ -0,0 +1,24 @@
+package copy
+
+import (
+	"strings"
+
+	"github.com/containers/image/v5/types"
+)
+
+// isOciEncrypted returns a bool indicating if a mediatype is encrypted
+// This function will be moved to be part of OCI spec when adopted.
+func isOciEncrypted(mediatype string) bool {
+	return strings.HasSuffix(mediatype, "+encrypted")
+}
+
+// isEncrypted checks if an image is encrypted
+func isEncrypted(i types.Image) bool {
+	layers := i.LayerInfos()
+	for _, l := range layers {
+		if isOciEncrypted(l.MediaType) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vendor/github.com/containers/image/v5/copy/manifest.go b/vendor/github.com/containers/image/v5/copy/manifest.go
index f5f6c9c5f..bcf082df3 100644
--- a/vendor/github.com/containers/image/v5/copy/manifest.go
+++ b/vendor/github.com/containers/image/v5/copy/manifest.go
@@ -42,7 +42,7 @@ func (os *orderedSet) append(s string) {
 // Note that the conversion will only happen later, through ic.src.UpdatedImage
 // Returns the preferred manifest MIME type (whether we are converting to it or using it unmodified),
 // and a list of other possible alternatives, in order.
-func (ic *imageCopier) determineManifestConversion(ctx context.Context, destSupportedManifestMIMETypes []string, forceManifestMIMEType string) (string, []string, error) {
+func (ic *imageCopier) determineManifestConversion(ctx context.Context, destSupportedManifestMIMETypes []string, forceManifestMIMEType string, requiresOciEncryption bool) (string, []string, error) {
 	_, srcType, err := ic.src.Manifest(ctx)
 	if err != nil { // This should have been cached?!
 		return "", nil, errors.Wrap(err, "Error reading manifest")
@@ -57,12 +57,14 @@ func (ic *imageCopier) determineManifestConversion(ctx context.Context, destSupp
 		destSupportedManifestMIMETypes = []string{forceManifestMIMEType}
 	}
 
-	if len(destSupportedManifestMIMETypes) == 0 {
+	if len(destSupportedManifestMIMETypes) == 0 && (!requiresOciEncryption || manifest.MIMETypeSupportsEncryption(srcType)) {
 		return srcType, []string{}, nil // Anything goes; just use the original as is, do not try any conversions.
 	}
 	supportedByDest := map[string]struct{}{}
 	for _, t := range destSupportedManifestMIMETypes {
-		supportedByDest[t] = struct{}{}
+		if !requiresOciEncryption || manifest.MIMETypeSupportsEncryption(t) {
+			supportedByDest[t] = struct{}{}
+		}
 	}
 
 	// destSupportedManifestMIMETypes is a static guess; a particular registry may still only support a subset of the types.
diff --git a/vendor/github.com/containers/image/v5/copy/progress_reader.go b/vendor/github.com/containers/image/v5/copy/progress_reader.go
index 1d0c41bce..0761065a2 100644
--- a/vendor/github.com/containers/image/v5/copy/progress_reader.go
+++ b/vendor/github.com/containers/image/v5/copy/progress_reader.go
@@ -9,20 +9,71 @@ import (
 
 // progressReader is a reader that reports its progress on an interval.
 type progressReader struct {
-	source   io.Reader
-	channel  chan types.ProgressProperties
-	interval time.Duration
-	artifact types.BlobInfo
-	lastTime time.Time
-	offset   uint64
+	source       io.Reader
+	channel      chan<- types.ProgressProperties
+	interval     time.Duration
+	artifact     types.BlobInfo
+	lastUpdate   time.Time
+	offset       uint64
+	offsetUpdate uint64
 }
 
+// newProgressReader creates a new progress reader for:
+// `source`:   The source when internally reading bytes
+// `channel`:  The reporter channel to which the progress will be sent
+// `interval`: The update interval to indicate how often the progress should update
+// `artifact`: The blob metadata which is currently being progressed
+func newProgressReader(
+	source io.Reader,
+	channel chan<- types.ProgressProperties,
+	interval time.Duration,
+	artifact types.BlobInfo,
+) *progressReader {
+	// The progress reader constructor informs the progress channel
+	// that a new artifact will be read
+	channel <- types.ProgressProperties{
+		Event:    types.ProgressEventNewArtifact,
+		Artifact: artifact,
+	}
+	return &progressReader{
+		source:       source,
+		channel:      channel,
+		interval:     interval,
+		artifact:     artifact,
+		lastUpdate:   time.Now(),
+		offset:       0,
+		offsetUpdate: 0,
+	}
+}
+
+// reportDone indicates to the internal channel that the progress has been
+// finished
+func (r *progressReader) reportDone() {
+	r.channel <- types.ProgressProperties{
+		Event:        types.ProgressEventDone,
+		Artifact:     r.artifact,
+		Offset:       r.offset,
+		OffsetUpdate: r.offsetUpdate,
+	}
+}
+
+// Read continuously reads bytes into the progress reader and reports the
+// status via the internal channel
 func (r *progressReader) Read(p []byte) (int, error) {
 	n, err := r.source.Read(p)
 	r.offset += uint64(n)
-	if time.Since(r.lastTime) > r.interval {
-		r.channel <- types.ProgressProperties{Artifact: r.artifact, Offset: r.offset}
-		r.lastTime = time.Now()
+	r.offsetUpdate += uint64(n)
+
+	// Fire the progress reader in the provided interval
+	if time.Since(r.lastUpdate) > r.interval {
+		r.channel <- types.ProgressProperties{
+			Event:        types.ProgressEventRead,
+			Artifact:     r.artifact,
+			Offset:       r.offset,
+			OffsetUpdate: r.offsetUpdate,
+		}
+		r.lastUpdate = time.Now()
+		r.offsetUpdate = 0
 	}
 	return n, err
 }
diff --git a/vendor/github.com/containers/image/v5/directory/directory_dest.go b/vendor/github.com/containers/image/v5/directory/directory_dest.go
index 2d6650de7..caa7a207f 100644
--- a/vendor/github.com/containers/image/v5/directory/directory_dest.go
+++ b/vendor/github.com/containers/image/v5/directory/directory_dest.go
@@ -112,7 +112,7 @@ func (d *dirImageDestination) AcceptsForeignLayerURLs() bool {
 	return false
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 func (d *dirImageDestination) MustMatchRuntimeOS() bool {
 	return false
 }
diff --git a/vendor/github.com/containers/image/v5/docker/archive/dest.go b/vendor/github.com/containers/image/v5/docker/archive/dest.go
index 5845f63be..1cf197429 100644
--- a/vendor/github.com/containers/image/v5/docker/archive/dest.go
+++ b/vendor/github.com/containers/image/v5/docker/archive/dest.go
@@ -36,7 +36,7 @@ func newImageDestination(sys *types.SystemContext, ref archiveReference) (types.
 		return nil, errors.New("docker-archive doesn't support modifying existing images")
 	}
 
-	tarDest := tarfile.NewDestination(fh, ref.destinationRef)
+	tarDest := tarfile.NewDestinationWithContext(sys, fh, ref.destinationRef)
 	if sys != nil && sys.DockerArchiveAdditionalTags != nil {
 		tarDest.AddRepoTags(sys.DockerArchiveAdditionalTags)
 	}
diff --git a/vendor/github.com/containers/image/v5/docker/archive/src.go b/vendor/github.com/containers/image/v5/docker/archive/src.go
index a90707437..6a628508d 100644
--- a/vendor/github.com/containers/image/v5/docker/archive/src.go
+++ b/vendor/github.com/containers/image/v5/docker/archive/src.go
@@ -2,6 +2,7 @@ package archive
 
 import (
 	"context"
+
 	"github.com/containers/image/v5/docker/tarfile"
 	"github.com/containers/image/v5/types"
 	"github.com/sirupsen/logrus"
@@ -14,11 +15,11 @@ type archiveImageSource struct {
 
 // newImageSource returns a types.ImageSource for the specified image reference.
 // The caller must call .Close() on the returned ImageSource.
-func newImageSource(ctx context.Context, ref archiveReference) (types.ImageSource, error) {
+func newImageSource(ctx context.Context, sys *types.SystemContext, ref archiveReference) (types.ImageSource, error) {
 	if ref.destinationRef != nil {
 		logrus.Warnf("docker-archive: references are not supported for sources (ignoring)")
 	}
-	src, err := tarfile.NewSourceFromFile(ref.path)
+	src, err := tarfile.NewSourceFromFileWithContext(sys, ref.path)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/containers/image/v5/docker/archive/transport.go b/vendor/github.com/containers/image/v5/docker/archive/transport.go
index 44213bb8d..46c01891f 100644
--- a/vendor/github.com/containers/image/v5/docker/archive/transport.go
+++ b/vendor/github.com/containers/image/v5/docker/archive/transport.go
@@ -134,7 +134,7 @@ func (ref archiveReference) PolicyConfigurationNamespaces() []string {
 // verify that UnparsedImage, and convert it into a real Image via image.FromUnparsedImage.
 // WARNING: This may not do the right thing for a manifest list, see image.FromSource for details.
 func (ref archiveReference) NewImage(ctx context.Context, sys *types.SystemContext) (types.ImageCloser, error) {
-	src, err := newImageSource(ctx, ref)
+	src, err := newImageSource(ctx, sys, ref)
 	if err != nil {
 		return nil, err
 	}
@@ -144,7 +144,7 @@ func (ref archiveReference) NewImage(ctx context.Context, sys *types.SystemConte
 // NewImageSource returns a types.ImageSource for this reference.
 // The caller must call .Close() on the returned ImageSource.
 func (ref archiveReference) NewImageSource(ctx context.Context, sys *types.SystemContext) (types.ImageSource, error) {
-	return newImageSource(ctx, ref)
+	return newImageSource(ctx, sys, ref)
 }
 
 // NewImageDestination returns a types.ImageDestination for this reference.
diff --git a/vendor/github.com/containers/image/v5/docker/daemon/daemon_dest.go b/vendor/github.com/containers/image/v5/docker/daemon/daemon_dest.go
index 25ce55a17..c6afd4bde 100644
--- a/vendor/github.com/containers/image/v5/docker/daemon/daemon_dest.go
+++ b/vendor/github.com/containers/image/v5/docker/daemon/daemon_dest.go
@@ -54,7 +54,7 @@ func newImageDestination(ctx context.Context, sys *types.SystemContext, ref daem
 	return &daemonImageDestination{
 		ref:                ref,
 		mustMatchRuntimeOS: mustMatchRuntimeOS,
-		Destination:        tarfile.NewDestination(writer, namedTaggedRef),
+		Destination:        tarfile.NewDestinationWithContext(sys, writer, namedTaggedRef),
 		goroutineCancel:    goroutineCancel,
 		statusChannel:      statusChannel,
 		writer:             writer,
@@ -73,7 +73,9 @@ func imageLoadGoroutine(ctx context.Context, c *client.Client, reader *io.PipeRe
 		if err == nil {
 			reader.Close()
 		} else {
-			reader.CloseWithError(err)
+			if err := reader.CloseWithError(err); err != nil {
+				logrus.Debugf("imageLoadGoroutine: Error during reader.CloseWithError: %v", err)
+			}
 		}
 	}()
 
@@ -90,7 +92,7 @@ func (d *daemonImageDestination) DesiredLayerCompression() types.LayerCompressio
 	return types.PreserveOriginal
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 func (d *daemonImageDestination) MustMatchRuntimeOS() bool {
 	return d.mustMatchRuntimeOS
 }
@@ -109,7 +111,9 @@ func (d *daemonImageDestination) Close() error {
 		// immediately, and hopefully, through terminating the sending which uses "Transfer-Encoding: chunked"" without sending
 		// the terminating zero-length chunk, prevent the docker daemon from processing the tar stream at all.
 		// Whether that works or not, closing the PipeWriter seems desirable in any case.
-		d.writer.CloseWithError(errors.New("Aborting upload, daemonImageDestination closed without a previous .Commit()"))
+		if err := d.writer.CloseWithError(errors.New("Aborting upload, daemonImageDestination closed without a previous .Commit()")); err != nil {
+			return err
+		}
 	}
 	d.goroutineCancel()
 
diff --git a/vendor/github.com/containers/image/v5/docker/daemon/daemon_src.go b/vendor/github.com/containers/image/v5/docker/daemon/daemon_src.go
index 46fbcc4e0..1827f811d 100644
--- a/vendor/github.com/containers/image/v5/docker/daemon/daemon_src.go
+++ b/vendor/github.com/containers/image/v5/docker/daemon/daemon_src.go
@@ -13,11 +13,6 @@ type daemonImageSource struct {
 	*tarfile.Source // Implements most of types.ImageSource
 }
 
-type layerInfo struct {
-	path string
-	size int64
-}
-
 // newImageSource returns a types.ImageSource for the specified image reference.
 // The caller must call .Close() on the returned ImageSource.
 //
@@ -40,7 +35,7 @@ func newImageSource(ctx context.Context, sys *types.SystemContext, ref daemonRef
 	}
 	defer inputStream.Close()
 
-	src, err := tarfile.NewSourceFromStream(inputStream)
+	src, err := tarfile.NewSourceFromStreamWithSystemContext(sys, inputStream)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/containers/image/v5/docker/docker_client.go b/vendor/github.com/containers/image/v5/docker/docker_client.go
index 0b012c703..986bcb986 100644
--- a/vendor/github.com/containers/image/v5/docker/docker_client.go
+++ b/vendor/github.com/containers/image/v5/docker/docker_client.go
@@ -440,7 +440,7 @@ func (c *dockerClient) makeRequestToResolvedURL(ctx context.Context, method, url
 		// If the delta between the date and now is positive, use it.
 		// Otherwise, fall back to using the default exponential back off.
 		if t, err := http.ParseTime(after); err == nil {
-			delta := int64(t.Sub(time.Now()).Seconds())
+			delta := int64(time.Until(t).Seconds())
 			if delta > 0 {
 				return min(delta, maxDelay)
 			}
diff --git a/vendor/github.com/containers/image/v5/docker/docker_image_dest.go b/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
index 417d97aec..47a73d868 100644
--- a/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
+++ b/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
@@ -94,7 +94,7 @@ func (d *dockerImageDestination) AcceptsForeignLayerURLs() bool {
 	return true
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 func (d *dockerImageDestination) MustMatchRuntimeOS() bool {
 	return false
 }
diff --git a/vendor/github.com/containers/image/v5/docker/tarfile/dest.go b/vendor/github.com/containers/image/v5/docker/tarfile/dest.go
index b02c60bb3..c322156b5 100644
--- a/vendor/github.com/containers/image/v5/docker/tarfile/dest.go
+++ b/vendor/github.com/containers/image/v5/docker/tarfile/dest.go
@@ -29,10 +29,17 @@ type Destination struct {
 	// Other state.
 	blobs  map[digest.Digest]types.BlobInfo // list of already-sent blobs
 	config []byte
+	sysCtx *types.SystemContext
 }
 
 // NewDestination returns a tarfile.Destination for the specified io.Writer.
+// Deprecated: please use NewDestinationWithContext instead
 func NewDestination(dest io.Writer, ref reference.NamedTagged) *Destination {
+	return NewDestinationWithContext(nil, dest, ref)
+}
+
+// NewDestinationWithContext returns a tarfile.Destination for the specified io.Writer.
+func NewDestinationWithContext(sys *types.SystemContext, dest io.Writer, ref reference.NamedTagged) *Destination {
 	repoTags := []reference.NamedTagged{}
 	if ref != nil {
 		repoTags = append(repoTags, ref)
@@ -42,6 +49,7 @@ func NewDestination(dest io.Writer, ref reference.NamedTagged) *Destination {
 		tar:      tar.NewWriter(dest),
 		repoTags: repoTags,
 		blobs:    make(map[digest.Digest]types.BlobInfo),
+		sysCtx:   sys,
 	}
 }
 
@@ -70,7 +78,7 @@ func (d *Destination) AcceptsForeignLayerURLs() bool {
 	return false
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 func (d *Destination) MustMatchRuntimeOS() bool {
 	return false
 }
@@ -99,7 +107,7 @@ func (d *Destination) PutBlob(ctx context.Context, stream io.Reader, inputInfo t
 	// When the layer is decompressed, we also have to generate the digest on uncompressed datas.
 	if inputInfo.Size == -1 || inputInfo.Digest.String() == "" {
 		logrus.Debugf("docker tarfile: input with unknown size, streaming to disk first ...")
-		streamCopy, err := ioutil.TempFile(tmpdir.TemporaryDirectoryForBigFiles(), "docker-tarfile-blob")
+		streamCopy, err := ioutil.TempFile(tmpdir.TemporaryDirectoryForBigFiles(d.sysCtx), "docker-tarfile-blob")
 		if err != nil {
 			return types.BlobInfo{}, err
 		}
@@ -113,7 +121,7 @@ func (d *Destination) PutBlob(ctx context.Context, stream io.Reader, inputInfo t
 		if err != nil {
 			return types.BlobInfo{}, err
 		}
-		_, err = streamCopy.Seek(0, os.SEEK_SET)
+		_, err = streamCopy.Seek(0, io.SeekStart)
 		if err != nil {
 			return types.BlobInfo{}, err
 		}
diff --git a/vendor/github.com/containers/image/v5/docker/tarfile/src.go b/vendor/github.com/containers/image/v5/docker/tarfile/src.go
index ad0a3d2cb..80dd753e4 100644
--- a/vendor/github.com/containers/image/v5/docker/tarfile/src.go
+++ b/vendor/github.com/containers/image/v5/docker/tarfile/src.go
@@ -46,7 +46,14 @@ type layerInfo struct {
 // 	To do for both the NewSourceFromFile and NewSourceFromStream functions
 
 // NewSourceFromFile returns a tarfile.Source for the specified path.
+// Deprecated: Please use NewSourceFromFileWithContext which will allows you to configure temp directory
+// for big files through SystemContext.BigFilesTemporaryDir
 func NewSourceFromFile(path string) (*Source, error) {
+	return NewSourceFromFileWithContext(nil, path)
+}
+
+// NewSourceFromFileWithContext returns a tarfile.Source for the specified path.
+func NewSourceFromFileWithContext(sys *types.SystemContext, path string) (*Source, error) {
 	file, err := os.Open(path)
 	if err != nil {
 		return nil, errors.Wrapf(err, "error opening file %q", path)
@@ -65,16 +72,25 @@ func NewSourceFromFile(path string) (*Source, error) {
 			tarPath: path,
 		}, nil
 	}
-	return NewSourceFromStream(stream)
+	return NewSourceFromStreamWithSystemContext(sys, stream)
 }
 
 // NewSourceFromStream returns a tarfile.Source for the specified inputStream,
 // which can be either compressed or uncompressed. The caller can close the
 // inputStream immediately after NewSourceFromFile returns.
+// Deprecated: Please use NewSourceFromStreamWithSystemContext which will allows you to configure
+// temp directory for big files through SystemContext.BigFilesTemporaryDir
 func NewSourceFromStream(inputStream io.Reader) (*Source, error) {
+	return NewSourceFromStreamWithSystemContext(nil, inputStream)
+}
+
+// NewSourceFromStreamWithSystemContext returns a tarfile.Source for the specified inputStream,
+// which can be either compressed or uncompressed. The caller can close the
+// inputStream immediately after NewSourceFromFile returns.
+func NewSourceFromStreamWithSystemContext(sys *types.SystemContext, inputStream io.Reader) (*Source, error) {
 	// FIXME: use SystemContext here.
 	// Save inputStream to a temporary file
-	tarCopyFile, err := ioutil.TempFile(tmpdir.TemporaryDirectoryForBigFiles(), "docker-tar")
+	tarCopyFile, err := ioutil.TempFile(tmpdir.TemporaryDirectoryForBigFiles(sys), "docker-tar")
 	if err != nil {
 		return nil, errors.Wrap(err, "error creating temporary file")
 	}
@@ -146,7 +162,7 @@ func (s *Source) openTarComponent(componentPath string) (io.ReadCloser, error) {
 	}
 	if header.FileInfo().Mode()&os.ModeType == os.ModeSymlink { // FIXME: untested
 		// We follow only one symlink; so no loops are possible.
-		if _, err := f.Seek(0, os.SEEK_SET); err != nil {
+		if _, err := f.Seek(0, io.SeekStart); err != nil {
 			return nil, err
 		}
 		// The new path could easily point "outside" the archive, but we only compare it to existing tar headers without extracting the archive,
diff --git a/vendor/github.com/containers/image/v5/docker/wwwauthenticate.go b/vendor/github.com/containers/image/v5/docker/wwwauthenticate.go
index 23664a74a..d0bbbba8a 100644
--- a/vendor/github.com/containers/image/v5/docker/wwwauthenticate.go
+++ b/vendor/github.com/containers/image/v5/docker/wwwauthenticate.go
@@ -48,8 +48,8 @@ func init() {
 		var t octetType
 		isCtl := c <= 31 || c == 127
 		isChar := 0 <= c && c <= 127
-		isSeparator := strings.IndexRune(" \t\"(),/:;<=>?@[]\\{}", rune(c)) >= 0
-		if strings.IndexRune(" \t\r\n", rune(c)) >= 0 {
+		isSeparator := strings.ContainsRune(" \t\"(),/:;<=>?@[]\\{}", rune(c))
+		if strings.ContainsRune(" \t\r\n", rune(c)) {
 			t |= isSpace
 		}
 		if isChar && !isCtl && !isSeparator {
diff --git a/vendor/github.com/containers/image/v5/image/docker_schema1.go b/vendor/github.com/containers/image/v5/image/docker_schema1.go
index 1a1c39d55..48ddb174e 100644
--- a/vendor/github.com/containers/image/v5/image/docker_schema1.go
+++ b/vendor/github.com/containers/image/v5/image/docker_schema1.go
@@ -200,3 +200,8 @@ func (m *manifestSchema1) convertToManifestSchema2(uploadedLayerInfos []types.Bl
 
 	return manifestSchema2FromComponents(configDescriptor, nil, configJSON, layers), nil
 }
+
+// SupportsEncryption returns if encryption is supported for the manifest type
+func (m *manifestSchema1) SupportsEncryption(context.Context) bool {
+	return false
+}
diff --git a/vendor/github.com/containers/image/v5/image/docker_schema2.go b/vendor/github.com/containers/image/v5/image/docker_schema2.go
index 254c13f78..7891562b7 100644
--- a/vendor/github.com/containers/image/v5/image/docker_schema2.go
+++ b/vendor/github.com/containers/image/v5/image/docker_schema2.go
@@ -355,3 +355,8 @@ func v1ConfigFromConfigJSON(configJSON []byte, v1ID, parentV1ID string, throwawa
 	}
 	return json.Marshal(rawContents)
 }
+
+// SupportsEncryption returns if encryption is supported for the manifest type
+func (m *manifestSchema2) SupportsEncryption(context.Context) bool {
+	return false
+}
diff --git a/vendor/github.com/containers/image/v5/image/manifest.go b/vendor/github.com/containers/image/v5/image/manifest.go
index fe66da157..c574fa9fc 100644
--- a/vendor/github.com/containers/image/v5/image/manifest.go
+++ b/vendor/github.com/containers/image/v5/image/manifest.go
@@ -44,6 +44,8 @@ type genericManifest interface {
 	// UpdatedImage returns a types.Image modified according to options.
 	// This does not change the state of the original Image object.
 	UpdatedImage(ctx context.Context, options types.ManifestUpdateOptions) (types.Image, error)
+	// SupportsEncryption returns if encryption is supported for the manifest type
+	SupportsEncryption(ctx context.Context) bool
 }
 
 // manifestInstanceFromBlob returns a genericManifest implementation for (manblob, mt) in src.
diff --git a/vendor/github.com/containers/image/v5/image/oci.go b/vendor/github.com/containers/image/v5/image/oci.go
index 18a38d463..059d84977 100644
--- a/vendor/github.com/containers/image/v5/image/oci.go
+++ b/vendor/github.com/containers/image/v5/image/oci.go
@@ -212,3 +212,8 @@ func (m *manifestOCI1) convertToManifestSchema2() (types.Image, error) {
 	m1 := manifestSchema2FromComponents(config, m.src, nil, layers)
 	return memoryImageFromManifest(m1), nil
 }
+
+// SupportsEncryption returns if encryption is supported for the manifest type
+func (m *manifestOCI1) SupportsEncryption(context.Context) bool {
+	return true
+}
diff --git a/vendor/github.com/containers/image/v5/internal/pkg/keyctl/keyring.go b/vendor/github.com/containers/image/v5/internal/pkg/keyctl/keyring.go
index 4bf170156..91c64a1b8 100644
--- a/vendor/github.com/containers/image/v5/internal/pkg/keyctl/keyring.go
+++ b/vendor/github.com/containers/image/v5/internal/pkg/keyctl/keyring.go
@@ -5,9 +5,6 @@
 // +build linux
 
 // Package keyctl is a Go interface to linux kernel keyrings (keyctl interface)
-//
-// Deprecated: Most callers should use either golang.org/x/sys/unix directly,
-// or the original (and more extensive) github.com/jsipprell/keyctl .
 package keyctl
 
 import (
diff --git a/vendor/github.com/containers/image/v5/internal/tmpdir/tmpdir.go b/vendor/github.com/containers/image/v5/internal/tmpdir/tmpdir.go
index 8c776929c..a3081f4f2 100644
--- a/vendor/github.com/containers/image/v5/internal/tmpdir/tmpdir.go
+++ b/vendor/github.com/containers/image/v5/internal/tmpdir/tmpdir.go
@@ -3,6 +3,8 @@ package tmpdir
 import (
 	"os"
 	"runtime"
+
+	"github.com/containers/image/v5/types"
 )
 
 // unixTempDirForBigFiles is the directory path to store big files on non Windows systems.
@@ -18,7 +20,10 @@ const builtinUnixTempDirForBigFiles = "/var/tmp"
 // TemporaryDirectoryForBigFiles returns a directory for temporary (big) files.
 // On non Windows systems it avoids the use of os.TempDir(), because the default temporary directory usually falls under /tmp
 // which on systemd based systems could be the unsuitable tmpfs filesystem.
-func TemporaryDirectoryForBigFiles() string {
+func TemporaryDirectoryForBigFiles(sys *types.SystemContext) string {
+	if sys != nil && sys.BigFilesTemporaryDir != "" {
+		return sys.BigFilesTemporaryDir
+	}
 	var temporaryDirectoryForBigFiles string
 	if runtime.GOOS == "windows" {
 		temporaryDirectoryForBigFiles = os.TempDir()
diff --git a/vendor/github.com/containers/image/v5/manifest/list.go b/vendor/github.com/containers/image/v5/manifest/list.go
index 6d10430fd..c7d741dc2 100644
--- a/vendor/github.com/containers/image/v5/manifest/list.go
+++ b/vendor/github.com/containers/image/v5/manifest/list.go
@@ -66,9 +66,7 @@ func dupStringSlice(list []string) []string {
 		return nil
 	}
 	dup := make([]string, len(list))
-	for i := range list {
-		dup[i] = list[i]
-	}
+	copy(dup, list)
 	return dup
 }
 
diff --git a/vendor/github.com/containers/image/v5/manifest/manifest.go b/vendor/github.com/containers/image/v5/manifest/manifest.go
index 5b4d341d8..033b8d951 100644
--- a/vendor/github.com/containers/image/v5/manifest/manifest.go
+++ b/vendor/github.com/containers/image/v5/manifest/manifest.go
@@ -206,6 +206,11 @@ func MIMETypeIsMultiImage(mimeType string) bool {
 	return mimeType == DockerV2ListMediaType || mimeType == imgspecv1.MediaTypeImageIndex
 }
 
+// MIMETypeSupportsEncryption returns true if the mimeType supports encryption
+func MIMETypeSupportsEncryption(mimeType string) bool {
+	return mimeType == imgspecv1.MediaTypeImageManifest
+}
+
 // NormalizedMIMEType returns the effective MIME type of a manifest MIME type returned by a server,
 // centralizing various workarounds.
 func NormalizedMIMEType(input string) string {
diff --git a/vendor/github.com/containers/image/v5/manifest/oci.go b/vendor/github.com/containers/image/v5/manifest/oci.go
index 46c551b18..2d27d9433 100644
--- a/vendor/github.com/containers/image/v5/manifest/oci.go
+++ b/vendor/github.com/containers/image/v5/manifest/oci.go
@@ -3,9 +3,11 @@ package manifest
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/containers/image/v5/pkg/compression"
 	"github.com/containers/image/v5/types"
+	ociencspec "github.com/containers/ocicrypt/spec"
 	"github.com/opencontainers/go-digest"
 	"github.com/opencontainers/image-spec/specs-go"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
@@ -33,7 +35,7 @@ type OCI1 struct {
 // SupportedOCI1MediaType checks if the specified string is a supported OCI1 media type.
 func SupportedOCI1MediaType(m string) error {
 	switch m {
-	case imgspecv1.MediaTypeDescriptor, imgspecv1.MediaTypeImageConfig, imgspecv1.MediaTypeImageLayer, imgspecv1.MediaTypeImageLayerGzip, imgspecv1.MediaTypeImageLayerNonDistributable, imgspecv1.MediaTypeImageLayerNonDistributableGzip, imgspecv1.MediaTypeImageLayerNonDistributableZstd, imgspecv1.MediaTypeImageLayerZstd, imgspecv1.MediaTypeImageManifest, imgspecv1.MediaTypeLayoutHeader:
+	case imgspecv1.MediaTypeDescriptor, imgspecv1.MediaTypeImageConfig, imgspecv1.MediaTypeImageLayer, imgspecv1.MediaTypeImageLayerGzip, imgspecv1.MediaTypeImageLayerNonDistributable, imgspecv1.MediaTypeImageLayerNonDistributableGzip, imgspecv1.MediaTypeImageLayerNonDistributableZstd, imgspecv1.MediaTypeImageLayerZstd, imgspecv1.MediaTypeImageManifest, imgspecv1.MediaTypeLayoutHeader, ociencspec.MediaTypeLayerEnc, ociencspec.MediaTypeLayerGzipEnc:
 		return nil
 	default:
 		return fmt.Errorf("unsupported OCIv1 media type: %q", m)
@@ -117,7 +119,7 @@ func isOCI1Layer(mimeType string) bool {
 	}
 }
 
-// UpdateLayerInfos replaces the original layers with the specified BlobInfos (size+digest+urls), in order (the root layer first, and then successive layered layers)
+// UpdateLayerInfos replaces the original layers with the specified BlobInfos (size+digest+urls+mediatype), in order (the root layer first, and then successive layered layers)
 func (m *OCI1) UpdateLayerInfos(layerInfos []types.BlobInfo) error {
 	if len(m.Layers) != len(layerInfos) {
 		return errors.Errorf("Error preparing updated manifest: layer count changed from %d to %d", len(m.Layers), len(layerInfos))
@@ -125,11 +127,20 @@ func (m *OCI1) UpdateLayerInfos(layerInfos []types.BlobInfo) error {
 	original := m.Layers
 	m.Layers = make([]imgspecv1.Descriptor, len(layerInfos))
 	for i, info := range layerInfos {
+		mimeType := original[i].MediaType
 		// First make sure we support the media type of the original layer.
 		if err := SupportedOCI1MediaType(original[i].MediaType); err != nil {
 			return fmt.Errorf("Error preparing updated manifest: unknown media type of original layer: %q", original[i].MediaType)
 		}
 
+		if info.CryptoOperation == types.Decrypt {
+			decMimeType, err := getDecryptedMediaType(mimeType)
+			if err != nil {
+				return fmt.Errorf("error preparing updated manifest: decryption specified but original mediatype is not encrypted: %q", mimeType)
+			}
+			mimeType = decMimeType
+		}
+
 		// Set the correct media types based on the specified compression
 		// operation, the desired compression algorithm AND the original media
 		// type.
@@ -142,31 +153,29 @@ func (m *OCI1) UpdateLayerInfos(layerInfos []types.BlobInfo) error {
 		switch info.CompressionOperation {
 		case types.PreserveOriginal:
 			// Keep the original media type.
-			m.Layers[i].MediaType = original[i].MediaType
+			m.Layers[i].MediaType = mimeType
 
 		case types.Decompress:
 			// Decompress the original media type and check if it was
 			// non-distributable one or not.
-			mimeType := original[i].MediaType
 			switch {
 			case isOCI1NonDistributableLayer(mimeType):
 				m.Layers[i].MediaType = imgspecv1.MediaTypeImageLayerNonDistributable
 			case isOCI1Layer(mimeType):
 				m.Layers[i].MediaType = imgspecv1.MediaTypeImageLayer
 			default:
-				return fmt.Errorf("Error preparing updated manifest: unsupported media type for decompression: %q", original[i].MediaType)
+				return fmt.Errorf("Error preparing updated manifest: unsupported media type for decompression: %q", mimeType)
 			}
 
 		case types.Compress:
 			if info.CompressionAlgorithm == nil {
 				logrus.Debugf("Error preparing updated manifest: blob %q was compressed but does not specify by which algorithm: falling back to use the original blob", info.Digest)
-				m.Layers[i].MediaType = original[i].MediaType
+				m.Layers[i].MediaType = mimeType
 				break
 			}
 			// Compress the original media type and set the new one based on
 			// that type (distributable or not) and the specified compression
 			// algorithm. Throw an error if the algorithm is not supported.
-			mimeType := original[i].MediaType
 			switch info.CompressionAlgorithm.Name() {
 			case compression.Gzip.Name():
 				switch {
@@ -175,7 +184,7 @@ func (m *OCI1) UpdateLayerInfos(layerInfos []types.BlobInfo) error {
 				case isOCI1Layer(mimeType):
 					m.Layers[i].MediaType = imgspecv1.MediaTypeImageLayerGzip
 				default:
-					return fmt.Errorf("Error preparing updated manifest: unsupported media type for compression: %q", original[i].MediaType)
+					return fmt.Errorf("Error preparing updated manifest: unsupported media type for compression: %q", mimeType)
 				}
 
 			case compression.Zstd.Name():
@@ -185,7 +194,7 @@ func (m *OCI1) UpdateLayerInfos(layerInfos []types.BlobInfo) error {
 				case isOCI1Layer(mimeType):
 					m.Layers[i].MediaType = imgspecv1.MediaTypeImageLayerZstd
 				default:
-					return fmt.Errorf("Error preparing updated manifest: unsupported media type for compression: %q", original[i].MediaType)
+					return fmt.Errorf("Error preparing updated manifest: unsupported media type for compression: %q", mimeType)
 				}
 
 			default:
@@ -195,6 +204,15 @@ func (m *OCI1) UpdateLayerInfos(layerInfos []types.BlobInfo) error {
 		default:
 			return fmt.Errorf("Error preparing updated manifest: unknown compression operation (%d) for layer %q", info.CompressionOperation, info.Digest)
 		}
+
+		if info.CryptoOperation == types.Encrypt {
+			encMediaType, err := getEncryptedMediaType(m.Layers[i].MediaType)
+			if err != nil {
+				return fmt.Errorf("error preparing updated manifest: encryption specified but no counterpart for mediatype: %q", m.Layers[i].MediaType)
+			}
+			m.Layers[i].MediaType = encMediaType
+		}
+
 		m.Layers[i].Digest = info.Digest
 		m.Layers[i].Size = info.Size
 		m.Layers[i].Annotations = info.Annotations
@@ -220,7 +238,9 @@ func (m *OCI1) Inspect(configGetter func(types.BlobInfo) ([]byte, error)) (*type
 		return nil, err
 	}
 	d1 := &Schema2V1Image{}
-	json.Unmarshal(config, d1)
+	if err := json.Unmarshal(config, d1); err != nil {
+		return nil, err
+	}
 	i := &types.ImageInspectInfo{
 		Tag:           "",
 		Created:       v1.Created,
@@ -241,3 +261,30 @@ func (m *OCI1) ImageID([]digest.Digest) (string, error) {
 	}
 	return m.Config.Digest.Hex(), nil
 }
+
+// getEncryptedMediaType will return the mediatype to its encrypted counterpart and return
+// an error if the mediatype does not support encryption
+func getEncryptedMediaType(mediatype string) (string, error) {
+	for _, s := range strings.Split(mediatype, "+")[1:] {
+		if s == "encrypted" {
+			return "", errors.Errorf("unsupportedmediatype: %v already encrypted", mediatype)
+		}
+	}
+	unsuffixedMediatype := strings.Split(mediatype, "+")[0]
+	switch unsuffixedMediatype {
+	case DockerV2Schema2LayerMediaType, imgspecv1.MediaTypeImageLayer, imgspecv1.MediaTypeImageLayerNonDistributable:
+		return mediatype + "+encrypted", nil
+	}
+
+	return "", errors.Errorf("unsupported mediatype to encrypt: %v", mediatype)
+}
+
+// getEncryptedMediaType will return the mediatype to its encrypted counterpart and return
+// an error if the mediatype does not support decryption
+func getDecryptedMediaType(mediatype string) (string, error) {
+	if !strings.HasSuffix(mediatype, "+encrypted") {
+		return "", errors.Errorf("unsupported mediatype to decrypt %v:", mediatype)
+	}
+
+	return strings.TrimSuffix(mediatype, "+encrypted"), nil
+}
diff --git a/vendor/github.com/containers/image/v5/oci/archive/oci_dest.go b/vendor/github.com/containers/image/v5/oci/archive/oci_dest.go
index 164d5522d..0509eaa83 100644
--- a/vendor/github.com/containers/image/v5/oci/archive/oci_dest.go
+++ b/vendor/github.com/containers/image/v5/oci/archive/oci_dest.go
@@ -9,6 +9,7 @@ import (
 	"github.com/containers/storage/pkg/archive"
 	digest "github.com/opencontainers/go-digest"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 )
 
 type ociArchiveImageDestination struct {
@@ -19,7 +20,7 @@ type ociArchiveImageDestination struct {
 
 // newImageDestination returns an ImageDestination for writing to an existing directory.
 func newImageDestination(ctx context.Context, sys *types.SystemContext, ref ociArchiveReference) (types.ImageDestination, error) {
-	tempDirRef, err := createOCIRef(ref.image)
+	tempDirRef, err := createOCIRef(sys, ref.image)
 	if err != nil {
 		return nil, errors.Wrapf(err, "error creating oci reference")
 	}
@@ -43,7 +44,10 @@ func (d *ociArchiveImageDestination) Reference() types.ImageReference {
 // Close removes resources associated with an initialized ImageDestination, if any
 // Close deletes the temp directory of the oci-archive image
 func (d *ociArchiveImageDestination) Close() error {
-	defer d.tempDirRef.deleteTempDir()
+	defer func() {
+		err := d.tempDirRef.deleteTempDir()
+		logrus.Debugf("Error deleting temporary directory: %v", err)
+	}()
 	return d.unpackedDest.Close()
 }
 
@@ -66,7 +70,7 @@ func (d *ociArchiveImageDestination) AcceptsForeignLayerURLs() bool {
 	return d.unpackedDest.AcceptsForeignLayerURLs()
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise
 func (d *ociArchiveImageDestination) MustMatchRuntimeOS() bool {
 	return d.unpackedDest.MustMatchRuntimeOS()
 }
diff --git a/vendor/github.com/containers/image/v5/oci/archive/oci_src.go b/vendor/github.com/containers/image/v5/oci/archive/oci_src.go
index 33a41d44b..8f07b3307 100644
--- a/vendor/github.com/containers/image/v5/oci/archive/oci_src.go
+++ b/vendor/github.com/containers/image/v5/oci/archive/oci_src.go
@@ -9,6 +9,7 @@ import (
 	digest "github.com/opencontainers/go-digest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 )
 
 type ociArchiveImageSource struct {
@@ -20,7 +21,7 @@ type ociArchiveImageSource struct {
 // newImageSource returns an ImageSource for reading from an existing directory.
 // newImageSource untars the file and saves it in a temp directory
 func newImageSource(ctx context.Context, sys *types.SystemContext, ref ociArchiveReference) (types.ImageSource, error) {
-	tempDirRef, err := createUntarTempDir(ref)
+	tempDirRef, err := createUntarTempDir(sys, ref)
 	if err != nil {
 		return nil, errors.Wrap(err, "error creating temp directory")
 	}
@@ -38,16 +39,25 @@ func newImageSource(ctx context.Context, sys *types.SystemContext, ref ociArchiv
 }
 
 // LoadManifestDescriptor loads the manifest
+// Deprecated: use LoadManifestDescriptorWithContext instead
 func LoadManifestDescriptor(imgRef types.ImageReference) (imgspecv1.Descriptor, error) {
+	return LoadManifestDescriptorWithContext(nil, imgRef)
+}
+
+// LoadManifestDescriptorWithContext loads the manifest
+func LoadManifestDescriptorWithContext(sys *types.SystemContext, imgRef types.ImageReference) (imgspecv1.Descriptor, error) {
 	ociArchRef, ok := imgRef.(ociArchiveReference)
 	if !ok {
 		return imgspecv1.Descriptor{}, errors.Errorf("error typecasting, need type ociArchiveReference")
 	}
-	tempDirRef, err := createUntarTempDir(ociArchRef)
+	tempDirRef, err := createUntarTempDir(sys, ociArchRef)
 	if err != nil {
 		return imgspecv1.Descriptor{}, errors.Wrap(err, "error creating temp directory")
 	}
-	defer tempDirRef.deleteTempDir()
+	defer func() {
+		err := tempDirRef.deleteTempDir()
+		logrus.Debugf("Error deleting temporary directory: %v", err)
+	}()
 
 	descriptor, err := ocilayout.LoadManifestDescriptor(tempDirRef.ociRefExtracted)
 	if err != nil {
@@ -64,7 +74,10 @@ func (s *ociArchiveImageSource) Reference() types.ImageReference {
 // Close removes resources associated with an initialized ImageSource, if any.
 // Close deletes the temporary directory at dst
 func (s *ociArchiveImageSource) Close() error {
-	defer s.tempDirRef.deleteTempDir()
+	defer func() {
+		err := s.tempDirRef.deleteTempDir()
+		logrus.Debugf("error deleting tmp dir: %v", err)
+	}()
 	return s.unpackedSrc.Close()
 }
 
diff --git a/vendor/github.com/containers/image/v5/oci/archive/oci_transport.go b/vendor/github.com/containers/image/v5/oci/archive/oci_transport.go
index 2d72a6fee..3033b4a27 100644
--- a/vendor/github.com/containers/image/v5/oci/archive/oci_transport.go
+++ b/vendor/github.com/containers/image/v5/oci/archive/oci_transport.go
@@ -96,7 +96,7 @@ func (ref ociArchiveReference) PolicyConfigurationIdentity() string {
 	// NOTE: ref.image is not a part of the image identity, because "$dir:$someimage" and "$dir:" may mean the
 	// same image and the two can’t be statically disambiguated.  Using at least the repository directory is
 	// less granular but hopefully still useful.
-	return fmt.Sprintf("%s", ref.resolvedFile)
+	return ref.resolvedFile
 }
 
 // PolicyConfigurationNamespaces returns a list of other policy configuration namespaces to search
@@ -159,8 +159,9 @@ func (t *tempDirOCIRef) deleteTempDir() error {
 }
 
 // createOCIRef creates the oci reference of the image
-func createOCIRef(image string) (tempDirOCIRef, error) {
-	dir, err := ioutil.TempDir(tmpdir.TemporaryDirectoryForBigFiles(), "oci")
+// If SystemContext.BigFilesTemporaryDir not "", overrides the temporary directory to use for storing big files
+func createOCIRef(sys *types.SystemContext, image string) (tempDirOCIRef, error) {
+	dir, err := ioutil.TempDir(tmpdir.TemporaryDirectoryForBigFiles(sys), "oci")
 	if err != nil {
 		return tempDirOCIRef{}, errors.Wrapf(err, "error creating temp directory")
 	}
@@ -174,8 +175,8 @@ func createOCIRef(image string) (tempDirOCIRef, error) {
 }
 
 // creates the temporary directory and copies the tarred content to it
-func createUntarTempDir(ref ociArchiveReference) (tempDirOCIRef, error) {
-	tempDirRef, err := createOCIRef(ref.image)
+func createUntarTempDir(sys *types.SystemContext, ref ociArchiveReference) (tempDirOCIRef, error) {
+	tempDirRef, err := createOCIRef(sys, ref.image)
 	if err != nil {
 		return tempDirOCIRef{}, errors.Wrap(err, "error creating oci reference")
 	}
diff --git a/vendor/github.com/containers/image/v5/oci/layout/oci_dest.go b/vendor/github.com/containers/image/v5/oci/layout/oci_dest.go
index 370e8d2cd..fb0449ca5 100644
--- a/vendor/github.com/containers/image/v5/oci/layout/oci_dest.go
+++ b/vendor/github.com/containers/image/v5/oci/layout/oci_dest.go
@@ -97,7 +97,7 @@ func (d *ociImageDestination) AcceptsForeignLayerURLs() bool {
 	return true
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 func (d *ociImageDestination) MustMatchRuntimeOS() bool {
 	return false
 }
diff --git a/vendor/github.com/containers/image/v5/oci/layout/oci_transport.go b/vendor/github.com/containers/image/v5/oci/layout/oci_transport.go
index c662c9a7a..a99b63158 100644
--- a/vendor/github.com/containers/image/v5/oci/layout/oci_transport.go
+++ b/vendor/github.com/containers/image/v5/oci/layout/oci_transport.go
@@ -124,7 +124,7 @@ func (ref ociReference) PolicyConfigurationIdentity() string {
 	// NOTE: ref.image is not a part of the image identity, because "$dir:$someimage" and "$dir:" may mean the
 	// same image and the two can’t be statically disambiguated.  Using at least the repository directory is
 	// less granular but hopefully still useful.
-	return fmt.Sprintf("%s", ref.resolvedDir)
+	return ref.resolvedDir
 }
 
 // PolicyConfigurationNamespaces returns a list of other policy configuration namespaces to search
diff --git a/vendor/github.com/containers/image/v5/openshift/openshift-copies.go b/vendor/github.com/containers/image/v5/openshift/openshift-copies.go
index f45dc24c4..585b75069 100644
--- a/vendor/github.com/containers/image/v5/openshift/openshift-copies.go
+++ b/vendor/github.com/containers/image/v5/openshift/openshift-copies.go
@@ -19,6 +19,7 @@ import (
 	"github.com/ghodss/yaml"
 	"github.com/imdario/mergo"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 	"golang.org/x/net/http2"
 	"k8s.io/client-go/util/homedir"
 )
@@ -137,9 +138,8 @@ func (config *deferredLoadingClientConfig) createClientConfig() (clientConfig, e
 			return nil, err
 		}
 
-		var mergedClientConfig clientConfig
 		// REMOVED: Interactive fallback support.
-		mergedClientConfig = newNonInteractiveClientConfig(*mergedConfig)
+		mergedClientConfig := newNonInteractiveClientConfig(*mergedConfig)
 
 		config.clientConfig = mergedClientConfig
 	}
@@ -210,13 +210,17 @@ func (config *directClientConfig) ClientConfig() (*restConfig, error) {
 		if err != nil {
 			return nil, err
 		}
-		mergo.MergeWithOverwrite(clientConfig, userAuthPartialConfig)
+		if err = mergo.MergeWithOverwrite(clientConfig, userAuthPartialConfig); err != nil {
+			return nil, err
+		}
 
 		serverAuthPartialConfig, err := getServerIdentificationPartialConfig(configAuthInfo, configClusterInfo)
 		if err != nil {
 			return nil, err
 		}
-		mergo.MergeWithOverwrite(clientConfig, serverAuthPartialConfig)
+		if err = mergo.MergeWithOverwrite(clientConfig, serverAuthPartialConfig); err != nil {
+			return nil, err
+		}
 	}
 
 	return clientConfig, nil
@@ -237,7 +241,9 @@ func getServerIdentificationPartialConfig(configAuthInfo clientcmdAuthInfo, conf
 	configClientConfig.CAFile = configClusterInfo.CertificateAuthority
 	configClientConfig.CAData = configClusterInfo.CertificateAuthorityData
 	configClientConfig.Insecure = configClusterInfo.InsecureSkipTLSVerify
-	mergo.MergeWithOverwrite(mergedConfig, configClientConfig)
+	if err := mergo.MergeWithOverwrite(mergedConfig, configClientConfig); err != nil {
+		return nil, err
+	}
 
 	return mergedConfig, nil
 }
@@ -272,14 +278,6 @@ func getUserIdentificationPartialConfig(configAuthInfo clientcmdAuthInfo) (*rest
 	return mergedConfig, nil
 }
 
-// canIdentifyUser is a modified copy of k8s.io/kubernetes/pkg/client/unversioned/clientcmd.canIdentifyUser
-func canIdentifyUser(config restConfig) bool {
-	return len(config.Username) > 0 ||
-		(len(config.CertFile) > 0 || len(config.CertData) > 0) ||
-		len(config.BearerToken) > 0
-
-}
-
 // ConfirmUsable is a modified copy of k8s.io/kubernetes/pkg/client/unversioned/clientcmd.DirectClientConfig.ConfirmUsable.
 // ConfirmUsable looks a particular context and determines if that particular part of the config is useable.  There might still be errors in the config,
 // but no errors in the sections requested or referenced.  It does not return early so that it can find as many errors as possible.
@@ -320,7 +318,9 @@ func (config *directClientConfig) getContext() clientcmdContext {
 
 	var mergedContext clientcmdContext
 	if configContext, exists := contexts[contextName]; exists {
-		mergo.MergeWithOverwrite(&mergedContext, configContext)
+		if err := mergo.MergeWithOverwrite(&mergedContext, configContext); err != nil {
+			logrus.Debugf("Can't merge configContext: %v", err)
+		}
 	}
 	// REMOVED: overrides support
 
@@ -333,6 +333,17 @@ var (
 	errEmptyCluster = errors.New("cluster has no server defined")
 )
 
+//helper for checking certificate/key/CA
+func validateFileIsReadable(name string) error {
+	answer, err := os.Open(name)
+	defer func() {
+		if err := answer.Close(); err != nil {
+			logrus.Debugf("Error closing %v: %v", name, err)
+		}
+	}()
+	return err
+}
+
 // validateClusterInfo is a modified copy of k8s.io/kubernetes/pkg/client/unversioned/clientcmd.DirectClientConfig.validateClusterInfo.
 // validateClusterInfo looks for conflicts and errors in the cluster info
 func validateClusterInfo(clusterName string, clusterInfo clientcmdCluster) []error {
@@ -354,8 +365,7 @@ func validateClusterInfo(clusterName string, clusterInfo clientcmdCluster) []err
 		validationErrors = append(validationErrors, errors.Errorf("certificate-authority-data and certificate-authority are both specified for %v. certificate-authority-data will override", clusterName))
 	}
 	if len(clusterInfo.CertificateAuthority) != 0 {
-		clientCertCA, err := os.Open(clusterInfo.CertificateAuthority)
-		defer clientCertCA.Close()
+		err := validateFileIsReadable(clusterInfo.CertificateAuthority)
 		if err != nil {
 			validationErrors = append(validationErrors, errors.Errorf("unable to read certificate-authority %v for %v due to %v", clusterInfo.CertificateAuthority, clusterName, err))
 		}
@@ -393,15 +403,13 @@ func validateAuthInfo(authInfoName string, authInfo clientcmdAuthInfo) []error {
 		}
 
 		if len(authInfo.ClientCertificate) != 0 {
-			clientCertFile, err := os.Open(authInfo.ClientCertificate)
-			defer clientCertFile.Close()
+			err := validateFileIsReadable(authInfo.ClientCertificate)
 			if err != nil {
 				validationErrors = append(validationErrors, errors.Errorf("unable to read client-cert %v for %v due to %v", authInfo.ClientCertificate, authInfoName, err))
 			}
 		}
 		if len(authInfo.ClientKey) != 0 {
-			clientKeyFile, err := os.Open(authInfo.ClientKey)
-			defer clientKeyFile.Close()
+			err := validateFileIsReadable(authInfo.ClientKey)
 			if err != nil {
 				validationErrors = append(validationErrors, errors.Errorf("unable to read client-key %v for %v due to %v", authInfo.ClientKey, authInfoName, err))
 			}
@@ -423,7 +431,9 @@ func (config *directClientConfig) getAuthInfo() clientcmdAuthInfo {
 
 	var mergedAuthInfo clientcmdAuthInfo
 	if configAuthInfo, exists := authInfos[authInfoName]; exists {
-		mergo.MergeWithOverwrite(&mergedAuthInfo, configAuthInfo)
+		if err := mergo.MergeWithOverwrite(&mergedAuthInfo, configAuthInfo); err != nil {
+			logrus.Debugf("Can't merge configAuthInfo: %v", err)
+		}
 	}
 	// REMOVED: overrides support
 
@@ -436,10 +446,16 @@ func (config *directClientConfig) getCluster() clientcmdCluster {
 	clusterInfoName := config.getClusterName()
 
 	var mergedClusterInfo clientcmdCluster
-	mergo.MergeWithOverwrite(&mergedClusterInfo, defaultCluster)
-	mergo.MergeWithOverwrite(&mergedClusterInfo, envVarCluster)
+	if err := mergo.MergeWithOverwrite(&mergedClusterInfo, defaultCluster); err != nil {
+		logrus.Debugf("Can't merge defaultCluster: %v", err)
+	}
+	if err := mergo.MergeWithOverwrite(&mergedClusterInfo, envVarCluster); err != nil {
+		logrus.Debugf("Can't merge envVarCluster: %v", err)
+	}
 	if configClusterInfo, exists := clusterInfos[clusterInfoName]; exists {
-		mergo.MergeWithOverwrite(&mergedClusterInfo, configClusterInfo)
+		if err := mergo.MergeWithOverwrite(&mergedClusterInfo, configClusterInfo); err != nil {
+			logrus.Debugf("Can't merge configClusterInfo: %v", err)
+		}
 	}
 	// REMOVED: overrides support
 
@@ -573,7 +589,9 @@ func (rules *clientConfigLoadingRules) Load() (*clientcmdConfig, error) {
 	// first merge all of our maps
 	mapConfig := clientcmdNewConfig()
 	for _, kubeconfig := range kubeconfigs {
-		mergo.MergeWithOverwrite(mapConfig, kubeconfig)
+		if err := mergo.MergeWithOverwrite(mapConfig, kubeconfig); err != nil {
+			return nil, err
+		}
 	}
 
 	// merge all of the struct values in the reverse order so that priority is given correctly
@@ -581,14 +599,20 @@ func (rules *clientConfigLoadingRules) Load() (*clientcmdConfig, error) {
 	nonMapConfig := clientcmdNewConfig()
 	for i := len(kubeconfigs) - 1; i >= 0; i-- {
 		kubeconfig := kubeconfigs[i]
-		mergo.MergeWithOverwrite(nonMapConfig, kubeconfig)
+		if err := mergo.MergeWithOverwrite(nonMapConfig, kubeconfig); err != nil {
+			return nil, err
+		}
 	}
 
 	// since values are overwritten, but maps values are not, we can merge the non-map config on top of the map config and
 	// get the values we expect.
 	config := clientcmdNewConfig()
-	mergo.MergeWithOverwrite(config, mapConfig)
-	mergo.MergeWithOverwrite(config, nonMapConfig)
+	if err := mergo.MergeWithOverwrite(config, mapConfig); err != nil {
+		return nil, err
+	}
+	if err := mergo.MergeWithOverwrite(config, nonMapConfig); err != nil {
+		return nil, err
+	}
 
 	// REMOVED: Possibility to skip this.
 	if err := resolveLocalPaths(config); err != nil {
diff --git a/vendor/github.com/containers/image/v5/openshift/openshift.go b/vendor/github.com/containers/image/v5/openshift/openshift.go
index 016de4803..b9242da6e 100644
--- a/vendor/github.com/containers/image/v5/openshift/openshift.go
+++ b/vendor/github.com/containers/image/v5/openshift/openshift.go
@@ -378,7 +378,7 @@ func (d *openshiftImageDestination) AcceptsForeignLayerURLs() bool {
 	return true
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 func (d *openshiftImageDestination) MustMatchRuntimeOS() bool {
 	return false
 }
@@ -491,6 +491,9 @@ sigExists:
 			Content:    newSig,
 		}
 		body, err := json.Marshal(sig)
+		if err != nil {
+			return err
+		}
 		_, err = d.client.doRequest(ctx, "POST", "/oapi/v1/imagesignatures", body)
 		if err != nil {
 			return err
diff --git a/vendor/github.com/containers/image/v5/ostree/ostree_dest.go b/vendor/github.com/containers/image/v5/ostree/ostree_dest.go
index c442b4d2e..115097055 100644
--- a/vendor/github.com/containers/image/v5/ostree/ostree_dest.go
+++ b/vendor/github.com/containers/image/v5/ostree/ostree_dest.go
@@ -120,7 +120,7 @@ func (d *ostreeImageDestination) AcceptsForeignLayerURLs() bool {
 	return false
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 func (d *ostreeImageDestination) MustMatchRuntimeOS() bool {
 	return true
 }
diff --git a/vendor/github.com/containers/image/v5/pkg/sysregistriesv2/system_registries_v2.go b/vendor/github.com/containers/image/v5/pkg/sysregistriesv2/system_registries_v2.go
index ff802cefd..60d67dfdc 100644
--- a/vendor/github.com/containers/image/v5/pkg/sysregistriesv2/system_registries_v2.go
+++ b/vendor/github.com/containers/image/v5/pkg/sysregistriesv2/system_registries_v2.go
@@ -275,7 +275,10 @@ func (config *V2RegistriesConf) postProcess() error {
 	// Note: we need to iterate over the registries array to ensure a
 	// deterministic behavior which is not guaranteed by maps.
 	for _, reg := range config.Registries {
-		others, _ := regMap[reg.Location]
+		others, ok := regMap[reg.Location]
+		if !ok {
+			return fmt.Errorf("Internal error in V2RegistriesConf.PostProcess: entry in regMap is missing")
+		}
 		for _, other := range others {
 			if reg.Insecure != other.Insecure {
 				msg := fmt.Sprintf("registry '%s' is defined multiple times with conflicting 'insecure' setting", reg.Location)
diff --git a/vendor/github.com/containers/image/v5/pkg/tlsclientconfig/tlsclientconfig.go b/vendor/github.com/containers/image/v5/pkg/tlsclientconfig/tlsclientconfig.go
index 6785564e8..7e2142b1f 100644
--- a/vendor/github.com/containers/image/v5/pkg/tlsclientconfig/tlsclientconfig.go
+++ b/vendor/github.com/containers/image/v5/pkg/tlsclientconfig/tlsclientconfig.go
@@ -99,14 +99,13 @@ func NewTransport() *http.Transport {
 	}
 	tr := &http.Transport{
 		Proxy:               http.ProxyFromEnvironment,
-		Dial:                direct.Dial,
+		DialContext:         direct.DialContext,
 		TLSHandshakeTimeout: 10 * time.Second,
 		// TODO(dmcgowan): Call close idle connections when complete and use keep alive
 		DisableKeepAlives: true,
 	}
-	proxyDialer, err := sockets.DialerFromEnvironment(direct)
-	if err == nil {
-		tr.Dial = proxyDialer.Dial
+	if _, err := sockets.DialerFromEnvironment(direct); err != nil {
+		logrus.Debugf("Can't execute DialerFromEnvironment: %v", err)
 	}
 	return tr
 }
diff --git a/vendor/github.com/containers/image/v5/signature/policy_eval.go b/vendor/github.com/containers/image/v5/signature/policy_eval.go
index e94de2a9c..a1fb1eebb 100644
--- a/vendor/github.com/containers/image/v5/signature/policy_eval.go
+++ b/vendor/github.com/containers/image/v5/signature/policy_eval.go
@@ -85,7 +85,6 @@ type PolicyContext struct {
 type policyContextState string
 
 const (
-	pcInvalid      policyContextState = ""
 	pcInitializing policyContextState = "Initializing"
 	pcReady        policyContextState = "Ready"
 	pcInUse        policyContextState = "InUse"
diff --git a/vendor/github.com/containers/image/v5/signature/signature.go b/vendor/github.com/containers/image/v5/signature/signature.go
index 44e70b3b9..bc1c0e575 100644
--- a/vendor/github.com/containers/image/v5/signature/signature.go
+++ b/vendor/github.com/containers/image/v5/signature/signature.go
@@ -111,8 +111,8 @@ var _ json.Unmarshaler = (*untrustedSignature)(nil)
 func (s *untrustedSignature) UnmarshalJSON(data []byte) error {
 	err := s.strictUnmarshalJSON(data)
 	if err != nil {
-		if _, ok := err.(jsonFormatError); ok {
-			err = InvalidSignatureError{msg: err.Error()}
+		if formatErr, ok := err.(jsonFormatError); ok {
+			err = InvalidSignatureError{msg: formatErr.Error()}
 		}
 	}
 	return err
diff --git a/vendor/github.com/containers/image/v5/storage/storage_image.go b/vendor/github.com/containers/image/v5/storage/storage_image.go
index 2b89f329f..df4b67c7a 100644
--- a/vendor/github.com/containers/image/v5/storage/storage_image.go
+++ b/vendor/github.com/containers/image/v5/storage/storage_image.go
@@ -147,7 +147,8 @@ func (s *storageImageSource) getBlobAndLayerID(info types.BlobInfo) (rc io.ReadC
 	// Check if the blob corresponds to a diff that was used to initialize any layers.  Our
 	// callers should try to retrieve layers using their uncompressed digests, so no need to
 	// check if they're using one of the compressed digests, which we can't reproduce anyway.
-	layers, err := s.imageRef.transport.store.LayersByUncompressedDigest(info.Digest)
+	layers, _ := s.imageRef.transport.store.LayersByUncompressedDigest(info.Digest)
+
 	// If it's not a layer, then it must be a data item.
 	if len(layers) == 0 {
 		b, err := s.imageRef.transport.store.ImageBigData(s.image.ID, info.Digest.String())
@@ -341,8 +342,8 @@ func (s *storageImageSource) GetSignatures(ctx context.Context, instanceDigest *
 
 // newImageDestination sets us up to write a new image, caching blobs in a temporary directory until
 // it's time to Commit() the image
-func newImageDestination(imageRef storageReference) (*storageImageDestination, error) {
-	directory, err := ioutil.TempDir(tmpdir.TemporaryDirectoryForBigFiles(), "storage")
+func newImageDestination(sys *types.SystemContext, imageRef storageReference) (*storageImageDestination, error) {
+	directory, err := ioutil.TempDir(tmpdir.TemporaryDirectoryForBigFiles(sys), "storage")
 	if err != nil {
 		return nil, errors.Wrapf(err, "error creating a temporary directory")
 	}
@@ -930,7 +931,7 @@ func (s *storageImageDestination) AcceptsForeignLayerURLs() bool {
 	return false
 }
 
-// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 func (s *storageImageDestination) MustMatchRuntimeOS() bool {
 	return true
 }
diff --git a/vendor/github.com/containers/image/v5/storage/storage_reference.go b/vendor/github.com/containers/image/v5/storage/storage_reference.go
index 4e137ad1b..5199fb535 100644
--- a/vendor/github.com/containers/image/v5/storage/storage_reference.go
+++ b/vendor/github.com/containers/image/v5/storage/storage_reference.go
@@ -93,6 +93,9 @@ func imageMatchesSystemContext(store storage.Store, img *storage.Image, manifest
 	}
 	// Load the image's configuration blob.
 	m, err := manifest.FromBlob(manifestBytes, manifestType)
+	if err != nil {
+		return false
+	}
 	getConfig := func(blobInfo types.BlobInfo) ([]byte, error) {
 		return store.ImageBigData(img.ID, blobInfo.Digest.String())
 	}
@@ -295,5 +298,5 @@ func (s storageReference) NewImageSource(ctx context.Context, sys *types.SystemC
 }
 
 func (s storageReference) NewImageDestination(ctx context.Context, sys *types.SystemContext) (types.ImageDestination, error) {
-	return newImageDestination(s)
+	return newImageDestination(sys, s)
 }
diff --git a/vendor/github.com/containers/image/v5/types/types.go b/vendor/github.com/containers/image/v5/types/types.go
index 2db8c7827..d38a17fab 100644
--- a/vendor/github.com/containers/image/v5/types/types.go
+++ b/vendor/github.com/containers/image/v5/types/types.go
@@ -104,6 +104,19 @@ const (
 	Compress
 )
 
+// LayerCrypto indicates if layers have been encrypted or decrypted or none
+type LayerCrypto int
+
+const (
+	// PreserveOriginalCrypto indicates the layer must be preserved, ie
+	// no encryption/decryption
+	PreserveOriginalCrypto LayerCrypto = iota
+	// Encrypt indicates the layer is encrypted
+	Encrypt
+	// Decrypt indicates the layer is decrypted
+	Decrypt
+)
+
 // BlobInfo collects known information about a blob (layer/config).
 // In some situations, some fields may be unknown, in others they may be mandatory; documenting an “unknown” value here does not override that.
 type BlobInfo struct {
@@ -115,11 +128,18 @@ type BlobInfo struct {
 	// CompressionOperation is used in Image.UpdateLayerInfos to instruct
 	// whether the original layer should be preserved or (de)compressed. The
 	// field defaults to preserve the original layer.
+	// TODO: To remove together with CryptoOperation in re-design to remove
+	// field out out of BlobInfo.
 	CompressionOperation LayerCompression
 	// CompressionAlgorithm is used in Image.UpdateLayerInfos to set the correct
 	// MIME type for compressed layers (e.g., gzip or zstd). This field MUST be
 	// set when `CompressionOperation == Compress`.
 	CompressionAlgorithm *compression.Algorithm
+	// CryptoOperation is used in Image.UpdateLayerInfos to instruct
+	// whether the original layer was encrypted/decrypted
+	// TODO: To remove together with CompressionOperation in re-design to
+	// remove field out out of BlobInfo.
+	CryptoOperation LayerCrypto
 }
 
 // BICTransportScope encapsulates transport-dependent representation of a “scope” where blobs are or are not present.
@@ -264,7 +284,7 @@ type ImageDestination interface {
 	// AcceptsForeignLayerURLs returns false iff foreign layers in manifest should be actually
 	// uploaded to the image destination, true otherwise.
 	AcceptsForeignLayerURLs() bool
-	// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime OS. False otherwise.
+	// MustMatchRuntimeOS returns true iff the destination can store only images targeted for the current runtime architecture and OS. False otherwise.
 	MustMatchRuntimeOS() bool
 	// IgnoresEmbeddedDockerReference() returns true iff the destination does not care about Image.EmbeddedDockerReferenceConflicts(),
 	// and would prefer to receive an unmodified manifest instead of one modified for the destination.
@@ -378,6 +398,8 @@ type Image interface {
 	// Everything in options.InformationOnly should be provided, other fields should be set only if a modification is desired.
 	// This does not change the state of the original Image object.
 	UpdatedImage(ctx context.Context, options ManifestUpdateOptions) (Image, error)
+	// SupportsEncryption returns an indicator that the image supports encryption
+	SupportsEncryption(ctx context.Context) bool
 	// Size returns an approximation of the amount of disk space which is consumed by the image in its current
 	// location.  If the size is not known, -1 will be returned.
 	Size() (int64, error)
@@ -448,7 +470,7 @@ const (
 // OptionalBoolFalse.  The function is meant to avoid boilerplate code of users.
 func NewOptionalBool(b bool) OptionalBool {
 	o := OptionalBoolFalse
-	if b == true {
+	if b {
 		o = OptionalBoolTrue
 	}
 	return o
@@ -490,9 +512,10 @@ type SystemContext struct {
 	OSChoice string
 	// If not "", overrides the system's default directory containing a blob info cache.
 	BlobInfoCacheDir string
-
 	// Additional tags when creating or copying a docker-archive.
 	DockerArchiveAdditionalTags []reference.NamedTagged
+	// If not "", overrides the temporary directory to use for storing big files
+	BigFilesTemporaryDir string
 
 	// === OCI.Transport overrides ===
 	// If not "", a directory containing a CA certificate (ending with ".crt"),
@@ -547,9 +570,37 @@ type SystemContext struct {
 	CompressionLevel *int
 }
 
+// ProgressEvent is the type of events a progress reader can produce
+// Warning: new event types may be added any time.
+type ProgressEvent uint
+
+const (
+	// ProgressEventNewArtifact will be fired on progress reader setup
+	ProgressEventNewArtifact ProgressEvent = iota
+
+	// ProgressEventRead indicates that the artifact download is currently in
+	// progress
+	ProgressEventRead
+
+	// ProgressEventDone is fired when the data transfer has been finished for
+	// the specific artifact
+	ProgressEventDone
+)
+
 // ProgressProperties is used to pass information from the copy code to a monitor which
 // can use the real-time information to produce output or react to changes.
 type ProgressProperties struct {
+	// The event indicating what
+	Event ProgressEvent
+
+	// The artifact which has been updated in this interval
 	Artifact BlobInfo
-	Offset   uint64
+
+	// The currently downloaded size in bytes
+	// Increases from 0 to the final Artifact size
+	Offset uint64
+
+	// The additional offset which has been downloaded inside the last update
+	// interval. Will be reset after each ProgressEventRead event.
+	OffsetUpdate uint64
 }
diff --git a/vendor/github.com/containers/image/v5/version/version.go b/vendor/github.com/containers/image/v5/version/version.go
index 572be2b89..a92774466 100644
--- a/vendor/github.com/containers/image/v5/version/version.go
+++ b/vendor/github.com/containers/image/v5/version/version.go
@@ -6,7 +6,7 @@ const (
 	// VersionMajor is for an API incompatible changes
 	VersionMajor = 5
 	// VersionMinor is for functionality in a backwards-compatible manner
-	VersionMinor = 0
+	VersionMinor = 1
 	// VersionPatch is for backwards-compatible bug fixes
 	VersionPatch = 0
 
diff --git a/vendor/github.com/containers/ocicrypt/MAINTAINERS b/vendor/github.com/containers/ocicrypt/MAINTAINERS
new file mode 100644
index 000000000..e6a7d1f0a
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/MAINTAINERS
@@ -0,0 +1,5 @@
+# ocicrypt maintainers
+#
+# Github ID, Name, Email Address
+lumjjb, Brandon Lum, lumjjb@gmail.com
+stefanberger, Stefan Berger, stefanb@linux.ibm.com
diff --git a/vendor/github.com/containers/ocicrypt/Makefile b/vendor/github.com/containers/ocicrypt/Makefile
new file mode 100644
index 000000000..49fa80d74
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/Makefile
@@ -0,0 +1,31 @@
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+.PHONY: check build decoder
+
+all: build
+
+FORCE:
+
+check:
+	golangci-lint run
+
+build: vendor
+	go build ./...
+
+vendor:
+	go mod tidy
+
+test:
+	go test ./...
diff --git a/vendor/github.com/containers/ocicrypt/README.md b/vendor/github.com/containers/ocicrypt/README.md
new file mode 100644
index 000000000..ec5ae5b35
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/README.md
@@ -0,0 +1,32 @@
+# OCIcrypt Library
+
+The `ocicrypt` library is the OCI image spec implementation of container image encryption. More details of the spec can be seen in the [OCI repository](https://github.com/opencontainers/image-spec/pull/775). The purpose of this library is to encode spec structures and consts in code, as well as provide a consistent implementation of image encryption across container runtimes and build tools.
+
+## Usage
+
+There are various levels of usage for this library. The main consumers of these would be runtime/buil tools, and a more specific use would be in the ability to extend cryptographic function.
+
+### Runtime/Build tool usage
+
+The general exposed interface a runtime/build tool would use, would be to perform encryption or decryption of layers:
+
+```
+package "github.com/containers/ocicrypt"
+func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, EncryptLayerFinalizer, error)
+func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error)
+```
+
+The settings/parameters to these functions can be specified via creation of an encryption config with the `github.com/containers/ocicrypt/config` package. We note that because setting of annotations and other fields of the layer descriptor is done through various means in different runtimes/build tools, it is the resposibility of the caller to still ensure that the layer descriptor follows the OCI specification (i.e. encoding, setting annotations, etc.).
+
+
+### Crypto Agility and Extensibility
+
+The implementation for both symmetric and assymetric encryption used in this library are behind 2 main interfaces, which users can extend if need be. These are in the following packages:
+- github.com/containers/ocicrypt/blockcipher - LayerBlockCipher interface for block ciphers
+- github.com/containers/ocicrypt/keywrap - KeyWrapper interface for key wrapping
+
+We note that adding interfaces here is risky outside the OCI spec is not recommended, unless for very specialized and confined usecases. Please open an issue or PR if there is a general usecase that could be added to the OCI spec.
+
+## Security Issues
+
+We consider security issues related to this library critical. Please report and security related issues by emailing maintainers in the [MAINTAINERS](MAINTAINERS) file.
diff --git a/vendor/github.com/containers/ocicrypt/blockcipher/blockcipher.go b/vendor/github.com/containers/ocicrypt/blockcipher/blockcipher.go
new file mode 100644
index 000000000..da403d95d
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/blockcipher/blockcipher.go
@@ -0,0 +1,160 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package blockcipher
+
+import (
+	"io"
+
+	"github.com/opencontainers/go-digest"
+	"github.com/pkg/errors"
+)
+
+// LayerCipherType is the ciphertype as specified in the layer metadata
+type LayerCipherType string
+
+// TODO: Should be obtained from OCI spec once included
+const (
+	AES256CTR LayerCipherType = "AES_256_CTR_HMAC_SHA256"
+)
+
+// PrivateLayerBlockCipherOptions includes the information required to encrypt/decrypt
+// an image which are sensitive and should not be in plaintext
+type PrivateLayerBlockCipherOptions struct {
+	// SymmetricKey represents the symmetric key used for encryption/decryption
+	// This field should be populated by Encrypt/Decrypt calls
+	SymmetricKey []byte `json:"symkey"`
+
+	// Digest is the digest of the original data for verification.
+	// This is NOT populated by Encrypt/Decrypt calls
+	Digest digest.Digest `json:"digest"`
+
+	// CipherOptions contains the cipher metadata used for encryption/decryption
+	// This field should be populated by Encrypt/Decrypt calls
+	CipherOptions map[string][]byte `json:"cipheroptions"`
+}
+
+// PublicLayerBlockCipherOptions includes the information required to encrypt/decrypt
+// an image which are public and can be deduplicated in plaintext across multiple
+// recipients
+type PublicLayerBlockCipherOptions struct {
+	// CipherType denotes the cipher type according to the list of OCI suppported
+	// cipher types.
+	CipherType LayerCipherType `json:"cipher"`
+
+	// Hmac contains the hmac string to help verify encryption
+	Hmac []byte `json:"hmac"`
+
+	// CipherOptions contains the cipher metadata used for encryption/decryption
+	// This field should be populated by Encrypt/Decrypt calls
+	CipherOptions map[string][]byte `json:"cipheroptions"`
+}
+
+// LayerBlockCipherOptions contains the public and private LayerBlockCipherOptions
+// required to encrypt/decrypt an image
+type LayerBlockCipherOptions struct {
+	Public  PublicLayerBlockCipherOptions
+	Private PrivateLayerBlockCipherOptions
+}
+
+// LayerBlockCipher returns a provider for encrypt/decrypt functionality
+// for handling the layer data for a specific algorithm
+type LayerBlockCipher interface {
+	// GenerateKey creates a symmetric key
+	GenerateKey() ([]byte, error)
+	// Encrypt takes in layer data and returns the ciphertext and relevant LayerBlockCipherOptions
+	Encrypt(layerDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, Finalizer, error)
+	// Decrypt takes in layer ciphertext data and returns the plaintext and relevant LayerBlockCipherOptions
+	Decrypt(layerDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error)
+}
+
+// LayerBlockCipherHandler is the handler for encrypt/decrypt for layers
+type LayerBlockCipherHandler struct {
+	cipherMap map[LayerCipherType]LayerBlockCipher
+}
+
+// Finalizer is called after data blobs are written, and returns the LayerBlockCipherOptions for the encrypted blob
+type Finalizer func() (LayerBlockCipherOptions, error)
+
+// GetOpt returns the value of the cipher option and if the option exists
+func (lbco LayerBlockCipherOptions) GetOpt(key string) (value []byte, ok bool) {
+	if v, ok := lbco.Public.CipherOptions[key]; ok {
+		return v, ok
+	} else if v, ok := lbco.Private.CipherOptions[key]; ok {
+		return v, ok
+	} else {
+		return nil, false
+	}
+}
+
+func wrapFinalizerWithType(fin Finalizer, typ LayerCipherType) Finalizer {
+	return func() (LayerBlockCipherOptions, error) {
+		lbco, err := fin()
+		if err != nil {
+			return LayerBlockCipherOptions{}, err
+		}
+		lbco.Public.CipherType = typ
+		return lbco, err
+	}
+}
+
+// Encrypt is the handler for the layer decryption routine
+func (h *LayerBlockCipherHandler) Encrypt(plainDataReader io.Reader, typ LayerCipherType) (io.Reader, Finalizer, error) {
+	if c, ok := h.cipherMap[typ]; ok {
+		sk, err := c.GenerateKey()
+		if err != nil {
+			return nil, nil, err
+		}
+		opt := LayerBlockCipherOptions{
+			Private: PrivateLayerBlockCipherOptions{
+				SymmetricKey: sk,
+			},
+		}
+		encDataReader, fin, err := c.Encrypt(plainDataReader, opt)
+		if err == nil {
+			fin = wrapFinalizerWithType(fin, typ)
+		}
+		return encDataReader, fin, err
+	}
+	return nil, nil, errors.Errorf("unsupported cipher type: %s", typ)
+}
+
+// Decrypt is the handler for the layer decryption routine
+func (h *LayerBlockCipherHandler) Decrypt(encDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error) {
+	typ := opt.Public.CipherType
+	if typ == "" {
+		return nil, LayerBlockCipherOptions{}, errors.New("no cipher type provided")
+	}
+	if c, ok := h.cipherMap[LayerCipherType(typ)]; ok {
+		return c.Decrypt(encDataReader, opt)
+	}
+	return nil, LayerBlockCipherOptions{}, errors.Errorf("unsupported cipher type: %s", typ)
+}
+
+// NewLayerBlockCipherHandler returns a new default handler
+func NewLayerBlockCipherHandler() (*LayerBlockCipherHandler, error) {
+	h := LayerBlockCipherHandler{
+		cipherMap: map[LayerCipherType]LayerBlockCipher{},
+	}
+
+	var err error
+	h.cipherMap[AES256CTR], err = NewAESCTRLayerBlockCipher(256)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to set up Cipher AES-256-CTR")
+	}
+
+	return &h, nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/blockcipher/blockcipher_aes_ctr.go b/vendor/github.com/containers/ocicrypt/blockcipher/blockcipher_aes_ctr.go
new file mode 100644
index 000000000..095a53e35
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/blockcipher/blockcipher_aes_ctr.go
@@ -0,0 +1,193 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package blockcipher
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"hash"
+	"io"
+
+	"github.com/containers/ocicrypt/utils"
+	"github.com/pkg/errors"
+)
+
+// AESCTRLayerBlockCipher implements the AES CTR stream cipher
+type AESCTRLayerBlockCipher struct {
+	keylen         int // in bytes
+	reader         io.Reader
+	encrypt        bool
+	stream         cipher.Stream
+	err            error
+	hmac           hash.Hash
+	expHmac        []byte
+	doneEncrypting bool
+}
+
+type aesctrcryptor struct {
+	bc *AESCTRLayerBlockCipher
+}
+
+// NewAESCTRLayerBlockCipher returns a new AES SIV block cipher of 256 or 512 bits
+func NewAESCTRLayerBlockCipher(bits int) (LayerBlockCipher, error) {
+	if bits != 256 {
+		return nil, errors.New("AES CTR bit count not supported")
+	}
+	return &AESCTRLayerBlockCipher{keylen: bits / 8}, nil
+}
+
+func (r *aesctrcryptor) Read(p []byte) (int, error) {
+	var (
+		o int
+	)
+
+	if r.bc.err != nil {
+		return 0, r.bc.err
+	}
+
+	o, err := utils.FillBuffer(r.bc.reader, p)
+	if err != nil {
+		if err == io.EOF {
+			r.bc.err = err
+		} else {
+			return 0, err
+		}
+	}
+
+	if !r.bc.encrypt {
+		if _, err := r.bc.hmac.Write(p[:o]); err != nil {
+			r.bc.err = errors.Wrapf(err, "could not write to hmac")
+			return 0, r.bc.err
+		}
+
+		if r.bc.err == io.EOF {
+			// Before we return EOF we let the HMAC comparison
+			// provide a verdict
+			if !hmac.Equal(r.bc.hmac.Sum(nil), r.bc.expHmac) {
+				r.bc.err = fmt.Errorf("could not properly decrypt byte stream; exp hmac: '%x', actual hmac: '%s'", r.bc.expHmac, r.bc.hmac.Sum(nil))
+				return 0, r.bc.err
+			}
+		}
+	}
+
+	r.bc.stream.XORKeyStream(p[:o], p[:o])
+
+	if r.bc.encrypt {
+		if _, err := r.bc.hmac.Write(p[:o]); err != nil {
+			r.bc.err = errors.Wrapf(err, "could not write to hmac")
+			return 0, r.bc.err
+		}
+
+		if r.bc.err == io.EOF {
+			// Final data encrypted; Do the 'then-MAC' part
+			r.bc.doneEncrypting = true
+		}
+	}
+
+	return o, r.bc.err
+}
+
+// init initializes an instance
+func (bc *AESCTRLayerBlockCipher) init(encrypt bool, reader io.Reader, opts LayerBlockCipherOptions) (LayerBlockCipherOptions, error) {
+	var (
+		err error
+	)
+
+	key := opts.Private.SymmetricKey
+	if len(key) != bc.keylen {
+		return LayerBlockCipherOptions{}, fmt.Errorf("invalid key length of %d bytes; need %d bytes", len(key), bc.keylen)
+	}
+
+	nonce, ok := opts.GetOpt("nonce")
+	if !ok {
+		nonce = make([]byte, aes.BlockSize)
+		if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+			return LayerBlockCipherOptions{}, errors.Wrap(err, "unable to generate random nonce")
+		}
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return LayerBlockCipherOptions{}, errors.Wrap(err, "aes.NewCipher failed")
+	}
+
+	bc.reader = reader
+	bc.encrypt = encrypt
+	bc.stream = cipher.NewCTR(block, nonce)
+	bc.err = nil
+	bc.hmac = hmac.New(sha256.New, key)
+	bc.expHmac = opts.Public.Hmac
+	bc.doneEncrypting = false
+
+	if !encrypt && len(bc.expHmac) == 0 {
+		return LayerBlockCipherOptions{}, errors.New("HMAC is not provided for decryption process")
+	}
+
+	lbco := LayerBlockCipherOptions{
+		Private: PrivateLayerBlockCipherOptions{
+			SymmetricKey: key,
+			CipherOptions: map[string][]byte{
+				"nonce": nonce,
+			},
+		},
+	}
+
+	return lbco, nil
+}
+
+// GenerateKey creates a synmmetric key
+func (bc *AESCTRLayerBlockCipher) GenerateKey() ([]byte, error) {
+	key := make([]byte, bc.keylen)
+	if _, err := io.ReadFull(rand.Reader, key); err != nil {
+		return nil, err
+	}
+	return key, nil
+}
+
+// Encrypt takes in layer data and returns the ciphertext and relevant LayerBlockCipherOptions
+func (bc *AESCTRLayerBlockCipher) Encrypt(plainDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, Finalizer, error) {
+	lbco, err := bc.init(true, plainDataReader, opt)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	finalizer := func() (LayerBlockCipherOptions, error) {
+		if !bc.doneEncrypting {
+			return LayerBlockCipherOptions{}, errors.New("Read()ing not complete, unable to finalize")
+		}
+		if lbco.Public.CipherOptions == nil {
+			lbco.Public.CipherOptions = map[string][]byte{}
+		}
+		lbco.Public.Hmac = bc.hmac.Sum(nil)
+		return lbco, nil
+	}
+	return &aesctrcryptor{bc}, finalizer, nil
+}
+
+// Decrypt takes in layer ciphertext data and returns the plaintext and relevant LayerBlockCipherOptions
+func (bc *AESCTRLayerBlockCipher) Decrypt(encDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error) {
+	lbco, err := bc.init(false, encDataReader, opt)
+	if err != nil {
+		return nil, LayerBlockCipherOptions{}, err
+	}
+
+	return utils.NewDelayedReader(&aesctrcryptor{bc}, 1024*10), lbco, nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/config/config.go b/vendor/github.com/containers/ocicrypt/config/config.go
new file mode 100644
index 000000000..d960766eb
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/config/config.go
@@ -0,0 +1,114 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+// EncryptConfig is the container image PGP encryption configuration holding
+// the identifiers of those that will be able to decrypt the container and
+// the PGP public keyring file data that contains their public keys.
+type EncryptConfig struct {
+	// map holding 'gpg-recipients', 'gpg-pubkeyringfile', 'pubkeys', 'x509s'
+	Parameters map[string][][]byte
+
+	DecryptConfig DecryptConfig
+}
+
+// DecryptConfig wraps the Parameters map that holds the decryption key
+type DecryptConfig struct {
+	// map holding 'privkeys', 'x509s', 'gpg-privatekeys'
+	Parameters map[string][][]byte
+}
+
+// CryptoConfig is a common wrapper for EncryptConfig and DecrypConfig that can
+// be passed through functions that share much code for encryption and decryption
+type CryptoConfig struct {
+	EncryptConfig *EncryptConfig
+	DecryptConfig *DecryptConfig
+}
+
+// InitDecryption initialized a CryptoConfig object with parameters used for decryption
+func InitDecryption(dcparameters map[string][][]byte) CryptoConfig {
+	return CryptoConfig{
+		DecryptConfig: &DecryptConfig{
+			Parameters: dcparameters,
+		},
+	}
+}
+
+// InitEncryption initializes a CryptoConfig object with parameters used for encryption
+// It also takes dcparameters that may be needed for decryption when adding a recipient
+// to an already encrypted image
+func InitEncryption(parameters, dcparameters map[string][][]byte) CryptoConfig {
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters: parameters,
+			DecryptConfig: DecryptConfig{
+				Parameters: dcparameters,
+			},
+		},
+	}
+}
+
+// CombineCryptoConfigs takes a CryptoConfig list and creates a single CryptoConfig
+// containing the crypto configuration of all the key bundles
+func CombineCryptoConfigs(ccs []CryptoConfig) CryptoConfig {
+	ecparam := map[string][][]byte{}
+	ecdcparam := map[string][][]byte{}
+	dcparam := map[string][][]byte{}
+
+	for _, cc := range ccs {
+		if ec := cc.EncryptConfig; ec != nil {
+			addToMap(ecparam, ec.Parameters)
+			addToMap(ecdcparam, ec.DecryptConfig.Parameters)
+		}
+
+		if dc := cc.DecryptConfig; dc != nil {
+			addToMap(dcparam, dc.Parameters)
+		}
+	}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters: ecparam,
+			DecryptConfig: DecryptConfig{
+				Parameters: ecdcparam,
+			},
+		},
+		DecryptConfig: &DecryptConfig{
+			Parameters: dcparam,
+		},
+	}
+
+}
+
+// AttachDecryptConfig adds DecryptConfig to the field of EncryptConfig so that
+// the decryption parameters can be used to add recipients to an existing image
+// if the user is able to decrypt it.
+func (ec *EncryptConfig) AttachDecryptConfig(dc *DecryptConfig) {
+	if dc != nil {
+		addToMap(ec.DecryptConfig.Parameters, dc.Parameters)
+	}
+}
+
+func addToMap(orig map[string][][]byte, add map[string][][]byte) {
+	for k, v := range add {
+		if ov, ok := orig[k]; ok {
+			orig[k] = append(ov, v...)
+		} else {
+			orig[k] = v
+		}
+	}
+}
diff --git a/vendor/github.com/containers/ocicrypt/config/constructors.go b/vendor/github.com/containers/ocicrypt/config/constructors.go
new file mode 100644
index 000000000..44adcdb35
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/config/constructors.go
@@ -0,0 +1,134 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/pkg/errors"
+)
+
+// EncryptWithJwe returns a CryptoConfig to encrypt with jwe public keys
+func EncryptWithJwe(pubKeys [][]byte) (CryptoConfig, error) {
+	dc := DecryptConfig{}
+	ep := map[string][][]byte{
+		"pubkeys": pubKeys,
+	}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// EncryptWithPkcs7 returns a CryptoConfig to encrypt with pkcs7 x509 certs
+func EncryptWithPkcs7(x509s [][]byte) (CryptoConfig, error) {
+	dc := DecryptConfig{}
+
+	ep := map[string][][]byte{
+		"x509s": x509s,
+	}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// EncryptWithGpg returns a CryptoConfig to encrypt with configured gpg parameters
+func EncryptWithGpg(gpgRecipients [][]byte, gpgPubRingFile []byte) (CryptoConfig, error) {
+	dc := DecryptConfig{}
+	ep := map[string][][]byte{
+		"gpg-recipients":     gpgRecipients,
+		"gpg-pubkeyringfile": {gpgPubRingFile},
+	}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// DecryptWithPrivKeys returns a CryptoConfig to decrypt with configured private keys
+func DecryptWithPrivKeys(privKeys [][]byte, privKeysPasswords [][]byte) (CryptoConfig, error) {
+	if len(privKeys) != len(privKeysPasswords) {
+		return CryptoConfig{}, errors.New("Length of privKeys should match length of privKeysPasswords")
+	}
+
+	dc := DecryptConfig{
+		Parameters: map[string][][]byte{
+			"privkeys":           privKeys,
+			"privkeys-passwords": privKeysPasswords,
+		},
+	}
+
+	ep := map[string][][]byte{}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// DecryptWithX509s returns a CryptoConfig to decrypt with configured x509 certs
+func DecryptWithX509s(x509s [][]byte) (CryptoConfig, error) {
+	dc := DecryptConfig{
+		Parameters: map[string][][]byte{
+			"x509s": x509s,
+		},
+	}
+
+	ep := map[string][][]byte{}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// DecryptWithGpgPrivKeys returns a CryptoConfig to decrypt with configured gpg private keys
+func DecryptWithGpgPrivKeys(gpgPrivKeys, gpgPrivKeysPwds [][]byte) (CryptoConfig, error) {
+	dc := DecryptConfig{
+		Parameters: map[string][][]byte{
+			"gpg-privatekeys":           gpgPrivKeys,
+			"gpg-privatekeys-passwords": gpgPrivKeysPwds,
+		},
+	}
+
+	ep := map[string][][]byte{}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/encryption.go b/vendor/github.com/containers/ocicrypt/encryption.go
new file mode 100644
index 000000000..139ff5f93
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/encryption.go
@@ -0,0 +1,325 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package ocicrypt
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"strings"
+
+	"github.com/containers/ocicrypt/blockcipher"
+	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/keywrap"
+	"github.com/containers/ocicrypt/keywrap/jwe"
+	"github.com/containers/ocicrypt/keywrap/pgp"
+	"github.com/containers/ocicrypt/keywrap/pkcs7"
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
+)
+
+// EncryptLayerFinalizer is a finalizer run to return the annotations to set for
+// the encrypted layer
+type EncryptLayerFinalizer func() (map[string]string, error)
+
+func init() {
+	keyWrappers = make(map[string]keywrap.KeyWrapper)
+	keyWrapperAnnotations = make(map[string]string)
+	RegisterKeyWrapper("pgp", pgp.NewKeyWrapper())
+	RegisterKeyWrapper("jwe", jwe.NewKeyWrapper())
+	RegisterKeyWrapper("pkcs7", pkcs7.NewKeyWrapper())
+}
+
+var keyWrappers map[string]keywrap.KeyWrapper
+var keyWrapperAnnotations map[string]string
+
+// RegisterKeyWrapper allows to register key wrappers by their encryption scheme
+func RegisterKeyWrapper(scheme string, iface keywrap.KeyWrapper) {
+	keyWrappers[scheme] = iface
+	keyWrapperAnnotations[iface.GetAnnotationID()] = scheme
+}
+
+// GetKeyWrapper looks up the encryptor interface given an encryption scheme (gpg, jwe)
+func GetKeyWrapper(scheme string) keywrap.KeyWrapper {
+	return keyWrappers[scheme]
+}
+
+// GetWrappedKeysMap returns a map of wrappedKeys as values in a
+// map with the encryption scheme(s) as the key(s)
+func GetWrappedKeysMap(desc ocispec.Descriptor) map[string]string {
+	wrappedKeysMap := make(map[string]string)
+
+	for annotationsID, scheme := range keyWrapperAnnotations {
+		if annotation, ok := desc.Annotations[annotationsID]; ok {
+			wrappedKeysMap[scheme] = annotation
+		}
+	}
+	return wrappedKeysMap
+}
+
+// EncryptLayer encrypts the layer by running one encryptor after the other
+func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, EncryptLayerFinalizer, error) {
+	var (
+		encLayerReader io.Reader
+		err            error
+		encrypted      bool
+		bcFin          blockcipher.Finalizer
+		privOptsData   []byte
+		pubOptsData    []byte
+	)
+
+	if ec == nil {
+		return nil, nil, errors.New("EncryptConfig must not be nil")
+	}
+
+	for annotationsID := range keyWrapperAnnotations {
+		annotation := desc.Annotations[annotationsID]
+		if annotation != "" {
+			privOptsData, err = decryptLayerKeyOptsData(&ec.DecryptConfig, desc)
+			if err != nil {
+				return nil, nil, err
+			}
+			pubOptsData, err = getLayerPubOpts(desc)
+			if err != nil {
+				return nil, nil, err
+			}
+			// already encrypted!
+			encrypted = true
+		}
+	}
+
+	if !encrypted {
+		encLayerReader, bcFin, err = commonEncryptLayer(encOrPlainLayerReader, desc.Digest, blockcipher.AES256CTR)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	encLayerFinalizer := func() (map[string]string, error) {
+		// If layer was already encrypted, bcFin should be nil, use existing optsData
+		if bcFin != nil {
+			opts, err := bcFin()
+			if err != nil {
+				return nil, err
+			}
+			privOptsData, err = json.Marshal(opts.Private)
+			if err != nil {
+				return nil, errors.Wrapf(err, "could not JSON marshal opts")
+			}
+			pubOptsData, err = json.Marshal(opts.Public)
+			if err != nil {
+				return nil, errors.Wrapf(err, "could not JSON marshal opts")
+			}
+		}
+
+		newAnnotations := make(map[string]string)
+		for annotationsID, scheme := range keyWrapperAnnotations {
+			b64Annotations := desc.Annotations[annotationsID]
+			keywrapper := GetKeyWrapper(scheme)
+			b64Annotations, err = preWrapKeys(keywrapper, ec, b64Annotations, privOptsData)
+			if err != nil {
+				return nil, err
+			}
+			if b64Annotations != "" {
+				newAnnotations[annotationsID] = b64Annotations
+			}
+		}
+
+		newAnnotations["org.opencontainers.image.enc.pubopts"] = base64.StdEncoding.EncodeToString(pubOptsData)
+
+		if len(newAnnotations) == 0 {
+			return nil, errors.New("no encryptor found to handle encryption")
+		}
+
+		return newAnnotations, err
+	}
+
+	// if nothing was encrypted, we just return encLayer = nil
+	return encLayerReader, encLayerFinalizer, err
+
+}
+
+// preWrapKeys calls WrapKeys and handles the base64 encoding and concatenation of the
+// annotation data
+func preWrapKeys(keywrapper keywrap.KeyWrapper, ec *config.EncryptConfig, b64Annotations string, optsData []byte) (string, error) {
+	newAnnotation, err := keywrapper.WrapKeys(ec, optsData)
+	if err != nil || len(newAnnotation) == 0 {
+		return b64Annotations, err
+	}
+	b64newAnnotation := base64.StdEncoding.EncodeToString(newAnnotation)
+	if b64Annotations == "" {
+		return b64newAnnotation, nil
+	}
+	return b64Annotations + "," + b64newAnnotation, nil
+}
+
+// DecryptLayer decrypts a layer trying one keywrap.KeyWrapper after the other to see whether it
+// can apply the provided private key
+// If unwrapOnly is set we will only try to decrypt the layer encryption key and return
+func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error) {
+	if dc == nil {
+		return nil, "", errors.New("DecryptConfig must not be nil")
+	}
+	privOptsData, err := decryptLayerKeyOptsData(dc, desc)
+	if err != nil || unwrapOnly {
+		return nil, "", err
+	}
+
+	var pubOptsData []byte
+	pubOptsData, err = getLayerPubOpts(desc)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return commonDecryptLayer(encLayerReader, privOptsData, pubOptsData)
+}
+
+func decryptLayerKeyOptsData(dc *config.DecryptConfig, desc ocispec.Descriptor) ([]byte, error) {
+	privKeyGiven := false
+	for annotationsID, scheme := range keyWrapperAnnotations {
+		b64Annotation := desc.Annotations[annotationsID]
+		if b64Annotation != "" {
+			keywrapper := GetKeyWrapper(scheme)
+
+			if len(keywrapper.GetPrivateKeys(dc.Parameters)) == 0 {
+				continue
+			}
+			privKeyGiven = true
+
+			optsData, err := preUnwrapKey(keywrapper, dc, b64Annotation)
+			if err != nil {
+				// try next keywrap.KeyWrapper
+				continue
+			}
+			if optsData == nil {
+				// try next keywrap.KeyWrapper
+				continue
+			}
+			return optsData, nil
+		}
+	}
+	if !privKeyGiven {
+		return nil, errors.New("missing private key needed for decryption")
+	}
+	return nil, errors.Errorf("no suitable key unwrapper found or none of the private keys could be used for decryption")
+}
+
+func getLayerPubOpts(desc ocispec.Descriptor) ([]byte, error) {
+	pubOptsString := desc.Annotations["org.opencontainers.image.enc.pubopts"]
+	if pubOptsString == "" {
+		return json.Marshal(blockcipher.PublicLayerBlockCipherOptions{})
+	}
+	return base64.StdEncoding.DecodeString(pubOptsString)
+}
+
+// preUnwrapKey decodes the comma separated base64 strings and calls the Unwrap function
+// of the given keywrapper with it and returns the result in case the Unwrap functions
+// does not return an error. If all attempts fail, an error is returned.
+func preUnwrapKey(keywrapper keywrap.KeyWrapper, dc *config.DecryptConfig, b64Annotations string) ([]byte, error) {
+	if b64Annotations == "" {
+		return nil, nil
+	}
+	for _, b64Annotation := range strings.Split(b64Annotations, ",") {
+		annotation, err := base64.StdEncoding.DecodeString(b64Annotation)
+		if err != nil {
+			return nil, errors.New("could not base64 decode the annotation")
+		}
+		optsData, err := keywrapper.UnwrapKey(dc, annotation)
+		if err != nil {
+			continue
+		}
+		return optsData, nil
+	}
+	return nil, errors.New("no suitable key found for decrypting layer key")
+}
+
+// commonEncryptLayer is a function to encrypt the plain layer using a new random
+// symmetric key and return the LayerBlockCipherHandler's JSON in string form for
+// later use during decryption
+func commonEncryptLayer(plainLayerReader io.Reader, d digest.Digest, typ blockcipher.LayerCipherType) (io.Reader, blockcipher.Finalizer, error) {
+	lbch, err := blockcipher.NewLayerBlockCipherHandler()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	encLayerReader, bcFin, err := lbch.Encrypt(plainLayerReader, typ)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	newBcFin := func() (blockcipher.LayerBlockCipherOptions, error) {
+		lbco, err := bcFin()
+		if err != nil {
+			return blockcipher.LayerBlockCipherOptions{}, err
+		}
+		lbco.Private.Digest = d
+		return lbco, nil
+	}
+
+	return encLayerReader, newBcFin, err
+}
+
+// commonDecryptLayer decrypts an encrypted layer previously encrypted with commonEncryptLayer
+// by passing along the optsData
+func commonDecryptLayer(encLayerReader io.Reader, privOptsData []byte, pubOptsData []byte) (io.Reader, digest.Digest, error) {
+	privOpts := blockcipher.PrivateLayerBlockCipherOptions{}
+	err := json.Unmarshal(privOptsData, &privOpts)
+	if err != nil {
+		return nil, "", errors.Wrapf(err, "could not JSON unmarshal privOptsData")
+	}
+
+	lbch, err := blockcipher.NewLayerBlockCipherHandler()
+	if err != nil {
+		return nil, "", err
+	}
+
+	pubOpts := blockcipher.PublicLayerBlockCipherOptions{}
+	if len(pubOptsData) > 0 {
+		err := json.Unmarshal(pubOptsData, &pubOpts)
+		if err != nil {
+			return nil, "", errors.Wrapf(err, "could not JSON unmarshal pubOptsData")
+		}
+	}
+
+	opts := blockcipher.LayerBlockCipherOptions{
+		Private: privOpts,
+		Public:  pubOpts,
+	}
+
+	plainLayerReader, opts, err := lbch.Decrypt(encLayerReader, opts)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return plainLayerReader, opts.Private.Digest, nil
+}
+
+// FilterOutAnnotations filters out the annotations belonging to the image encryption 'namespace'
+// and returns a map with those taken out
+func FilterOutAnnotations(annotations map[string]string) map[string]string {
+	a := make(map[string]string)
+	if len(annotations) > 0 {
+		for k, v := range annotations {
+			if strings.HasPrefix(k, "org.opencontainers.image.enc.") {
+				continue
+			}
+			a[k] = v
+		}
+	}
+	return a
+}
diff --git a/vendor/github.com/containers/ocicrypt/go.mod b/vendor/github.com/containers/ocicrypt/go.mod
new file mode 100644
index 000000000..214496e05
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/go.mod
@@ -0,0 +1,18 @@
+module github.com/containers/ocicrypt
+
+go 1.12
+
+require (
+	github.com/containerd/containerd v1.2.10
+	github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa
+	github.com/opencontainers/go-digest v1.0.0-rc1
+	github.com/opencontainers/image-spec v1.0.1
+	github.com/pkg/errors v0.8.1
+	github.com/sirupsen/logrus v1.4.2 // indirect
+	github.com/stretchr/testify v1.3.0 // indirect
+	github.com/urfave/cli v1.22.1
+	golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4
+	google.golang.org/grpc v1.24.0 // indirect
+	gopkg.in/square/go-jose.v2 v2.3.1
+	gotest.tools v2.2.0+incompatible // indirect
+)
diff --git a/vendor/github.com/containers/ocicrypt/go.sum b/vendor/github.com/containers/ocicrypt/go.sum
new file mode 100644
index 000000000..d4c40e3ae
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/go.sum
@@ -0,0 +1,73 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/containerd/containerd v1.2.10 h1:liQDhXqIn7y6cJ/7qBgOaZsiTZJc56/wkkhDBiDBRDw=
+github.com/containerd/containerd v1.2.10/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvDvId8XSGPu3rmpmSe+wKRcEWNgsfWU=
+github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2iki3E3Ii+WN7gQ=
+github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
+github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/urfave/cli v1.22.1 h1:+mkCCcOFKPnCmVYVcURKps1Xe+3zP90gSYGNfRkjoIY=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4 h1:HuIa8hRrWRSrqYzx1qI49NNxhdi2PrY7gxVSq1JjLDc=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894 h1:Cz4ceDQGXuKRnVBDTS23GTn/pU5OE2C0WrNTOYK1Uuc=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.24.0 h1:vb/1TCsVn3DcJlQ0Gs1yB1pKI6Do2/QNwxdKqmc/b0s=
+google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/square/go-jose.v2 v2.3.1 h1:SK5KegNXmKmqE342YYN2qPHEnUYeoMiXXl1poUlI+o4=
+gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/vendor/github.com/containers/ocicrypt/gpg.go b/vendor/github.com/containers/ocicrypt/gpg.go
new file mode 100644
index 000000000..44cafae0c
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/gpg.go
@@ -0,0 +1,425 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package ocicrypt
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/ssh/terminal"
+)
+
+// GPGVersion enum representing the GPG client version to use.
+type GPGVersion int
+
+const (
+	// GPGv2 signifies gpgv2+
+	GPGv2 GPGVersion = iota
+	// GPGv1 signifies gpgv1+
+	GPGv1
+	// GPGVersionUndetermined signifies gpg client version undetermined
+	GPGVersionUndetermined
+)
+
+// GPGClient defines an interface for wrapping the gpg command line tools
+type GPGClient interface {
+	// ReadGPGPubRingFile gets the byte sequence of the gpg public keyring
+	ReadGPGPubRingFile() ([]byte, error)
+	// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
+	GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error)
+	// GetSecretKeyDetails gets the details of a secret key
+	GetSecretKeyDetails(keyid uint64) ([]byte, bool, error)
+	// GetKeyDetails gets the details of a public key
+	GetKeyDetails(keyid uint64) ([]byte, bool, error)
+	// ResolveRecipients resolves PGP key ids to user names
+	ResolveRecipients([]string) []string
+}
+
+// gpgClient contains generic gpg client information
+type gpgClient struct {
+	gpgHomeDir string
+}
+
+// gpgv2Client is a gpg2 client
+type gpgv2Client struct {
+	gpgClient
+}
+
+// gpgv1Client is a gpg client
+type gpgv1Client struct {
+	gpgClient
+}
+
+// GuessGPGVersion guesses the version of gpg. Defaults to gpg2 if exists, if
+// not defaults to regular gpg.
+func GuessGPGVersion() GPGVersion {
+	if err := exec.Command("gpg2", "--version").Run(); err == nil {
+		return GPGv2
+	} else if err := exec.Command("gpg", "--version").Run(); err == nil {
+		return GPGv1
+	} else {
+		return GPGVersionUndetermined
+	}
+}
+
+// NewGPGClient creates a new GPGClient object representing the given version
+// and using the given home directory
+func NewGPGClient(gpgVersion, gpgHomeDir string) (GPGClient, error) {
+	v := new(GPGVersion)
+	switch gpgVersion {
+	case "v1":
+		*v = GPGv1
+	case "v2":
+		*v = GPGv2
+	default:
+		v = nil
+	}
+	return newGPGClient(v, gpgHomeDir)
+}
+
+func newGPGClient(version *GPGVersion, homedir string) (GPGClient, error) {
+	var gpgVersion GPGVersion
+	if version != nil {
+		gpgVersion = *version
+	} else {
+		gpgVersion = GuessGPGVersion()
+	}
+
+	switch gpgVersion {
+	case GPGv1:
+		return &gpgv1Client{
+			gpgClient: gpgClient{gpgHomeDir: homedir},
+		}, nil
+	case GPGv2:
+		return &gpgv2Client{
+			gpgClient: gpgClient{gpgHomeDir: homedir},
+		}, nil
+	case GPGVersionUndetermined:
+		return nil, fmt.Errorf("unable to determine GPG version")
+	default:
+		return nil, fmt.Errorf("unhandled case: NewGPGClient")
+	}
+}
+
+// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
+func (gc *gpgv2Client) GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
+	}
+
+	rfile, wfile, err := os.Pipe()
+	if err != nil {
+		return nil, errors.Wrapf(err, "could not create pipe")
+	}
+	defer func() {
+		rfile.Close()
+		wfile.Close()
+	}()
+	// fill pipe in background
+	go func(passphrase string) {
+		_, _ = wfile.Write([]byte(passphrase))
+		wfile.Close()
+	}(passphrase)
+
+	args = append(args, []string{"--pinentry-mode", "loopback", "--batch", "--passphrase-fd", fmt.Sprintf("%d", 3), "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...)
+
+	cmd := exec.Command("gpg2", args...)
+	cmd.ExtraFiles = []*os.File{rfile}
+
+	return runGPGGetOutput(cmd)
+}
+
+// ReadGPGPubRingFile reads the GPG public key ring file
+func (gc *gpgv2Client) ReadGPGPubRingFile() ([]byte, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
+	}
+	args = append(args, []string{"--batch", "--export"}...)
+
+	cmd := exec.Command("gpg2", args...)
+
+	return runGPGGetOutput(cmd)
+}
+
+func (gc *gpgv2Client) getKeyDetails(option string, keyid uint64) ([]byte, bool, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append([]string{"--homedir", gc.gpgHomeDir})
+	}
+	args = append(args, option, fmt.Sprintf("0x%x", keyid))
+
+	cmd := exec.Command("gpg2", args...)
+
+	keydata, err := runGPGGetOutput(cmd)
+	return keydata, err == nil, err
+}
+
+// GetSecretKeyDetails retrives the secret key details of key with keyid.
+// returns a byte array of the details and a bool if the key exists
+func (gc *gpgv2Client) GetSecretKeyDetails(keyid uint64) ([]byte, bool, error) {
+	return gc.getKeyDetails("-K", keyid)
+}
+
+// GetKeyDetails retrives the public key details of key with keyid.
+// returns a byte array of the details and a bool if the key exists
+func (gc *gpgv2Client) GetKeyDetails(keyid uint64) ([]byte, bool, error) {
+	return gc.getKeyDetails("-k", keyid)
+}
+
+// ResolveRecipients converts PGP keyids to email addresses, if possible
+func (gc *gpgv2Client) ResolveRecipients(recipients []string) []string {
+	return resolveRecipients(gc, recipients)
+}
+
+// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
+func (gc *gpgv1Client) GetGPGPrivateKey(keyid uint64, _ string) ([]byte, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
+	}
+	args = append(args, []string{"--batch", "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...)
+
+	cmd := exec.Command("gpg", args...)
+
+	return runGPGGetOutput(cmd)
+}
+
+// ReadGPGPubRingFile reads the GPG public key ring file
+func (gc *gpgv1Client) ReadGPGPubRingFile() ([]byte, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
+	}
+	args = append(args, []string{"--batch", "--export"}...)
+
+	cmd := exec.Command("gpg", args...)
+
+	return runGPGGetOutput(cmd)
+}
+
+func (gc *gpgv1Client) getKeyDetails(option string, keyid uint64) ([]byte, bool, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append([]string{"--homedir", gc.gpgHomeDir})
+	}
+	args = append(args, option, fmt.Sprintf("0x%x", keyid))
+
+	cmd := exec.Command("gpg", args...)
+
+	keydata, err := runGPGGetOutput(cmd)
+
+	return keydata, err == nil, err
+}
+
+// GetSecretKeyDetails retrives the secret key details of key with keyid.
+// returns a byte array of the details and a bool if the key exists
+func (gc *gpgv1Client) GetSecretKeyDetails(keyid uint64) ([]byte, bool, error) {
+	return gc.getKeyDetails("-K", keyid)
+}
+
+// GetKeyDetails retrives the public key details of key with keyid.
+// returns a byte array of the details and a bool if the key exists
+func (gc *gpgv1Client) GetKeyDetails(keyid uint64) ([]byte, bool, error) {
+	return gc.getKeyDetails("-k", keyid)
+}
+
+// ResolveRecipients converts PGP keyids to email addresses, if possible
+func (gc *gpgv1Client) ResolveRecipients(recipients []string) []string {
+	return resolveRecipients(gc, recipients)
+}
+
+// runGPGGetOutput runs the GPG commandline and returns stdout as byte array
+// and any stderr in the error
+func runGPGGetOutput(cmd *exec.Cmd) ([]byte, error) {
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, err
+	}
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+
+	stdoutstr, err2 := ioutil.ReadAll(stdout)
+	stderrstr, _ := ioutil.ReadAll(stderr)
+
+	if err := cmd.Wait(); err != nil {
+		return nil, fmt.Errorf("error from %s: %s", cmd.Path, string(stderrstr))
+	}
+
+	return stdoutstr, err2
+}
+
+// resolveRecipients walks the list of recipients and attempts to convert
+// all keyIds to email addresses; if something goes wrong during the
+// conversion of a recipient, the original string is returned for that
+// recpient
+func resolveRecipients(gc GPGClient, recipients []string) []string {
+	var result []string
+
+	for _, recipient := range recipients {
+		keyID, err := strconv.ParseUint(recipient, 0, 64)
+		if err != nil {
+			result = append(result, recipient)
+		} else {
+			details, found, _ := gc.GetKeyDetails(keyID)
+			if !found {
+				result = append(result, recipient)
+			} else {
+				email := extractEmailFromDetails(details)
+				if email == "" {
+					result = append(result, recipient)
+				} else {
+					result = append(result, email)
+				}
+			}
+		}
+	}
+	return result
+}
+
+var emailPattern = regexp.MustCompile(`uid\s+\[.*\]\s.*\s<(?P<email>.+)>`)
+
+func extractEmailFromDetails(details []byte) string {
+	loc := emailPattern.FindSubmatchIndex(details)
+	if len(loc) == 0 {
+		return ""
+	}
+	return string(emailPattern.Expand(nil, []byte("$email"), details, loc))
+}
+
+// uint64ToStringArray converts an array of uint64's to an array of strings
+// by applying a format string to each uint64
+func uint64ToStringArray(format string, in []uint64) []string {
+	var ret []string
+
+	for _, v := range in {
+		ret = append(ret, fmt.Sprintf(format, v))
+	}
+	return ret
+}
+
+// GPGGetPrivateKey walks the list of layerInfos and tries to decrypt the
+// wrapped symmetric keys. For this it determines whether a private key is
+// in the GPGVault or on this system and prompts for the passwords for those
+// that are available. If we do not find a private key on the system for
+// getting to the symmetric key of a layer then an error is generated.
+func GPGGetPrivateKey(descs []ocispec.Descriptor, gpgClient GPGClient, gpgVault GPGVault, mustFindKey bool) (gpgPrivKeys [][]byte, gpgPrivKeysPwds [][]byte, err error) {
+	// PrivateKeyData describes a private key
+	type PrivateKeyData struct {
+		KeyData         []byte
+		KeyDataPassword []byte
+	}
+	var pkd PrivateKeyData
+	keyIDPasswordMap := make(map[uint64]PrivateKeyData)
+
+	for _, desc := range descs {
+		for scheme, b64pgpPackets := range GetWrappedKeysMap(desc) {
+			if scheme != "pgp" {
+				continue
+			}
+			keywrapper := GetKeyWrapper(scheme)
+			if keywrapper == nil {
+				return nil, nil, errors.Errorf("could not get KeyWrapper for %s\n", scheme)
+			}
+			keyIds, err := keywrapper.GetKeyIdsFromPacket(b64pgpPackets)
+			if err != nil {
+				return nil, nil, err
+			}
+
+			found := false
+			for _, keyid := range keyIds {
+				// do we have this key? -- first check the vault
+				if gpgVault != nil {
+					_, keydata := gpgVault.GetGPGPrivateKey(keyid)
+					if len(keydata) > 0 {
+						pkd = PrivateKeyData{
+							KeyData:         keydata,
+							KeyDataPassword: nil, // password not supported in this case
+						}
+						keyIDPasswordMap[keyid] = pkd
+						found = true
+						break
+					}
+				} else if gpgClient != nil {
+					// check the local system's gpg installation
+					keyinfo, haveKey, _ := gpgClient.GetSecretKeyDetails(keyid)
+					// this may fail if the key is not here; we ignore the error
+					if !haveKey {
+						// key not on this system
+						continue
+					}
+
+					_, found = keyIDPasswordMap[keyid]
+					if !found {
+						fmt.Printf("Passphrase required for Key id 0x%x: \n%v", keyid, string(keyinfo))
+						fmt.Printf("Enter passphrase for key with Id 0x%x: ", keyid)
+
+						password, err := terminal.ReadPassword(int(os.Stdin.Fd()))
+						fmt.Printf("\n")
+						if err != nil {
+							return nil, nil, err
+						}
+						keydata, err := gpgClient.GetGPGPrivateKey(keyid, string(password))
+						if err != nil {
+							return nil, nil, err
+						}
+						pkd = PrivateKeyData{
+							KeyData:         keydata,
+							KeyDataPassword: password,
+						}
+						keyIDPasswordMap[keyid] = pkd
+						found = true
+					}
+					break
+				} else {
+					return nil, nil, errors.New("no GPGVault or GPGClient passed")
+				}
+			}
+			if !found && len(b64pgpPackets) > 0 && mustFindKey {
+				ids := uint64ToStringArray("0x%x", keyIds)
+
+				return nil, nil, errors.Errorf("missing key for decryption of layer %x of %s. Need one of the following keys: %s", desc.Digest, desc.Platform, strings.Join(ids, ", "))
+			}
+		}
+	}
+
+	for _, pkd := range keyIDPasswordMap {
+		gpgPrivKeys = append(gpgPrivKeys, pkd.KeyData)
+		gpgPrivKeysPwds = append(gpgPrivKeysPwds, pkd.KeyDataPassword)
+	}
+
+	return gpgPrivKeys, gpgPrivKeysPwds, nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/gpgvault.go b/vendor/github.com/containers/ocicrypt/gpgvault.go
new file mode 100644
index 000000000..dd9a10007
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/gpgvault.go
@@ -0,0 +1,100 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package ocicrypt
+
+import (
+	"bytes"
+	"io/ioutil"
+
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/openpgp"
+	"golang.org/x/crypto/openpgp/packet"
+)
+
+// GPGVault defines an interface for wrapping multiple secret key rings
+type GPGVault interface {
+	// AddSecretKeyRingData adds a secret keyring via its raw byte array
+	AddSecretKeyRingData(gpgSecretKeyRingData []byte) error
+	// AddSecretKeyRingDataArray adds secret keyring via its raw byte arrays
+	AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error
+	// AddSecretKeyRingFiles adds secret keyrings given their filenames
+	AddSecretKeyRingFiles(filenames []string) error
+	// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
+	GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte)
+}
+
+// gpgVault wraps an array of gpgSecretKeyRing
+type gpgVault struct {
+	entityLists []openpgp.EntityList
+	keyDataList [][]byte // the raw data original passed in
+}
+
+// NewGPGVault creates an empty GPGVault
+func NewGPGVault() GPGVault {
+	return &gpgVault{}
+}
+
+// AddSecretKeyRingData adds a secret keyring's to the gpgVault; the raw byte
+// array read from the file must be passed and will be parsed by this function
+func (g *gpgVault) AddSecretKeyRingData(gpgSecretKeyRingData []byte) error {
+	// read the private keys
+	r := bytes.NewReader(gpgSecretKeyRingData)
+	entityList, err := openpgp.ReadKeyRing(r)
+	if err != nil {
+		return errors.Wrapf(err, "could not read keyring")
+	}
+	g.entityLists = append(g.entityLists, entityList)
+	g.keyDataList = append(g.keyDataList, gpgSecretKeyRingData)
+	return nil
+}
+
+// AddSecretKeyRingDataArray adds secret keyrings to the gpgVault; the raw byte
+// arrays read from files must be passed
+func (g *gpgVault) AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error {
+	for _, gpgSecretKeyRingData := range gpgSecretKeyRingDataArray {
+		if err := g.AddSecretKeyRingData(gpgSecretKeyRingData); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// AddSecretKeyRingFiles adds the secret key rings given their filenames
+func (g *gpgVault) AddSecretKeyRingFiles(filenames []string) error {
+	for _, filename := range filenames {
+		gpgSecretKeyRingData, err := ioutil.ReadFile(filename)
+		if err != nil {
+			return err
+		}
+		err = g.AddSecretKeyRingData(gpgSecretKeyRingData)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
+func (g *gpgVault) GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte) {
+	for i, el := range g.entityLists {
+		decKeys := el.KeysByIdUsage(keyid, packet.KeyFlagEncryptCommunications)
+		if len(decKeys) > 0 {
+			return decKeys, g.keyDataList[i]
+		}
+	}
+	return nil, nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go b/vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go
new file mode 100644
index 000000000..5d1dde241
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go
@@ -0,0 +1,132 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package jwe
+
+import (
+	"crypto/ecdsa"
+
+	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/keywrap"
+	"github.com/containers/ocicrypt/utils"
+	"github.com/pkg/errors"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+type jweKeyWrapper struct {
+}
+
+func (kw *jweKeyWrapper) GetAnnotationID() string {
+	return "org.opencontainers.image.enc.keys.jwe"
+}
+
+// NewKeyWrapper returns a new key wrapping interface using jwe
+func NewKeyWrapper() keywrap.KeyWrapper {
+	return &jweKeyWrapper{}
+}
+
+// WrapKeys wraps the session key for recpients and encrypts the optsData, which
+// describe the symmetric key used for encrypting the layer
+func (kw *jweKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
+	var joseRecipients []jose.Recipient
+
+	err := addPubKeys(&joseRecipients, ec.Parameters["pubkeys"])
+	if err != nil {
+		return nil, err
+	}
+	// no recipients is not an error...
+	if len(joseRecipients) == 0 {
+		return nil, nil
+	}
+
+	encrypter, err := jose.NewMultiEncrypter(jose.A256GCM, joseRecipients, nil)
+	if err != nil {
+		return nil, errors.Wrapf(err, "jose.NewMultiEncrypter failed")
+	}
+	jwe, err := encrypter.Encrypt(optsData)
+	if err != nil {
+		return nil, errors.Wrapf(err, "JWE Encrypt failed")
+	}
+	return []byte(jwe.FullSerialize()), nil
+}
+
+func (kw *jweKeyWrapper) UnwrapKey(dc *config.DecryptConfig, jweString []byte) ([]byte, error) {
+	jwe, err := jose.ParseEncrypted(string(jweString))
+	if err != nil {
+		return nil, errors.New("jose.ParseEncrypted failed")
+	}
+
+	privKeys := kw.GetPrivateKeys(dc.Parameters)
+	if len(privKeys) == 0 {
+		return nil, errors.New("No private keys found for JWE decryption")
+	}
+	privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
+	if len(privKeysPasswords) != len(privKeys) {
+		return nil, errors.New("Private key password array length must be same as that of private keys")
+	}
+
+	for idx, privKey := range privKeys {
+		key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "JWE")
+		if err != nil {
+			return nil, err
+		}
+		_, _, plain, err := jwe.DecryptMulti(key)
+		if err == nil {
+			return plain, nil
+		}
+	}
+	return nil, errors.New("JWE: No suitable private key found for decryption")
+}
+
+func (kw *jweKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["privkeys"]
+}
+
+func (kw *jweKeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["privkeys-passwords"]
+}
+
+func (kw *jweKeyWrapper) GetKeyIdsFromPacket(b64jwes string) ([]uint64, error) {
+	return nil, nil
+}
+
+func (kw *jweKeyWrapper) GetRecipients(b64jwes string) ([]string, error) {
+	return []string{"[jwe]"}, nil
+}
+
+func addPubKeys(joseRecipients *[]jose.Recipient, pubKeys [][]byte) error {
+	if len(pubKeys) == 0 {
+		return nil
+	}
+	for _, pubKey := range pubKeys {
+		key, err := utils.ParsePublicKey(pubKey, "JWE")
+		if err != nil {
+			return err
+		}
+
+		alg := jose.RSA_OAEP
+		switch key.(type) {
+		case *ecdsa.PublicKey:
+			alg = jose.ECDH_ES_A256KW
+		}
+
+		*joseRecipients = append(*joseRecipients, jose.Recipient{
+			Algorithm: alg,
+			Key:       key,
+		})
+	}
+	return nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/keywrap/keywrap.go b/vendor/github.com/containers/ocicrypt/keywrap/keywrap.go
new file mode 100644
index 000000000..75fdf6886
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/keywrap/keywrap.go
@@ -0,0 +1,40 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package keywrap
+
+import (
+	"github.com/containers/ocicrypt/config"
+)
+
+// KeyWrapper is the interface used for wrapping keys using
+// a specific encryption technology (pgp, jwe)
+type KeyWrapper interface {
+	WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error)
+	UnwrapKey(dc *config.DecryptConfig, annotation []byte) ([]byte, error)
+	GetAnnotationID() string
+	// GetPrivateKeys (optional) gets the array of private keys. It is an optional implementation
+	// as in some key services, a private key may not be exportable (i.e. HSM)
+	GetPrivateKeys(dcparameters map[string][][]byte) [][]byte
+
+	// GetKeyIdsFromPacket (optional) gets a list of key IDs. This is optional as some encryption
+	// schemes may not have a notion of key IDs
+	GetKeyIdsFromPacket(packet string) ([]uint64, error)
+
+	// GetRecipients (optional) gets a list of recipients. It is optional due to the validity of
+	// recipients in a particular encryptiong scheme
+	GetRecipients(packet string) ([]string, error)
+}
diff --git a/vendor/github.com/containers/ocicrypt/keywrap/pgp/keywrapper_gpg.go b/vendor/github.com/containers/ocicrypt/keywrap/pgp/keywrapper_gpg.go
new file mode 100644
index 000000000..ff70c2d65
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/keywrap/pgp/keywrapper_gpg.go
@@ -0,0 +1,269 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package pgp
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/mail"
+	"strconv"
+	"strings"
+
+	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/keywrap"
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/openpgp"
+	"golang.org/x/crypto/openpgp/packet"
+)
+
+type gpgKeyWrapper struct {
+}
+
+// NewKeyWrapper returns a new key wrapping interface for pgp
+func NewKeyWrapper() keywrap.KeyWrapper {
+	return &gpgKeyWrapper{}
+}
+
+var (
+	// GPGDefaultEncryptConfig is the default configuration for layer encryption/decryption
+	GPGDefaultEncryptConfig = &packet.Config{
+		Rand:              rand.Reader,
+		DefaultHash:       crypto.SHA256,
+		DefaultCipher:     packet.CipherAES256,
+		CompressionConfig: &packet.CompressionConfig{Level: 0}, // No compression
+		RSABits:           2048,
+	}
+)
+
+func (kw *gpgKeyWrapper) GetAnnotationID() string {
+	return "org.opencontainers.image.enc.keys.pgp"
+}
+
+// WrapKeys wraps the session key for recpients and encrypts the optsData, which
+// describe the symmetric key used for encrypting the layer
+func (kw *gpgKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
+	ciphertext := new(bytes.Buffer)
+	el, err := kw.createEntityList(ec)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to create entity list")
+	}
+	if len(el) == 0 {
+		// nothing to do -- not an error
+		return nil, nil
+	}
+
+	plaintextWriter, err := openpgp.Encrypt(ciphertext,
+		el,  /*EntityList*/
+		nil, /* Sign*/
+		nil, /* FileHint */
+		GPGDefaultEncryptConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err = plaintextWriter.Write(optsData); err != nil {
+		return nil, err
+	} else if err = plaintextWriter.Close(); err != nil {
+		return nil, err
+	}
+	return ciphertext.Bytes(), err
+}
+
+// UnwrapKey unwraps the symmetric key with which the layer is encrypted
+// This symmetric key is encrypted in the PGP payload.
+func (kw *gpgKeyWrapper) UnwrapKey(dc *config.DecryptConfig, pgpPacket []byte) ([]byte, error) {
+	pgpPrivateKeys, pgpPrivateKeysPwd, err := kw.getKeyParameters(dc.Parameters)
+	if err != nil {
+		return nil, err
+	}
+
+	for idx, pgpPrivateKey := range pgpPrivateKeys {
+		r := bytes.NewBuffer(pgpPrivateKey)
+		entityList, err := openpgp.ReadKeyRing(r)
+		if err != nil {
+			return nil, errors.Wrap(err, "unable to parse private keys")
+		}
+
+		var prompt openpgp.PromptFunction
+		if len(pgpPrivateKeysPwd) > idx {
+			responded := false
+			prompt = func(keys []openpgp.Key, symmetric bool) ([]byte, error) {
+				if responded {
+					return nil, fmt.Errorf("don't seem to have the right password")
+				}
+				responded = true
+				for _, key := range keys {
+					if key.PrivateKey != nil {
+						_ = key.PrivateKey.Decrypt(pgpPrivateKeysPwd[idx])
+					}
+				}
+				return pgpPrivateKeysPwd[idx], nil
+			}
+		}
+
+		r = bytes.NewBuffer(pgpPacket)
+		md, err := openpgp.ReadMessage(r, entityList, prompt, GPGDefaultEncryptConfig)
+		if err != nil {
+			continue
+		}
+		// we get the plain key options back
+		optsData, err := ioutil.ReadAll(md.UnverifiedBody)
+		if err != nil {
+			continue
+		}
+		return optsData, nil
+	}
+	return nil, errors.New("PGP: No suitable key found to unwrap key")
+}
+
+// GetKeyIdsFromWrappedKeys converts the base64 encoded PGPPacket to uint64 keyIds
+func (kw *gpgKeyWrapper) GetKeyIdsFromPacket(b64pgpPackets string) ([]uint64, error) {
+
+	var keyids []uint64
+	for _, b64pgpPacket := range strings.Split(b64pgpPackets, ",") {
+		pgpPacket, err := base64.StdEncoding.DecodeString(b64pgpPacket)
+		if err != nil {
+			return nil, errors.Wrapf(err, "could not decode base64 encoded PGP packet")
+		}
+		newids, err := kw.getKeyIDs(pgpPacket)
+		if err != nil {
+			return nil, err
+		}
+		keyids = append(keyids, newids...)
+	}
+	return keyids, nil
+}
+
+// getKeyIDs parses a PGPPacket and gets the list of recipients' key IDs
+func (kw *gpgKeyWrapper) getKeyIDs(pgpPacket []byte) ([]uint64, error) {
+	var keyids []uint64
+
+	kbuf := bytes.NewBuffer(pgpPacket)
+	packets := packet.NewReader(kbuf)
+ParsePackets:
+	for {
+		p, err := packets.Next()
+		if err == io.EOF {
+			break ParsePackets
+		}
+		if err != nil {
+			return []uint64{}, errors.Wrapf(err, "packets.Next() failed")
+		}
+		switch p := p.(type) {
+		case *packet.EncryptedKey:
+			keyids = append(keyids, p.KeyId)
+		case *packet.SymmetricallyEncrypted:
+			break ParsePackets
+		}
+	}
+	return keyids, nil
+}
+
+// GetRecipients converts the wrappedKeys to an array of recipients
+func (kw *gpgKeyWrapper) GetRecipients(b64pgpPackets string) ([]string, error) {
+	keyIds, err := kw.GetKeyIdsFromPacket(b64pgpPackets)
+	if err != nil {
+		return nil, err
+	}
+	var array []string
+	for _, keyid := range keyIds {
+		array = append(array, "0x"+strconv.FormatUint(keyid, 16))
+	}
+	return array, nil
+}
+
+func (kw *gpgKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["gpg-privatekeys"]
+}
+
+func (kw *gpgKeyWrapper) getKeyParameters(dcparameters map[string][][]byte) ([][]byte, [][]byte, error) {
+
+	privKeys := kw.GetPrivateKeys(dcparameters)
+	if len(privKeys) == 0 {
+		return nil, nil, errors.New("GPG: Missing private key parameter")
+	}
+
+	return privKeys, dcparameters["gpg-privatekeys-passwords"], nil
+}
+
+// createEntityList creates the opengpg EntityList by reading the KeyRing
+// first and then filtering out recipients' keys
+func (kw *gpgKeyWrapper) createEntityList(ec *config.EncryptConfig) (openpgp.EntityList, error) {
+	pgpPubringFile := ec.Parameters["gpg-pubkeyringfile"]
+	if len(pgpPubringFile) == 0 {
+		return nil, nil
+	}
+	r := bytes.NewReader(pgpPubringFile[0])
+
+	entityList, err := openpgp.ReadKeyRing(r)
+	if err != nil {
+		return nil, err
+	}
+
+	gpgRecipients := ec.Parameters["gpg-recipients"]
+	if len(gpgRecipients) == 0 {
+		return nil, nil
+	}
+
+	rSet := make(map[string]int)
+	for _, r := range gpgRecipients {
+		rSet[string(r)] = 0
+	}
+
+	var filteredList openpgp.EntityList
+	for _, entity := range entityList {
+		for k := range entity.Identities {
+			addr, err := mail.ParseAddress(k)
+			if err != nil {
+				return nil, err
+			}
+			for _, r := range gpgRecipients {
+				recp := string(r)
+				if strings.Compare(addr.Name, recp) == 0 || strings.Compare(addr.Address, recp) == 0 {
+					filteredList = append(filteredList, entity)
+					rSet[recp] = rSet[recp] + 1
+				}
+			}
+		}
+	}
+
+	// make sure we found keys for all the Recipients...
+	var buffer bytes.Buffer
+	notFound := false
+	buffer.WriteString("PGP: No key found for the following recipients: ")
+
+	for k, v := range rSet {
+		if v == 0 {
+			if notFound {
+				buffer.WriteString(", ")
+			}
+			buffer.WriteString(k)
+			notFound = true
+		}
+	}
+
+	if notFound {
+		return nil, errors.New(buffer.String())
+	}
+
+	return filteredList, nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/keywrap/pkcs7/keywrapper_pkcs7.go b/vendor/github.com/containers/ocicrypt/keywrap/pkcs7/keywrapper_pkcs7.go
new file mode 100644
index 000000000..2762b9777
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/keywrap/pkcs7/keywrapper_pkcs7.go
@@ -0,0 +1,132 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package pkcs7
+
+import (
+	"crypto"
+	"crypto/x509"
+
+	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/keywrap"
+	"github.com/containers/ocicrypt/utils"
+	"github.com/fullsailor/pkcs7"
+	"github.com/pkg/errors"
+)
+
+type pkcs7KeyWrapper struct {
+}
+
+// NewKeyWrapper returns a new key wrapping interface using jwe
+func NewKeyWrapper() keywrap.KeyWrapper {
+	return &pkcs7KeyWrapper{}
+}
+
+func (kw *pkcs7KeyWrapper) GetAnnotationID() string {
+	return "org.opencontainers.image.enc.keys.pkcs7"
+}
+
+// WrapKeys wraps the session key for recpients and encrypts the optsData, which
+// describe the symmetric key used for encrypting the layer
+func (kw *pkcs7KeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
+	x509Certs, err := collectX509s(ec.Parameters["x509s"])
+	if err != nil {
+		return nil, err
+	}
+	// no recipients is not an error...
+	if len(x509Certs) == 0 {
+		return nil, nil
+	}
+
+	pkcs7.ContentEncryptionAlgorithm = pkcs7.EncryptionAlgorithmAES128GCM
+	return pkcs7.Encrypt(optsData, x509Certs)
+}
+
+func collectX509s(x509s [][]byte) ([]*x509.Certificate, error) {
+	if len(x509s) == 0 {
+		return nil, nil
+	}
+	var x509Certs []*x509.Certificate
+	for _, x509 := range x509s {
+		x509Cert, err := utils.ParseCertificate(x509, "PKCS7")
+		if err != nil {
+			return nil, err
+		}
+		x509Certs = append(x509Certs, x509Cert)
+	}
+	return x509Certs, nil
+}
+
+func (kw *pkcs7KeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["privkeys"]
+}
+
+func (kw *pkcs7KeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["privkeys-passwords"]
+}
+
+// UnwrapKey unwraps the symmetric key with which the layer is encrypted
+// This symmetric key is encrypted in the PKCS7 payload.
+func (kw *pkcs7KeyWrapper) UnwrapKey(dc *config.DecryptConfig, pkcs7Packet []byte) ([]byte, error) {
+	privKeys := kw.GetPrivateKeys(dc.Parameters)
+	if len(privKeys) == 0 {
+		return nil, errors.New("no private keys found for PKCS7 decryption")
+	}
+	privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
+	if len(privKeysPasswords) != len(privKeys) {
+		return nil, errors.New("private key password array length must be same as that of private keys")
+	}
+
+	x509Certs, err := collectX509s(dc.Parameters["x509s"])
+	if err != nil {
+		return nil, err
+	}
+	if len(x509Certs) == 0 {
+		return nil, errors.New("no x509 certificates found needed for PKCS7 decryption")
+	}
+
+	p7, err := pkcs7.Parse(pkcs7Packet)
+	if err != nil {
+		return nil, errors.Wrapf(err, "could not parse PKCS7 packet")
+	}
+
+	for idx, privKey := range privKeys {
+		key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "PKCS7")
+		if err != nil {
+			return nil, err
+		}
+		for _, x509Cert := range x509Certs {
+			optsData, err := p7.Decrypt(x509Cert, crypto.PrivateKey(key))
+			if err != nil {
+				continue
+			}
+			return optsData, nil
+		}
+	}
+	return nil, errors.New("PKCS7: No suitable private key found for decryption")
+}
+
+// GetKeyIdsFromWrappedKeys converts the base64 encoded Packet to uint64 keyIds;
+// We cannot do this with pkcs7
+func (kw *pkcs7KeyWrapper) GetKeyIdsFromPacket(b64pkcs7Packets string) ([]uint64, error) {
+	return nil, nil
+}
+
+// GetRecipients converts the wrappedKeys to an array of recipients
+// We cannot do this with pkcs7
+func (kw *pkcs7KeyWrapper) GetRecipients(b64pkcs7Packets string) ([]string, error) {
+	return []string{"[pkcs7]"}, nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/reader.go b/vendor/github.com/containers/ocicrypt/reader.go
new file mode 100644
index 000000000..a93eec8e9
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/reader.go
@@ -0,0 +1,40 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package ocicrypt
+
+import (
+	"io"
+)
+
+type readerAtReader struct {
+	r   io.ReaderAt
+	off int64
+}
+
+// ReaderFromReaderAt takes an io.ReaderAt and returns an io.Reader
+func ReaderFromReaderAt(r io.ReaderAt) io.Reader {
+	return &readerAtReader{
+		r:   r,
+		off: 0,
+	}
+}
+
+func (rar *readerAtReader) Read(p []byte) (n int, err error) {
+	n, err = rar.r.ReadAt(p, rar.off)
+	rar.off += int64(n)
+	return n, err
+}
diff --git a/vendor/github.com/containers/ocicrypt/spec/spec.go b/vendor/github.com/containers/ocicrypt/spec/spec.go
new file mode 100644
index 000000000..330069d49
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/spec/spec.go
@@ -0,0 +1,12 @@
+package spec
+
+const (
+	// MediaTypeLayerEnc is MIME type used for encrypted layers.
+	MediaTypeLayerEnc = "application/vnd.oci.image.layer.v1.tar+encrypted"
+	// MediaTypeLayerGzipEnc is MIME type used for encrypted compressed layers.
+	MediaTypeLayerGzipEnc = "application/vnd.oci.image.layer.v1.tar+gzip+encrypted"
+	// MediaTypeLayerNonDistributableEnc is MIME type used for non distributable encrypted layers.
+	MediaTypeLayerNonDistributableEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+encrypted"
+	// MediaTypeLayerGzipEnc is MIME type used for non distributable encrypted compressed layers.
+	MediaTypeLayerNonDistributableGzipEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+gzip+encrypted"
+)
diff --git a/vendor/github.com/containers/ocicrypt/utils/delayedreader.go b/vendor/github.com/containers/ocicrypt/utils/delayedreader.go
new file mode 100644
index 000000000..3b939bdea
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/utils/delayedreader.go
@@ -0,0 +1,109 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"io"
+)
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// DelayedReader wraps a io.Reader and allows a client to use the Reader
+// interface. The DelayedReader holds back some buffer to the client
+// so that it can report any error that occurred on the Reader it wraps
+// early to the client while it may still have held some data back.
+type DelayedReader struct {
+	reader   io.Reader // Reader to Read() bytes from and delay them
+	err      error     // error that occurred on the reader
+	buffer   []byte    // delay buffer
+	bufbytes int       // number of bytes in the delay buffer to give to Read(); on '0' we return 'EOF' to caller
+	bufoff   int       // offset in the delay buffer to give to Read()
+}
+
+// NewDelayedReader wraps a io.Reader and allocates a delay buffer of bufsize bytes
+func NewDelayedReader(reader io.Reader, bufsize uint) io.Reader {
+	return &DelayedReader{
+		reader: reader,
+		buffer: make([]byte, bufsize),
+	}
+}
+
+// Read implements the io.Reader interface
+func (dr *DelayedReader) Read(p []byte) (int, error) {
+	if dr.err != nil && dr.err != io.EOF {
+		return 0, dr.err
+	}
+
+	// if we are completely drained, return io.EOF
+	if dr.err == io.EOF && dr.bufbytes == 0 {
+		return 0, io.EOF
+	}
+
+	// only at the beginning we fill our delay buffer in an extra step
+	if dr.bufbytes < len(dr.buffer) && dr.err == nil {
+		dr.bufbytes, dr.err = FillBuffer(dr.reader, dr.buffer)
+		if dr.err != nil && dr.err != io.EOF {
+			return 0, dr.err
+		}
+	}
+	// dr.err != nil means we have EOF and can drain the delay buffer
+	// otherwise we need to still read from the reader
+
+	var tmpbuf []byte
+	tmpbufbytes := 0
+	if dr.err == nil {
+		tmpbuf = make([]byte, len(p))
+		tmpbufbytes, dr.err = FillBuffer(dr.reader, tmpbuf)
+		if dr.err != nil && dr.err != io.EOF {
+			return 0, dr.err
+		}
+	}
+
+	// copy out of the delay buffer into 'p'
+	tocopy1 := min(len(p), dr.bufbytes)
+	c1 := copy(p[:tocopy1], dr.buffer[dr.bufoff:])
+	dr.bufoff += c1
+	dr.bufbytes -= c1
+
+	c2 := 0
+	// can p still hold more data?
+	if c1 < len(p) {
+		// copy out of the tmpbuf into 'p'
+		c2 = copy(p[tocopy1:], tmpbuf[:tmpbufbytes])
+	}
+
+	// if tmpbuf holds data we need to hold onto, copy them
+	// into the delay buffer
+	if tmpbufbytes-c2 > 0 {
+		// left-shift the delay buffer and append the tmpbuf's remaining data
+		dr.buffer = dr.buffer[dr.bufoff : dr.bufoff+dr.bufbytes]
+		dr.buffer = append(dr.buffer, tmpbuf[c2:tmpbufbytes]...)
+		dr.bufoff = 0
+		dr.bufbytes = len(dr.buffer)
+	}
+
+	var err error
+	if dr.bufbytes == 0 {
+		err = io.EOF
+	}
+	return c1 + c2, err
+}
diff --git a/vendor/github.com/containers/ocicrypt/utils/ioutils.go b/vendor/github.com/containers/ocicrypt/utils/ioutils.go
new file mode 100644
index 000000000..c360e0a33
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/utils/ioutils.go
@@ -0,0 +1,31 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"io"
+)
+
+// FillBuffer fills the given buffer with as many bytes from the reader as possible. It returns
+// EOF if an EOF was encountered or any other error.
+func FillBuffer(reader io.Reader, buffer []byte) (int, error) {
+	n, err := io.ReadFull(reader, buffer)
+	if err == io.ErrUnexpectedEOF {
+		return n, io.EOF
+	}
+	return n, err
+}
diff --git a/vendor/github.com/containers/ocicrypt/utils/testing.go b/vendor/github.com/containers/ocicrypt/utils/testing.go
new file mode 100644
index 000000000..e2ed4b1d8
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/utils/testing.go
@@ -0,0 +1,166 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+// CreateRSAKey creates an RSA key
+func CreateRSAKey(bits int) (*rsa.PrivateKey, error) {
+	key, err := rsa.GenerateKey(rand.Reader, bits)
+	if err != nil {
+		return nil, errors.Wrap(err, "rsa.GenerateKey failed")
+	}
+	return key, nil
+}
+
+// CreateRSATestKey creates an RSA key of the given size and returns
+// the public and private key in PEM or DER format
+func CreateRSATestKey(bits int, password []byte, pemencode bool) ([]byte, []byte, error) {
+	key, err := CreateRSAKey(bits)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	pubData, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "x509.MarshalPKIXPublicKey failed")
+	}
+	privData := x509.MarshalPKCS1PrivateKey(key)
+
+	// no more encoding needed for DER
+	if !pemencode {
+		return pubData, privData, nil
+	}
+
+	publicKey := pem.EncodeToMemory(&pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: pubData,
+	})
+
+	var block *pem.Block
+
+	typ := "RSA PRIVATE KEY"
+	if len(password) > 0 {
+		block, err = x509.EncryptPEMBlock(rand.Reader, typ, privData, password, x509.PEMCipherAES256)
+		if err != nil {
+			return nil, nil, errors.Wrap(err, "x509.EncryptPEMBlock failed")
+		}
+	} else {
+		block = &pem.Block{
+			Type:  typ,
+			Bytes: privData,
+		}
+	}
+
+	privateKey := pem.EncodeToMemory(block)
+
+	return publicKey, privateKey, nil
+}
+
+// CreateECDSATestKey creates and elliptic curve key for the given curve and returns
+// the public and private key in DER format
+func CreateECDSATestKey(curve elliptic.Curve) ([]byte, []byte, error) {
+	key, err := ecdsa.GenerateKey(curve, rand.Reader)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "ecdsa.GenerateKey failed")
+	}
+
+	pubData, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "x509.MarshalPKIXPublicKey failed")
+	}
+
+	privData, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "x509.MarshalECPrivateKey failed")
+	}
+
+	return pubData, privData, nil
+}
+
+// CreateTestCA creates a root CA for testing
+func CreateTestCA() (*rsa.PrivateKey, *x509.Certificate, error) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "rsa.GenerateKey failed")
+	}
+
+	ca := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject: pkix.Name{
+			CommonName: "test-ca",
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().AddDate(1, 0, 0),
+		IsCA:                  true,
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+	}
+	caCert, err := certifyKey(&key.PublicKey, ca, key, ca)
+
+	return key, caCert, err
+}
+
+// CertifyKey certifies a public key using the given CA's private key and cert;
+// The certificate template for the public key is optional
+func CertifyKey(pubbytes []byte, template *x509.Certificate, caKey *rsa.PrivateKey, caCert *x509.Certificate) (*x509.Certificate, error) {
+	pubKey, err := ParsePublicKey(pubbytes, "CertifyKey")
+	if err != nil {
+		return nil, err
+	}
+	return certifyKey(pubKey, template, caKey, caCert)
+}
+
+func certifyKey(pub interface{}, template *x509.Certificate, caKey *rsa.PrivateKey, caCert *x509.Certificate) (*x509.Certificate, error) {
+	if template == nil {
+		template = &x509.Certificate{
+			SerialNumber: big.NewInt(1),
+			Subject: pkix.Name{
+				CommonName: "testkey",
+			},
+			NotBefore:             time.Now(),
+			NotAfter:              time.Now().Add(time.Hour),
+			IsCA:                  false,
+			KeyUsage:              x509.KeyUsageDigitalSignature,
+			BasicConstraintsValid: true,
+		}
+	}
+
+	certDER, err := x509.CreateCertificate(rand.Reader, template, caCert, pub, caKey)
+	if err != nil {
+		return nil, errors.Wrap(err, "x509.CreateCertificate failed")
+	}
+
+	cert, err := x509.ParseCertificate(certDER)
+	if err != nil {
+		return nil, errors.Wrap(err, "x509.ParseCertificate failed")
+	}
+
+	return cert, nil
+}
diff --git a/vendor/github.com/containers/ocicrypt/utils/utils.go b/vendor/github.com/containers/ocicrypt/utils/utils.go
new file mode 100644
index 000000000..14eea38c1
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/utils/utils.go
@@ -0,0 +1,220 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"strings"
+
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/openpgp"
+	json "gopkg.in/square/go-jose.v2"
+)
+
+// parseJWKPrivateKey parses the input byte array as a JWK and makes sure it's a private key
+func parseJWKPrivateKey(privKey []byte, prefix string) (interface{}, error) {
+	jwk := json.JSONWebKey{}
+	err := jwk.UnmarshalJSON(privKey)
+	if err != nil {
+		return nil, errors.Wrapf(err, "%s: Could not parse input as JWK", prefix)
+	}
+	if jwk.IsPublic() {
+		return nil, fmt.Errorf("%s: JWK is not a private key", prefix)
+	}
+	return &jwk, nil
+}
+
+// parseJWKPublicKey parses the input byte array as a JWK
+func parseJWKPublicKey(privKey []byte, prefix string) (interface{}, error) {
+	jwk := json.JSONWebKey{}
+	err := jwk.UnmarshalJSON(privKey)
+	if err != nil {
+		return nil, errors.Wrapf(err, "%s: Could not parse input as JWK", prefix)
+	}
+	if !jwk.IsPublic() {
+		return nil, fmt.Errorf("%s: JWK is not a public key", prefix)
+	}
+	return &jwk, nil
+}
+
+// IsPasswordError checks whether an error is related to a missing or wrong
+// password
+func IsPasswordError(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := strings.ToLower(err.Error())
+
+	return strings.Contains(msg, "password") &&
+		(strings.Contains(msg, "missing") || strings.Contains(msg, "wrong"))
+}
+
+// ParsePrivateKey tries to parse a private key in DER format first and
+// PEM format after, returning an error if the parsing failed
+func ParsePrivateKey(privKey, privKeyPassword []byte, prefix string) (interface{}, error) {
+	key, err := x509.ParsePKCS8PrivateKey(privKey)
+	if err != nil {
+		key, err = x509.ParsePKCS1PrivateKey(privKey)
+		if err != nil {
+			key, err = x509.ParseECPrivateKey(privKey)
+		}
+	}
+	if err != nil {
+		block, _ := pem.Decode(privKey)
+		if block != nil {
+			var der []byte
+			if x509.IsEncryptedPEMBlock(block) {
+				if privKeyPassword == nil {
+					return nil, errors.Errorf("%s: Missing password for encrypted private key", prefix)
+				}
+				der, err = x509.DecryptPEMBlock(block, privKeyPassword)
+				if err != nil {
+					return nil, errors.Errorf("%s: Wrong password: could not decrypt private key", prefix)
+				}
+			} else {
+				der = block.Bytes
+			}
+
+			key, err = x509.ParsePKCS8PrivateKey(der)
+			if err != nil {
+				key, err = x509.ParsePKCS1PrivateKey(der)
+				if err != nil {
+					return nil, errors.Wrapf(err, "%s: Could not parse private key", prefix)
+				}
+			}
+		} else {
+			key, err = parseJWKPrivateKey(privKey, prefix)
+		}
+	}
+	return key, err
+}
+
+// IsPrivateKey returns true in case the given byte array represents a private key
+// It returns an error if for example the password is wrong
+func IsPrivateKey(data []byte, password []byte) (bool, error) {
+	_, err := ParsePrivateKey(data, password, "")
+	return err == nil, err
+}
+
+// ParsePublicKey tries to parse a public key in DER format first and
+// PEM format after, returning an error if the parsing failed
+func ParsePublicKey(pubKey []byte, prefix string) (interface{}, error) {
+	key, err := x509.ParsePKIXPublicKey(pubKey)
+	if err != nil {
+		block, _ := pem.Decode(pubKey)
+		if block != nil {
+			key, err = x509.ParsePKIXPublicKey(block.Bytes)
+			if err != nil {
+				return nil, errors.Wrapf(err, "%s: Could not parse public key", prefix)
+			}
+		} else {
+			key, err = parseJWKPublicKey(pubKey, prefix)
+		}
+	}
+	return key, err
+}
+
+// IsPublicKey returns true in case the given byte array represents a public key
+func IsPublicKey(data []byte) bool {
+	_, err := ParsePublicKey(data, "")
+	return err == nil
+}
+
+// ParseCertificate tries to parse a public key in DER format first and
+// PEM format after, returning an error if the parsing failed
+func ParseCertificate(certBytes []byte, prefix string) (*x509.Certificate, error) {
+	x509Cert, err := x509.ParseCertificate(certBytes)
+	if err != nil {
+		block, _ := pem.Decode(certBytes)
+		if block == nil {
+			return nil, fmt.Errorf("%s: Could not PEM decode x509 certificate", prefix)
+		}
+		x509Cert, err = x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, errors.Wrapf(err, "%s: Could not parse x509 certificate", prefix)
+		}
+	}
+	return x509Cert, err
+}
+
+// IsCertificate returns true in case the given byte array represents an x.509 certificate
+func IsCertificate(data []byte) bool {
+	_, err := ParseCertificate(data, "")
+	return err == nil
+}
+
+// IsGPGPrivateKeyRing returns true in case the given byte array represents a GPG private key ring file
+func IsGPGPrivateKeyRing(data []byte) bool {
+	r := bytes.NewBuffer(data)
+	_, err := openpgp.ReadKeyRing(r)
+	return err == nil
+}
+
+// SortDecryptionKeys parses a list of comma separated base64 entries and sorts the data into
+// a map. Each entry in the list may be either a GPG private key ring, private key, or x.509
+// certificate
+func SortDecryptionKeys(b64ItemList string) (map[string][][]byte, error) {
+	dcparameters := make(map[string][][]byte)
+
+	for _, b64Item := range strings.Split(b64ItemList, ",") {
+		var password []byte
+		b64Data := strings.Split(b64Item, ":")
+		keyData, err := base64.StdEncoding.DecodeString(b64Data[0])
+		if err != nil {
+			return nil, errors.New("Could not base64 decode a passed decryption key")
+		}
+		if len(b64Data) == 2 {
+			password, err = base64.StdEncoding.DecodeString(b64Data[1])
+			if err != nil {
+				return nil, errors.New("Could not base64 decode a passed decryption key password")
+			}
+		}
+		var key string
+		isPrivKey, err := IsPrivateKey(keyData, password)
+		if IsPasswordError(err) {
+			return nil, err
+		}
+		if isPrivKey {
+			key = "privkeys"
+			if _, ok := dcparameters["privkeys-passwords"]; !ok {
+				dcparameters["privkeys-passwords"] = [][]byte{password}
+			} else {
+				dcparameters["privkeys-passwords"] = append(dcparameters["privkeys-passwords"], password)
+			}
+		} else if IsCertificate(keyData) {
+			key = "x509s"
+		} else if IsGPGPrivateKeyRing(keyData) {
+			key = "gpg-privatekeys"
+		}
+		if key != "" {
+			values := dcparameters[key]
+			if values == nil {
+				dcparameters[key] = [][]byte{keyData}
+			} else {
+				dcparameters[key] = append(dcparameters[key], keyData)
+			}
+		} else {
+			return nil, errors.New("Unknown decryption key type")
+		}
+	}
+
+	return dcparameters, nil
+}
diff --git a/vendor/github.com/fullsailor/pkcs7/.gitignore b/vendor/github.com/fullsailor/pkcs7/.gitignore
new file mode 100644
index 000000000..daf913b1b
--- /dev/null
+++ b/vendor/github.com/fullsailor/pkcs7/.gitignore
@@ -0,0 +1,24 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof
diff --git a/vendor/github.com/fullsailor/pkcs7/.travis.yml b/vendor/github.com/fullsailor/pkcs7/.travis.yml
new file mode 100644
index 000000000..bc1204376
--- /dev/null
+++ b/vendor/github.com/fullsailor/pkcs7/.travis.yml
@@ -0,0 +1,7 @@
+language: go
+
+go:
+    - 1.8
+    - 1.9
+    - "1.10"
+    - tip
diff --git a/vendor/github.com/fullsailor/pkcs7/LICENSE b/vendor/github.com/fullsailor/pkcs7/LICENSE
new file mode 100644
index 000000000..75f320908
--- /dev/null
+++ b/vendor/github.com/fullsailor/pkcs7/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Andrew Smith
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
diff --git a/vendor/github.com/fullsailor/pkcs7/README.md b/vendor/github.com/fullsailor/pkcs7/README.md
new file mode 100644
index 000000000..bfd948f32
--- /dev/null
+++ b/vendor/github.com/fullsailor/pkcs7/README.md
@@ -0,0 +1,8 @@
+# pkcs7
+
+[![GoDoc](https://godoc.org/github.com/fullsailor/pkcs7?status.svg)](https://godoc.org/github.com/fullsailor/pkcs7)
+[![Build Status](https://travis-ci.org/fullsailor/pkcs7.svg?branch=master)](https://travis-ci.org/fullsailor/pkcs7)
+
+pkcs7 implements parsing and creating signed and enveloped messages.
+
+- Documentation on [GoDoc](http://godoc.org/github.com/fullsailor/pkcs7)
diff --git a/vendor/github.com/fullsailor/pkcs7/ber.go b/vendor/github.com/fullsailor/pkcs7/ber.go
new file mode 100644
index 000000000..89e96d30c
--- /dev/null
+++ b/vendor/github.com/fullsailor/pkcs7/ber.go
@@ -0,0 +1,248 @@
+package pkcs7
+
+import (
+	"bytes"
+	"errors"
+)
+
+// var encodeIndent = 0
+
+type asn1Object interface {
+	EncodeTo(writer *bytes.Buffer) error
+}
+
+type asn1Structured struct {
+	tagBytes []byte
+	content  []asn1Object
+}
+
+func (s asn1Structured) EncodeTo(out *bytes.Buffer) error {
+	//fmt.Printf("%s--> tag: % X\n", strings.Repeat("| ", encodeIndent), s.tagBytes)
+	//encodeIndent++
+	inner := new(bytes.Buffer)
+	for _, obj := range s.content {
+		err := obj.EncodeTo(inner)
+		if err != nil {
+			return err
+		}
+	}
+	//encodeIndent--
+	out.Write(s.tagBytes)
+	encodeLength(out, inner.Len())
+	out.Write(inner.Bytes())
+	return nil
+}
+
+type asn1Primitive struct {
+	tagBytes []byte
+	length   int
+	content  []byte
+}
+
+func (p asn1Primitive) EncodeTo(out *bytes.Buffer) error {
+	_, err := out.Write(p.tagBytes)
+	if err != nil {
+		return err
+	}
+	if err = encodeLength(out, p.length); err != nil {
+		return err
+	}
+	//fmt.Printf("%s--> tag: % X length: %d\n", strings.Repeat("| ", encodeIndent), p.tagBytes, p.length)
+	//fmt.Printf("%s--> content length: %d\n", strings.Repeat("| ", encodeIndent), len(p.content))
+	out.Write(p.content)
+
+	return nil
+}
+
+func ber2der(ber []byte) ([]byte, error) {
+	if len(ber) == 0 {
+		return nil, errors.New("ber2der: input ber is empty")
+	}
+	//fmt.Printf("--> ber2der: Transcoding %d bytes\n", len(ber))
+	out := new(bytes.Buffer)
+
+	obj, _, err := readObject(ber, 0)
+	if err != nil {
+		return nil, err
+	}
+	obj.EncodeTo(out)
+
+	// if offset < len(ber) {
+	//	return nil, fmt.Errorf("ber2der: Content longer than expected. Got %d, expected %d", offset, len(ber))
+	//}
+
+	return out.Bytes(), nil
+}
+
+// encodes lengths that are longer than 127 into string of bytes
+func marshalLongLength(out *bytes.Buffer, i int) (err error) {
+	n := lengthLength(i)
+
+	for ; n > 0; n-- {
+		err = out.WriteByte(byte(i >> uint((n-1)*8)))
+		if err != nil {
+			return
+		}
+	}
+
+	return nil
+}
+
+// computes the byte length of an encoded length value
+func lengthLength(i int) (numBytes int) {
+	numBytes = 1
+	for i > 255 {
+		numBytes++
+		i >>= 8
+	}
+	return
+}
+
+// encodes the length in DER format
+// If the length fits in 7 bits, the value is encoded directly.
+//
+// Otherwise, the number of bytes to encode the length is first determined.
+// This number is likely to be 4 or less for a 32bit length. This number is
+// added to 0x80. The length is encoded in big endian encoding follow after
+//
+// Examples:
+//  length | byte 1 | bytes n
+//  0      | 0x00   | -
+//  120    | 0x78   | -
+//  200    | 0x81   | 0xC8
+//  500    | 0x82   | 0x01 0xF4
+//
+func encodeLength(out *bytes.Buffer, length int) (err error) {
+	if length >= 128 {
+		l := lengthLength(length)
+		err = out.WriteByte(0x80 | byte(l))
+		if err != nil {
+			return
+		}
+		err = marshalLongLength(out, length)
+		if err != nil {
+			return
+		}
+	} else {
+		err = out.WriteByte(byte(length))
+		if err != nil {
+			return
+		}
+	}
+	return
+}
+
+func readObject(ber []byte, offset int) (asn1Object, int, error) {
+	//fmt.Printf("\n====> Starting readObject at offset: %d\n\n", offset)
+	tagStart := offset
+	b := ber[offset]
+	offset++
+	tag := b & 0x1F // last 5 bits
+	if tag == 0x1F {
+		tag = 0
+		for ber[offset] >= 0x80 {
+			tag = tag*128 + ber[offset] - 0x80
+			offset++
+		}
+		tag = tag*128 + ber[offset] - 0x80
+		offset++
+	}
+	tagEnd := offset
+
+	kind := b & 0x20
+	/*
+		if kind == 0 {
+			fmt.Print("--> Primitive\n")
+		} else {
+			fmt.Print("--> Constructed\n")
+		}
+	*/
+	// read length
+	var length int
+	l := ber[offset]
+	offset++
+	indefinite := false
+	if l > 0x80 {
+		numberOfBytes := (int)(l & 0x7F)
+		if numberOfBytes > 4 { // int is only guaranteed to be 32bit
+			return nil, 0, errors.New("ber2der: BER tag length too long")
+		}
+		if numberOfBytes == 4 && (int)(ber[offset]) > 0x7F {
+			return nil, 0, errors.New("ber2der: BER tag length is negative")
+		}
+		if 0x0 == (int)(ber[offset]) {
+			return nil, 0, errors.New("ber2der: BER tag length has leading zero")
+		}
+		//fmt.Printf("--> (compute length) indicator byte: %x\n", l)
+		//fmt.Printf("--> (compute length) length bytes: % X\n", ber[offset:offset+numberOfBytes])
+		for i := 0; i < numberOfBytes; i++ {
+			length = length*256 + (int)(ber[offset])
+			offset++
+		}
+	} else if l == 0x80 {
+		indefinite = true
+	} else {
+		length = (int)(l)
+	}
+
+	//fmt.Printf("--> length        : %d\n", length)
+	contentEnd := offset + length
+	if contentEnd > len(ber) {
+		return nil, 0, errors.New("ber2der: BER tag length is more than available data")
+	}
+	//fmt.Printf("--> content start : %d\n", offset)
+	//fmt.Printf("--> content end   : %d\n", contentEnd)
+	//fmt.Printf("--> content       : % X\n", ber[offset:contentEnd])
+	var obj asn1Object
+	if indefinite && kind == 0 {
+		return nil, 0, errors.New("ber2der: Indefinite form tag must have constructed encoding")
+	}
+	if kind == 0 {
+		obj = asn1Primitive{
+			tagBytes: ber[tagStart:tagEnd],
+			length:   length,
+			content:  ber[offset:contentEnd],
+		}
+	} else {
+		var subObjects []asn1Object
+		for (offset < contentEnd) || indefinite {
+			var subObj asn1Object
+			var err error
+			subObj, offset, err = readObject(ber, offset)
+			if err != nil {
+				return nil, 0, err
+			}
+			subObjects = append(subObjects, subObj)
+
+			if indefinite {
+				terminated, err := isIndefiniteTermination(ber, offset)
+				if err != nil {
+					return nil, 0, err
+				}
+
+				if terminated {
+					break
+				}
+			}
+		}
+		obj = asn1Structured{
+			tagBytes: ber[tagStart:tagEnd],
+			content:  subObjects,
+		}
+	}
+
+	// Apply indefinite form length with 0x0000 terminator.
+	if indefinite {
+		contentEnd = offset + 2
+	}
+
+	return obj, contentEnd, nil
+}
+
+func isIndefiniteTermination(ber []byte, offset int) (bool, error) {
+	if len(ber) - offset < 2 {
+		return false, errors.New("ber2der: Invalid BER format")
+	}
+
+	return bytes.Index(ber[offset:], []byte{0x0, 0x0}) == 0, nil
+}
diff --git a/vendor/github.com/fullsailor/pkcs7/pkcs7.go b/vendor/github.com/fullsailor/pkcs7/pkcs7.go
new file mode 100644
index 000000000..0264466b4
--- /dev/null
+++ b/vendor/github.com/fullsailor/pkcs7/pkcs7.go
@@ -0,0 +1,962 @@
+// Package pkcs7 implements parsing and generation of some PKCS#7 structures.
+package pkcs7
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/des"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"math/big"
+	"sort"
+	"time"
+
+	_ "crypto/sha1" // for crypto.SHA1
+)
+
+// PKCS7 Represents a PKCS7 structure
+type PKCS7 struct {
+	Content      []byte
+	Certificates []*x509.Certificate
+	CRLs         []pkix.CertificateList
+	Signers      []signerInfo
+	raw          interface{}
+}
+
+type contentInfo struct {
+	ContentType asn1.ObjectIdentifier
+	Content     asn1.RawValue `asn1:"explicit,optional,tag:0"`
+}
+
+// ErrUnsupportedContentType is returned when a PKCS7 content is not supported.
+// Currently only Data (1.2.840.113549.1.7.1), Signed Data (1.2.840.113549.1.7.2),
+// and Enveloped Data are supported (1.2.840.113549.1.7.3)
+var ErrUnsupportedContentType = errors.New("pkcs7: cannot parse data: unimplemented content type")
+
+type unsignedData []byte
+
+var (
+	oidData                   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 1}
+	oidSignedData             = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 2}
+	oidEnvelopedData          = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 3}
+	oidSignedAndEnvelopedData = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 4}
+	oidDigestedData           = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 5}
+	oidEncryptedData          = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 6}
+	oidAttributeContentType   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 3}
+	oidAttributeMessageDigest = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 4}
+	oidAttributeSigningTime   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 5}
+)
+
+type signedData struct {
+	Version                    int                        `asn1:"default:1"`
+	DigestAlgorithmIdentifiers []pkix.AlgorithmIdentifier `asn1:"set"`
+	ContentInfo                contentInfo
+	Certificates               rawCertificates        `asn1:"optional,tag:0"`
+	CRLs                       []pkix.CertificateList `asn1:"optional,tag:1"`
+	SignerInfos                []signerInfo           `asn1:"set"`
+}
+
+type rawCertificates struct {
+	Raw asn1.RawContent
+}
+
+type envelopedData struct {
+	Version              int
+	RecipientInfos       []recipientInfo `asn1:"set"`
+	EncryptedContentInfo encryptedContentInfo
+}
+
+type recipientInfo struct {
+	Version                int
+	IssuerAndSerialNumber  issuerAndSerial
+	KeyEncryptionAlgorithm pkix.AlgorithmIdentifier
+	EncryptedKey           []byte
+}
+
+type encryptedContentInfo struct {
+	ContentType                asn1.ObjectIdentifier
+	ContentEncryptionAlgorithm pkix.AlgorithmIdentifier
+	EncryptedContent           asn1.RawValue `asn1:"tag:0,optional"`
+}
+
+type attribute struct {
+	Type  asn1.ObjectIdentifier
+	Value asn1.RawValue `asn1:"set"`
+}
+
+type issuerAndSerial struct {
+	IssuerName   asn1.RawValue
+	SerialNumber *big.Int
+}
+
+// MessageDigestMismatchError is returned when the signer data digest does not
+// match the computed digest for the contained content
+type MessageDigestMismatchError struct {
+	ExpectedDigest []byte
+	ActualDigest   []byte
+}
+
+func (err *MessageDigestMismatchError) Error() string {
+	return fmt.Sprintf("pkcs7: Message digest mismatch\n\tExpected: %X\n\tActual  : %X", err.ExpectedDigest, err.ActualDigest)
+}
+
+type signerInfo struct {
+	Version                   int `asn1:"default:1"`
+	IssuerAndSerialNumber     issuerAndSerial
+	DigestAlgorithm           pkix.AlgorithmIdentifier
+	AuthenticatedAttributes   []attribute `asn1:"optional,tag:0"`
+	DigestEncryptionAlgorithm pkix.AlgorithmIdentifier
+	EncryptedDigest           []byte
+	UnauthenticatedAttributes []attribute `asn1:"optional,tag:1"`
+}
+
+// Parse decodes a DER encoded PKCS7 package
+func Parse(data []byte) (p7 *PKCS7, err error) {
+	if len(data) == 0 {
+		return nil, errors.New("pkcs7: input data is empty")
+	}
+	var info contentInfo
+	der, err := ber2der(data)
+	if err != nil {
+		return nil, err
+	}
+	rest, err := asn1.Unmarshal(der, &info)
+	if len(rest) > 0 {
+		err = asn1.SyntaxError{Msg: "trailing data"}
+		return
+	}
+	if err != nil {
+		return
+	}
+
+	// fmt.Printf("--> Content Type: %s", info.ContentType)
+	switch {
+	case info.ContentType.Equal(oidSignedData):
+		return parseSignedData(info.Content.Bytes)
+	case info.ContentType.Equal(oidEnvelopedData):
+		return parseEnvelopedData(info.Content.Bytes)
+	}
+	return nil, ErrUnsupportedContentType
+}
+
+func parseSignedData(data []byte) (*PKCS7, error) {
+	var sd signedData
+	asn1.Unmarshal(data, &sd)
+	certs, err := sd.Certificates.Parse()
+	if err != nil {
+		return nil, err
+	}
+	// fmt.Printf("--> Signed Data Version %d\n", sd.Version)
+
+	var compound asn1.RawValue
+	var content unsignedData
+
+	// The Content.Bytes maybe empty on PKI responses.
+	if len(sd.ContentInfo.Content.Bytes) > 0 {
+		if _, err := asn1.Unmarshal(sd.ContentInfo.Content.Bytes, &compound); err != nil {
+			return nil, err
+		}
+	}
+	// Compound octet string
+	if compound.IsCompound {
+		if _, err = asn1.Unmarshal(compound.Bytes, &content); err != nil {
+			return nil, err
+		}
+	} else {
+		// assuming this is tag 04
+		content = compound.Bytes
+	}
+	return &PKCS7{
+		Content:      content,
+		Certificates: certs,
+		CRLs:         sd.CRLs,
+		Signers:      sd.SignerInfos,
+		raw:          sd}, nil
+}
+
+func (raw rawCertificates) Parse() ([]*x509.Certificate, error) {
+	if len(raw.Raw) == 0 {
+		return nil, nil
+	}
+
+	var val asn1.RawValue
+	if _, err := asn1.Unmarshal(raw.Raw, &val); err != nil {
+		return nil, err
+	}
+
+	return x509.ParseCertificates(val.Bytes)
+}
+
+func parseEnvelopedData(data []byte) (*PKCS7, error) {
+	var ed envelopedData
+	if _, err := asn1.Unmarshal(data, &ed); err != nil {
+		return nil, err
+	}
+	return &PKCS7{
+		raw: ed,
+	}, nil
+}
+
+// Verify checks the signatures of a PKCS7 object
+// WARNING: Verify does not check signing time or verify certificate chains at
+// this time.
+func (p7 *PKCS7) Verify() (err error) {
+	if len(p7.Signers) == 0 {
+		return errors.New("pkcs7: Message has no signers")
+	}
+	for _, signer := range p7.Signers {
+		if err := verifySignature(p7, signer); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func verifySignature(p7 *PKCS7, signer signerInfo) error {
+	signedData := p7.Content
+	hash, err := getHashForOID(signer.DigestAlgorithm.Algorithm)
+	if err != nil {
+		return err
+	}
+	if len(signer.AuthenticatedAttributes) > 0 {
+		// TODO(fullsailor): First check the content type match
+		var digest []byte
+		err := unmarshalAttribute(signer.AuthenticatedAttributes, oidAttributeMessageDigest, &digest)
+		if err != nil {
+			return err
+		}
+		h := hash.New()
+		h.Write(p7.Content)
+		computed := h.Sum(nil)
+		if !hmac.Equal(digest, computed) {
+			return &MessageDigestMismatchError{
+				ExpectedDigest: digest,
+				ActualDigest:   computed,
+			}
+		}
+		// TODO(fullsailor): Optionally verify certificate chain
+		// TODO(fullsailor): Optionally verify signingTime against certificate NotAfter/NotBefore
+		signedData, err = marshalAttributes(signer.AuthenticatedAttributes)
+		if err != nil {
+			return err
+		}
+	}
+	cert := getCertFromCertsByIssuerAndSerial(p7.Certificates, signer.IssuerAndSerialNumber)
+	if cert == nil {
+		return errors.New("pkcs7: No certificate for signer")
+	}
+
+	algo := getSignatureAlgorithmFromAI(signer.DigestEncryptionAlgorithm)
+	if algo == x509.UnknownSignatureAlgorithm {
+		// I'm not sure what the spec here is, and the openssl sources were not
+		// helpful. But, this is what App Store receipts appear to do.
+		// The DigestEncryptionAlgorithm is just "rsaEncryption (PKCS #1)"
+		// But we're expecting a digest + encryption algorithm. So... we're going
+		// to determine an algorithm based on the DigestAlgorithm and this
+		// encryption algorithm.
+		if signer.DigestEncryptionAlgorithm.Algorithm.Equal(oidEncryptionAlgorithmRSA) {
+			algo = getRSASignatureAlgorithmForDigestAlgorithm(hash)
+		}
+	}
+	return cert.CheckSignature(algo, signedData, signer.EncryptedDigest)
+}
+
+func marshalAttributes(attrs []attribute) ([]byte, error) {
+	encodedAttributes, err := asn1.Marshal(struct {
+		A []attribute `asn1:"set"`
+	}{A: attrs})
+	if err != nil {
+		return nil, err
+	}
+
+	// Remove the leading sequence octets
+	var raw asn1.RawValue
+	asn1.Unmarshal(encodedAttributes, &raw)
+	return raw.Bytes, nil
+}
+
+var (
+	oidDigestAlgorithmSHA1    = asn1.ObjectIdentifier{1, 3, 14, 3, 2, 26}
+	oidEncryptionAlgorithmRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 1}
+)
+
+func getCertFromCertsByIssuerAndSerial(certs []*x509.Certificate, ias issuerAndSerial) *x509.Certificate {
+	for _, cert := range certs {
+		if isCertMatchForIssuerAndSerial(cert, ias) {
+			return cert
+		}
+	}
+	return nil
+}
+
+func getHashForOID(oid asn1.ObjectIdentifier) (crypto.Hash, error) {
+	switch {
+	case oid.Equal(oidDigestAlgorithmSHA1):
+		return crypto.SHA1, nil
+  case oid.Equal(oidSHA256):
+    return crypto.SHA256, nil
+	}
+	return crypto.Hash(0), ErrUnsupportedAlgorithm
+}
+
+func getRSASignatureAlgorithmForDigestAlgorithm(hash crypto.Hash) x509.SignatureAlgorithm {
+	for _, details := range signatureAlgorithmDetails {
+		if details.pubKeyAlgo == x509.RSA && details.hash == hash {
+			return details.algo
+		}
+	}
+	return x509.UnknownSignatureAlgorithm
+}
+
+// GetOnlySigner returns an x509.Certificate for the first signer of the signed
+// data payload. If there are more or less than one signer, nil is returned
+func (p7 *PKCS7) GetOnlySigner() *x509.Certificate {
+	if len(p7.Signers) != 1 {
+		return nil
+	}
+	signer := p7.Signers[0]
+	return getCertFromCertsByIssuerAndSerial(p7.Certificates, signer.IssuerAndSerialNumber)
+}
+
+// ErrUnsupportedAlgorithm tells you when our quick dev assumptions have failed
+var ErrUnsupportedAlgorithm = errors.New("pkcs7: cannot decrypt data: only RSA, DES, DES-EDE3, AES-256-CBC and AES-128-GCM supported")
+
+// ErrNotEncryptedContent is returned when attempting to Decrypt data that is not encrypted data
+var ErrNotEncryptedContent = errors.New("pkcs7: content data is a decryptable data type")
+
+// Decrypt decrypts encrypted content info for recipient cert and private key
+func (p7 *PKCS7) Decrypt(cert *x509.Certificate, pk crypto.PrivateKey) ([]byte, error) {
+	data, ok := p7.raw.(envelopedData)
+	if !ok {
+		return nil, ErrNotEncryptedContent
+	}
+	recipient := selectRecipientForCertificate(data.RecipientInfos, cert)
+	if recipient.EncryptedKey == nil {
+		return nil, errors.New("pkcs7: no enveloped recipient for provided certificate")
+	}
+	if priv := pk.(*rsa.PrivateKey); priv != nil {
+		var contentKey []byte
+		contentKey, err := rsa.DecryptPKCS1v15(rand.Reader, priv, recipient.EncryptedKey)
+		if err != nil {
+			return nil, err
+		}
+		return data.EncryptedContentInfo.decrypt(contentKey)
+	}
+	fmt.Printf("Unsupported Private Key: %v\n", pk)
+	return nil, ErrUnsupportedAlgorithm
+}
+
+var oidEncryptionAlgorithmDESCBC = asn1.ObjectIdentifier{1, 3, 14, 3, 2, 7}
+var oidEncryptionAlgorithmDESEDE3CBC = asn1.ObjectIdentifier{1, 2, 840, 113549, 3, 7}
+var oidEncryptionAlgorithmAES256CBC = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 42}
+var oidEncryptionAlgorithmAES128GCM = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 6}
+var oidEncryptionAlgorithmAES128CBC = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 2}
+
+func (eci encryptedContentInfo) decrypt(key []byte) ([]byte, error) {
+	alg := eci.ContentEncryptionAlgorithm.Algorithm
+	if !alg.Equal(oidEncryptionAlgorithmDESCBC) &&
+		!alg.Equal(oidEncryptionAlgorithmDESEDE3CBC) &&
+		!alg.Equal(oidEncryptionAlgorithmAES256CBC) &&
+		!alg.Equal(oidEncryptionAlgorithmAES128CBC) &&
+		!alg.Equal(oidEncryptionAlgorithmAES128GCM) {
+		fmt.Printf("Unsupported Content Encryption Algorithm: %s\n", alg)
+		return nil, ErrUnsupportedAlgorithm
+	}
+
+	// EncryptedContent can either be constructed of multple OCTET STRINGs
+	// or _be_ a tagged OCTET STRING
+	var cyphertext []byte
+	if eci.EncryptedContent.IsCompound {
+		// Complex case to concat all of the children OCTET STRINGs
+		var buf bytes.Buffer
+		cypherbytes := eci.EncryptedContent.Bytes
+		for {
+			var part []byte
+			cypherbytes, _ = asn1.Unmarshal(cypherbytes, &part)
+			buf.Write(part)
+			if cypherbytes == nil {
+				break
+			}
+		}
+		cyphertext = buf.Bytes()
+	} else {
+		// Simple case, the bytes _are_ the cyphertext
+		cyphertext = eci.EncryptedContent.Bytes
+	}
+
+	var block cipher.Block
+	var err error
+
+	switch {
+	case alg.Equal(oidEncryptionAlgorithmDESCBC):
+		block, err = des.NewCipher(key)
+	case alg.Equal(oidEncryptionAlgorithmDESEDE3CBC):
+		block, err = des.NewTripleDESCipher(key)
+	case alg.Equal(oidEncryptionAlgorithmAES256CBC):
+		fallthrough
+	case alg.Equal(oidEncryptionAlgorithmAES128GCM), alg.Equal(oidEncryptionAlgorithmAES128CBC):
+		block, err = aes.NewCipher(key)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if alg.Equal(oidEncryptionAlgorithmAES128GCM) {
+		params := aesGCMParameters{}
+		paramBytes := eci.ContentEncryptionAlgorithm.Parameters.Bytes
+
+		_, err := asn1.Unmarshal(paramBytes, &params)
+		if err != nil {
+			return nil, err
+		}
+
+		gcm, err := cipher.NewGCM(block)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(params.Nonce) != gcm.NonceSize() {
+			return nil, errors.New("pkcs7: encryption algorithm parameters are incorrect")
+		}
+		if params.ICVLen != gcm.Overhead() {
+			return nil, errors.New("pkcs7: encryption algorithm parameters are incorrect")
+		}
+
+		plaintext, err := gcm.Open(nil, params.Nonce, cyphertext, nil)
+		if err != nil {
+			return nil, err
+		}
+
+		return plaintext, nil
+	}
+
+	iv := eci.ContentEncryptionAlgorithm.Parameters.Bytes
+	if len(iv) != block.BlockSize() {
+		return nil, errors.New("pkcs7: encryption algorithm parameters are malformed")
+	}
+	mode := cipher.NewCBCDecrypter(block, iv)
+	plaintext := make([]byte, len(cyphertext))
+	mode.CryptBlocks(plaintext, cyphertext)
+	if plaintext, err = unpad(plaintext, mode.BlockSize()); err != nil {
+		return nil, err
+	}
+	return plaintext, nil
+}
+
+func selectRecipientForCertificate(recipients []recipientInfo, cert *x509.Certificate) recipientInfo {
+	for _, recp := range recipients {
+		if isCertMatchForIssuerAndSerial(cert, recp.IssuerAndSerialNumber) {
+			return recp
+		}
+	}
+	return recipientInfo{}
+}
+
+func isCertMatchForIssuerAndSerial(cert *x509.Certificate, ias issuerAndSerial) bool {
+	return cert.SerialNumber.Cmp(ias.SerialNumber) == 0 && bytes.Compare(cert.RawIssuer, ias.IssuerName.FullBytes) == 0
+}
+
+func pad(data []byte, blocklen int) ([]byte, error) {
+	if blocklen < 1 {
+		return nil, fmt.Errorf("invalid blocklen %d", blocklen)
+	}
+	padlen := blocklen - (len(data) % blocklen)
+	if padlen == 0 {
+		padlen = blocklen
+	}
+	pad := bytes.Repeat([]byte{byte(padlen)}, padlen)
+	return append(data, pad...), nil
+}
+
+func unpad(data []byte, blocklen int) ([]byte, error) {
+	if blocklen < 1 {
+		return nil, fmt.Errorf("invalid blocklen %d", blocklen)
+	}
+	if len(data)%blocklen != 0 || len(data) == 0 {
+		return nil, fmt.Errorf("invalid data len %d", len(data))
+	}
+
+	// the last byte is the length of padding
+	padlen := int(data[len(data)-1])
+
+	// check padding integrity, all bytes should be the same
+	pad := data[len(data)-padlen:]
+	for _, padbyte := range pad {
+		if padbyte != byte(padlen) {
+			return nil, errors.New("invalid padding")
+		}
+	}
+
+	return data[:len(data)-padlen], nil
+}
+
+func unmarshalAttribute(attrs []attribute, attributeType asn1.ObjectIdentifier, out interface{}) error {
+	for _, attr := range attrs {
+		if attr.Type.Equal(attributeType) {
+			_, err := asn1.Unmarshal(attr.Value.Bytes, out)
+			return err
+		}
+	}
+	return errors.New("pkcs7: attribute type not in attributes")
+}
+
+// UnmarshalSignedAttribute decodes a single attribute from the signer info
+func (p7 *PKCS7) UnmarshalSignedAttribute(attributeType asn1.ObjectIdentifier, out interface{}) error {
+	sd, ok := p7.raw.(signedData)
+	if !ok {
+		return errors.New("pkcs7: payload is not signedData content")
+	}
+	if len(sd.SignerInfos) < 1 {
+		return errors.New("pkcs7: payload has no signers")
+	}
+	attributes := sd.SignerInfos[0].AuthenticatedAttributes
+	return unmarshalAttribute(attributes, attributeType, out)
+}
+
+// SignedData is an opaque data structure for creating signed data payloads
+type SignedData struct {
+	sd            signedData
+	certs         []*x509.Certificate
+	messageDigest []byte
+}
+
+// Attribute represents a key value pair attribute. Value must be marshalable byte
+// `encoding/asn1`
+type Attribute struct {
+	Type  asn1.ObjectIdentifier
+	Value interface{}
+}
+
+// SignerInfoConfig are optional values to include when adding a signer
+type SignerInfoConfig struct {
+	ExtraSignedAttributes []Attribute
+}
+
+// NewSignedData initializes a SignedData with content
+func NewSignedData(data []byte) (*SignedData, error) {
+	content, err := asn1.Marshal(data)
+	if err != nil {
+		return nil, err
+	}
+	ci := contentInfo{
+		ContentType: oidData,
+		Content:     asn1.RawValue{Class: 2, Tag: 0, Bytes: content, IsCompound: true},
+	}
+	digAlg := pkix.AlgorithmIdentifier{
+		Algorithm: oidDigestAlgorithmSHA1,
+	}
+	h := crypto.SHA1.New()
+	h.Write(data)
+	md := h.Sum(nil)
+	sd := signedData{
+		ContentInfo:                ci,
+		Version:                    1,
+		DigestAlgorithmIdentifiers: []pkix.AlgorithmIdentifier{digAlg},
+	}
+	return &SignedData{sd: sd, messageDigest: md}, nil
+}
+
+type attributes struct {
+	types  []asn1.ObjectIdentifier
+	values []interface{}
+}
+
+// Add adds the attribute, maintaining insertion order
+func (attrs *attributes) Add(attrType asn1.ObjectIdentifier, value interface{}) {
+	attrs.types = append(attrs.types, attrType)
+	attrs.values = append(attrs.values, value)
+}
+
+type sortableAttribute struct {
+	SortKey   []byte
+	Attribute attribute
+}
+
+type attributeSet []sortableAttribute
+
+func (sa attributeSet) Len() int {
+	return len(sa)
+}
+
+func (sa attributeSet) Less(i, j int) bool {
+	return bytes.Compare(sa[i].SortKey, sa[j].SortKey) < 0
+}
+
+func (sa attributeSet) Swap(i, j int) {
+	sa[i], sa[j] = sa[j], sa[i]
+}
+
+func (sa attributeSet) Attributes() []attribute {
+	attrs := make([]attribute, len(sa))
+	for i, attr := range sa {
+		attrs[i] = attr.Attribute
+	}
+	return attrs
+}
+
+func (attrs *attributes) ForMarshaling() ([]attribute, error) {
+	sortables := make(attributeSet, len(attrs.types))
+	for i := range sortables {
+		attrType := attrs.types[i]
+		attrValue := attrs.values[i]
+		asn1Value, err := asn1.Marshal(attrValue)
+		if err != nil {
+			return nil, err
+		}
+		attr := attribute{
+			Type:  attrType,
+			Value: asn1.RawValue{Tag: 17, IsCompound: true, Bytes: asn1Value}, // 17 == SET tag
+		}
+		encoded, err := asn1.Marshal(attr)
+		if err != nil {
+			return nil, err
+		}
+		sortables[i] = sortableAttribute{
+			SortKey:   encoded,
+			Attribute: attr,
+		}
+	}
+	sort.Sort(sortables)
+	return sortables.Attributes(), nil
+}
+
+// AddSigner signs attributes about the content and adds certificate to payload
+func (sd *SignedData) AddSigner(cert *x509.Certificate, pkey crypto.PrivateKey, config SignerInfoConfig) error {
+	attrs := &attributes{}
+	attrs.Add(oidAttributeContentType, sd.sd.ContentInfo.ContentType)
+	attrs.Add(oidAttributeMessageDigest, sd.messageDigest)
+	attrs.Add(oidAttributeSigningTime, time.Now())
+	for _, attr := range config.ExtraSignedAttributes {
+		attrs.Add(attr.Type, attr.Value)
+	}
+	finalAttrs, err := attrs.ForMarshaling()
+	if err != nil {
+		return err
+	}
+	signature, err := signAttributes(finalAttrs, pkey, crypto.SHA1)
+	if err != nil {
+		return err
+	}
+
+	ias, err := cert2issuerAndSerial(cert)
+	if err != nil {
+		return err
+	}
+
+	signer := signerInfo{
+		AuthenticatedAttributes:   finalAttrs,
+		DigestAlgorithm:           pkix.AlgorithmIdentifier{Algorithm: oidDigestAlgorithmSHA1},
+		DigestEncryptionAlgorithm: pkix.AlgorithmIdentifier{Algorithm: oidSignatureSHA1WithRSA},
+		IssuerAndSerialNumber:     ias,
+		EncryptedDigest:           signature,
+		Version:                   1,
+	}
+	// create signature of signed attributes
+	sd.certs = append(sd.certs, cert)
+	sd.sd.SignerInfos = append(sd.sd.SignerInfos, signer)
+	return nil
+}
+
+// AddCertificate adds the certificate to the payload. Useful for parent certificates
+func (sd *SignedData) AddCertificate(cert *x509.Certificate) {
+	sd.certs = append(sd.certs, cert)
+}
+
+// Detach removes content from the signed data struct to make it a detached signature.
+// This must be called right before Finish()
+func (sd *SignedData) Detach() {
+	sd.sd.ContentInfo = contentInfo{ContentType: oidData}
+}
+
+// Finish marshals the content and its signers
+func (sd *SignedData) Finish() ([]byte, error) {
+	sd.sd.Certificates = marshalCertificates(sd.certs)
+	inner, err := asn1.Marshal(sd.sd)
+	if err != nil {
+		return nil, err
+	}
+	outer := contentInfo{
+		ContentType: oidSignedData,
+		Content:     asn1.RawValue{Class: 2, Tag: 0, Bytes: inner, IsCompound: true},
+	}
+	return asn1.Marshal(outer)
+}
+
+func cert2issuerAndSerial(cert *x509.Certificate) (issuerAndSerial, error) {
+	var ias issuerAndSerial
+	// The issuer RDNSequence has to match exactly the sequence in the certificate
+	// We cannot use cert.Issuer.ToRDNSequence() here since it mangles the sequence
+	ias.IssuerName = asn1.RawValue{FullBytes: cert.RawIssuer}
+	ias.SerialNumber = cert.SerialNumber
+
+	return ias, nil
+}
+
+// signs the DER encoded form of the attributes with the private key
+func signAttributes(attrs []attribute, pkey crypto.PrivateKey, hash crypto.Hash) ([]byte, error) {
+	attrBytes, err := marshalAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+	h := hash.New()
+	h.Write(attrBytes)
+	hashed := h.Sum(nil)
+	switch priv := pkey.(type) {
+	case *rsa.PrivateKey:
+		return rsa.SignPKCS1v15(rand.Reader, priv, crypto.SHA1, hashed)
+	}
+	return nil, ErrUnsupportedAlgorithm
+}
+
+// concats and wraps the certificates in the RawValue structure
+func marshalCertificates(certs []*x509.Certificate) rawCertificates {
+	var buf bytes.Buffer
+	for _, cert := range certs {
+		buf.Write(cert.Raw)
+	}
+	rawCerts, _ := marshalCertificateBytes(buf.Bytes())
+	return rawCerts
+}
+
+// Even though, the tag & length are stripped out during marshalling the
+// RawContent, we have to encode it into the RawContent. If its missing,
+// then `asn1.Marshal()` will strip out the certificate wrapper instead.
+func marshalCertificateBytes(certs []byte) (rawCertificates, error) {
+	var val = asn1.RawValue{Bytes: certs, Class: 2, Tag: 0, IsCompound: true}
+	b, err := asn1.Marshal(val)
+	if err != nil {
+		return rawCertificates{}, err
+	}
+	return rawCertificates{Raw: b}, nil
+}
+
+// DegenerateCertificate creates a signed data structure containing only the
+// provided certificate or certificate chain.
+func DegenerateCertificate(cert []byte) ([]byte, error) {
+	rawCert, err := marshalCertificateBytes(cert)
+	if err != nil {
+		return nil, err
+	}
+	emptyContent := contentInfo{ContentType: oidData}
+	sd := signedData{
+		Version:      1,
+		ContentInfo:  emptyContent,
+		Certificates: rawCert,
+		CRLs:         []pkix.CertificateList{},
+	}
+	content, err := asn1.Marshal(sd)
+	if err != nil {
+		return nil, err
+	}
+	signedContent := contentInfo{
+		ContentType: oidSignedData,
+		Content:     asn1.RawValue{Class: 2, Tag: 0, Bytes: content, IsCompound: true},
+	}
+	return asn1.Marshal(signedContent)
+}
+
+const (
+	EncryptionAlgorithmDESCBC = iota
+	EncryptionAlgorithmAES128GCM
+)
+
+// ContentEncryptionAlgorithm determines the algorithm used to encrypt the
+// plaintext message. Change the value of this variable to change which
+// algorithm is used in the Encrypt() function.
+var ContentEncryptionAlgorithm = EncryptionAlgorithmDESCBC
+
+// ErrUnsupportedEncryptionAlgorithm is returned when attempting to encrypt
+// content with an unsupported algorithm.
+var ErrUnsupportedEncryptionAlgorithm = errors.New("pkcs7: cannot encrypt content: only DES-CBC and AES-128-GCM supported")
+
+const nonceSize = 12
+
+type aesGCMParameters struct {
+	Nonce  []byte `asn1:"tag:4"`
+	ICVLen int
+}
+
+func encryptAES128GCM(content []byte) ([]byte, *encryptedContentInfo, error) {
+	// Create AES key and nonce
+	key := make([]byte, 16)
+	nonce := make([]byte, nonceSize)
+
+	_, err := rand.Read(key)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	_, err = rand.Read(nonce)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Encrypt content
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	ciphertext := gcm.Seal(nil, nonce, content, nil)
+
+	// Prepare ASN.1 Encrypted Content Info
+	paramSeq := aesGCMParameters{
+		Nonce:  nonce,
+		ICVLen: gcm.Overhead(),
+	}
+
+	paramBytes, err := asn1.Marshal(paramSeq)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	eci := encryptedContentInfo{
+		ContentType: oidData,
+		ContentEncryptionAlgorithm: pkix.AlgorithmIdentifier{
+			Algorithm: oidEncryptionAlgorithmAES128GCM,
+			Parameters: asn1.RawValue{
+				Tag:   asn1.TagSequence,
+				Bytes: paramBytes,
+			},
+		},
+		EncryptedContent: marshalEncryptedContent(ciphertext),
+	}
+
+	return key, &eci, nil
+}
+
+func encryptDESCBC(content []byte) ([]byte, *encryptedContentInfo, error) {
+	// Create DES key & CBC IV
+	key := make([]byte, 8)
+	iv := make([]byte, des.BlockSize)
+	_, err := rand.Read(key)
+	if err != nil {
+		return nil, nil, err
+	}
+	_, err = rand.Read(iv)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Encrypt padded content
+	block, err := des.NewCipher(key)
+	if err != nil {
+		return nil, nil, err
+	}
+	mode := cipher.NewCBCEncrypter(block, iv)
+	plaintext, err := pad(content, mode.BlockSize())
+	cyphertext := make([]byte, len(plaintext))
+	mode.CryptBlocks(cyphertext, plaintext)
+
+	// Prepare ASN.1 Encrypted Content Info
+	eci := encryptedContentInfo{
+		ContentType: oidData,
+		ContentEncryptionAlgorithm: pkix.AlgorithmIdentifier{
+			Algorithm:  oidEncryptionAlgorithmDESCBC,
+			Parameters: asn1.RawValue{Tag: 4, Bytes: iv},
+		},
+		EncryptedContent: marshalEncryptedContent(cyphertext),
+	}
+
+	return key, &eci, nil
+}
+
+// Encrypt creates and returns an envelope data PKCS7 structure with encrypted
+// recipient keys for each recipient public key.
+//
+// The algorithm used to perform encryption is determined by the current value
+// of the global ContentEncryptionAlgorithm package variable. By default, the
+// value is EncryptionAlgorithmDESCBC. To use a different algorithm, change the
+// value before calling Encrypt(). For example:
+//
+//     ContentEncryptionAlgorithm = EncryptionAlgorithmAES128GCM
+//
+// TODO(fullsailor): Add support for encrypting content with other algorithms
+func Encrypt(content []byte, recipients []*x509.Certificate) ([]byte, error) {
+	var eci *encryptedContentInfo
+	var key []byte
+	var err error
+
+	// Apply chosen symmetric encryption method
+	switch ContentEncryptionAlgorithm {
+	case EncryptionAlgorithmDESCBC:
+		key, eci, err = encryptDESCBC(content)
+
+	case EncryptionAlgorithmAES128GCM:
+		key, eci, err = encryptAES128GCM(content)
+
+	default:
+		return nil, ErrUnsupportedEncryptionAlgorithm
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Prepare each recipient's encrypted cipher key
+	recipientInfos := make([]recipientInfo, len(recipients))
+	for i, recipient := range recipients {
+		encrypted, err := encryptKey(key, recipient)
+		if err != nil {
+			return nil, err
+		}
+		ias, err := cert2issuerAndSerial(recipient)
+		if err != nil {
+			return nil, err
+		}
+		info := recipientInfo{
+			Version:               0,
+			IssuerAndSerialNumber: ias,
+			KeyEncryptionAlgorithm: pkix.AlgorithmIdentifier{
+				Algorithm: oidEncryptionAlgorithmRSA,
+			},
+			EncryptedKey: encrypted,
+		}
+		recipientInfos[i] = info
+	}
+
+	// Prepare envelope content
+	envelope := envelopedData{
+		EncryptedContentInfo: *eci,
+		Version:              0,
+		RecipientInfos:       recipientInfos,
+	}
+	innerContent, err := asn1.Marshal(envelope)
+	if err != nil {
+		return nil, err
+	}
+
+	// Prepare outer payload structure
+	wrapper := contentInfo{
+		ContentType: oidEnvelopedData,
+		Content:     asn1.RawValue{Class: 2, Tag: 0, IsCompound: true, Bytes: innerContent},
+	}
+
+	return asn1.Marshal(wrapper)
+}
+
+func marshalEncryptedContent(content []byte) asn1.RawValue {
+	asn1Content, _ := asn1.Marshal(content)
+	return asn1.RawValue{Tag: 0, Class: 2, Bytes: asn1Content, IsCompound: true}
+}
+
+func encryptKey(key []byte, recipient *x509.Certificate) ([]byte, error) {
+	if pub := recipient.PublicKey.(*rsa.PublicKey); pub != nil {
+		return rsa.EncryptPKCS1v15(rand.Reader, pub, key)
+	}
+	return nil, ErrUnsupportedAlgorithm
+}
diff --git a/vendor/github.com/fullsailor/pkcs7/x509.go b/vendor/github.com/fullsailor/pkcs7/x509.go
new file mode 100644
index 000000000..195fd0e4b
--- /dev/null
+++ b/vendor/github.com/fullsailor/pkcs7/x509.go
@@ -0,0 +1,133 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the go/golang LICENSE file.
+
+package pkcs7
+
+// These are private constants and functions from the crypto/x509 package that
+// are useful when dealing with signatures verified by x509 certificates
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+)
+
+var (
+	oidSignatureMD2WithRSA      = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 2}
+	oidSignatureMD5WithRSA      = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 4}
+	oidSignatureSHA1WithRSA     = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5}
+	oidSignatureSHA256WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 11}
+	oidSignatureSHA384WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 12}
+	oidSignatureSHA512WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 13}
+	oidSignatureRSAPSS          = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 10}
+	oidSignatureDSAWithSHA1     = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 3}
+	oidSignatureDSAWithSHA256   = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 3, 2}
+	oidSignatureECDSAWithSHA1   = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 1}
+	oidSignatureECDSAWithSHA256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 2}
+	oidSignatureECDSAWithSHA384 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 3}
+	oidSignatureECDSAWithSHA512 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 4}
+
+	oidSHA256 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 1}
+	oidSHA384 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 2}
+	oidSHA512 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 3}
+
+	oidMGF1 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 8}
+
+	// oidISOSignatureSHA1WithRSA means the same as oidSignatureSHA1WithRSA
+	// but it's specified by ISO. Microsoft's makecert.exe has been known
+	// to produce certificates with this OID.
+	oidISOSignatureSHA1WithRSA = asn1.ObjectIdentifier{1, 3, 14, 3, 2, 29}
+)
+
+var signatureAlgorithmDetails = []struct {
+	algo       x509.SignatureAlgorithm
+	name       string
+	oid        asn1.ObjectIdentifier
+	pubKeyAlgo x509.PublicKeyAlgorithm
+	hash       crypto.Hash
+}{
+	{x509.MD2WithRSA, "MD2-RSA", oidSignatureMD2WithRSA, x509.RSA, crypto.Hash(0) /* no value for MD2 */},
+	{x509.MD5WithRSA, "MD5-RSA", oidSignatureMD5WithRSA, x509.RSA, crypto.MD5},
+	{x509.SHA1WithRSA, "SHA1-RSA", oidSignatureSHA1WithRSA, x509.RSA, crypto.SHA1},
+	{x509.SHA1WithRSA, "SHA1-RSA", oidISOSignatureSHA1WithRSA, x509.RSA, crypto.SHA1},
+	{x509.SHA256WithRSA, "SHA256-RSA", oidSignatureSHA256WithRSA, x509.RSA, crypto.SHA256},
+	{x509.SHA384WithRSA, "SHA384-RSA", oidSignatureSHA384WithRSA, x509.RSA, crypto.SHA384},
+	{x509.SHA512WithRSA, "SHA512-RSA", oidSignatureSHA512WithRSA, x509.RSA, crypto.SHA512},
+	{x509.SHA256WithRSAPSS, "SHA256-RSAPSS", oidSignatureRSAPSS, x509.RSA, crypto.SHA256},
+	{x509.SHA384WithRSAPSS, "SHA384-RSAPSS", oidSignatureRSAPSS, x509.RSA, crypto.SHA384},
+	{x509.SHA512WithRSAPSS, "SHA512-RSAPSS", oidSignatureRSAPSS, x509.RSA, crypto.SHA512},
+	{x509.DSAWithSHA1, "DSA-SHA1", oidSignatureDSAWithSHA1, x509.DSA, crypto.SHA1},
+	{x509.DSAWithSHA256, "DSA-SHA256", oidSignatureDSAWithSHA256, x509.DSA, crypto.SHA256},
+	{x509.ECDSAWithSHA1, "ECDSA-SHA1", oidSignatureECDSAWithSHA1, x509.ECDSA, crypto.SHA1},
+	{x509.ECDSAWithSHA256, "ECDSA-SHA256", oidSignatureECDSAWithSHA256, x509.ECDSA, crypto.SHA256},
+	{x509.ECDSAWithSHA384, "ECDSA-SHA384", oidSignatureECDSAWithSHA384, x509.ECDSA, crypto.SHA384},
+	{x509.ECDSAWithSHA512, "ECDSA-SHA512", oidSignatureECDSAWithSHA512, x509.ECDSA, crypto.SHA512},
+}
+
+// pssParameters reflects the parameters in an AlgorithmIdentifier that
+// specifies RSA PSS. See https://tools.ietf.org/html/rfc3447#appendix-A.2.3
+type pssParameters struct {
+	// The following three fields are not marked as
+	// optional because the default values specify SHA-1,
+	// which is no longer suitable for use in signatures.
+	Hash         pkix.AlgorithmIdentifier `asn1:"explicit,tag:0"`
+	MGF          pkix.AlgorithmIdentifier `asn1:"explicit,tag:1"`
+	SaltLength   int                      `asn1:"explicit,tag:2"`
+	TrailerField int                      `asn1:"optional,explicit,tag:3,default:1"`
+}
+
+// asn1.NullBytes is not available prior to Go 1.9
+var nullBytes = []byte{5, 0}
+
+func getSignatureAlgorithmFromAI(ai pkix.AlgorithmIdentifier) x509.SignatureAlgorithm {
+	if !ai.Algorithm.Equal(oidSignatureRSAPSS) {
+		for _, details := range signatureAlgorithmDetails {
+			if ai.Algorithm.Equal(details.oid) {
+				return details.algo
+			}
+		}
+		return x509.UnknownSignatureAlgorithm
+	}
+
+	// RSA PSS is special because it encodes important parameters
+	// in the Parameters.
+
+	var params pssParameters
+	if _, err := asn1.Unmarshal(ai.Parameters.FullBytes, &params); err != nil {
+		return x509.UnknownSignatureAlgorithm
+	}
+
+	var mgf1HashFunc pkix.AlgorithmIdentifier
+	if _, err := asn1.Unmarshal(params.MGF.Parameters.FullBytes, &mgf1HashFunc); err != nil {
+		return x509.UnknownSignatureAlgorithm
+	}
+
+	// PSS is greatly overburdened with options. This code forces
+	// them into three buckets by requiring that the MGF1 hash
+	// function always match the message hash function (as
+	// recommended in
+	// https://tools.ietf.org/html/rfc3447#section-8.1), that the
+	// salt length matches the hash length, and that the trailer
+	// field has the default value.
+	if !bytes.Equal(params.Hash.Parameters.FullBytes, nullBytes) ||
+		!params.MGF.Algorithm.Equal(oidMGF1) ||
+		!mgf1HashFunc.Algorithm.Equal(params.Hash.Algorithm) ||
+		!bytes.Equal(mgf1HashFunc.Parameters.FullBytes, nullBytes) ||
+		params.TrailerField != 1 {
+		return x509.UnknownSignatureAlgorithm
+	}
+
+	switch {
+	case params.Hash.Algorithm.Equal(oidSHA256) && params.SaltLength == 32:
+		return x509.SHA256WithRSAPSS
+	case params.Hash.Algorithm.Equal(oidSHA384) && params.SaltLength == 48:
+		return x509.SHA384WithRSAPSS
+	case params.Hash.Algorithm.Equal(oidSHA512) && params.SaltLength == 64:
+		return x509.SHA512WithRSAPSS
+	}
+
+	return x509.UnknownSignatureAlgorithm
+}
diff --git a/vendor/github.com/imdario/mergo/.travis.yml b/vendor/github.com/imdario/mergo/.travis.yml
index b13a50ed1..dad29725f 100644
--- a/vendor/github.com/imdario/mergo/.travis.yml
+++ b/vendor/github.com/imdario/mergo/.travis.yml
@@ -4,4 +4,6 @@ install:
   - go get golang.org/x/tools/cmd/cover
   - go get github.com/mattn/goveralls
 script:
+  - go test -race -v ./...
+after_script:
   - $HOME/gopath/bin/goveralls -service=travis-ci -repotoken $COVERALLS_TOKEN
diff --git a/vendor/github.com/imdario/mergo/merge.go b/vendor/github.com/imdario/mergo/merge.go
index f8de6c543..3fb6c64d0 100644
--- a/vendor/github.com/imdario/mergo/merge.go
+++ b/vendor/github.com/imdario/mergo/merge.go
@@ -26,10 +26,12 @@ func hasExportedField(dst reflect.Value) (exported bool) {
 }
 
 type Config struct {
-	Overwrite               bool
-	AppendSlice             bool
-	Transformers            Transformers
-	overwriteWithEmptyValue bool
+	Overwrite                    bool
+	AppendSlice                  bool
+	TypeCheck                    bool
+	Transformers                 Transformers
+	overwriteWithEmptyValue      bool
+	overwriteSliceWithEmptyValue bool
 }
 
 type Transformers interface {
@@ -41,7 +43,9 @@ type Transformers interface {
 // short circuiting on recursive types.
 func deepMerge(dst, src reflect.Value, visited map[uintptr]*visit, depth int, config *Config) (err error) {
 	overwrite := config.Overwrite
+	typeCheck := config.TypeCheck
 	overwriteWithEmptySrc := config.overwriteWithEmptyValue
+	overwriteSliceWithEmptySrc := config.overwriteSliceWithEmptyValue
 	config.overwriteWithEmptyValue = false
 
 	if !src.IsValid() {
@@ -128,11 +132,14 @@ func deepMerge(dst, src reflect.Value, visited map[uintptr]*visit, depth int, co
 						dstSlice = reflect.ValueOf(dstElement.Interface())
 					}
 
-					if (!isEmptyValue(src) || overwriteWithEmptySrc) && (overwrite || isEmptyValue(dst)) && !config.AppendSlice {
+					if (!isEmptyValue(src) || overwriteWithEmptySrc || overwriteSliceWithEmptySrc) && (overwrite || isEmptyValue(dst)) && !config.AppendSlice {
+						if typeCheck && srcSlice.Type() != dstSlice.Type() {
+							return fmt.Errorf("cannot override two slices with different type (%s, %s)", srcSlice.Type(), dstSlice.Type())
+						}
 						dstSlice = srcSlice
 					} else if config.AppendSlice {
 						if srcSlice.Type() != dstSlice.Type() {
-							return fmt.Errorf("cannot append two slice with different type (%s, %s)", srcSlice.Type(), dstSlice.Type())
+							return fmt.Errorf("cannot append two slices with different type (%s, %s)", srcSlice.Type(), dstSlice.Type())
 						}
 						dstSlice = reflect.AppendSlice(dstSlice, srcSlice)
 					}
@@ -143,7 +150,7 @@ func deepMerge(dst, src reflect.Value, visited map[uintptr]*visit, depth int, co
 				continue
 			}
 
-			if srcElement.IsValid() && (overwrite || (!dstElement.IsValid() || isEmptyValue(dstElement))) {
+			if srcElement.IsValid() && ((srcElement.Kind() != reflect.Ptr && overwrite) || !dstElement.IsValid() || isEmptyValue(dstElement)) {
 				if dst.IsNil() {
 					dst.Set(reflect.MakeMap(dst.Type()))
 				}
@@ -154,7 +161,7 @@ func deepMerge(dst, src reflect.Value, visited map[uintptr]*visit, depth int, co
 		if !dst.CanSet() {
 			break
 		}
-		if (!isEmptyValue(src) || overwriteWithEmptySrc) && (overwrite || isEmptyValue(dst)) && !config.AppendSlice {
+		if (!isEmptyValue(src) || overwriteWithEmptySrc || overwriteSliceWithEmptySrc) && (overwrite || isEmptyValue(dst)) && !config.AppendSlice {
 			dst.Set(src)
 		} else if config.AppendSlice {
 			if src.Type() != dst.Type() {
@@ -168,11 +175,21 @@ func deepMerge(dst, src reflect.Value, visited map[uintptr]*visit, depth int, co
 		if src.IsNil() {
 			break
 		}
-		if src.Kind() != reflect.Interface {
+
+		if dst.Kind() != reflect.Ptr && src.Type().AssignableTo(dst.Type()) {
 			if dst.IsNil() || overwrite {
 				if dst.CanSet() && (overwrite || isEmptyValue(dst)) {
 					dst.Set(src)
 				}
+			}
+			break
+		}
+
+		if src.Kind() != reflect.Interface {
+			if dst.IsNil() || (src.Kind() != reflect.Ptr && overwrite) {
+				if dst.CanSet() && (overwrite || isEmptyValue(dst)) {
+					dst.Set(src)
+				}
 			} else if src.Kind() == reflect.Ptr {
 				if err = deepMerge(dst.Elem(), src.Elem(), visited, depth+1, config); err != nil {
 					return
@@ -198,6 +215,7 @@ func deepMerge(dst, src reflect.Value, visited map[uintptr]*visit, depth int, co
 			dst.Set(src)
 		}
 	}
+
 	return
 }
 
@@ -209,7 +227,7 @@ func Merge(dst, src interface{}, opts ...func(*Config)) error {
 	return merge(dst, src, opts...)
 }
 
-// MergeWithOverwrite will do the same as Merge except that non-empty dst attributes will be overriden by
+// MergeWithOverwrite will do the same as Merge except that non-empty dst attributes will be overridden by
 // non-empty src attribute values.
 // Deprecated: use Merge(…) with WithOverride
 func MergeWithOverwrite(dst, src interface{}, opts ...func(*Config)) error {
@@ -228,11 +246,21 @@ func WithOverride(config *Config) {
 	config.Overwrite = true
 }
 
-// WithAppendSlice will make merge append slices instead of overwriting it
+// WithOverride will make merge override empty dst slice with empty src slice.
+func WithOverrideEmptySlice(config *Config) {
+	config.overwriteSliceWithEmptyValue = true
+}
+
+// WithAppendSlice will make merge append slices instead of overwriting it.
 func WithAppendSlice(config *Config) {
 	config.AppendSlice = true
 }
 
+// WithTypeCheck will make merge check types while overwriting it (must be used with WithOverride).
+func WithTypeCheck(config *Config) {
+	config.TypeCheck = true
+}
+
 func merge(dst, src interface{}, opts ...func(*Config)) error {
 	var (
 		vDst, vSrc reflect.Value
diff --git a/vendor/github.com/mattn/go-isatty/.travis.yml b/vendor/github.com/mattn/go-isatty/.travis.yml
deleted file mode 100644
index 5597e026d..000000000
--- a/vendor/github.com/mattn/go-isatty/.travis.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-language: go
-go:
-  - tip
-
-os:
-  - linux
-  - osx
-
-before_install:
-  - go get github.com/mattn/goveralls
-  - go get golang.org/x/tools/cmd/cover
-script:
-  - $HOME/gopath/bin/goveralls -repotoken 3gHdORO5k5ziZcWMBxnd9LrMZaJs8m9x5
diff --git a/vendor/github.com/mattn/go-isatty/LICENSE b/vendor/github.com/mattn/go-isatty/LICENSE
deleted file mode 100644
index 65dc692b6..000000000
--- a/vendor/github.com/mattn/go-isatty/LICENSE
+++ /dev/null
@@ -1,9 +0,0 @@
-Copyright (c) Yasuhiro MATSUMOTO <mattn.jp@gmail.com>
-
-MIT License (Expat)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/vendor/github.com/mattn/go-isatty/README.md b/vendor/github.com/mattn/go-isatty/README.md
deleted file mode 100644
index 1e69004bb..000000000
--- a/vendor/github.com/mattn/go-isatty/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# go-isatty
-
-[![Godoc Reference](https://godoc.org/github.com/mattn/go-isatty?status.svg)](http://godoc.org/github.com/mattn/go-isatty)
-[![Build Status](https://travis-ci.org/mattn/go-isatty.svg?branch=master)](https://travis-ci.org/mattn/go-isatty)
-[![Coverage Status](https://coveralls.io/repos/github/mattn/go-isatty/badge.svg?branch=master)](https://coveralls.io/github/mattn/go-isatty?branch=master)
-[![Go Report Card](https://goreportcard.com/badge/mattn/go-isatty)](https://goreportcard.com/report/mattn/go-isatty)
-
-isatty for golang
-
-## Usage
-
-```go
-package main
-
-import (
-	"fmt"
-	"github.com/mattn/go-isatty"
-	"os"
-)
-
-func main() {
-	if isatty.IsTerminal(os.Stdout.Fd()) {
-		fmt.Println("Is Terminal")
-	} else if isatty.IsCygwinTerminal(os.Stdout.Fd()) {
-		fmt.Println("Is Cygwin/MSYS2 Terminal")
-	} else {
-		fmt.Println("Is Not Terminal")
-	}
-}
-```
-
-## Installation
-
-```
-$ go get github.com/mattn/go-isatty
-```
-
-## License
-
-MIT
-
-## Author
-
-Yasuhiro Matsumoto (a.k.a mattn)
-
-## Thanks
-
-* k-takata: base idea for IsCygwinTerminal
-
-    https://github.com/k-takata/go-iscygpty
diff --git a/vendor/github.com/mattn/go-isatty/doc.go b/vendor/github.com/mattn/go-isatty/doc.go
deleted file mode 100644
index 17d4f90eb..000000000
--- a/vendor/github.com/mattn/go-isatty/doc.go
+++ /dev/null
@@ -1,2 +0,0 @@
-// Package isatty implements interface to isatty
-package isatty
diff --git a/vendor/github.com/mattn/go-isatty/go.mod b/vendor/github.com/mattn/go-isatty/go.mod
deleted file mode 100644
index f310320c3..000000000
--- a/vendor/github.com/mattn/go-isatty/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/mattn/go-isatty
-
-require golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223
diff --git a/vendor/github.com/mattn/go-isatty/go.sum b/vendor/github.com/mattn/go-isatty/go.sum
deleted file mode 100644
index 426c8973c..000000000
--- a/vendor/github.com/mattn/go-isatty/go.sum
+++ /dev/null
@@ -1,2 +0,0 @@
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223 h1:DH4skfRX4EBpamg7iV4ZlCpblAHI6s6TDM39bFZumv8=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
diff --git a/vendor/github.com/mattn/go-isatty/isatty_android.go b/vendor/github.com/mattn/go-isatty/isatty_android.go
deleted file mode 100644
index d3567cb5b..000000000
--- a/vendor/github.com/mattn/go-isatty/isatty_android.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// +build android
-
-package isatty
-
-import (
-	"syscall"
-	"unsafe"
-)
-
-const ioctlReadTermios = syscall.TCGETS
-
-// IsTerminal return true if the file descriptor is terminal.
-func IsTerminal(fd uintptr) bool {
-	var termios syscall.Termios
-	_, _, err := syscall.Syscall6(syscall.SYS_IOCTL, fd, ioctlReadTermios, uintptr(unsafe.Pointer(&termios)), 0, 0, 0)
-	return err == 0
-}
-
-// IsCygwinTerminal return true if the file descriptor is a cygwin or msys2
-// terminal. This is also always false on this environment.
-func IsCygwinTerminal(fd uintptr) bool {
-	return false
-}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_bsd.go b/vendor/github.com/mattn/go-isatty/isatty_bsd.go
deleted file mode 100644
index 07e93039d..000000000
--- a/vendor/github.com/mattn/go-isatty/isatty_bsd.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// +build darwin freebsd openbsd netbsd dragonfly
-// +build !appengine
-
-package isatty
-
-import (
-	"syscall"
-	"unsafe"
-)
-
-const ioctlReadTermios = syscall.TIOCGETA
-
-// IsTerminal return true if the file descriptor is terminal.
-func IsTerminal(fd uintptr) bool {
-	var termios syscall.Termios
-	_, _, err := syscall.Syscall6(syscall.SYS_IOCTL, fd, ioctlReadTermios, uintptr(unsafe.Pointer(&termios)), 0, 0, 0)
-	return err == 0
-}
-
-// IsCygwinTerminal return true if the file descriptor is a cygwin or msys2
-// terminal. This is also always false on this environment.
-func IsCygwinTerminal(fd uintptr) bool {
-	return false
-}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_others.go b/vendor/github.com/mattn/go-isatty/isatty_others.go
deleted file mode 100644
index ff714a376..000000000
--- a/vendor/github.com/mattn/go-isatty/isatty_others.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// +build appengine js nacl
-
-package isatty
-
-// IsTerminal returns true if the file descriptor is terminal which
-// is always false on js and appengine classic which is a sandboxed PaaS.
-func IsTerminal(fd uintptr) bool {
-	return false
-}
-
-// IsCygwinTerminal() return true if the file descriptor is a cygwin or msys2
-// terminal. This is also always false on this environment.
-func IsCygwinTerminal(fd uintptr) bool {
-	return false
-}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_solaris.go b/vendor/github.com/mattn/go-isatty/isatty_solaris.go
deleted file mode 100644
index bdd5c79a0..000000000
--- a/vendor/github.com/mattn/go-isatty/isatty_solaris.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// +build solaris
-// +build !appengine
-
-package isatty
-
-import (
-	"golang.org/x/sys/unix"
-)
-
-// IsTerminal returns true if the given file descriptor is a terminal.
-// see: http://src.illumos.org/source/xref/illumos-gate/usr/src/lib/libbc/libc/gen/common/isatty.c
-func IsTerminal(fd uintptr) bool {
-	var termio unix.Termio
-	err := unix.IoctlSetTermio(int(fd), unix.TCGETA, &termio)
-	return err == nil
-}
-
-// IsCygwinTerminal return true if the file descriptor is a cygwin or msys2
-// terminal. This is also always false on this environment.
-func IsCygwinTerminal(fd uintptr) bool {
-	return false
-}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_tcgets.go b/vendor/github.com/mattn/go-isatty/isatty_tcgets.go
deleted file mode 100644
index 453b025d0..000000000
--- a/vendor/github.com/mattn/go-isatty/isatty_tcgets.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// +build linux aix
-// +build !appengine
-// +build !android
-
-package isatty
-
-import "golang.org/x/sys/unix"
-
-// IsTerminal return true if the file descriptor is terminal.
-func IsTerminal(fd uintptr) bool {
-	_, err := unix.IoctlGetTermios(int(fd), unix.TCGETS)
-	return err == nil
-}
-
-// IsCygwinTerminal return true if the file descriptor is a cygwin or msys2
-// terminal. This is also always false on this environment.
-func IsCygwinTerminal(fd uintptr) bool {
-	return false
-}
diff --git a/vendor/github.com/mattn/go-isatty/isatty_windows.go b/vendor/github.com/mattn/go-isatty/isatty_windows.go
deleted file mode 100644
index af51cbcaa..000000000
--- a/vendor/github.com/mattn/go-isatty/isatty_windows.go
+++ /dev/null
@@ -1,94 +0,0 @@
-// +build windows
-// +build !appengine
-
-package isatty
-
-import (
-	"strings"
-	"syscall"
-	"unicode/utf16"
-	"unsafe"
-)
-
-const (
-	fileNameInfo uintptr = 2
-	fileTypePipe         = 3
-)
-
-var (
-	kernel32                         = syscall.NewLazyDLL("kernel32.dll")
-	procGetConsoleMode               = kernel32.NewProc("GetConsoleMode")
-	procGetFileInformationByHandleEx = kernel32.NewProc("GetFileInformationByHandleEx")
-	procGetFileType                  = kernel32.NewProc("GetFileType")
-)
-
-func init() {
-	// Check if GetFileInformationByHandleEx is available.
-	if procGetFileInformationByHandleEx.Find() != nil {
-		procGetFileInformationByHandleEx = nil
-	}
-}
-
-// IsTerminal return true if the file descriptor is terminal.
-func IsTerminal(fd uintptr) bool {
-	var st uint32
-	r, _, e := syscall.Syscall(procGetConsoleMode.Addr(), 2, fd, uintptr(unsafe.Pointer(&st)), 0)
-	return r != 0 && e == 0
-}
-
-// Check pipe name is used for cygwin/msys2 pty.
-// Cygwin/MSYS2 PTY has a name like:
-//   \{cygwin,msys}-XXXXXXXXXXXXXXXX-ptyN-{from,to}-master
-func isCygwinPipeName(name string) bool {
-	token := strings.Split(name, "-")
-	if len(token) < 5 {
-		return false
-	}
-
-	if token[0] != `\msys` && token[0] != `\cygwin` {
-		return false
-	}
-
-	if token[1] == "" {
-		return false
-	}
-
-	if !strings.HasPrefix(token[2], "pty") {
-		return false
-	}
-
-	if token[3] != `from` && token[3] != `to` {
-		return false
-	}
-
-	if token[4] != "master" {
-		return false
-	}
-
-	return true
-}
-
-// IsCygwinTerminal() return true if the file descriptor is a cygwin or msys2
-// terminal.
-func IsCygwinTerminal(fd uintptr) bool {
-	if procGetFileInformationByHandleEx == nil {
-		return false
-	}
-
-	// Cygwin/msys's pty is a pipe.
-	ft, _, e := syscall.Syscall(procGetFileType.Addr(), 1, fd, 0, 0)
-	if ft != fileTypePipe || e != 0 {
-		return false
-	}
-
-	var buf [2 + syscall.MAX_PATH]uint16
-	r, _, e := syscall.Syscall6(procGetFileInformationByHandleEx.Addr(),
-		4, fd, fileNameInfo, uintptr(unsafe.Pointer(&buf)),
-		uintptr(len(buf)*2), 0, 0)
-	if r == 0 || e != 0 {
-		return false
-	}
-
-	l := *(*uint32)(unsafe.Pointer(&buf))
-	return isCygwinPipeName(string(utf16.Decode(buf[2 : 2+l/2])))
-}
diff --git a/vendor/github.com/vbauerster/mpb/.travis.yml b/vendor/github.com/vbauerster/mpb/.travis.yml
deleted file mode 100644
index c982d1f90..000000000
--- a/vendor/github.com/vbauerster/mpb/.travis.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-language: go
-sudo: false
-go:
-  - 1.10.x
-  - tip
-
-before_install:
-  - go get -t -v ./...
-
-script:
-  - go test -race -coverprofile=coverage.txt -covermode=atomic
-
-after_success:
-  - bash <(curl -s https://codecov.io/bash)
diff --git a/vendor/github.com/vbauerster/mpb/LICENSE b/vendor/github.com/vbauerster/mpb/LICENSE
deleted file mode 100644
index 5e68ed21e..000000000
--- a/vendor/github.com/vbauerster/mpb/LICENSE
+++ /dev/null
@@ -1,29 +0,0 @@
-BSD 3-Clause License
-
-Copyright (C) 2016-2018 Vladimir Bauer
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
-
-* Redistributions in binary form must reproduce the above copyright notice,
-  this list of conditions and the following disclaimer in the documentation
-  and/or other materials provided with the distribution.
-
-* Neither the name of the copyright holder nor the names of its
-  contributors may be used to endorse or promote products derived from
-  this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/vbauerster/mpb/bar.go b/vendor/github.com/vbauerster/mpb/bar.go
deleted file mode 100644
index a304a87cb..000000000
--- a/vendor/github.com/vbauerster/mpb/bar.go
+++ /dev/null
@@ -1,399 +0,0 @@
-package mpb
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"strings"
-	"sync"
-	"time"
-	"unicode/utf8"
-
-	"github.com/vbauerster/mpb/decor"
-)
-
-// Bar represents a progress Bar
-type Bar struct {
-	priority int
-	index    int
-
-	runningBar    *Bar
-	cacheState    *bState
-	operateState  chan func(*bState)
-	int64Ch       chan int64
-	boolCh        chan bool
-	frameReaderCh chan *frameReader
-	syncTableCh   chan [][]chan int
-
-	// done is closed by Bar's goroutine, after cacheState is written
-	done chan struct{}
-	// shutdown is closed from master Progress goroutine only
-	shutdown chan struct{}
-}
-
-// Filler interface.
-// Bar renders by calling Filler's Fill method. You can literally have
-// any bar kind, by implementing this interface and passing it to the
-// Add method.
-type Filler interface {
-	Fill(w io.Writer, width int, s *decor.Statistics)
-}
-
-// FillerFunc is function type adapter to convert function into Filler.
-type FillerFunc func(w io.Writer, width int, stat *decor.Statistics)
-
-func (f FillerFunc) Fill(w io.Writer, width int, stat *decor.Statistics) {
-	f(w, width, stat)
-}
-
-type (
-	bState struct {
-		filler             Filler
-		id                 int
-		width              int
-		alignment          int
-		total              int64
-		current            int64
-		trimSpace          bool
-		toComplete         bool
-		removeOnComplete   bool
-		barClearOnComplete bool
-		completeFlushed    bool
-		aDecorators        []decor.Decorator
-		pDecorators        []decor.Decorator
-		amountReceivers    []decor.AmountReceiver
-		shutdownListeners  []decor.ShutdownListener
-		refill             *refill
-		bufP, bufB, bufA   *bytes.Buffer
-		bufNL              *bytes.Buffer
-		panicMsg           string
-		newLineExtendFn    func(io.Writer, *decor.Statistics)
-
-		// following options are assigned to the *Bar
-		priority   int
-		runningBar *Bar
-	}
-	refill struct {
-		r     rune
-		limit int64
-	}
-	frameReader struct {
-		io.Reader
-		extendedLines    int
-		toShutdown       bool
-		removeOnComplete bool
-	}
-)
-
-func newBar(
-	ctx context.Context,
-	wg *sync.WaitGroup,
-	filler Filler,
-	id, width int,
-	total int64,
-	options ...BarOption,
-) *Bar {
-
-	s := &bState{
-		filler:   filler,
-		id:       id,
-		priority: id,
-		width:    width,
-		total:    total,
-	}
-
-	for _, opt := range options {
-		if opt != nil {
-			opt(s)
-		}
-	}
-
-	s.bufP = bytes.NewBuffer(make([]byte, 0, s.width))
-	s.bufB = bytes.NewBuffer(make([]byte, 0, s.width))
-	s.bufA = bytes.NewBuffer(make([]byte, 0, s.width))
-	if s.newLineExtendFn != nil {
-		s.bufNL = bytes.NewBuffer(make([]byte, 0, s.width))
-	}
-
-	b := &Bar{
-		priority:      s.priority,
-		runningBar:    s.runningBar,
-		operateState:  make(chan func(*bState)),
-		int64Ch:       make(chan int64),
-		boolCh:        make(chan bool),
-		frameReaderCh: make(chan *frameReader, 1),
-		syncTableCh:   make(chan [][]chan int),
-		done:          make(chan struct{}),
-		shutdown:      make(chan struct{}),
-	}
-
-	if b.runningBar != nil {
-		b.priority = b.runningBar.priority
-	}
-
-	go b.serve(ctx, wg, s)
-	return b
-}
-
-// RemoveAllPrependers removes all prepend functions.
-func (b *Bar) RemoveAllPrependers() {
-	select {
-	case b.operateState <- func(s *bState) { s.pDecorators = nil }:
-	case <-b.done:
-	}
-}
-
-// RemoveAllAppenders removes all append functions.
-func (b *Bar) RemoveAllAppenders() {
-	select {
-	case b.operateState <- func(s *bState) { s.aDecorators = nil }:
-	case <-b.done:
-	}
-}
-
-// ProxyReader wraps r with metrics required for progress tracking.
-func (b *Bar) ProxyReader(r io.Reader) io.ReadCloser {
-	if r == nil {
-		panic("expect io.Reader, got nil")
-	}
-	rc, ok := r.(io.ReadCloser)
-	if !ok {
-		rc = ioutil.NopCloser(r)
-	}
-	return &proxyReader{rc, b, time.Now()}
-}
-
-// ID returs id of the bar.
-func (b *Bar) ID() int {
-	select {
-	case b.operateState <- func(s *bState) { b.int64Ch <- int64(s.id) }:
-		return int(<-b.int64Ch)
-	case <-b.done:
-		return b.cacheState.id
-	}
-}
-
-// Current returns bar's current number, in other words sum of all increments.
-func (b *Bar) Current() int64 {
-	select {
-	case b.operateState <- func(s *bState) { b.int64Ch <- s.current }:
-		return <-b.int64Ch
-	case <-b.done:
-		return b.cacheState.current
-	}
-}
-
-// SetTotal sets total dynamically.
-// Set complete to true, to trigger bar complete event now.
-func (b *Bar) SetTotal(total int64, complete bool) {
-	select {
-	case b.operateState <- func(s *bState) {
-		s.total = total
-		if complete && !s.toComplete {
-			s.current = s.total
-			s.toComplete = true
-		}
-	}:
-	case <-b.done:
-	}
-}
-
-// SetRefill sets refill, if supported by underlying Filler.
-func (b *Bar) SetRefill(amount int64) {
-	b.operateState <- func(s *bState) {
-		if f, ok := s.filler.(interface{ SetRefill(int64) }); ok {
-			f.SetRefill(amount)
-		}
-	}
-}
-
-// Increment is a shorthand for b.IncrBy(1).
-func (b *Bar) Increment() {
-	b.IncrBy(1)
-}
-
-// IncrBy increments progress bar by amount of n.
-// wdd is optional work duration i.e. time.Since(start), which expected
-// to be provided, if any ewma based decorator is used.
-func (b *Bar) IncrBy(n int, wdd ...time.Duration) {
-	select {
-	case b.operateState <- func(s *bState) {
-		s.current += int64(n)
-		if s.total > 0 && s.current >= s.total {
-			s.current = s.total
-			s.toComplete = true
-		}
-		for _, ar := range s.amountReceivers {
-			ar.NextAmount(n, wdd...)
-		}
-	}:
-	case <-b.done:
-	}
-}
-
-// Completed reports whether the bar is in completed state.
-func (b *Bar) Completed() bool {
-	// omit select here, because primary usage of the method is for loop
-	// condition, like for !bar.Completed() {...} so when toComplete=true
-	// it is called once (at which time, the bar is still alive), then
-	// quits the loop and never suppose to be called afterwards.
-	return <-b.boolCh
-}
-
-func (b *Bar) wSyncTable() [][]chan int {
-	select {
-	case b.operateState <- func(s *bState) { b.syncTableCh <- s.wSyncTable() }:
-		return <-b.syncTableCh
-	case <-b.done:
-		return b.cacheState.wSyncTable()
-	}
-}
-
-func (b *Bar) serve(ctx context.Context, wg *sync.WaitGroup, s *bState) {
-	defer wg.Done()
-	cancel := ctx.Done()
-	for {
-		select {
-		case op := <-b.operateState:
-			op(s)
-		case b.boolCh <- s.toComplete:
-		case <-cancel:
-			s.toComplete = true
-			cancel = nil
-		case <-b.shutdown:
-			b.cacheState = s
-			close(b.done)
-			for _, sl := range s.shutdownListeners {
-				sl.Shutdown()
-			}
-			return
-		}
-	}
-}
-
-func (b *Bar) render(debugOut io.Writer, tw int) {
-	select {
-	case b.operateState <- func(s *bState) {
-		defer func() {
-			// recovering if user defined decorator panics for example
-			if p := recover(); p != nil {
-				s.panicMsg = fmt.Sprintf("panic: %v", p)
-				fmt.Fprintf(debugOut, "%s %s bar id %02d %v\n", "[mpb]", time.Now(), s.id, s.panicMsg)
-				b.frameReaderCh <- &frameReader{
-					Reader:     strings.NewReader(fmt.Sprintf(fmt.Sprintf("%%.%ds\n", tw), s.panicMsg)),
-					toShutdown: true,
-				}
-			}
-		}()
-		r := s.draw(tw)
-		var extendedLines int
-		if s.newLineExtendFn != nil {
-			s.bufNL.Reset()
-			s.newLineExtendFn(s.bufNL, newStatistics(s))
-			extendedLines = countLines(s.bufNL.Bytes())
-			r = io.MultiReader(r, s.bufNL)
-		}
-		b.frameReaderCh <- &frameReader{
-			Reader:           r,
-			extendedLines:    extendedLines,
-			toShutdown:       s.toComplete && !s.completeFlushed,
-			removeOnComplete: s.removeOnComplete,
-		}
-		s.completeFlushed = s.toComplete
-	}:
-	case <-b.done:
-		s := b.cacheState
-		r := s.draw(tw)
-		var extendedLines int
-		if s.newLineExtendFn != nil {
-			s.bufNL.Reset()
-			s.newLineExtendFn(s.bufNL, newStatistics(s))
-			extendedLines = countLines(s.bufNL.Bytes())
-			r = io.MultiReader(r, s.bufNL)
-		}
-		b.frameReaderCh <- &frameReader{
-			Reader:        r,
-			extendedLines: extendedLines,
-		}
-	}
-}
-
-func (s *bState) draw(termWidth int) io.Reader {
-	if s.panicMsg != "" {
-		return strings.NewReader(fmt.Sprintf(fmt.Sprintf("%%.%ds\n", termWidth), s.panicMsg))
-	}
-
-	stat := newStatistics(s)
-
-	for _, d := range s.pDecorators {
-		s.bufP.WriteString(d.Decor(stat))
-	}
-
-	for _, d := range s.aDecorators {
-		s.bufA.WriteString(d.Decor(stat))
-	}
-
-	if s.barClearOnComplete && s.completeFlushed {
-		s.bufA.WriteByte('\n')
-		return io.MultiReader(s.bufP, s.bufA)
-	}
-
-	prependCount := utf8.RuneCount(s.bufP.Bytes())
-	appendCount := utf8.RuneCount(s.bufA.Bytes())
-
-	if !s.trimSpace {
-		// reserve space for edge spaces
-		termWidth -= 2
-		s.bufB.WriteByte(' ')
-	}
-
-	if prependCount+s.width+appendCount > termWidth {
-		s.filler.Fill(s.bufB, termWidth-prependCount-appendCount, stat)
-	} else {
-		s.filler.Fill(s.bufB, s.width, stat)
-	}
-
-	if !s.trimSpace {
-		s.bufB.WriteByte(' ')
-	}
-
-	s.bufA.WriteByte('\n')
-	return io.MultiReader(s.bufP, s.bufB, s.bufA)
-}
-
-func (s *bState) wSyncTable() [][]chan int {
-	columns := make([]chan int, 0, len(s.pDecorators)+len(s.aDecorators))
-	var pCount int
-	for _, d := range s.pDecorators {
-		if ok, ch := d.Syncable(); ok {
-			columns = append(columns, ch)
-			pCount++
-		}
-	}
-	var aCount int
-	for _, d := range s.aDecorators {
-		if ok, ch := d.Syncable(); ok {
-			columns = append(columns, ch)
-			aCount++
-		}
-	}
-	table := make([][]chan int, 2)
-	table[0] = columns[0:pCount]
-	table[1] = columns[pCount : pCount+aCount : pCount+aCount]
-	return table
-}
-
-func newStatistics(s *bState) *decor.Statistics {
-	return &decor.Statistics{
-		ID:        s.id,
-		Completed: s.completeFlushed,
-		Total:     s.total,
-		Current:   s.current,
-	}
-}
-
-func countLines(b []byte) int {
-	return bytes.Count(b, []byte("\n"))
-}
diff --git a/vendor/github.com/vbauerster/mpb/bar_filler.go b/vendor/github.com/vbauerster/mpb/bar_filler.go
deleted file mode 100644
index 4e9285ca5..000000000
--- a/vendor/github.com/vbauerster/mpb/bar_filler.go
+++ /dev/null
@@ -1,111 +0,0 @@
-package mpb
-
-import (
-	"io"
-	"unicode/utf8"
-
-	"github.com/vbauerster/mpb/decor"
-	"github.com/vbauerster/mpb/internal"
-)
-
-const (
-	rLeft = iota
-	rFill
-	rTip
-	rEmpty
-	rRight
-	rRevTip
-	rRefill
-)
-
-var defaultBarStyle = "[=>-]<+"
-
-type barFiller struct {
-	format       [][]byte
-	refillAmount int64
-	reverse      bool
-}
-
-func newDefaultBarFiller() Filler {
-	bf := &barFiller{
-		format: make([][]byte, utf8.RuneCountInString(defaultBarStyle)),
-	}
-	bf.setStyle(defaultBarStyle)
-	return bf
-}
-
-func (s *barFiller) setStyle(style string) {
-	if !utf8.ValidString(style) {
-		return
-	}
-	src := make([][]byte, 0, utf8.RuneCountInString(style))
-	for _, r := range style {
-		src = append(src, []byte(string(r)))
-	}
-	copy(s.format, src)
-}
-
-func (s *barFiller) setReverse() {
-	s.reverse = true
-}
-
-func (s *barFiller) SetRefill(amount int64) {
-	s.refillAmount = amount
-}
-
-func (s *barFiller) Fill(w io.Writer, width int, stat *decor.Statistics) {
-
-	// don't count rLeft and rRight [brackets]
-	width -= 2
-	if width < 2 {
-		return
-	}
-
-	w.Write(s.format[rLeft])
-	if width == 2 {
-		w.Write(s.format[rRight])
-		return
-	}
-
-	bb := make([][]byte, width)
-
-	cwidth := int(internal.Percentage(stat.Total, stat.Current, int64(width)))
-
-	for i := 0; i < cwidth; i++ {
-		bb[i] = s.format[rFill]
-	}
-
-	if s.refillAmount > 0 {
-		var rwidth int
-		if s.refillAmount > stat.Current {
-			rwidth = cwidth
-		} else {
-			rwidth = int(internal.Percentage(stat.Total, int64(s.refillAmount), int64(width)))
-		}
-		for i := 0; i < rwidth; i++ {
-			bb[i] = s.format[rRefill]
-		}
-	}
-
-	if cwidth > 0 && cwidth < width {
-		bb[cwidth-1] = s.format[rTip]
-	}
-
-	for i := cwidth; i < width; i++ {
-		bb[i] = s.format[rEmpty]
-	}
-
-	if s.reverse {
-		if cwidth > 0 && cwidth < width {
-			bb[cwidth-1] = s.format[rRevTip]
-		}
-		for i := len(bb) - 1; i >= 0; i-- {
-			w.Write(bb[i])
-		}
-	} else {
-		for i := 0; i < len(bb); i++ {
-			w.Write(bb[i])
-		}
-	}
-	w.Write(s.format[rRight])
-}
diff --git a/vendor/github.com/vbauerster/mpb/bar_option.go b/vendor/github.com/vbauerster/mpb/bar_option.go
deleted file mode 100644
index e9a4bd2a7..000000000
--- a/vendor/github.com/vbauerster/mpb/bar_option.go
+++ /dev/null
@@ -1,193 +0,0 @@
-package mpb
-
-import (
-	"io"
-
-	"github.com/vbauerster/mpb/decor"
-)
-
-// BarOption is a function option which changes the default behavior of a bar.
-type BarOption func(*bState)
-
-// AppendDecorators let you inject decorators to the bar's right side.
-func AppendDecorators(appenders ...decor.Decorator) BarOption {
-	return func(s *bState) {
-		for _, decorator := range appenders {
-			if ar, ok := decorator.(decor.AmountReceiver); ok {
-				s.amountReceivers = append(s.amountReceivers, ar)
-			}
-			if sl, ok := decorator.(decor.ShutdownListener); ok {
-				s.shutdownListeners = append(s.shutdownListeners, sl)
-			}
-			s.aDecorators = append(s.aDecorators, decorator)
-		}
-	}
-}
-
-// PrependDecorators let you inject decorators to the bar's left side.
-func PrependDecorators(prependers ...decor.Decorator) BarOption {
-	return func(s *bState) {
-		for _, decorator := range prependers {
-			if ar, ok := decorator.(decor.AmountReceiver); ok {
-				s.amountReceivers = append(s.amountReceivers, ar)
-			}
-			if sl, ok := decorator.(decor.ShutdownListener); ok {
-				s.shutdownListeners = append(s.shutdownListeners, sl)
-			}
-			s.pDecorators = append(s.pDecorators, decorator)
-		}
-	}
-}
-
-// BarID sets bar id.
-func BarID(id int) BarOption {
-	return func(s *bState) {
-		s.id = id
-	}
-}
-
-// BarWidth sets bar width independent of the container.
-func BarWidth(width int) BarOption {
-	return func(s *bState) {
-		s.width = width
-	}
-}
-
-// BarRemoveOnComplete is a flag, if set whole bar line will be removed
-// on complete event. If both BarRemoveOnComplete and BarClearOnComplete
-// are set, first bar section gets cleared and then whole bar line
-// gets removed completely.
-func BarRemoveOnComplete() BarOption {
-	return func(s *bState) {
-		s.removeOnComplete = true
-	}
-}
-
-// BarReplaceOnComplete is indicator for delayed bar start, after the
-// `runningBar` is complete. To achieve bar replacement effect,
-// `runningBar` should has its `BarRemoveOnComplete` option set.
-func BarReplaceOnComplete(runningBar *Bar) BarOption {
-	return BarParkTo(runningBar)
-}
-
-// BarParkTo same as BarReplaceOnComplete
-func BarParkTo(runningBar *Bar) BarOption {
-	return func(s *bState) {
-		s.runningBar = runningBar
-	}
-}
-
-// BarClearOnComplete is a flag, if set will clear bar section on
-// complete event. If you need to remove a whole bar line, refer to
-// BarRemoveOnComplete.
-func BarClearOnComplete() BarOption {
-	return func(s *bState) {
-		s.barClearOnComplete = true
-	}
-}
-
-// BarPriority sets bar's priority. Zero is highest priority, i.e. bar
-// will be on top. If `BarReplaceOnComplete` option is supplied, this
-// option is ignored.
-func BarPriority(priority int) BarOption {
-	return func(s *bState) {
-		s.priority = priority
-	}
-}
-
-// BarNewLineExtend takes user defined efn, which gets called each
-// render cycle. Any write to provided writer of efn, will appear on
-// new line of respective bar.
-func BarNewLineExtend(efn func(io.Writer, *decor.Statistics)) BarOption {
-	return func(s *bState) {
-		s.newLineExtendFn = efn
-	}
-}
-
-// TrimSpace trims bar's edge spaces.
-func TrimSpace() BarOption {
-	return func(s *bState) {
-		s.trimSpace = true
-	}
-}
-
-// BarStyle sets custom bar style, default one is "[=>-]<+".
-//
-//	'[' left bracket rune
-//
-//	'=' fill rune
-//
-//	'>' tip rune
-//
-//	'-' empty rune
-//
-//	']' right bracket rune
-//
-//	'<' reverse tip rune, used when BarReverse option is set
-//
-//	'+' refill rune, used when *Bar.SetRefill(int64) is called
-//
-// It's ok to provide first five runes only, for example mpb.BarStyle("╢▌▌░╟")
-func BarStyle(style string) BarOption {
-	chk := func(filler Filler) (interface{}, bool) {
-		if style == "" {
-			return nil, false
-		}
-		t, ok := filler.(*barFiller)
-		return t, ok
-	}
-	cb := func(t interface{}) {
-		t.(*barFiller).setStyle(style)
-	}
-	return MakeFillerTypeSpecificBarOption(chk, cb)
-}
-
-// BarReverse reverse mode, bar will progress from right to left.
-func BarReverse() BarOption {
-	chk := func(filler Filler) (interface{}, bool) {
-		t, ok := filler.(*barFiller)
-		return t, ok
-	}
-	cb := func(t interface{}) {
-		t.(*barFiller).setReverse()
-	}
-	return MakeFillerTypeSpecificBarOption(chk, cb)
-}
-
-// SpinnerStyle sets custom spinner style.
-// Effective when Filler type is spinner.
-func SpinnerStyle(frames []string) BarOption {
-	chk := func(filler Filler) (interface{}, bool) {
-		if len(frames) == 0 {
-			return nil, false
-		}
-		t, ok := filler.(*spinnerFiller)
-		return t, ok
-	}
-	cb := func(t interface{}) {
-		t.(*spinnerFiller).frames = frames
-	}
-	return MakeFillerTypeSpecificBarOption(chk, cb)
-}
-
-// MakeFillerTypeSpecificBarOption makes BarOption specific to Filler's
-// actual type. If you implement your own Filler, so most probably
-// you'll need this. See BarStyle or SpinnerStyle for example.
-func MakeFillerTypeSpecificBarOption(
-	typeChecker func(Filler) (interface{}, bool),
-	cb func(interface{}),
-) BarOption {
-	return func(s *bState) {
-		if t, ok := typeChecker(s.filler); ok {
-			cb(t)
-		}
-	}
-}
-
-// OptionOnCondition returns option when condition evaluates to true.
-func OptionOnCondition(option BarOption, condition func() bool) BarOption {
-	if condition() {
-		return option
-	}
-	return nil
-}
diff --git a/vendor/github.com/vbauerster/mpb/cwriter/writer_posix.go b/vendor/github.com/vbauerster/mpb/cwriter/writer_posix.go
deleted file mode 100644
index 05e31c480..000000000
--- a/vendor/github.com/vbauerster/mpb/cwriter/writer_posix.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// +build !windows
-
-package cwriter
-
-import (
-	"io"
-	"strings"
-)
-
-func (w *Writer) clearLines() error {
-	_, err := io.WriteString(w.out, strings.Repeat(clearCursorAndLine, w.lineCount))
-	return err
-}
diff --git a/vendor/github.com/vbauerster/mpb/cwriter/writer_windows.go b/vendor/github.com/vbauerster/mpb/cwriter/writer_windows.go
deleted file mode 100644
index 747a63484..000000000
--- a/vendor/github.com/vbauerster/mpb/cwriter/writer_windows.go
+++ /dev/null
@@ -1,77 +0,0 @@
-// +build windows
-
-package cwriter
-
-import (
-	"io"
-	"strings"
-	"syscall"
-	"unsafe"
-
-	isatty "github.com/mattn/go-isatty"
-)
-
-var kernel32 = syscall.NewLazyDLL("kernel32.dll")
-
-var (
-	procGetConsoleScreenBufferInfo = kernel32.NewProc("GetConsoleScreenBufferInfo")
-	procSetConsoleCursorPosition   = kernel32.NewProc("SetConsoleCursorPosition")
-	procFillConsoleOutputCharacter = kernel32.NewProc("FillConsoleOutputCharacterW")
-	procFillConsoleOutputAttribute = kernel32.NewProc("FillConsoleOutputAttribute")
-)
-
-type (
-	short int16
-	word  uint16
-	dword uint32
-
-	coord struct {
-		x short
-		y short
-	}
-	smallRect struct {
-		left   short
-		top    short
-		right  short
-		bottom short
-	}
-	consoleScreenBufferInfo struct {
-		size              coord
-		cursorPosition    coord
-		attributes        word
-		window            smallRect
-		maximumWindowSize coord
-	}
-)
-
-// FdWriter is a writer with a file descriptor.
-type FdWriter interface {
-	io.Writer
-	Fd() uintptr
-}
-
-func (w *Writer) clearLines() error {
-	f, ok := w.out.(FdWriter)
-	if ok && !isatty.IsTerminal(f.Fd()) {
-		_, err := io.WriteString(w.out, strings.Repeat(clearCursorAndLine, w.lineCount))
-		return err
-	}
-	fd := f.Fd()
-	var info consoleScreenBufferInfo
-	procGetConsoleScreenBufferInfo.Call(fd, uintptr(unsafe.Pointer(&info)))
-
-	for i := 0; i < w.lineCount; i++ {
-		// move the cursor up
-		info.cursorPosition.y--
-		procSetConsoleCursorPosition.Call(fd, uintptr(*(*int32)(unsafe.Pointer(&info.cursorPosition))))
-		// clear the line
-		cursor := coord{
-			x: info.window.left,
-			y: info.window.top + info.cursorPosition.y,
-		}
-		var count, w dword
-		count = dword(info.size.x)
-		procFillConsoleOutputCharacter.Call(fd, uintptr(' '), uintptr(count), *(*uintptr)(unsafe.Pointer(&cursor)), uintptr(unsafe.Pointer(&w)))
-	}
-	return nil
-}
diff --git a/vendor/github.com/vbauerster/mpb/decor/counters.go b/vendor/github.com/vbauerster/mpb/decor/counters.go
deleted file mode 100644
index 7d581eefb..000000000
--- a/vendor/github.com/vbauerster/mpb/decor/counters.go
+++ /dev/null
@@ -1,208 +0,0 @@
-package decor
-
-import (
-	"fmt"
-	"io"
-	"strconv"
-	"strings"
-)
-
-const (
-	_   = iota
-	KiB = 1 << (iota * 10)
-	MiB
-	GiB
-	TiB
-)
-
-const (
-	KB = 1000
-	MB = KB * 1000
-	GB = MB * 1000
-	TB = GB * 1000
-)
-
-const (
-	_ = iota
-	UnitKiB
-	UnitKB
-)
-
-type CounterKiB int64
-
-func (c CounterKiB) Format(st fmt.State, verb rune) {
-	prec, ok := st.Precision()
-
-	if verb == 'd' || !ok {
-		prec = 0
-	}
-	if verb == 'f' && !ok {
-		prec = 6
-	}
-	// retain old beahavior if s verb used
-	if verb == 's' {
-		prec = 1
-	}
-
-	var res, unit string
-	switch {
-	case c >= TiB:
-		unit = "TiB"
-		res = strconv.FormatFloat(float64(c)/TiB, 'f', prec, 64)
-	case c >= GiB:
-		unit = "GiB"
-		res = strconv.FormatFloat(float64(c)/GiB, 'f', prec, 64)
-	case c >= MiB:
-		unit = "MiB"
-		res = strconv.FormatFloat(float64(c)/MiB, 'f', prec, 64)
-	case c >= KiB:
-		unit = "KiB"
-		res = strconv.FormatFloat(float64(c)/KiB, 'f', prec, 64)
-	default:
-		unit = "b"
-		res = strconv.FormatInt(int64(c), 10)
-	}
-
-	if st.Flag(' ') {
-		res += " "
-	}
-	res += unit
-
-	if w, ok := st.Width(); ok {
-		if len(res) < w {
-			pad := strings.Repeat(" ", w-len(res))
-			if st.Flag(int('-')) {
-				res += pad
-			} else {
-				res = pad + res
-			}
-		}
-	}
-
-	io.WriteString(st, res)
-}
-
-type CounterKB int64
-
-func (c CounterKB) Format(st fmt.State, verb rune) {
-	prec, ok := st.Precision()
-
-	if verb == 'd' || !ok {
-		prec = 0
-	}
-	if verb == 'f' && !ok {
-		prec = 6
-	}
-	// retain old beahavior if s verb used
-	if verb == 's' {
-		prec = 1
-	}
-
-	var res, unit string
-	switch {
-	case c >= TB:
-		unit = "TB"
-		res = strconv.FormatFloat(float64(c)/TB, 'f', prec, 64)
-	case c >= GB:
-		unit = "GB"
-		res = strconv.FormatFloat(float64(c)/GB, 'f', prec, 64)
-	case c >= MB:
-		unit = "MB"
-		res = strconv.FormatFloat(float64(c)/MB, 'f', prec, 64)
-	case c >= KB:
-		unit = "kB"
-		res = strconv.FormatFloat(float64(c)/KB, 'f', prec, 64)
-	default:
-		unit = "b"
-		res = strconv.FormatInt(int64(c), 10)
-	}
-
-	if st.Flag(' ') {
-		res += " "
-	}
-	res += unit
-
-	if w, ok := st.Width(); ok {
-		if len(res) < w {
-			pad := strings.Repeat(" ", w-len(res))
-			if st.Flag(int('-')) {
-				res += pad
-			} else {
-				res = pad + res
-			}
-		}
-	}
-
-	io.WriteString(st, res)
-}
-
-// CountersNoUnit is a wrapper around Counters with no unit param.
-func CountersNoUnit(pairFormat string, wcc ...WC) Decorator {
-	return Counters(0, pairFormat, wcc...)
-}
-
-// CountersKibiByte is a wrapper around Counters with predefined unit
-// UnitKiB (bytes/1024).
-func CountersKibiByte(pairFormat string, wcc ...WC) Decorator {
-	return Counters(UnitKiB, pairFormat, wcc...)
-}
-
-// CountersKiloByte is a wrapper around Counters with predefined unit
-// UnitKB (bytes/1000).
-func CountersKiloByte(pairFormat string, wcc ...WC) Decorator {
-	return Counters(UnitKB, pairFormat, wcc...)
-}
-
-// Counters decorator with dynamic unit measure adjustment.
-//
-//	`unit` one of [0|UnitKiB|UnitKB] zero for no unit
-//
-//	`pairFormat` printf compatible verbs for current and total, like "%f" or "%d"
-//
-//	`wcc` optional WC config
-//
-// pairFormat example if UnitKB is chosen:
-//
-//	"%.1f / %.1f" = "1.0MB / 12.0MB" or "% .1f / % .1f" = "1.0 MB / 12.0 MB"
-func Counters(unit int, pairFormat string, wcc ...WC) Decorator {
-	var wc WC
-	for _, widthConf := range wcc {
-		wc = widthConf
-	}
-	wc.Init()
-	d := &countersDecorator{
-		WC:         wc,
-		unit:       unit,
-		pairFormat: pairFormat,
-	}
-	return d
-}
-
-type countersDecorator struct {
-	WC
-	unit        int
-	pairFormat  string
-	completeMsg *string
-}
-
-func (d *countersDecorator) Decor(st *Statistics) string {
-	if st.Completed && d.completeMsg != nil {
-		return d.FormatMsg(*d.completeMsg)
-	}
-
-	var str string
-	switch d.unit {
-	case UnitKiB:
-		str = fmt.Sprintf(d.pairFormat, CounterKiB(st.Current), CounterKiB(st.Total))
-	case UnitKB:
-		str = fmt.Sprintf(d.pairFormat, CounterKB(st.Current), CounterKB(st.Total))
-	default:
-		str = fmt.Sprintf(d.pairFormat, st.Current, st.Total)
-	}
-
-	return d.FormatMsg(str)
-}
-
-func (d *countersDecorator) OnCompleteMessage(msg string) {
-	d.completeMsg = &msg
-}
diff --git a/vendor/github.com/vbauerster/mpb/decor/decorator.go b/vendor/github.com/vbauerster/mpb/decor/decorator.go
deleted file mode 100644
index 2fe40aea6..000000000
--- a/vendor/github.com/vbauerster/mpb/decor/decorator.go
+++ /dev/null
@@ -1,152 +0,0 @@
-package decor
-
-import (
-	"fmt"
-	"time"
-	"unicode/utf8"
-)
-
-const (
-	// DidentRight bit specifies identation direction.
-	// |foo   |b     | With DidentRight
-	// |   foo|     b| Without DidentRight
-	DidentRight = 1 << iota
-
-	// DextraSpace bit adds extra space, makes sense with DSyncWidth only.
-	// When DidentRight bit set, the space will be added to the right,
-	// otherwise to the left.
-	DextraSpace
-
-	// DSyncWidth bit enables same column width synchronization.
-	// Effective with multiple bars only.
-	DSyncWidth
-
-	// DSyncWidthR is shortcut for DSyncWidth|DidentRight
-	DSyncWidthR = DSyncWidth | DidentRight
-
-	// DSyncSpace is shortcut for DSyncWidth|DextraSpace
-	DSyncSpace = DSyncWidth | DextraSpace
-
-	// DSyncSpaceR is shortcut for DSyncWidth|DextraSpace|DidentRight
-	DSyncSpaceR = DSyncWidth | DextraSpace | DidentRight
-)
-
-// TimeStyle enum.
-type TimeStyle int
-
-// TimeStyle kinds.
-const (
-	ET_STYLE_GO TimeStyle = iota
-	ET_STYLE_HHMMSS
-	ET_STYLE_HHMM
-	ET_STYLE_MMSS
-)
-
-// Statistics is a struct, which gets passed to a Decorator.
-type Statistics struct {
-	ID        int
-	Completed bool
-	Total     int64
-	Current   int64
-}
-
-// Decorator interface.
-// A decorator must implement this interface, in order to be used with
-// mpb library.
-type Decorator interface {
-	Decor(*Statistics) string
-	Syncable
-}
-
-// Syncable interface.
-// All decorators implement this interface implicitly. Its Syncable
-// method exposes width sync channel, if sync is enabled.
-type Syncable interface {
-	Syncable() (bool, chan int)
-}
-
-// OnCompleteMessenger interface.
-// Decorators implementing this interface suppose to return provided
-// string on complete event.
-type OnCompleteMessenger interface {
-	OnCompleteMessage(string)
-}
-
-// AmountReceiver interface.
-// If decorator needs to receive increment amount, so this is the right
-// interface to implement.
-type AmountReceiver interface {
-	NextAmount(int, ...time.Duration)
-}
-
-// ShutdownListener interface.
-// If decorator needs to be notified once upon bar shutdown event, so
-// this is the right interface to implement.
-type ShutdownListener interface {
-	Shutdown()
-}
-
-// Global convenience shortcuts
-var (
-	WCSyncWidth  = WC{C: DSyncWidth}
-	WCSyncWidthR = WC{C: DSyncWidthR}
-	WCSyncSpace  = WC{C: DSyncSpace}
-	WCSyncSpaceR = WC{C: DSyncSpaceR}
-)
-
-// WC is a struct with two public fields W and C, both of int type.
-// W represents width and C represents bit set of width related config.
-// A decorator should embed WC, in order to become Syncable.
-type WC struct {
-	W      int
-	C      int
-	format string
-	wsync  chan int
-}
-
-// FormatMsg formats final message according to WC.W and WC.C.
-// Should be called by any Decorator implementation.
-func (wc WC) FormatMsg(msg string) string {
-	if (wc.C & DSyncWidth) != 0 {
-		wc.wsync <- utf8.RuneCountInString(msg)
-		max := <-wc.wsync
-		if max == 0 {
-			max = wc.W
-		}
-		if (wc.C & DextraSpace) != 0 {
-			max++
-		}
-		return fmt.Sprintf(fmt.Sprintf(wc.format, max), msg)
-	}
-	return fmt.Sprintf(fmt.Sprintf(wc.format, wc.W), msg)
-}
-
-// Init initializes width related config.
-func (wc *WC) Init() {
-	wc.format = "%%"
-	if (wc.C & DidentRight) != 0 {
-		wc.format += "-"
-	}
-	wc.format += "%ds"
-	if (wc.C & DSyncWidth) != 0 {
-		wc.wsync = make(chan int)
-	}
-}
-
-// Syncable is implementation of Syncable interface.
-func (wc *WC) Syncable() (bool, chan int) {
-	return (wc.C & DSyncWidth) != 0, wc.wsync
-}
-
-// OnComplete returns decorator, which wraps provided decorator, with
-// sole purpose to display provided message on complete event.
-//
-//	`decorator` Decorator to wrap
-//
-//	`message` message to display on complete event
-func OnComplete(decorator Decorator, message string) Decorator {
-	if d, ok := decorator.(OnCompleteMessenger); ok {
-		d.OnCompleteMessage(message)
-	}
-	return decorator
-}
diff --git a/vendor/github.com/vbauerster/mpb/decor/elapsed.go b/vendor/github.com/vbauerster/mpb/decor/elapsed.go
deleted file mode 100644
index b2e75852c..000000000
--- a/vendor/github.com/vbauerster/mpb/decor/elapsed.go
+++ /dev/null
@@ -1,68 +0,0 @@
-package decor
-
-import (
-	"fmt"
-	"time"
-)
-
-// Elapsed returns elapsed time decorator.
-//
-//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
-//
-//	`wcc` optional WC config
-func Elapsed(style TimeStyle, wcc ...WC) Decorator {
-	var wc WC
-	for _, widthConf := range wcc {
-		wc = widthConf
-	}
-	wc.Init()
-	d := &elapsedDecorator{
-		WC:        wc,
-		style:     style,
-		startTime: time.Now(),
-	}
-	return d
-}
-
-type elapsedDecorator struct {
-	WC
-	style       TimeStyle
-	startTime   time.Time
-	msg         string
-	completeMsg *string
-}
-
-func (d *elapsedDecorator) Decor(st *Statistics) string {
-	if st.Completed {
-		if d.completeMsg != nil {
-			return d.FormatMsg(*d.completeMsg)
-		}
-		return d.FormatMsg(d.msg)
-	}
-
-	timeElapsed := time.Since(d.startTime)
-	hours := int64((timeElapsed / time.Hour) % 60)
-	minutes := int64((timeElapsed / time.Minute) % 60)
-	seconds := int64((timeElapsed / time.Second) % 60)
-
-	switch d.style {
-	case ET_STYLE_GO:
-		d.msg = fmt.Sprint(time.Duration(timeElapsed.Seconds()) * time.Second)
-	case ET_STYLE_HHMMSS:
-		d.msg = fmt.Sprintf("%02d:%02d:%02d", hours, minutes, seconds)
-	case ET_STYLE_HHMM:
-		d.msg = fmt.Sprintf("%02d:%02d", hours, minutes)
-	case ET_STYLE_MMSS:
-		if hours > 0 {
-			d.msg = fmt.Sprintf("%02d:%02d:%02d", hours, minutes, seconds)
-		} else {
-			d.msg = fmt.Sprintf("%02d:%02d", minutes, seconds)
-		}
-	}
-
-	return d.FormatMsg(d.msg)
-}
-
-func (d *elapsedDecorator) OnCompleteMessage(msg string) {
-	d.completeMsg = &msg
-}
diff --git a/vendor/github.com/vbauerster/mpb/decor/eta.go b/vendor/github.com/vbauerster/mpb/decor/eta.go
deleted file mode 100644
index e8dc979b4..000000000
--- a/vendor/github.com/vbauerster/mpb/decor/eta.go
+++ /dev/null
@@ -1,206 +0,0 @@
-package decor
-
-import (
-	"fmt"
-	"math"
-	"time"
-
-	"github.com/VividCortex/ewma"
-)
-
-type TimeNormalizer func(time.Duration) time.Duration
-
-// EwmaETA exponential-weighted-moving-average based ETA decorator.
-//
-//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
-//
-//	`age` is the previous N samples to average over.
-//
-//	`wcc` optional WC config
-func EwmaETA(style TimeStyle, age float64, wcc ...WC) Decorator {
-	return MovingAverageETA(style, ewma.NewMovingAverage(age), NopNormalizer(), wcc...)
-}
-
-// MovingAverageETA decorator relies on MovingAverage implementation to calculate its average.
-//
-//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
-//
-//	`average` available implementations of MovingAverage [ewma.MovingAverage|NewMedian|NewMedianEwma]
-//
-//	`normalizer` available implementations are [NopNormalizer|FixedIntervalTimeNormalizer|MaxTolerateTimeNormalizer]
-//
-//	`wcc` optional WC config
-func MovingAverageETA(style TimeStyle, average MovingAverage, normalizer TimeNormalizer, wcc ...WC) Decorator {
-	var wc WC
-	for _, widthConf := range wcc {
-		wc = widthConf
-	}
-	wc.Init()
-	d := &movingAverageETA{
-		WC:         wc,
-		style:      style,
-		average:    average,
-		normalizer: normalizer,
-	}
-	return d
-}
-
-type movingAverageETA struct {
-	WC
-	style       TimeStyle
-	average     ewma.MovingAverage
-	completeMsg *string
-	normalizer  TimeNormalizer
-}
-
-func (d *movingAverageETA) Decor(st *Statistics) string {
-	if st.Completed && d.completeMsg != nil {
-		return d.FormatMsg(*d.completeMsg)
-	}
-
-	v := math.Round(d.average.Value())
-	remaining := d.normalizer(time.Duration((st.Total - st.Current) * int64(v)))
-	hours := int64((remaining / time.Hour) % 60)
-	minutes := int64((remaining / time.Minute) % 60)
-	seconds := int64((remaining / time.Second) % 60)
-
-	var str string
-	switch d.style {
-	case ET_STYLE_GO:
-		str = fmt.Sprint(time.Duration(remaining.Seconds()) * time.Second)
-	case ET_STYLE_HHMMSS:
-		str = fmt.Sprintf("%02d:%02d:%02d", hours, minutes, seconds)
-	case ET_STYLE_HHMM:
-		str = fmt.Sprintf("%02d:%02d", hours, minutes)
-	case ET_STYLE_MMSS:
-		if hours > 0 {
-			str = fmt.Sprintf("%02d:%02d:%02d", hours, minutes, seconds)
-		} else {
-			str = fmt.Sprintf("%02d:%02d", minutes, seconds)
-		}
-	}
-
-	return d.FormatMsg(str)
-}
-
-func (d *movingAverageETA) NextAmount(n int, wdd ...time.Duration) {
-	var workDuration time.Duration
-	for _, wd := range wdd {
-		workDuration = wd
-	}
-	lastItemEstimate := float64(workDuration) / float64(n)
-	if math.IsInf(lastItemEstimate, 0) || math.IsNaN(lastItemEstimate) {
-		return
-	}
-	d.average.Add(lastItemEstimate)
-}
-
-func (d *movingAverageETA) OnCompleteMessage(msg string) {
-	d.completeMsg = &msg
-}
-
-// AverageETA decorator.
-//
-//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
-//
-//	`wcc` optional WC config
-func AverageETA(style TimeStyle, wcc ...WC) Decorator {
-	var wc WC
-	for _, widthConf := range wcc {
-		wc = widthConf
-	}
-	wc.Init()
-	d := &averageETA{
-		WC:        wc,
-		style:     style,
-		startTime: time.Now(),
-	}
-	return d
-}
-
-type averageETA struct {
-	WC
-	style       TimeStyle
-	startTime   time.Time
-	completeMsg *string
-}
-
-func (d *averageETA) Decor(st *Statistics) string {
-	if st.Completed && d.completeMsg != nil {
-		return d.FormatMsg(*d.completeMsg)
-	}
-
-	var str string
-	timeElapsed := time.Since(d.startTime)
-	v := math.Round(float64(timeElapsed) / float64(st.Current))
-	if math.IsInf(v, 0) || math.IsNaN(v) {
-		v = 0
-	}
-	remaining := time.Duration((st.Total - st.Current) * int64(v))
-	hours := int64((remaining / time.Hour) % 60)
-	minutes := int64((remaining / time.Minute) % 60)
-	seconds := int64((remaining / time.Second) % 60)
-
-	switch d.style {
-	case ET_STYLE_GO:
-		str = fmt.Sprint(time.Duration(remaining.Seconds()) * time.Second)
-	case ET_STYLE_HHMMSS:
-		str = fmt.Sprintf("%02d:%02d:%02d", hours, minutes, seconds)
-	case ET_STYLE_HHMM:
-		str = fmt.Sprintf("%02d:%02d", hours, minutes)
-	case ET_STYLE_MMSS:
-		if hours > 0 {
-			str = fmt.Sprintf("%02d:%02d:%02d", hours, minutes, seconds)
-		} else {
-			str = fmt.Sprintf("%02d:%02d", minutes, seconds)
-		}
-	}
-
-	return d.FormatMsg(str)
-}
-
-func (d *averageETA) OnCompleteMessage(msg string) {
-	d.completeMsg = &msg
-}
-
-func MaxTolerateTimeNormalizer(maxTolerate time.Duration) TimeNormalizer {
-	var normalized time.Duration
-	var lastCall time.Time
-	return func(remaining time.Duration) time.Duration {
-		if diff := normalized - remaining; diff <= 0 || diff > maxTolerate || remaining < maxTolerate/2 {
-			normalized = remaining
-			lastCall = time.Now()
-			return remaining
-		}
-		normalized -= time.Since(lastCall)
-		lastCall = time.Now()
-		return normalized
-	}
-}
-
-func FixedIntervalTimeNormalizer(updInterval int) TimeNormalizer {
-	var normalized time.Duration
-	var lastCall time.Time
-	var count int
-	return func(remaining time.Duration) time.Duration {
-		if count == 0 || remaining <= time.Duration(15*time.Second) {
-			count = updInterval
-			normalized = remaining
-			lastCall = time.Now()
-			return remaining
-		}
-		count--
-		normalized -= time.Since(lastCall)
-		lastCall = time.Now()
-		if normalized > 0 {
-			return normalized
-		}
-		return remaining
-	}
-}
-
-func NopNormalizer() TimeNormalizer {
-	return func(remaining time.Duration) time.Duration {
-		return remaining
-	}
-}
diff --git a/vendor/github.com/vbauerster/mpb/decor/name.go b/vendor/github.com/vbauerster/mpb/decor/name.go
deleted file mode 100644
index a5a5d1469..000000000
--- a/vendor/github.com/vbauerster/mpb/decor/name.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package decor
-
-// StaticName returns name decorator.
-//
-//	`name` string to display
-//
-//	`wcc` optional WC config
-func StaticName(name string, wcc ...WC) Decorator {
-	return Name(name, wcc...)
-}
-
-// Name returns name decorator.
-//
-//	`name` string to display
-//
-//	`wcc` optional WC config
-func Name(name string, wcc ...WC) Decorator {
-	var wc WC
-	for _, widthConf := range wcc {
-		wc = widthConf
-	}
-	wc.Init()
-	d := &nameDecorator{
-		WC:  wc,
-		msg: name,
-	}
-	return d
-}
-
-type nameDecorator struct {
-	WC
-	msg      string
-	complete *string
-}
-
-func (d *nameDecorator) Decor(st *Statistics) string {
-	if st.Completed && d.complete != nil {
-		return d.FormatMsg(*d.complete)
-	}
-	return d.FormatMsg(d.msg)
-}
-
-func (d *nameDecorator) OnCompleteMessage(msg string) {
-	d.complete = &msg
-}
diff --git a/vendor/github.com/vbauerster/mpb/decor/percentage.go b/vendor/github.com/vbauerster/mpb/decor/percentage.go
deleted file mode 100644
index 078fbcf89..000000000
--- a/vendor/github.com/vbauerster/mpb/decor/percentage.go
+++ /dev/null
@@ -1,39 +0,0 @@
-package decor
-
-import (
-	"fmt"
-
-	"github.com/vbauerster/mpb/internal"
-)
-
-// Percentage returns percentage decorator.
-//
-//	`wcc` optional WC config
-func Percentage(wcc ...WC) Decorator {
-	var wc WC
-	for _, widthConf := range wcc {
-		wc = widthConf
-	}
-	wc.Init()
-	d := &percentageDecorator{
-		WC: wc,
-	}
-	return d
-}
-
-type percentageDecorator struct {
-	WC
-	completeMsg *string
-}
-
-func (d *percentageDecorator) Decor(st *Statistics) string {
-	if st.Completed && d.completeMsg != nil {
-		return d.FormatMsg(*d.completeMsg)
-	}
-	str := fmt.Sprintf("%d %%", internal.Percentage(st.Total, st.Current, 100))
-	return d.FormatMsg(str)
-}
-
-func (d *percentageDecorator) OnCompleteMessage(msg string) {
-	d.completeMsg = &msg
-}
diff --git a/vendor/github.com/vbauerster/mpb/decor/speed.go b/vendor/github.com/vbauerster/mpb/decor/speed.go
deleted file mode 100644
index 74658ce41..000000000
--- a/vendor/github.com/vbauerster/mpb/decor/speed.go
+++ /dev/null
@@ -1,271 +0,0 @@
-package decor
-
-import (
-	"fmt"
-	"io"
-	"math"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/VividCortex/ewma"
-)
-
-type SpeedKiB float64
-
-func (s SpeedKiB) Format(st fmt.State, verb rune) {
-	prec, ok := st.Precision()
-
-	if verb == 'd' || !ok {
-		prec = 0
-	}
-	if verb == 'f' && !ok {
-		prec = 6
-	}
-	// retain old beahavior if s verb used
-	if verb == 's' {
-		prec = 1
-	}
-
-	var res, unit string
-	switch {
-	case s >= TiB:
-		unit = "TiB/s"
-		res = strconv.FormatFloat(float64(s)/TiB, 'f', prec, 64)
-	case s >= GiB:
-		unit = "GiB/s"
-		res = strconv.FormatFloat(float64(s)/GiB, 'f', prec, 64)
-	case s >= MiB:
-		unit = "MiB/s"
-		res = strconv.FormatFloat(float64(s)/MiB, 'f', prec, 64)
-	case s >= KiB:
-		unit = "KiB/s"
-		res = strconv.FormatFloat(float64(s)/KiB, 'f', prec, 64)
-	default:
-		unit = "b/s"
-		res = strconv.FormatInt(int64(s), 10)
-	}
-
-	if st.Flag(' ') {
-		res += " "
-	}
-	res += unit
-
-	if w, ok := st.Width(); ok {
-		if len(res) < w {
-			pad := strings.Repeat(" ", w-len(res))
-			if st.Flag(int('-')) {
-				res += pad
-			} else {
-				res = pad + res
-			}
-		}
-	}
-
-	io.WriteString(st, res)
-}
-
-type SpeedKB float64
-
-func (s SpeedKB) Format(st fmt.State, verb rune) {
-	prec, ok := st.Precision()
-
-	if verb == 'd' || !ok {
-		prec = 0
-	}
-	if verb == 'f' && !ok {
-		prec = 6
-	}
-	// retain old beahavior if s verb used
-	if verb == 's' {
-		prec = 1
-	}
-
-	var res, unit string
-	switch {
-	case s >= TB:
-		unit = "TB/s"
-		res = strconv.FormatFloat(float64(s)/TB, 'f', prec, 64)
-	case s >= GB:
-		unit = "GB/s"
-		res = strconv.FormatFloat(float64(s)/GB, 'f', prec, 64)
-	case s >= MB:
-		unit = "MB/s"
-		res = strconv.FormatFloat(float64(s)/MB, 'f', prec, 64)
-	case s >= KB:
-		unit = "kB/s"
-		res = strconv.FormatFloat(float64(s)/KB, 'f', prec, 64)
-	default:
-		unit = "b/s"
-		res = strconv.FormatInt(int64(s), 10)
-	}
-
-	if st.Flag(' ') {
-		res += " "
-	}
-	res += unit
-
-	if w, ok := st.Width(); ok {
-		if len(res) < w {
-			pad := strings.Repeat(" ", w-len(res))
-			if st.Flag(int('-')) {
-				res += pad
-			} else {
-				res = pad + res
-			}
-		}
-	}
-
-	io.WriteString(st, res)
-}
-
-// EwmaSpeed exponential-weighted-moving-average based speed decorator,
-// with dynamic unit measure adjustment.
-//
-//	`unit` one of [0|UnitKiB|UnitKB] zero for no unit
-//
-//	`unitFormat` printf compatible verb for value, like "%f" or "%d"
-//
-//	`average` MovingAverage implementation
-//
-//	`wcc` optional WC config
-//
-// unitFormat example if UnitKiB is chosen:
-//
-//	"%.1f" = "1.0MiB/s" or "% .1f" = "1.0 MiB/s"
-func EwmaSpeed(unit int, unitFormat string, age float64, wcc ...WC) Decorator {
-	return MovingAverageSpeed(unit, unitFormat, ewma.NewMovingAverage(age), wcc...)
-}
-
-// MovingAverageSpeed decorator relies on MovingAverage implementation
-// to calculate its average.
-//
-//	`unit` one of [0|UnitKiB|UnitKB] zero for no unit
-//
-//	`unitFormat` printf compatible verb for value, like "%f" or "%d"
-//
-//	`average` MovingAverage implementation
-//
-//	`wcc` optional WC config
-func MovingAverageSpeed(unit int, unitFormat string, average MovingAverage, wcc ...WC) Decorator {
-	var wc WC
-	for _, widthConf := range wcc {
-		wc = widthConf
-	}
-	wc.Init()
-	d := &movingAverageSpeed{
-		WC:         wc,
-		unit:       unit,
-		unitFormat: unitFormat,
-		average:    average,
-	}
-	return d
-}
-
-type movingAverageSpeed struct {
-	WC
-	unit        int
-	unitFormat  string
-	average     ewma.MovingAverage
-	msg         string
-	completeMsg *string
-}
-
-func (d *movingAverageSpeed) Decor(st *Statistics) string {
-	if st.Completed {
-		if d.completeMsg != nil {
-			return d.FormatMsg(*d.completeMsg)
-		}
-		return d.FormatMsg(d.msg)
-	}
-
-	speed := d.average.Value()
-	switch d.unit {
-	case UnitKiB:
-		d.msg = fmt.Sprintf(d.unitFormat, SpeedKiB(speed))
-	case UnitKB:
-		d.msg = fmt.Sprintf(d.unitFormat, SpeedKB(speed))
-	default:
-		d.msg = fmt.Sprintf(d.unitFormat, speed)
-	}
-
-	return d.FormatMsg(d.msg)
-}
-
-func (s *movingAverageSpeed) NextAmount(n int, wdd ...time.Duration) {
-	var workDuration time.Duration
-	for _, wd := range wdd {
-		workDuration = wd
-	}
-	speed := float64(n) / workDuration.Seconds() / 1000
-	if math.IsInf(speed, 0) || math.IsNaN(speed) {
-		return
-	}
-	s.average.Add(speed)
-}
-
-func (d *movingAverageSpeed) OnCompleteMessage(msg string) {
-	d.completeMsg = &msg
-}
-
-// AverageSpeed decorator with dynamic unit measure adjustment.
-//
-//	`unit` one of [0|UnitKiB|UnitKB] zero for no unit
-//
-//	`unitFormat` printf compatible verb for value, like "%f" or "%d"
-//
-//	`wcc` optional WC config
-//
-// unitFormat example if UnitKiB is chosen:
-//
-//	"%.1f" = "1.0MiB/s" or "% .1f" = "1.0 MiB/s"
-func AverageSpeed(unit int, unitFormat string, wcc ...WC) Decorator {
-	var wc WC
-	for _, widthConf := range wcc {
-		wc = widthConf
-	}
-	wc.Init()
-	d := &averageSpeed{
-		WC:         wc,
-		unit:       unit,
-		unitFormat: unitFormat,
-		startTime:  time.Now(),
-	}
-	return d
-}
-
-type averageSpeed struct {
-	WC
-	unit        int
-	unitFormat  string
-	startTime   time.Time
-	msg         string
-	completeMsg *string
-}
-
-func (d *averageSpeed) Decor(st *Statistics) string {
-	if st.Completed {
-		if d.completeMsg != nil {
-			return d.FormatMsg(*d.completeMsg)
-		}
-		return d.FormatMsg(d.msg)
-	}
-
-	timeElapsed := time.Since(d.startTime)
-	speed := float64(st.Current) / timeElapsed.Seconds()
-
-	switch d.unit {
-	case UnitKiB:
-		d.msg = fmt.Sprintf(d.unitFormat, SpeedKiB(speed))
-	case UnitKB:
-		d.msg = fmt.Sprintf(d.unitFormat, SpeedKB(speed))
-	default:
-		d.msg = fmt.Sprintf(d.unitFormat, speed)
-	}
-
-	return d.FormatMsg(d.msg)
-}
-
-func (d *averageSpeed) OnCompleteMessage(msg string) {
-	d.completeMsg = &msg
-}
diff --git a/vendor/github.com/vbauerster/mpb/doc.go b/vendor/github.com/vbauerster/mpb/doc.go
deleted file mode 100644
index 16245956a..000000000
--- a/vendor/github.com/vbauerster/mpb/doc.go
+++ /dev/null
@@ -1,6 +0,0 @@
-// Copyright (C) 2016-2018 Vladimir Bauer
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package mpb is a library for rendering progress bars in terminal applications.
-package mpb
diff --git a/vendor/github.com/vbauerster/mpb/go.test.sh b/vendor/github.com/vbauerster/mpb/go.test.sh
deleted file mode 100644
index 34dbbfb31..000000000
--- a/vendor/github.com/vbauerster/mpb/go.test.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-echo "" > coverage.txt
-
-for d in $(go list ./... | grep -v vendor); do
-    go test -race -coverprofile=profile.out -covermode=atomic $d
-    if [ -f profile.out ]; then
-        cat profile.out >> coverage.txt
-        rm profile.out
-    fi
-done
diff --git a/vendor/github.com/vbauerster/mpb/internal/percentage.go b/vendor/github.com/vbauerster/mpb/internal/percentage.go
deleted file mode 100644
index 0483d2598..000000000
--- a/vendor/github.com/vbauerster/mpb/internal/percentage.go
+++ /dev/null
@@ -1,12 +0,0 @@
-package internal
-
-import "math"
-
-// Percentage is a helper function, to calculate percentage.
-func Percentage(total, current, width int64) int64 {
-	if total <= 0 {
-		return 0
-	}
-	p := float64(width*current) / float64(total)
-	return int64(math.Round(p))
-}
diff --git a/vendor/github.com/vbauerster/mpb/options.go b/vendor/github.com/vbauerster/mpb/options.go
deleted file mode 100644
index 44a6ee3f3..000000000
--- a/vendor/github.com/vbauerster/mpb/options.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package mpb
-
-import (
-	"context"
-	"io"
-	"sync"
-	"time"
-
-	"github.com/vbauerster/mpb/cwriter"
-)
-
-// ProgressOption is a function option which changes the default
-// behavior of progress pool, if passed to mpb.New(...ProgressOption).
-type ProgressOption func(*pState)
-
-// WithWaitGroup provides means to have a single joint point. If
-// *sync.WaitGroup is provided, you can safely call just p.Wait()
-// without calling Wait() on provided *sync.WaitGroup. Makes sense
-// when there are more than one bar to render.
-func WithWaitGroup(wg *sync.WaitGroup) ProgressOption {
-	return func(s *pState) {
-		s.uwg = wg
-	}
-}
-
-// WithWidth sets container width. Default is 80. Bars inherit this
-// width, as long as no BarWidth is applied.
-func WithWidth(w int) ProgressOption {
-	return func(s *pState) {
-		if w >= 0 {
-			s.width = w
-		}
-	}
-}
-
-// WithRefreshRate overrides default 120ms refresh rate.
-func WithRefreshRate(d time.Duration) ProgressOption {
-	return func(s *pState) {
-		if d < 10*time.Millisecond {
-			return
-		}
-		s.rr = d
-	}
-}
-
-// WithManualRefresh disables internal auto refresh time.Ticker.
-// Refresh will occur upon receive value from provided ch.
-func WithManualRefresh(ch <-chan time.Time) ProgressOption {
-	return func(s *pState) {
-		s.manualRefreshCh = ch
-	}
-}
-
-// WithContext provided context will be used for cancellation purposes.
-func WithContext(ctx context.Context) ProgressOption {
-	return func(s *pState) {
-		if ctx == nil {
-			return
-		}
-		s.ctx = ctx
-	}
-}
-
-// WithShutdownNotifier provided chanel will be closed, after all bars
-// have been rendered.
-func WithShutdownNotifier(ch chan struct{}) ProgressOption {
-	return func(s *pState) {
-		s.shutdownNotifier = ch
-	}
-}
-
-// WithOutput overrides default output os.Stdout.
-func WithOutput(w io.Writer) ProgressOption {
-	return func(s *pState) {
-		if w == nil {
-			return
-		}
-		s.cw = cwriter.New(w)
-	}
-}
-
-// WithDebugOutput sets debug output.
-func WithDebugOutput(w io.Writer) ProgressOption {
-	return func(s *pState) {
-		if w == nil {
-			return
-		}
-		s.debugOut = w
-	}
-}
diff --git a/vendor/github.com/vbauerster/mpb/progress.go b/vendor/github.com/vbauerster/mpb/progress.go
deleted file mode 100644
index f9e25af79..000000000
--- a/vendor/github.com/vbauerster/mpb/progress.go
+++ /dev/null
@@ -1,267 +0,0 @@
-package mpb
-
-import (
-	"container/heap"
-	"context"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"sync"
-	"time"
-
-	"github.com/vbauerster/mpb/cwriter"
-)
-
-const (
-	// default RefreshRate
-	prr = 120 * time.Millisecond
-	// default width
-	pwidth = 80
-)
-
-// Progress represents the container that renders Progress bars
-type Progress struct {
-	wg           *sync.WaitGroup
-	uwg          *sync.WaitGroup
-	operateState chan func(*pState)
-	done         chan struct{}
-}
-
-type pState struct {
-	bHeap           *priorityQueue
-	shutdownPending []*Bar
-	heapUpdated     bool
-	zeroWait        bool
-	idCounter       int
-	width           int
-	format          string
-	rr              time.Duration
-	cw              *cwriter.Writer
-	pMatrix         map[int][]chan int
-	aMatrix         map[int][]chan int
-
-	// following are provided/overrided by user
-	ctx              context.Context
-	uwg              *sync.WaitGroup
-	manualRefreshCh  <-chan time.Time
-	shutdownNotifier chan struct{}
-	waitBars         map[*Bar]*Bar
-	debugOut         io.Writer
-}
-
-// New creates new Progress instance, which orchestrates bars rendering
-// process. Accepts mpb.ProgressOption funcs for customization.
-func New(options ...ProgressOption) *Progress {
-	pq := make(priorityQueue, 0)
-	heap.Init(&pq)
-	s := &pState{
-		ctx:      context.Background(),
-		bHeap:    &pq,
-		width:    pwidth,
-		cw:       cwriter.New(os.Stdout),
-		rr:       prr,
-		waitBars: make(map[*Bar]*Bar),
-		debugOut: ioutil.Discard,
-	}
-
-	for _, opt := range options {
-		if opt != nil {
-			opt(s)
-		}
-	}
-
-	p := &Progress{
-		uwg:          s.uwg,
-		wg:           new(sync.WaitGroup),
-		operateState: make(chan func(*pState)),
-		done:         make(chan struct{}),
-	}
-	go p.serve(s)
-	return p
-}
-
-// AddBar creates a new progress bar and adds to the container.
-func (p *Progress) AddBar(total int64, options ...BarOption) *Bar {
-	return p.Add(total, newDefaultBarFiller(), options...)
-}
-
-// AddSpinner creates a new spinner bar and adds to the container.
-func (p *Progress) AddSpinner(total int64, alignment SpinnerAlignment, options ...BarOption) *Bar {
-	filler := &spinnerFiller{
-		frames:    defaultSpinnerStyle,
-		alignment: alignment,
-	}
-	return p.Add(total, filler, options...)
-}
-
-// Add creates a bar which renders itself by provided filler.
-func (p *Progress) Add(total int64, filler Filler, options ...BarOption) *Bar {
-	if filler == nil {
-		filler = newDefaultBarFiller()
-	}
-	p.wg.Add(1)
-	result := make(chan *Bar)
-	select {
-	case p.operateState <- func(s *pState) {
-		b := newBar(s.ctx, p.wg, filler, s.idCounter, s.width, total, options...)
-		if b.runningBar != nil {
-			s.waitBars[b.runningBar] = b
-		} else {
-			heap.Push(s.bHeap, b)
-			s.heapUpdated = true
-		}
-		s.idCounter++
-		result <- b
-	}:
-		return <-result
-	case <-p.done:
-		p.wg.Done()
-		return nil
-	}
-}
-
-// Abort is only effective while bar progress is running, it means
-// remove bar now without waiting for its completion. If bar is already
-// completed, there is nothing to abort. If you need to remove bar
-// after completion, use BarRemoveOnComplete BarOption.
-func (p *Progress) Abort(b *Bar, remove bool) {
-	select {
-	case p.operateState <- func(s *pState) {
-		if b.index < 0 {
-			return
-		}
-		if remove {
-			s.heapUpdated = heap.Remove(s.bHeap, b.index) != nil
-		}
-		s.shutdownPending = append(s.shutdownPending, b)
-	}:
-	case <-p.done:
-	}
-}
-
-// UpdateBarPriority provides a way to change bar's order position.
-// Zero is highest priority, i.e. bar will be on top.
-func (p *Progress) UpdateBarPriority(b *Bar, priority int) {
-	select {
-	case p.operateState <- func(s *pState) { s.bHeap.update(b, priority) }:
-	case <-p.done:
-	}
-}
-
-// BarCount returns bars count
-func (p *Progress) BarCount() int {
-	result := make(chan int, 1)
-	select {
-	case p.operateState <- func(s *pState) { result <- s.bHeap.Len() }:
-		return <-result
-	case <-p.done:
-		return 0
-	}
-}
-
-// Wait first waits for user provided *sync.WaitGroup, if any, then
-// waits far all bars to complete and finally shutdowns master goroutine.
-// After this method has been called, there is no way to reuse *Progress
-// instance.
-func (p *Progress) Wait() {
-	if p.uwg != nil {
-		p.uwg.Wait()
-	}
-
-	p.wg.Wait()
-
-	select {
-	case p.operateState <- func(s *pState) { s.zeroWait = true }:
-		<-p.done
-	case <-p.done:
-	}
-}
-
-func (s *pState) updateSyncMatrix() {
-	s.pMatrix = make(map[int][]chan int)
-	s.aMatrix = make(map[int][]chan int)
-	for i := 0; i < s.bHeap.Len(); i++ {
-		bar := (*s.bHeap)[i]
-		table := bar.wSyncTable()
-		pRow, aRow := table[0], table[1]
-
-		for i, ch := range pRow {
-			s.pMatrix[i] = append(s.pMatrix[i], ch)
-		}
-
-		for i, ch := range aRow {
-			s.aMatrix[i] = append(s.aMatrix[i], ch)
-		}
-	}
-}
-
-func (s *pState) render(tw int) {
-	if s.heapUpdated {
-		s.updateSyncMatrix()
-		s.heapUpdated = false
-	}
-	syncWidth(s.pMatrix)
-	syncWidth(s.aMatrix)
-
-	for i := 0; i < s.bHeap.Len(); i++ {
-		bar := (*s.bHeap)[i]
-		go bar.render(s.debugOut, tw)
-	}
-
-	if err := s.flush(s.bHeap.Len()); err != nil {
-		fmt.Fprintf(s.debugOut, "%s %s %v\n", "[mpb]", time.Now(), err)
-	}
-}
-
-func (s *pState) flush(lineCount int) error {
-	for s.bHeap.Len() > 0 {
-		bar := heap.Pop(s.bHeap).(*Bar)
-		frameReader := <-bar.frameReaderCh
-		defer func() {
-			if frameReader.toShutdown {
-				// shutdown at next flush, in other words decrement underlying WaitGroup
-				// only after the bar with completed state has been flushed. this
-				// ensures no bar ends up with less than 100% rendered.
-				s.shutdownPending = append(s.shutdownPending, bar)
-				if replacementBar, ok := s.waitBars[bar]; ok {
-					heap.Push(s.bHeap, replacementBar)
-					s.heapUpdated = true
-					delete(s.waitBars, bar)
-				}
-				if frameReader.removeOnComplete {
-					s.heapUpdated = true
-					return
-				}
-			}
-			heap.Push(s.bHeap, bar)
-		}()
-		s.cw.ReadFrom(frameReader)
-		lineCount += frameReader.extendedLines
-	}
-
-	for i := len(s.shutdownPending) - 1; i >= 0; i-- {
-		close(s.shutdownPending[i].shutdown)
-		s.shutdownPending = s.shutdownPending[:i]
-	}
-
-	return s.cw.Flush(lineCount)
-}
-
-func syncWidth(matrix map[int][]chan int) {
-	for _, column := range matrix {
-		column := column
-		go func() {
-			var maxWidth int
-			for _, ch := range column {
-				w := <-ch
-				if w > maxWidth {
-					maxWidth = w
-				}
-			}
-			for _, ch := range column {
-				ch <- maxWidth
-			}
-		}()
-	}
-}
diff --git a/vendor/github.com/vbauerster/mpb/progress_posix.go b/vendor/github.com/vbauerster/mpb/progress_posix.go
deleted file mode 100644
index 545245a42..000000000
--- a/vendor/github.com/vbauerster/mpb/progress_posix.go
+++ /dev/null
@@ -1,70 +0,0 @@
-// +build !windows
-
-package mpb
-
-import (
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-)
-
-func (p *Progress) serve(s *pState) {
-
-	var ticker *time.Ticker
-	var refreshCh <-chan time.Time
-	var winch chan os.Signal
-	var resumeTimer *time.Timer
-	var resumeEvent <-chan time.Time
-	winchIdleDur := s.rr * 2
-
-	if s.manualRefreshCh == nil {
-		ticker = time.NewTicker(s.rr)
-		refreshCh = ticker.C
-		winch = make(chan os.Signal, 2)
-		signal.Notify(winch, syscall.SIGWINCH)
-	} else {
-		refreshCh = s.manualRefreshCh
-	}
-
-	for {
-		select {
-		case op := <-p.operateState:
-			op(s)
-		case <-refreshCh:
-			if s.zeroWait {
-				if s.manualRefreshCh == nil {
-					signal.Stop(winch)
-					ticker.Stop()
-				}
-				if s.shutdownNotifier != nil {
-					close(s.shutdownNotifier)
-				}
-				close(p.done)
-				return
-			}
-			tw, err := s.cw.GetWidth()
-			if err != nil {
-				tw = s.width
-			}
-			s.render(tw)
-		case <-winch:
-			tw, err := s.cw.GetWidth()
-			if err != nil {
-				tw = s.width
-			}
-			s.render(tw - tw/8)
-			if resumeTimer != nil && resumeTimer.Reset(winchIdleDur) {
-				break
-			}
-			ticker.Stop()
-			resumeTimer = time.NewTimer(winchIdleDur)
-			resumeEvent = resumeTimer.C
-		case <-resumeEvent:
-			ticker = time.NewTicker(s.rr)
-			refreshCh = ticker.C
-			resumeEvent = nil
-			resumeTimer = nil
-		}
-	}
-}
diff --git a/vendor/github.com/vbauerster/mpb/progress_windows.go b/vendor/github.com/vbauerster/mpb/progress_windows.go
deleted file mode 100644
index cab03d36c..000000000
--- a/vendor/github.com/vbauerster/mpb/progress_windows.go
+++ /dev/null
@@ -1,43 +0,0 @@
-// +build windows
-
-package mpb
-
-import (
-	"time"
-)
-
-func (p *Progress) serve(s *pState) {
-
-	var ticker *time.Ticker
-	var refreshCh <-chan time.Time
-
-	if s.manualRefreshCh == nil {
-		ticker = time.NewTicker(s.rr)
-		refreshCh = ticker.C
-	} else {
-		refreshCh = s.manualRefreshCh
-	}
-
-	for {
-		select {
-		case op := <-p.operateState:
-			op(s)
-		case <-refreshCh:
-			if s.zeroWait {
-				if s.manualRefreshCh == nil {
-					ticker.Stop()
-				}
-				if s.shutdownNotifier != nil {
-					close(s.shutdownNotifier)
-				}
-				close(p.done)
-				return
-			}
-			tw, err := s.cw.GetWidth()
-			if err != nil {
-				tw = s.width
-			}
-			s.render(tw)
-		}
-	}
-}
diff --git a/vendor/github.com/vbauerster/mpb/proxyreader.go b/vendor/github.com/vbauerster/mpb/proxyreader.go
deleted file mode 100644
index d2692ccf4..000000000
--- a/vendor/github.com/vbauerster/mpb/proxyreader.go
+++ /dev/null
@@ -1,22 +0,0 @@
-package mpb
-
-import (
-	"io"
-	"time"
-)
-
-// proxyReader is io.Reader wrapper, for proxy read bytes
-type proxyReader struct {
-	io.ReadCloser
-	bar *Bar
-	iT  time.Time
-}
-
-func (pr *proxyReader) Read(p []byte) (n int, err error) {
-	n, err = pr.ReadCloser.Read(p)
-	if n > 0 {
-		pr.bar.IncrBy(n, time.Since(pr.iT))
-		pr.iT = time.Now()
-	}
-	return
-}
diff --git a/vendor/github.com/vbauerster/mpb/.gitignore b/vendor/github.com/vbauerster/mpb/v4/.gitignore
index 63bd91672..63bd91672 100644
--- a/vendor/github.com/vbauerster/mpb/.gitignore
+++ b/vendor/github.com/vbauerster/mpb/v4/.gitignore
diff --git a/vendor/github.com/vbauerster/mpb/v4/.travis.yml b/vendor/github.com/vbauerster/mpb/v4/.travis.yml
new file mode 100644
index 000000000..997ae32d6
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/.travis.yml
@@ -0,0 +1,12 @@
+language: go
+
+go:
+  - 1.12.x
+  - 1.13.x
+
+env:
+  - GO111MODULE=on
+
+script:
+  - go test -race ./...
+  - for i in _examples/*/; do go build $i/*.go || exit 1; done
diff --git a/vendor/github.com/vbauerster/mpb/README.md b/vendor/github.com/vbauerster/mpb/v4/README.md
index f96857c47..003fb5987 100644
--- a/vendor/github.com/vbauerster/mpb/README.md
+++ b/vendor/github.com/vbauerster/mpb/v4/README.md
@@ -3,43 +3,41 @@
 [![GoDoc](https://godoc.org/github.com/vbauerster/mpb?status.svg)](https://godoc.org/github.com/vbauerster/mpb)
 [![Build Status](https://travis-ci.org/vbauerster/mpb.svg?branch=master)](https://travis-ci.org/vbauerster/mpb)
 [![Go Report Card](https://goreportcard.com/badge/github.com/vbauerster/mpb)](https://goreportcard.com/report/github.com/vbauerster/mpb)
-[![codecov](https://codecov.io/gh/vbauerster/mpb/branch/master/graph/badge.svg)](https://codecov.io/gh/vbauerster/mpb)
 
 **mpb** is a Go lib for rendering progress bars in terminal applications.
 
 ## Features
 
 * __Multiple Bars__: Multiple progress bars are supported
-* __Dynamic Total__: [Set total](https://github.com/vbauerster/mpb/issues/9#issuecomment-344448984) while bar is running
+* __Dynamic Total__: Set total while bar is running
 * __Dynamic Add/Remove__: Dynamically add or remove bars
 * __Cancellation__: Cancel whole rendering process
 * __Predefined Decorators__: Elapsed time, [ewma](https://github.com/VividCortex/ewma) based ETA, Percentage, Bytes counter
 * __Decorator's width sync__:  Synchronized decorator's width among multiple bars
 
-## Installation
+## Usage
 
-```sh
-go get github.com/vbauerster/mpb
-```
+#### [Rendering single bar](_examples/singleBar/main.go)
+```go
+package main
 
-_Note:_ it is preferable to go get from github.com, rather than gopkg.in. See issue [#11](https://github.com/vbauerster/mpb/issues/11).
+import (
+    "math/rand"
+    "time"
 
-## Usage
+    "github.com/vbauerster/mpb/v4"
+    "github.com/vbauerster/mpb/v4/decor"
+)
 
-#### [Rendering single bar](examples/singleBar/main.go)
-```go
-    p := mpb.New(
-        // override default (80) width
-        mpb.WithWidth(64),
-        // override default 120ms refresh rate
-        mpb.WithRefreshRate(180*time.Millisecond),
-    )
+func main() {
+    // initialize progress container, with custom width
+    p := mpb.New(mpb.WithWidth(64))
 
     total := 100
     name := "Single Bar:"
-    // adding a single bar
+    // adding a single bar, which will inherit container's width
     bar := p.AddBar(int64(total),
-        // override default "[=>-]" style
+        // override DefaultBarStyle, which is "[=>-]<+"
         mpb.BarStyle("╢▌▌░╟"),
         mpb.PrependDecorators(
             // display our name with one space on the right
@@ -57,16 +55,18 @@ _Note:_ it is preferable to go get from github.com, rather than gopkg.in. See is
     for i := 0; i < total; i++ {
         start := time.Now()
         time.Sleep(time.Duration(rand.Intn(10)+1) * max / 10)
-        // ewma based decorators require work duration measurement
-        bar.IncrBy(1, time.Since(start))
+        // since ewma decorator is used, we need to pass time.Since(start)
+        bar.Increment(time.Since(start))
     }
     // wait for our bar to complete and flush
     p.Wait()
+}
 ```
 
-#### [Rendering multiple bars](examples/simple/main.go)
+#### [Rendering multiple bars](_examples/multiBars//main.go)
 ```go
     var wg sync.WaitGroup
+    // pass &wg (optional), so p will wait for it eventually
     p := mpb.New(mpb.WithWaitGroup(&wg))
     total, numBars := 100, 3
     wg.Add(numBars)
@@ -91,27 +91,28 @@ _Note:_ it is preferable to go get from github.com, rather than gopkg.in. See is
         // simulating some work
         go func() {
             defer wg.Done()
+            rng := rand.New(rand.NewSource(time.Now().UnixNano()))
             max := 100 * time.Millisecond
             for i := 0; i < total; i++ {
                 start := time.Now()
-                time.Sleep(time.Duration(rand.Intn(10)+1) * max / 10)
-                // ewma based decorators require work duration measurement
-                bar.IncrBy(1, time.Since(start))
+                time.Sleep(time.Duration(rng.Intn(10)+1) * max / 10)
+                // since ewma decorator is used, we need to pass time.Since(start)
+                bar.Increment(time.Since(start))
             }
         }()
     }
-    // wait for all bars to complete and flush
+    // Waiting for passed &wg and for all bars to complete and flush
     p.Wait()
 ```
 
-#### [Dynamic total](examples/dynTotal/main.go)
+#### [Dynamic total](_examples/dynTotal/main.go)
 
-![dynamic total](examples/gifs/godEMrCZmJkHYH1X9dN4Nm0U7.svg)
+![dynamic total](_svg/godEMrCZmJkHYH1X9dN4Nm0U7.svg)
 
-#### [Complex example](examples/complex/main.go)
+#### [Complex example](_examples/complex/main.go)
 
-![complex](examples/gifs/wHzf1M7sd7B3zVa2scBMnjqRf.svg)
+![complex](_svg/wHzf1M7sd7B3zVa2scBMnjqRf.svg)
 
-#### [Bytes counters](examples/io/single/main.go)
+#### [Bytes counters](_examples/io/main.go)
 
-![byte counters](examples/gifs/hIpTa3A5rQz65ssiVuRJu87X6.svg)
+![byte counters](_svg/hIpTa3A5rQz65ssiVuRJu87X6.svg)
diff --git a/vendor/github.com/vbauerster/mpb/v4/UNLICENSE b/vendor/github.com/vbauerster/mpb/v4/UNLICENSE
new file mode 100644
index 000000000..68a49daad
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/UNLICENSE
@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org/>
diff --git a/vendor/github.com/vbauerster/mpb/v4/bar.go b/vendor/github.com/vbauerster/mpb/v4/bar.go
new file mode 100644
index 000000000..c362da739
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/bar.go
@@ -0,0 +1,477 @@
+package mpb
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"log"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/vbauerster/mpb/v4/decor"
+)
+
+// Filler interface.
+// Bar renders by calling Filler's Fill method. You can literally have
+// any bar kind, by implementing this interface and passing it to the
+// *Progress.Add method.
+type Filler interface {
+	Fill(w io.Writer, width int, stat *decor.Statistics)
+}
+
+// FillerFunc is function type adapter to convert function into Filler.
+type FillerFunc func(w io.Writer, width int, stat *decor.Statistics)
+
+func (f FillerFunc) Fill(w io.Writer, width int, stat *decor.Statistics) {
+	f(w, width, stat)
+}
+
+// Wrapper interface.
+// If you're implementing custom Filler by wrapping a built-in one,
+// it is necessary to implement this interface to retain functionality
+// of built-in Filler.
+type Wrapper interface {
+	Base() Filler
+}
+
+// Bar represents a progress Bar.
+type Bar struct {
+	priority int // used by heap
+	index    int // used by heap
+
+	extendedLines int
+	toShutdown    bool
+	toDrop        bool
+	noPop         bool
+	operateState  chan func(*bState)
+	frameCh       chan io.Reader
+	syncTableCh   chan [][]chan int
+	completed     chan bool
+
+	// cancel is called either by user or on complete event
+	cancel func()
+	// done is closed after cacheState is assigned
+	done chan struct{}
+	// cacheState is populated, right after close(shutdown)
+	cacheState *bState
+
+	container      *Progress
+	dlogger        *log.Logger
+	recoveredPanic interface{}
+}
+
+type extFunc func(in io.Reader, tw int, st *decor.Statistics) (out io.Reader, lines int)
+
+type bState struct {
+	baseF             Filler
+	filler            Filler
+	id                int
+	width             int
+	total             int64
+	current           int64
+	trimSpace         bool
+	toComplete        bool
+	completeFlushed   bool
+	noPop             bool
+	aDecorators       []decor.Decorator
+	pDecorators       []decor.Decorator
+	amountReceivers   []decor.AmountReceiver
+	shutdownListeners []decor.ShutdownListener
+	averageAdjusters  []decor.AverageAdjuster
+	bufP, bufB, bufA  *bytes.Buffer
+	extender          extFunc
+
+	// priority overrides *Bar's priority, if set
+	priority int
+	// dropOnComplete propagates to *Bar
+	dropOnComplete bool
+	// runningBar is a key for *pState.parkedBars
+	runningBar *Bar
+
+	debugOut io.Writer
+}
+
+func newBar(container *Progress, bs *bState) *Bar {
+	logPrefix := fmt.Sprintf("%sbar#%02d ", container.dlogger.Prefix(), bs.id)
+	ctx, cancel := context.WithCancel(container.ctx)
+
+	bar := &Bar{
+		container:    container,
+		priority:     bs.priority,
+		toDrop:       bs.dropOnComplete,
+		noPop:        bs.noPop,
+		operateState: make(chan func(*bState)),
+		frameCh:      make(chan io.Reader, 1),
+		syncTableCh:  make(chan [][]chan int),
+		completed:    make(chan bool, 1),
+		done:         make(chan struct{}),
+		cancel:       cancel,
+		dlogger:      log.New(bs.debugOut, logPrefix, log.Lshortfile),
+	}
+
+	go bar.serve(ctx, bs)
+	return bar
+}
+
+// RemoveAllPrependers removes all prepend functions.
+func (b *Bar) RemoveAllPrependers() {
+	select {
+	case b.operateState <- func(s *bState) { s.pDecorators = nil }:
+	case <-b.done:
+	}
+}
+
+// RemoveAllAppenders removes all append functions.
+func (b *Bar) RemoveAllAppenders() {
+	select {
+	case b.operateState <- func(s *bState) { s.aDecorators = nil }:
+	case <-b.done:
+	}
+}
+
+// ProxyReader wraps r with metrics required for progress tracking.
+func (b *Bar) ProxyReader(r io.Reader) io.ReadCloser {
+	if r == nil {
+		return nil
+	}
+	rc, ok := r.(io.ReadCloser)
+	if !ok {
+		rc = ioutil.NopCloser(r)
+	}
+	prox := &proxyReader{rc, b, time.Now()}
+	if wt, ok := r.(io.WriterTo); ok {
+		return &proxyWriterTo{prox, wt}
+	}
+	return prox
+}
+
+// ID returs id of the bar.
+func (b *Bar) ID() int {
+	result := make(chan int)
+	select {
+	case b.operateState <- func(s *bState) { result <- s.id }:
+		return <-result
+	case <-b.done:
+		return b.cacheState.id
+	}
+}
+
+// Current returns bar's current number, in other words sum of all increments.
+func (b *Bar) Current() int64 {
+	result := make(chan int64)
+	select {
+	case b.operateState <- func(s *bState) { result <- s.current }:
+		return <-result
+	case <-b.done:
+		return b.cacheState.current
+	}
+}
+
+// SetRefill sets refill, if supported by underlying Filler.
+// Useful for resume-able tasks.
+func (b *Bar) SetRefill(amount int64) {
+	type refiller interface {
+		SetRefill(int64)
+	}
+	b.operateState <- func(s *bState) {
+		if f, ok := s.baseF.(refiller); ok {
+			f.SetRefill(amount)
+		}
+	}
+}
+
+// AdjustAverageDecorators updates start time of all average decorators.
+// Useful for resume-able tasks.
+func (b *Bar) AdjustAverageDecorators(startTime time.Time) {
+	b.operateState <- func(s *bState) {
+		for _, adjuster := range s.averageAdjusters {
+			adjuster.AverageAdjust(startTime)
+		}
+	}
+}
+
+// TraverseDecorators traverses all available decorators and calls cb func on each.
+func (b *Bar) TraverseDecorators(cb decor.CBFunc) {
+	b.operateState <- func(s *bState) {
+		for _, decorators := range [...][]decor.Decorator{
+			s.pDecorators,
+			s.aDecorators,
+		} {
+			for _, d := range decorators {
+				cb(extractBaseDecorator(d))
+			}
+		}
+	}
+}
+
+// SetTotal sets total dynamically.
+// Set complete to true, to trigger bar complete event now.
+func (b *Bar) SetTotal(total int64, complete bool) {
+	select {
+	case b.operateState <- func(s *bState) {
+		if total <= 0 {
+			s.total = s.current
+		} else {
+			s.total = total
+		}
+		if complete && !s.toComplete {
+			s.current = s.total
+			s.toComplete = true
+			go b.refreshTillShutdown()
+		}
+	}:
+	case <-b.done:
+	}
+}
+
+// SetCurrent sets progress' current to arbitrary amount.
+func (b *Bar) SetCurrent(current int64, wdd ...time.Duration) {
+	select {
+	case b.operateState <- func(s *bState) {
+		for _, ar := range s.amountReceivers {
+			ar.NextAmount(current-s.current, wdd...)
+		}
+		s.current = current
+		if s.total > 0 && s.current >= s.total {
+			s.current = s.total
+			s.toComplete = true
+			go b.refreshTillShutdown()
+		}
+	}:
+	case <-b.done:
+	}
+}
+
+// Increment is a shorthand for b.IncrInt64(1, wdd...).
+func (b *Bar) Increment(wdd ...time.Duration) {
+	b.IncrInt64(1, wdd...)
+}
+
+// IncrBy is a shorthand for b.IncrInt64(int64(n), wdd...).
+func (b *Bar) IncrBy(n int, wdd ...time.Duration) {
+	b.IncrInt64(int64(n), wdd...)
+}
+
+// IncrInt64 increments progress bar by amount of n. wdd is an optional
+// work duration i.e. time.Since(start), which expected to be passed,
+// if any ewma based decorator is used.
+func (b *Bar) IncrInt64(n int64, wdd ...time.Duration) {
+	select {
+	case b.operateState <- func(s *bState) {
+		for _, ar := range s.amountReceivers {
+			ar.NextAmount(n, wdd...)
+		}
+		s.current += n
+		if s.total > 0 && s.current >= s.total {
+			s.current = s.total
+			s.toComplete = true
+			go b.refreshTillShutdown()
+		}
+	}:
+	case <-b.done:
+	}
+}
+
+// SetPriority changes bar's order among multiple bars. Zero is highest
+// priority, i.e. bar will be on top. If you don't need to set priority
+// dynamically, better use BarPriority option.
+func (b *Bar) SetPriority(priority int) {
+	select {
+	case <-b.done:
+	default:
+		b.container.setBarPriority(b, priority)
+	}
+}
+
+// Abort interrupts bar's running goroutine. Call this, if you'd like
+// to stop/remove bar before completion event. It has no effect after
+// completion event. If drop is true bar will be removed as well.
+func (b *Bar) Abort(drop bool) {
+	select {
+	case <-b.done:
+	default:
+		if drop {
+			b.container.dropBar(b)
+		}
+		b.cancel()
+	}
+}
+
+// Completed reports whether the bar is in completed state.
+func (b *Bar) Completed() bool {
+	select {
+	case b.operateState <- func(s *bState) { b.completed <- s.toComplete }:
+		return <-b.completed
+	case <-b.done:
+		return true
+	}
+}
+
+func (b *Bar) serve(ctx context.Context, s *bState) {
+	defer b.container.bwg.Done()
+	for {
+		select {
+		case op := <-b.operateState:
+			op(s)
+		case <-ctx.Done():
+			b.cacheState = s
+			close(b.done)
+			// Notifying decorators about shutdown event
+			for _, sl := range s.shutdownListeners {
+				sl.Shutdown()
+			}
+			return
+		}
+	}
+}
+
+func (b *Bar) render(tw int) {
+	if b.recoveredPanic != nil {
+		b.toShutdown = false
+		b.frameCh <- b.panicToFrame(tw)
+		return
+	}
+	select {
+	case b.operateState <- func(s *bState) {
+		defer func() {
+			// recovering if user defined decorator panics for example
+			if p := recover(); p != nil {
+				b.dlogger.Println(p)
+				b.recoveredPanic = p
+				b.toShutdown = !s.completeFlushed
+				b.frameCh <- b.panicToFrame(tw)
+			}
+		}()
+
+		st := newStatistics(s)
+		frame := s.draw(tw, st)
+		frame, b.extendedLines = s.extender(frame, tw, st)
+
+		b.toShutdown = s.toComplete && !s.completeFlushed
+		s.completeFlushed = s.toComplete
+		b.frameCh <- frame
+	}:
+	case <-b.done:
+		s := b.cacheState
+		st := newStatistics(s)
+		frame := s.draw(tw, st)
+		frame, b.extendedLines = s.extender(frame, tw, st)
+		b.frameCh <- frame
+	}
+}
+
+func (b *Bar) panicToFrame(termWidth int) io.Reader {
+	return strings.NewReader(fmt.Sprintf(fmt.Sprintf("%%.%dv\n", termWidth), b.recoveredPanic))
+}
+
+func (b *Bar) subscribeDecorators() {
+	var amountReceivers []decor.AmountReceiver
+	var shutdownListeners []decor.ShutdownListener
+	var averageAdjusters []decor.AverageAdjuster
+	b.TraverseDecorators(func(d decor.Decorator) {
+		if d, ok := d.(decor.AmountReceiver); ok {
+			amountReceivers = append(amountReceivers, d)
+		}
+		if d, ok := d.(decor.ShutdownListener); ok {
+			shutdownListeners = append(shutdownListeners, d)
+		}
+		if d, ok := d.(decor.AverageAdjuster); ok {
+			averageAdjusters = append(averageAdjusters, d)
+		}
+	})
+	b.operateState <- func(s *bState) {
+		s.amountReceivers = amountReceivers
+		s.shutdownListeners = shutdownListeners
+		s.averageAdjusters = averageAdjusters
+	}
+}
+
+func (b *Bar) refreshTillShutdown() {
+	for {
+		select {
+		case b.container.refreshCh <- time.Now():
+		case <-b.done:
+			return
+		}
+	}
+}
+
+func (b *Bar) wSyncTable() [][]chan int {
+	select {
+	case b.operateState <- func(s *bState) { b.syncTableCh <- s.wSyncTable() }:
+		return <-b.syncTableCh
+	case <-b.done:
+		return b.cacheState.wSyncTable()
+	}
+}
+
+func (s *bState) draw(termWidth int, stat *decor.Statistics) io.Reader {
+	for _, d := range s.pDecorators {
+		s.bufP.WriteString(d.Decor(stat))
+	}
+
+	for _, d := range s.aDecorators {
+		s.bufA.WriteString(d.Decor(stat))
+	}
+
+	s.bufA.WriteByte('\n')
+
+	prependCount := utf8.RuneCount(s.bufP.Bytes())
+	appendCount := utf8.RuneCount(s.bufA.Bytes()) - 1
+
+	if fitWidth := s.width; termWidth > 1 {
+		if !s.trimSpace {
+			// reserve space for edge spaces
+			termWidth -= 2
+			s.bufB.WriteByte(' ')
+			defer s.bufB.WriteByte(' ')
+		}
+		if prependCount+s.width+appendCount > termWidth {
+			fitWidth = termWidth - prependCount - appendCount
+		}
+		s.filler.Fill(s.bufB, fitWidth, stat)
+	}
+
+	return io.MultiReader(s.bufP, s.bufB, s.bufA)
+}
+
+func (s *bState) wSyncTable() [][]chan int {
+	columns := make([]chan int, 0, len(s.pDecorators)+len(s.aDecorators))
+	var pCount int
+	for _, d := range s.pDecorators {
+		if ch, ok := d.Sync(); ok {
+			columns = append(columns, ch)
+			pCount++
+		}
+	}
+	var aCount int
+	for _, d := range s.aDecorators {
+		if ch, ok := d.Sync(); ok {
+			columns = append(columns, ch)
+			aCount++
+		}
+	}
+	table := make([][]chan int, 2)
+	table[0] = columns[0:pCount]
+	table[1] = columns[pCount : pCount+aCount : pCount+aCount]
+	return table
+}
+
+func newStatistics(s *bState) *decor.Statistics {
+	return &decor.Statistics{
+		ID:        s.id,
+		Completed: s.completeFlushed,
+		Total:     s.total,
+		Current:   s.current,
+	}
+}
+
+func extractBaseDecorator(d decor.Decorator) decor.Decorator {
+	if d, ok := d.(decor.Wrapper); ok {
+		return extractBaseDecorator(d.Base())
+	}
+	return d
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/bar_filler.go b/vendor/github.com/vbauerster/mpb/v4/bar_filler.go
new file mode 100644
index 000000000..0d751a68d
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/bar_filler.go
@@ -0,0 +1,137 @@
+package mpb
+
+import (
+	"io"
+	"unicode/utf8"
+
+	"github.com/vbauerster/mpb/v4/decor"
+	"github.com/vbauerster/mpb/v4/internal"
+)
+
+const (
+	rLeft = iota
+	rFill
+	rTip
+	rEmpty
+	rRight
+	rRevTip
+	rRefill
+)
+
+// DefaultBarStyle is applied when bar constructed with *Progress.AddBar method.
+//
+//	'1th rune' stands for left boundary rune
+//
+//	'2th rune' stands for fill rune
+//
+//	'3th rune' stands for tip rune
+//
+//	'4th rune' stands for empty rune
+//
+//	'5th rune' stands for right boundary rune
+//
+//	'6th rune' stands for reverse tip rune
+//
+//	'7th rune' stands for refill rune
+//
+const DefaultBarStyle string = "[=>-]<+"
+
+type barFiller struct {
+	format  [][]byte
+	tip     []byte
+	refill  int64
+	reverse bool
+	flush   func(w io.Writer, bb [][]byte)
+}
+
+// NewBarFiller constucts mpb.Filler, to be used with *Progress.Add method.
+func NewBarFiller(style string, reverse bool) Filler {
+	if style == "" {
+		style = DefaultBarStyle
+	}
+	bf := &barFiller{
+		format: make([][]byte, utf8.RuneCountInString(style)),
+	}
+	bf.SetStyle(style)
+	bf.SetReverse(reverse)
+	return bf
+}
+
+func (s *barFiller) SetStyle(style string) {
+	if !utf8.ValidString(style) {
+		return
+	}
+	src := make([][]byte, 0, utf8.RuneCountInString(style))
+	for _, r := range style {
+		src = append(src, []byte(string(r)))
+	}
+	copy(s.format, src)
+	if s.reverse {
+		s.tip = s.format[rRevTip]
+	} else {
+		s.tip = s.format[rTip]
+	}
+}
+
+func (s *barFiller) SetReverse(reverse bool) {
+	if reverse {
+		s.tip = s.format[rRevTip]
+		s.flush = func(w io.Writer, bb [][]byte) {
+			for i := len(bb) - 1; i >= 0; i-- {
+				w.Write(bb[i])
+			}
+		}
+	} else {
+		s.tip = s.format[rTip]
+		s.flush = func(w io.Writer, bb [][]byte) {
+			for i := 0; i < len(bb); i++ {
+				w.Write(bb[i])
+			}
+		}
+	}
+	s.reverse = reverse
+}
+
+func (s *barFiller) SetRefill(amount int64) {
+	s.refill = amount
+}
+
+func (s *barFiller) Fill(w io.Writer, width int, stat *decor.Statistics) {
+	// don't count rLeft and rRight as progress
+	width -= 2
+	if width < 2 {
+		return
+	}
+	w.Write(s.format[rLeft])
+	defer w.Write(s.format[rRight])
+
+	bb := make([][]byte, width)
+
+	cwidth := int(internal.PercentageRound(stat.Total, stat.Current, width))
+
+	for i := 0; i < cwidth; i++ {
+		bb[i] = s.format[rFill]
+	}
+
+	if s.refill > 0 {
+		var rwidth int
+		if s.refill > stat.Current {
+			rwidth = cwidth
+		} else {
+			rwidth = int(internal.PercentageRound(stat.Total, int64(s.refill), width))
+		}
+		for i := 0; i < rwidth; i++ {
+			bb[i] = s.format[rRefill]
+		}
+	}
+
+	if cwidth > 0 && cwidth < width {
+		bb[cwidth-1] = s.tip
+	}
+
+	for i := cwidth; i < width; i++ {
+		bb[i] = s.format[rEmpty]
+	}
+
+	s.flush(w, bb)
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/bar_option.go b/vendor/github.com/vbauerster/mpb/v4/bar_option.go
new file mode 100644
index 000000000..bb79ac6a4
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/bar_option.go
@@ -0,0 +1,209 @@
+package mpb
+
+import (
+	"bytes"
+	"io"
+
+	"github.com/vbauerster/mpb/v4/decor"
+)
+
+// BarOption is a function option which changes the default behavior of a bar.
+type BarOption func(*bState)
+
+type mergeWrapper interface {
+	MergeUnwrap() []decor.Decorator
+}
+
+func (s *bState) addDecorators(dest *[]decor.Decorator, decorators ...decor.Decorator) {
+	for _, decorator := range decorators {
+		if mw, ok := decorator.(mergeWrapper); ok {
+			*dest = append(*dest, mw.MergeUnwrap()...)
+		}
+		*dest = append(*dest, decorator)
+	}
+}
+
+// AppendDecorators let you inject decorators to the bar's right side.
+func AppendDecorators(decorators ...decor.Decorator) BarOption {
+	return func(s *bState) {
+		s.addDecorators(&s.aDecorators, decorators...)
+	}
+}
+
+// PrependDecorators let you inject decorators to the bar's left side.
+func PrependDecorators(decorators ...decor.Decorator) BarOption {
+	return func(s *bState) {
+		s.addDecorators(&s.pDecorators, decorators...)
+	}
+}
+
+// BarID sets bar id.
+func BarID(id int) BarOption {
+	return func(s *bState) {
+		s.id = id
+	}
+}
+
+// BarWidth sets bar width independent of the container.
+func BarWidth(width int) BarOption {
+	return func(s *bState) {
+		s.width = width
+	}
+}
+
+// BarReplaceOnComplete is deprecated. Use BarParkTo instead.
+func BarReplaceOnComplete(runningBar *Bar) BarOption {
+	return BarParkTo(runningBar)
+}
+
+// BarParkTo parks constructed bar into the runningBar. In other words,
+// constructed bar will replace runningBar after it has been completed.
+func BarParkTo(runningBar *Bar) BarOption {
+	if runningBar == nil {
+		return nil
+	}
+	return func(s *bState) {
+		s.runningBar = runningBar
+	}
+}
+
+// BarRemoveOnComplete removes bar filler and decorators if any, on
+// complete event.
+func BarRemoveOnComplete() BarOption {
+	return func(s *bState) {
+		s.dropOnComplete = true
+	}
+}
+
+// BarClearOnComplete clears bar filler only, on complete event.
+func BarClearOnComplete() BarOption {
+	return BarOnComplete("")
+}
+
+// BarOnComplete replaces bar filler with message, on complete event.
+func BarOnComplete(message string) BarOption {
+	return func(s *bState) {
+		s.filler = makeBarOnCompleteFiller(s.baseF, message)
+	}
+}
+
+func makeBarOnCompleteFiller(filler Filler, message string) Filler {
+	return FillerFunc(func(w io.Writer, width int, st *decor.Statistics) {
+		if st.Completed {
+			io.WriteString(w, message)
+		} else {
+			filler.Fill(w, width, st)
+		}
+	})
+}
+
+// BarPriority sets bar's priority. Zero is highest priority, i.e. bar
+// will be on top. If `BarReplaceOnComplete` option is supplied, this
+// option is ignored.
+func BarPriority(priority int) BarOption {
+	return func(s *bState) {
+		s.priority = priority
+	}
+}
+
+// BarExtender is an option to extend bar to the next new line, with
+// arbitrary output.
+func BarExtender(extender Filler) BarOption {
+	if extender == nil {
+		return nil
+	}
+	return func(s *bState) {
+		s.extender = makeExtFunc(extender)
+	}
+}
+
+func makeExtFunc(extender Filler) extFunc {
+	buf := new(bytes.Buffer)
+	nl := []byte("\n")
+	return func(r io.Reader, tw int, st *decor.Statistics) (io.Reader, int) {
+		extender.Fill(buf, tw, st)
+		return io.MultiReader(r, buf), bytes.Count(buf.Bytes(), nl)
+	}
+}
+
+// TrimSpace trims bar's edge spaces.
+func TrimSpace() BarOption {
+	return func(s *bState) {
+		s.trimSpace = true
+	}
+}
+
+// BarStyle overrides mpb.DefaultBarStyle, for example BarStyle("╢▌▌░╟").
+// If you need to override `reverse tip` and `refill rune` set 6th and
+// 7th rune respectively, for example BarStyle("[=>-]<+").
+func BarStyle(style string) BarOption {
+	if style == "" {
+		return nil
+	}
+	type styleSetter interface {
+		SetStyle(string)
+	}
+	return func(s *bState) {
+		if t, ok := s.baseF.(styleSetter); ok {
+			t.SetStyle(style)
+		}
+	}
+}
+
+// BarNoPop disables bar pop out of container. Effective when
+// PopCompletedMode of container is enabled.
+func BarNoPop() BarOption {
+	return func(s *bState) {
+		s.noPop = true
+	}
+}
+
+// BarReverse reverse mode, bar will progress from right to left.
+func BarReverse() BarOption {
+	type revSetter interface {
+		SetReverse(bool)
+	}
+	return func(s *bState) {
+		if t, ok := s.baseF.(revSetter); ok {
+			t.SetReverse(true)
+		}
+	}
+}
+
+// SpinnerStyle sets custom spinner style.
+// Effective when Filler type is spinner.
+func SpinnerStyle(frames []string) BarOption {
+	if len(frames) == 0 {
+		return nil
+	}
+	chk := func(filler Filler) (interface{}, bool) {
+		t, ok := filler.(*spinnerFiller)
+		return t, ok
+	}
+	cb := func(t interface{}) {
+		t.(*spinnerFiller).frames = frames
+	}
+	return MakeFillerTypeSpecificBarOption(chk, cb)
+}
+
+// MakeFillerTypeSpecificBarOption makes BarOption specific to Filler's
+// actual type. If you implement your own Filler, so most probably
+// you'll need this. See BarStyle or SpinnerStyle for example.
+func MakeFillerTypeSpecificBarOption(
+	typeChecker func(Filler) (interface{}, bool),
+	cb func(interface{}),
+) BarOption {
+	return func(s *bState) {
+		if t, ok := typeChecker(s.baseF); ok {
+			cb(t)
+		}
+	}
+}
+
+// BarOptOnCond returns option when condition evaluates to true.
+func BarOptOnCond(option BarOption, condition func() bool) BarOption {
+	if condition() {
+		return option
+	}
+	return nil
+}
diff --git a/vendor/github.com/vbauerster/mpb/cwriter/writer.go b/vendor/github.com/vbauerster/mpb/v4/cwriter/writer.go
index 638237c18..9ec1ec66b 100644
--- a/vendor/github.com/vbauerster/mpb/cwriter/writer.go
+++ b/vendor/github.com/vbauerster/mpb/v4/cwriter/writer.go
@@ -7,59 +7,50 @@ import (
 	"io"
 	"os"
 
-	isatty "github.com/mattn/go-isatty"
 	"golang.org/x/crypto/ssh/terminal"
 )
 
-// ESC is the ASCII code for escape character
-const ESC = 27
-
+// NotATTY not a TeleTYpewriter error.
 var NotATTY = errors.New("not a terminal")
 
-var (
-	cursorUp           = fmt.Sprintf("%c[%dA", ESC, 1)
-	clearLine          = fmt.Sprintf("%c[2K\r", ESC)
-	clearCursorAndLine = cursorUp + clearLine
-)
+var cuuAndEd = fmt.Sprintf("%c[%%dA%[1]c[J", 27)
 
-// Writer is a buffered the writer that updates the terminal.  The
+// Writer is a buffered the writer that updates the terminal. The
 // contents of writer will be flushed when Flush is called.
 type Writer struct {
 	out        io.Writer
 	buf        bytes.Buffer
-	isTerminal bool
-	fd         int
 	lineCount  int
+	fd         uintptr
+	isTerminal bool
 }
 
-// New returns a new Writer with defaults
+// New returns a new Writer with defaults.
 func New(out io.Writer) *Writer {
 	w := &Writer{out: out}
 	if f, ok := out.(*os.File); ok {
-		fd := f.Fd()
-		w.isTerminal = isatty.IsTerminal(fd)
-		w.fd = int(fd)
+		w.fd = f.Fd()
+		w.isTerminal = terminal.IsTerminal(int(w.fd))
 	}
 	return w
 }
 
-// Flush flushes the underlying buffer
-func (w *Writer) Flush(lineCount int) error {
-	err := w.clearLines()
-	w.lineCount = lineCount
-	// WriteTo takes care of w.buf.Reset
-	if _, e := w.buf.WriteTo(w.out); err == nil {
-		err = e
+// Flush flushes the underlying buffer.
+func (w *Writer) Flush(lineCount int) (err error) {
+	if w.lineCount > 0 {
+		w.clearLines()
 	}
-	return err
+	w.lineCount = lineCount
+	_, err = w.buf.WriteTo(w.out)
+	return
 }
 
-// Write appends the contents of p to the underlying buffer
+// Write appends the contents of p to the underlying buffer.
 func (w *Writer) Write(p []byte) (n int, err error) {
 	return w.buf.Write(p)
 }
 
-// WriteString writes string to the underlying buffer
+// WriteString writes string to the underlying buffer.
 func (w *Writer) WriteString(s string) (n int, err error) {
 	return w.buf.WriteString(s)
 }
@@ -73,7 +64,7 @@ func (w *Writer) ReadFrom(r io.Reader) (n int64, err error) {
 // GetWidth returns width of underlying terminal.
 func (w *Writer) GetWidth() (int, error) {
 	if w.isTerminal {
-		tw, _, err := terminal.GetSize(w.fd)
+		tw, _, err := terminal.GetSize(int(w.fd))
 		return tw, err
 	}
 	return -1, NotATTY
diff --git a/vendor/github.com/vbauerster/mpb/v4/cwriter/writer_posix.go b/vendor/github.com/vbauerster/mpb/v4/cwriter/writer_posix.go
new file mode 100644
index 000000000..3fb8b7d75
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/cwriter/writer_posix.go
@@ -0,0 +1,9 @@
+// +build !windows
+
+package cwriter
+
+import "fmt"
+
+func (w *Writer) clearLines() {
+	fmt.Fprintf(w.out, cuuAndEd, w.lineCount)
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/cwriter/writer_windows.go b/vendor/github.com/vbauerster/mpb/v4/cwriter/writer_windows.go
new file mode 100644
index 000000000..712528900
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/cwriter/writer_windows.go
@@ -0,0 +1,60 @@
+// +build windows
+
+package cwriter
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+)
+
+var kernel32 = syscall.NewLazyDLL("kernel32.dll")
+
+var (
+	procGetConsoleScreenBufferInfo = kernel32.NewProc("GetConsoleScreenBufferInfo")
+	procSetConsoleCursorPosition   = kernel32.NewProc("SetConsoleCursorPosition")
+	procFillConsoleOutputCharacter = kernel32.NewProc("FillConsoleOutputCharacterW")
+	procFillConsoleOutputAttribute = kernel32.NewProc("FillConsoleOutputAttribute")
+)
+
+type coord struct {
+	x int16
+	y int16
+}
+
+type smallRect struct {
+	left   int16
+	top    int16
+	right  int16
+	bottom int16
+}
+
+type consoleScreenBufferInfo struct {
+	size              coord
+	cursorPosition    coord
+	attributes        uint16
+	window            smallRect
+	maximumWindowSize coord
+}
+
+func (w *Writer) clearLines() {
+	if !w.isTerminal {
+		fmt.Fprintf(w.out, cuuAndEd, w.lineCount)
+	}
+	var info consoleScreenBufferInfo
+	procGetConsoleScreenBufferInfo.Call(w.fd, uintptr(unsafe.Pointer(&info)))
+
+	info.cursorPosition.y -= int16(w.lineCount)
+	if info.cursorPosition.y < 0 {
+		info.cursorPosition.y = 0
+	}
+	procSetConsoleCursorPosition.Call(w.fd, uintptr(uint32(uint16(info.cursorPosition.y))<<16|uint32(uint16(info.cursorPosition.x))))
+
+	// clear the lines
+	cursor := coord{
+		x: info.window.left,
+		y: info.cursorPosition.y,
+	}
+	count := uint32(info.size.x) * uint32(w.lineCount)
+	procFillConsoleOutputCharacter.Call(w.fd, uintptr(' '), uintptr(count), *(*uintptr)(unsafe.Pointer(&cursor)), uintptr(unsafe.Pointer(new(uint32))))
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/counters.go b/vendor/github.com/vbauerster/mpb/v4/decor/counters.go
new file mode 100644
index 000000000..32bcdf76a
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/counters.go
@@ -0,0 +1,84 @@
+package decor
+
+import (
+	"fmt"
+)
+
+const (
+	_ = iota
+	UnitKiB
+	UnitKB
+)
+
+// CountersNoUnit is a wrapper around Counters with no unit param.
+func CountersNoUnit(pairFmt string, wcc ...WC) Decorator {
+	return Counters(0, pairFmt, wcc...)
+}
+
+// CountersKibiByte is a wrapper around Counters with predefined unit
+// UnitKiB (bytes/1024).
+func CountersKibiByte(pairFmt string, wcc ...WC) Decorator {
+	return Counters(UnitKiB, pairFmt, wcc...)
+}
+
+// CountersKiloByte is a wrapper around Counters with predefined unit
+// UnitKB (bytes/1000).
+func CountersKiloByte(pairFmt string, wcc ...WC) Decorator {
+	return Counters(UnitKB, pairFmt, wcc...)
+}
+
+// Counters decorator with dynamic unit measure adjustment.
+//
+//	`unit` one of [0|UnitKiB|UnitKB] zero for no unit
+//
+//	`pairFmt` printf compatible verbs for current and total, like "%f" or "%d"
+//
+//	`wcc` optional WC config
+//
+// pairFmt example if unit=UnitKB:
+//
+//	pairFmt="%.1f / %.1f"   output: "1.0MB / 12.0MB"
+//	pairFmt="% .1f / % .1f" output: "1.0 MB / 12.0 MB"
+//	pairFmt="%d / %d"       output: "1MB / 12MB"
+//	pairFmt="% d / % d"     output: "1 MB / 12 MB"
+//
+func Counters(unit int, pairFmt string, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	d := &countersDecorator{
+		WC:       wc.Init(),
+		producer: chooseSizeProducer(unit, pairFmt),
+	}
+	return d
+}
+
+type countersDecorator struct {
+	WC
+	producer func(*Statistics) string
+}
+
+func (d *countersDecorator) Decor(st *Statistics) string {
+	return d.FormatMsg(d.producer(st))
+}
+
+func chooseSizeProducer(unit int, format string) func(*Statistics) string {
+	if format == "" {
+		format = "%d / %d"
+	}
+	switch unit {
+	case UnitKiB:
+		return func(st *Statistics) string {
+			return fmt.Sprintf(format, SizeB1024(st.Current), SizeB1024(st.Total))
+		}
+	case UnitKB:
+		return func(st *Statistics) string {
+			return fmt.Sprintf(format, SizeB1000(st.Current), SizeB1000(st.Total))
+		}
+	default:
+		return func(st *Statistics) string {
+			return fmt.Sprintf(format, st.Current, st.Total)
+		}
+	}
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/decorator.go b/vendor/github.com/vbauerster/mpb/v4/decor/decorator.go
new file mode 100644
index 000000000..5c0d16880
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/decorator.go
@@ -0,0 +1,173 @@
+package decor
+
+import (
+	"fmt"
+	"time"
+	"unicode/utf8"
+)
+
+const (
+	// DidentRight bit specifies identation direction.
+	// |foo   |b     | With DidentRight
+	// |   foo|     b| Without DidentRight
+	DidentRight = 1 << iota
+
+	// DextraSpace bit adds extra space, makes sense with DSyncWidth only.
+	// When DidentRight bit set, the space will be added to the right,
+	// otherwise to the left.
+	DextraSpace
+
+	// DSyncWidth bit enables same column width synchronization.
+	// Effective with multiple bars only.
+	DSyncWidth
+
+	// DSyncWidthR is shortcut for DSyncWidth|DidentRight
+	DSyncWidthR = DSyncWidth | DidentRight
+
+	// DSyncSpace is shortcut for DSyncWidth|DextraSpace
+	DSyncSpace = DSyncWidth | DextraSpace
+
+	// DSyncSpaceR is shortcut for DSyncWidth|DextraSpace|DidentRight
+	DSyncSpaceR = DSyncWidth | DextraSpace | DidentRight
+)
+
+// TimeStyle enum.
+type TimeStyle int
+
+// TimeStyle kinds.
+const (
+	ET_STYLE_GO TimeStyle = iota
+	ET_STYLE_HHMMSS
+	ET_STYLE_HHMM
+	ET_STYLE_MMSS
+)
+
+// Statistics consists of progress related statistics, that Decorator
+// may need.
+type Statistics struct {
+	ID        int
+	Completed bool
+	Total     int64
+	Current   int64
+}
+
+// Decorator interface.
+// Implementors should embed WC type, that way only single method
+// Decor(*Statistics) needs to be implemented, the rest will be handled
+// by WC type.
+type Decorator interface {
+	Configurator
+	Synchronizer
+	Decor(*Statistics) string
+}
+
+// Synchronizer interface.
+// All decorators implement this interface implicitly. Its Sync
+// method exposes width sync channel, if DSyncWidth bit is set.
+type Synchronizer interface {
+	Sync() (chan int, bool)
+}
+
+// Configurator interface.
+type Configurator interface {
+	GetConf() WC
+	SetConf(WC)
+}
+
+// Wrapper interface.
+// If you're implementing custom Decorator by wrapping a built-in one,
+// it is necessary to implement this interface to retain functionality
+// of built-in Decorator.
+type Wrapper interface {
+	Base() Decorator
+}
+
+// AmountReceiver interface.
+// EWMA based decorators need to implement this one.
+type AmountReceiver interface {
+	NextAmount(int64, ...time.Duration)
+}
+
+// ShutdownListener interface.
+// If decorator needs to be notified once upon bar shutdown event, so
+// this is the right interface to implement.
+type ShutdownListener interface {
+	Shutdown()
+}
+
+// AverageAdjuster interface.
+// Average decorators should implement this interface to provide start
+// time adjustment facility, for resume-able tasks.
+type AverageAdjuster interface {
+	AverageAdjust(time.Time)
+}
+
+// CBFunc convenience call back func type.
+type CBFunc func(Decorator)
+
+// Global convenience instances of WC with sync width bit set.
+var (
+	WCSyncWidth  = WC{C: DSyncWidth}
+	WCSyncWidthR = WC{C: DSyncWidthR}
+	WCSyncSpace  = WC{C: DSyncSpace}
+	WCSyncSpaceR = WC{C: DSyncSpaceR}
+)
+
+// WC is a struct with two public fields W and C, both of int type.
+// W represents width and C represents bit set of width related config.
+// A decorator should embed WC, to enable width synchronization.
+type WC struct {
+	W            int
+	C            int
+	dynFormat    string
+	staticFormat string
+	wsync        chan int
+}
+
+// FormatMsg formats final message according to WC.W and WC.C.
+// Should be called by any Decorator implementation.
+func (wc *WC) FormatMsg(msg string) string {
+	if (wc.C & DSyncWidth) != 0 {
+		wc.wsync <- utf8.RuneCountInString(msg)
+		max := <-wc.wsync
+		if (wc.C & DextraSpace) != 0 {
+			max++
+		}
+		return fmt.Sprintf(fmt.Sprintf(wc.dynFormat, max), msg)
+	}
+	return fmt.Sprintf(wc.staticFormat, msg)
+}
+
+// Init initializes width related config.
+func (wc *WC) Init() WC {
+	wc.dynFormat = "%%"
+	if (wc.C & DidentRight) != 0 {
+		wc.dynFormat += "-"
+	}
+	wc.dynFormat += "%ds"
+	wc.staticFormat = fmt.Sprintf(wc.dynFormat, wc.W)
+	if (wc.C & DSyncWidth) != 0 {
+		// it's deliberate choice to override wsync on each Init() call,
+		// this way globals like WCSyncSpace can be reused
+		wc.wsync = make(chan int)
+	}
+	return *wc
+}
+
+// Sync is implementation of Synchronizer interface.
+func (wc *WC) Sync() (chan int, bool) {
+	if (wc.C&DSyncWidth) != 0 && wc.wsync == nil {
+		panic(fmt.Sprintf("%T is not initialized", wc))
+	}
+	return wc.wsync, (wc.C & DSyncWidth) != 0
+}
+
+// GetConf is implementation of Configurator interface.
+func (wc *WC) GetConf() WC {
+	return *wc
+}
+
+// SetConf is implementation of Configurator interface.
+func (wc *WC) SetConf(conf WC) {
+	*wc = conf.Init()
+}
diff --git a/vendor/github.com/vbauerster/mpb/decor/doc.go b/vendor/github.com/vbauerster/mpb/v4/decor/doc.go
index 561a8677c..b595e8015 100644
--- a/vendor/github.com/vbauerster/mpb/decor/doc.go
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/doc.go
@@ -1,9 +1,5 @@
-// Copyright (C) 2016-2018 Vladimir Bauer
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
 /*
- Package decor contains common decorators used by "github.com/vbauerster/mpb" package.
+ Package decor provides common decorators for "github.com/vbauerster/mpb/v4" module.
 
  Some decorators returned by this package might have a closure state. It is ok to use
  decorators concurrently, unless you share the same decorator among multiple
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/elapsed.go b/vendor/github.com/vbauerster/mpb/v4/decor/elapsed.go
new file mode 100644
index 000000000..ac2873143
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/elapsed.go
@@ -0,0 +1,48 @@
+package decor
+
+import (
+	"time"
+)
+
+// Elapsed decorator. It's wrapper of NewElapsed.
+//
+//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
+//
+//	`wcc` optional WC config
+func Elapsed(style TimeStyle, wcc ...WC) Decorator {
+	return NewElapsed(style, time.Now(), wcc...)
+}
+
+// NewElapsed returns elapsed time decorator.
+//
+//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
+//
+//	`startTime` start time
+//
+//	`wcc` optional WC config
+func NewElapsed(style TimeStyle, startTime time.Time, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	d := &elapsedDecorator{
+		WC:        wc.Init(),
+		startTime: startTime,
+		producer:  chooseTimeProducer(style),
+	}
+	return d
+}
+
+type elapsedDecorator struct {
+	WC
+	startTime time.Time
+	producer  func(time.Duration) string
+	msg       string
+}
+
+func (d *elapsedDecorator) Decor(st *Statistics) string {
+	if !st.Completed {
+		d.msg = d.producer(time.Since(d.startTime))
+	}
+	return d.FormatMsg(d.msg)
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/eta.go b/vendor/github.com/vbauerster/mpb/v4/decor/eta.go
new file mode 100644
index 000000000..818cded17
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/eta.go
@@ -0,0 +1,212 @@
+package decor
+
+import (
+	"fmt"
+	"math"
+	"time"
+
+	"github.com/VividCortex/ewma"
+)
+
+// TimeNormalizer interface. Implementors could be passed into
+// MovingAverageETA, in order to affect i.e. normalize its output.
+type TimeNormalizer interface {
+	Normalize(time.Duration) time.Duration
+}
+
+// TimeNormalizerFunc is function type adapter to convert function
+// into TimeNormalizer.
+type TimeNormalizerFunc func(time.Duration) time.Duration
+
+func (f TimeNormalizerFunc) Normalize(src time.Duration) time.Duration {
+	return f(src)
+}
+
+// EwmaETA exponential-weighted-moving-average based ETA decorator.
+// Note that it's necessary to supply bar.Incr* methods with incremental
+// work duration as second argument, in order for this decorator to
+// work correctly. This decorator is a wrapper of MovingAverageETA.
+func EwmaETA(style TimeStyle, age float64, wcc ...WC) Decorator {
+	var average MovingAverage
+	if age == 0 {
+		average = ewma.NewMovingAverage()
+	} else {
+		average = ewma.NewMovingAverage(age)
+	}
+	return MovingAverageETA(style, average, nil, wcc...)
+}
+
+// MovingAverageETA decorator relies on MovingAverage implementation to calculate its average.
+//
+//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
+//
+//	`average` implementation of MovingAverage interface
+//
+//	`normalizer` available implementations are [FixedIntervalTimeNormalizer|MaxTolerateTimeNormalizer]
+//
+//	`wcc` optional WC config
+func MovingAverageETA(style TimeStyle, average MovingAverage, normalizer TimeNormalizer, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	d := &movingAverageETA{
+		WC:         wc.Init(),
+		average:    average,
+		normalizer: normalizer,
+		producer:   chooseTimeProducer(style),
+	}
+	return d
+}
+
+type movingAverageETA struct {
+	WC
+	average    ewma.MovingAverage
+	normalizer TimeNormalizer
+	producer   func(time.Duration) string
+}
+
+func (d *movingAverageETA) Decor(st *Statistics) string {
+	v := math.Round(d.average.Value())
+	remaining := time.Duration((st.Total - st.Current) * int64(v))
+	if d.normalizer != nil {
+		remaining = d.normalizer.Normalize(remaining)
+	}
+	return d.FormatMsg(d.producer(remaining))
+}
+
+func (d *movingAverageETA) NextAmount(n int64, wdd ...time.Duration) {
+	var workDuration time.Duration
+	for _, wd := range wdd {
+		workDuration = wd
+	}
+	durPerItem := float64(workDuration) / float64(n)
+	if math.IsInf(durPerItem, 0) || math.IsNaN(durPerItem) {
+		return
+	}
+	d.average.Add(durPerItem)
+}
+
+// AverageETA decorator. It's wrapper of NewAverageETA.
+//
+//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
+//
+//	`wcc` optional WC config
+func AverageETA(style TimeStyle, wcc ...WC) Decorator {
+	return NewAverageETA(style, time.Now(), nil, wcc...)
+}
+
+// NewAverageETA decorator with user provided start time.
+//
+//	`style` one of [ET_STYLE_GO|ET_STYLE_HHMMSS|ET_STYLE_HHMM|ET_STYLE_MMSS]
+//
+//	`startTime` start time
+//
+//	`normalizer` available implementations are [FixedIntervalTimeNormalizer|MaxTolerateTimeNormalizer]
+//
+//	`wcc` optional WC config
+func NewAverageETA(style TimeStyle, startTime time.Time, normalizer TimeNormalizer, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	d := &averageETA{
+		WC:         wc.Init(),
+		startTime:  startTime,
+		normalizer: normalizer,
+		producer:   chooseTimeProducer(style),
+	}
+	return d
+}
+
+type averageETA struct {
+	WC
+	startTime  time.Time
+	normalizer TimeNormalizer
+	producer   func(time.Duration) string
+}
+
+func (d *averageETA) Decor(st *Statistics) string {
+	var remaining time.Duration
+	if st.Current != 0 {
+		durPerItem := float64(time.Since(d.startTime)) / float64(st.Current)
+		durPerItem = math.Round(durPerItem)
+		remaining = time.Duration((st.Total - st.Current) * int64(durPerItem))
+		if d.normalizer != nil {
+			remaining = d.normalizer.Normalize(remaining)
+		}
+	}
+	return d.FormatMsg(d.producer(remaining))
+}
+
+func (d *averageETA) AverageAdjust(startTime time.Time) {
+	d.startTime = startTime
+}
+
+// MaxTolerateTimeNormalizer returns implementation of TimeNormalizer.
+func MaxTolerateTimeNormalizer(maxTolerate time.Duration) TimeNormalizer {
+	var normalized time.Duration
+	var lastCall time.Time
+	return TimeNormalizerFunc(func(remaining time.Duration) time.Duration {
+		if diff := normalized - remaining; diff <= 0 || diff > maxTolerate || remaining < time.Minute {
+			normalized = remaining
+			lastCall = time.Now()
+			return remaining
+		}
+		normalized -= time.Since(lastCall)
+		lastCall = time.Now()
+		return normalized
+	})
+}
+
+// FixedIntervalTimeNormalizer returns implementation of TimeNormalizer.
+func FixedIntervalTimeNormalizer(updInterval int) TimeNormalizer {
+	var normalized time.Duration
+	var lastCall time.Time
+	var count int
+	return TimeNormalizerFunc(func(remaining time.Duration) time.Duration {
+		if count == 0 || remaining < time.Minute {
+			count = updInterval
+			normalized = remaining
+			lastCall = time.Now()
+			return remaining
+		}
+		count--
+		normalized -= time.Since(lastCall)
+		lastCall = time.Now()
+		return normalized
+	})
+}
+
+func chooseTimeProducer(style TimeStyle) func(time.Duration) string {
+	switch style {
+	case ET_STYLE_HHMMSS:
+		return func(remaining time.Duration) string {
+			hours := int64(remaining/time.Hour) % 60
+			minutes := int64(remaining/time.Minute) % 60
+			seconds := int64(remaining/time.Second) % 60
+			return fmt.Sprintf("%02d:%02d:%02d", hours, minutes, seconds)
+		}
+	case ET_STYLE_HHMM:
+		return func(remaining time.Duration) string {
+			hours := int64(remaining/time.Hour) % 60
+			minutes := int64(remaining/time.Minute) % 60
+			return fmt.Sprintf("%02d:%02d", hours, minutes)
+		}
+	case ET_STYLE_MMSS:
+		return func(remaining time.Duration) string {
+			hours := int64(remaining/time.Hour) % 60
+			minutes := int64(remaining/time.Minute) % 60
+			seconds := int64(remaining/time.Second) % 60
+			if hours > 0 {
+				return fmt.Sprintf("%02d:%02d:%02d", hours, minutes, seconds)
+			}
+			return fmt.Sprintf("%02d:%02d", minutes, seconds)
+		}
+	default:
+		return func(remaining time.Duration) string {
+			// strip off nanoseconds
+			return ((remaining / time.Second) * time.Second).String()
+		}
+	}
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/merge.go b/vendor/github.com/vbauerster/mpb/v4/decor/merge.go
new file mode 100644
index 000000000..fdf9e107b
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/merge.go
@@ -0,0 +1,97 @@
+package decor
+
+import (
+	"fmt"
+	"unicode/utf8"
+)
+
+// Merge wraps its decorator argument with intention to sync width
+// with several decorators of another bar. Visual example:
+//
+//    +----+--------+---------+--------+
+//    | B1 |      MERGE(D, P1, Pn)     |
+//    +----+--------+---------+--------+
+//    | B2 |   D0   |   D1    |   Dn   |
+//    +----+--------+---------+--------+
+//
+func Merge(decorator Decorator, placeholders ...WC) Decorator {
+	if _, ok := decorator.Sync(); !ok || len(placeholders) == 0 {
+		return decorator
+	}
+	md := &mergeDecorator{
+		Decorator:    decorator,
+		wc:           decorator.GetConf(),
+		placeHolders: make([]*placeHolderDecorator, len(placeholders)),
+	}
+	decorator.SetConf(WC{})
+	for i, wc := range placeholders {
+		if (wc.C & DSyncWidth) == 0 {
+			return decorator
+		}
+		md.placeHolders[i] = &placeHolderDecorator{
+			WC:  wc.Init(),
+			wch: make(chan int),
+		}
+	}
+	return md
+}
+
+type mergeDecorator struct {
+	Decorator
+	wc           WC
+	placeHolders []*placeHolderDecorator
+}
+
+func (d *mergeDecorator) GetConf() WC {
+	return d.wc
+}
+
+func (d *mergeDecorator) SetConf(conf WC) {
+	d.wc = conf.Init()
+}
+
+func (d *mergeDecorator) MergeUnwrap() []Decorator {
+	decorators := make([]Decorator, len(d.placeHolders))
+	for i, ph := range d.placeHolders {
+		decorators[i] = ph
+	}
+	return decorators
+}
+
+func (d *mergeDecorator) Sync() (chan int, bool) {
+	return d.wc.Sync()
+}
+
+func (d *mergeDecorator) Base() Decorator {
+	return d.Decorator
+}
+
+func (d *mergeDecorator) Decor(st *Statistics) string {
+	msg := d.Decorator.Decor(st)
+	msgLen := utf8.RuneCountInString(msg)
+
+	var space int
+	for _, ph := range d.placeHolders {
+		space += <-ph.wch
+	}
+
+	d.wc.wsync <- msgLen - space
+
+	max := <-d.wc.wsync
+	if (d.wc.C & DextraSpace) != 0 {
+		max++
+	}
+	return fmt.Sprintf(fmt.Sprintf(d.wc.dynFormat, max+space), msg)
+}
+
+type placeHolderDecorator struct {
+	WC
+	wch chan int
+}
+
+func (d *placeHolderDecorator) Decor(st *Statistics) string {
+	go func() {
+		d.wch <- utf8.RuneCountInString(d.FormatMsg(""))
+	}()
+	return ""
+}
diff --git a/vendor/github.com/vbauerster/mpb/decor/moving-average.go b/vendor/github.com/vbauerster/mpb/v4/decor/moving_average.go
index fcd268923..933b1f2cd 100644
--- a/vendor/github.com/vbauerster/mpb/decor/moving-average.go
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/moving_average.go
@@ -9,11 +9,7 @@ import (
 // MovingAverage is the interface that computes a moving average over
 // a time-series stream of numbers. The average may be over a window
 // or exponentially decaying.
-type MovingAverage interface {
-	Add(float64)
-	Value() float64
-	Set(float64)
-}
+type MovingAverage = ewma.MovingAverage
 
 type medianWindow [3]float64
 
@@ -42,26 +38,3 @@ func (s *medianWindow) Set(value float64) {
 func NewMedian() MovingAverage {
 	return new(medianWindow)
 }
-
-type medianEwma struct {
-	count  uint
-	median MovingAverage
-	MovingAverage
-}
-
-func (s *medianEwma) Add(v float64) {
-	s.median.Add(v)
-	if s.count >= 2 {
-		s.MovingAverage.Add(s.median.Value())
-	}
-	s.count++
-}
-
-// NewMedianEwma is ewma based MovingAverage, which gets its values
-// from median MovingAverage.
-func NewMedianEwma(age ...float64) MovingAverage {
-	return &medianEwma{
-		MovingAverage: ewma.NewMovingAverage(age...),
-		median:        NewMedian(),
-	}
-}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/name.go b/vendor/github.com/vbauerster/mpb/v4/decor/name.go
new file mode 100644
index 000000000..2d5865f6c
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/name.go
@@ -0,0 +1,27 @@
+package decor
+
+// Name returns name decorator.
+//
+//	`name` string to display
+//
+//	`wcc` optional WC config
+func Name(name string, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	d := &nameDecorator{
+		WC:  wc.Init(),
+		msg: name,
+	}
+	return d
+}
+
+type nameDecorator struct {
+	WC
+	msg string
+}
+
+func (d *nameDecorator) Decor(st *Statistics) string {
+	return d.FormatMsg(d.msg)
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/on_complete.go b/vendor/github.com/vbauerster/mpb/v4/decor/on_complete.go
new file mode 100644
index 000000000..714a0ded3
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/on_complete.go
@@ -0,0 +1,36 @@
+package decor
+
+// OnComplete returns decorator, which wraps provided decorator, with
+// sole purpose to display provided message on complete event.
+//
+//	`decorator` Decorator to wrap
+//
+//	`message` message to display on complete event
+func OnComplete(decorator Decorator, message string) Decorator {
+	d := &onCompleteWrapper{
+		Decorator: decorator,
+		msg:       message,
+	}
+	if md, ok := decorator.(*mergeDecorator); ok {
+		d.Decorator, md.Decorator = md.Decorator, d
+		return md
+	}
+	return d
+}
+
+type onCompleteWrapper struct {
+	Decorator
+	msg string
+}
+
+func (d *onCompleteWrapper) Decor(st *Statistics) string {
+	if st.Completed {
+		wc := d.GetConf()
+		return wc.FormatMsg(d.msg)
+	}
+	return d.Decorator.Decor(st)
+}
+
+func (d *onCompleteWrapper) Base() Decorator {
+	return d.Decorator
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/percentage.go b/vendor/github.com/vbauerster/mpb/v4/decor/percentage.go
new file mode 100644
index 000000000..abf343a35
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/percentage.go
@@ -0,0 +1,72 @@
+package decor
+
+import (
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/vbauerster/mpb/v4/internal"
+)
+
+type percentageType float64
+
+func (s percentageType) Format(st fmt.State, verb rune) {
+	var prec int
+	switch verb {
+	case 'd':
+	case 's':
+		prec = -1
+	default:
+		if p, ok := st.Precision(); ok {
+			prec = p
+		} else {
+			prec = 6
+		}
+	}
+
+	io.WriteString(st, strconv.FormatFloat(float64(s), 'f', prec, 64))
+
+	if st.Flag(' ') {
+		io.WriteString(st, " ")
+	}
+	io.WriteString(st, "%")
+}
+
+// Percentage returns percentage decorator. It's a wrapper of NewPercentage.
+func Percentage(wcc ...WC) Decorator {
+	return NewPercentage("% d", wcc...)
+}
+
+// NewPercentage percentage decorator with custom fmt string.
+//
+// fmt examples:
+//
+//	fmt="%.1f"  output: "1.0%"
+//	fmt="% .1f" output: "1.0 %"
+//	fmt="%d"    output: "1%"
+//	fmt="% d"   output: "1 %"
+//
+func NewPercentage(fmt string, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	if fmt == "" {
+		fmt = "% d"
+	}
+	d := &percentageDecorator{
+		WC:  wc.Init(),
+		fmt: fmt,
+	}
+	return d
+}
+
+type percentageDecorator struct {
+	WC
+	fmt string
+}
+
+func (d *percentageDecorator) Decor(st *Statistics) string {
+	p := internal.Percentage(st.Total, st.Current, 100)
+	return d.FormatMsg(fmt.Sprintf(d.fmt, percentageType(p)))
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/size_type.go b/vendor/github.com/vbauerster/mpb/v4/decor/size_type.go
new file mode 100644
index 000000000..e4b974058
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/size_type.go
@@ -0,0 +1,109 @@
+package decor
+
+import (
+	"fmt"
+	"io"
+	"math"
+	"strconv"
+)
+
+//go:generate stringer -type=SizeB1024 -trimprefix=_i
+//go:generate stringer -type=SizeB1000 -trimprefix=_
+
+const (
+	_ib   SizeB1024 = iota + 1
+	_iKiB SizeB1024 = 1 << (iota * 10)
+	_iMiB
+	_iGiB
+	_iTiB
+)
+
+// SizeB1024 named type, which implements fmt.Formatter interface. It
+// adjusts its value according to byte size multiple by 1024 and appends
+// appropriate size marker (KiB, MiB, GiB, TiB).
+type SizeB1024 int64
+
+func (self SizeB1024) Format(st fmt.State, verb rune) {
+	var prec int
+	switch verb {
+	case 'd':
+	case 's':
+		prec = -1
+	default:
+		if p, ok := st.Precision(); ok {
+			prec = p
+		} else {
+			prec = 6
+		}
+	}
+
+	var unit SizeB1024
+	switch {
+	case self < _iKiB:
+		unit = _ib
+	case self < _iMiB:
+		unit = _iKiB
+	case self < _iGiB:
+		unit = _iMiB
+	case self < _iTiB:
+		unit = _iGiB
+	case self <= math.MaxInt64:
+		unit = _iTiB
+	}
+
+	io.WriteString(st, strconv.FormatFloat(float64(self)/float64(unit), 'f', prec, 64))
+
+	if st.Flag(' ') {
+		io.WriteString(st, " ")
+	}
+	io.WriteString(st, unit.String())
+}
+
+const (
+	_b  SizeB1000 = 1
+	_KB SizeB1000 = _b * 1000
+	_MB SizeB1000 = _KB * 1000
+	_GB SizeB1000 = _MB * 1000
+	_TB SizeB1000 = _GB * 1000
+)
+
+// SizeB1000 named type, which implements fmt.Formatter interface. It
+// adjusts its value according to byte size multiple by 1000 and appends
+// appropriate size marker (KB, MB, GB, TB).
+type SizeB1000 int64
+
+func (self SizeB1000) Format(st fmt.State, verb rune) {
+	var prec int
+	switch verb {
+	case 'd':
+	case 's':
+		prec = -1
+	default:
+		if p, ok := st.Precision(); ok {
+			prec = p
+		} else {
+			prec = 6
+		}
+	}
+
+	var unit SizeB1000
+	switch {
+	case self < _KB:
+		unit = _b
+	case self < _MB:
+		unit = _KB
+	case self < _GB:
+		unit = _MB
+	case self < _TB:
+		unit = _GB
+	case self <= math.MaxInt64:
+		unit = _TB
+	}
+
+	io.WriteString(st, strconv.FormatFloat(float64(self)/float64(unit), 'f', prec, 64))
+
+	if st.Flag(' ') {
+		io.WriteString(st, " ")
+	}
+	io.WriteString(st, unit.String())
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/sizeb1000_string.go b/vendor/github.com/vbauerster/mpb/v4/decor/sizeb1000_string.go
new file mode 100644
index 000000000..3f32ef715
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/sizeb1000_string.go
@@ -0,0 +1,41 @@
+// Code generated by "stringer -type=SizeB1000 -trimprefix=_"; DO NOT EDIT.
+
+package decor
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[_b-1]
+	_ = x[_KB-1000]
+	_ = x[_MB-1000000]
+	_ = x[_GB-1000000000]
+	_ = x[_TB-1000000000000]
+}
+
+const (
+	_SizeB1000_name_0 = "b"
+	_SizeB1000_name_1 = "KB"
+	_SizeB1000_name_2 = "MB"
+	_SizeB1000_name_3 = "GB"
+	_SizeB1000_name_4 = "TB"
+)
+
+func (i SizeB1000) String() string {
+	switch {
+	case i == 1:
+		return _SizeB1000_name_0
+	case i == 1000:
+		return _SizeB1000_name_1
+	case i == 1000000:
+		return _SizeB1000_name_2
+	case i == 1000000000:
+		return _SizeB1000_name_3
+	case i == 1000000000000:
+		return _SizeB1000_name_4
+	default:
+		return "SizeB1000(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/sizeb1024_string.go b/vendor/github.com/vbauerster/mpb/v4/decor/sizeb1024_string.go
new file mode 100644
index 000000000..9fca66cc7
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/sizeb1024_string.go
@@ -0,0 +1,41 @@
+// Code generated by "stringer -type=SizeB1024 -trimprefix=_i"; DO NOT EDIT.
+
+package decor
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[_ib-1]
+	_ = x[_iKiB-1024]
+	_ = x[_iMiB-1048576]
+	_ = x[_iGiB-1073741824]
+	_ = x[_iTiB-1099511627776]
+}
+
+const (
+	_SizeB1024_name_0 = "b"
+	_SizeB1024_name_1 = "KiB"
+	_SizeB1024_name_2 = "MiB"
+	_SizeB1024_name_3 = "GiB"
+	_SizeB1024_name_4 = "TiB"
+)
+
+func (i SizeB1024) String() string {
+	switch {
+	case i == 1:
+		return _SizeB1024_name_0
+	case i == 1024:
+		return _SizeB1024_name_1
+	case i == 1048576:
+		return _SizeB1024_name_2
+	case i == 1073741824:
+		return _SizeB1024_name_3
+	case i == 1099511627776:
+		return _SizeB1024_name_4
+	default:
+		return "SizeB1024(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/speed.go b/vendor/github.com/vbauerster/mpb/v4/decor/speed.go
new file mode 100644
index 000000000..795a5536f
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/speed.go
@@ -0,0 +1,175 @@
+package decor
+
+import (
+	"fmt"
+	"io"
+	"math"
+	"time"
+
+	"github.com/VividCortex/ewma"
+)
+
+// SpeedFormatter is wrapper for SizeB1024 and SizeB1000 to format value as speed/s.
+type SpeedFormatter struct {
+	fmt.Formatter
+}
+
+func (self *SpeedFormatter) Format(st fmt.State, verb rune) {
+	self.Formatter.Format(st, verb)
+	io.WriteString(st, "/s")
+}
+
+// EwmaSpeed exponential-weighted-moving-average based speed decorator.
+// Note that it's necessary to supply bar.Incr* methods with incremental
+// work duration as second argument, in order for this decorator to
+// work correctly. This decorator is a wrapper of MovingAverageSpeed.
+func EwmaSpeed(unit int, format string, age float64, wcc ...WC) Decorator {
+	var average MovingAverage
+	if age == 0 {
+		average = ewma.NewMovingAverage()
+	} else {
+		average = ewma.NewMovingAverage(age)
+	}
+	return MovingAverageSpeed(unit, format, average, wcc...)
+}
+
+// MovingAverageSpeed decorator relies on MovingAverage implementation
+// to calculate its average.
+//
+//	`unit` one of [0|UnitKiB|UnitKB] zero for no unit
+//
+//	`format` printf compatible verb for value, like "%f" or "%d"
+//
+//	`average` MovingAverage implementation
+//
+//	`wcc` optional WC config
+//
+// format examples:
+//
+//	unit=UnitKiB, format="%.1f"  output: "1.0MiB/s"
+//	unit=UnitKiB, format="% .1f" output: "1.0 MiB/s"
+//	unit=UnitKB,  format="%.1f"  output: "1.0MB/s"
+//	unit=UnitKB,  format="% .1f" output: "1.0 MB/s"
+//
+func MovingAverageSpeed(unit int, format string, average MovingAverage, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	if format == "" {
+		format = "%.0f"
+	}
+	d := &movingAverageSpeed{
+		WC:       wc.Init(),
+		average:  average,
+		producer: chooseSpeedProducer(unit, format),
+	}
+	return d
+}
+
+type movingAverageSpeed struct {
+	WC
+	producer func(float64) string
+	average  ewma.MovingAverage
+	msg      string
+}
+
+func (d *movingAverageSpeed) Decor(st *Statistics) string {
+	if !st.Completed {
+		var speed float64
+		if v := d.average.Value(); v > 0 {
+			speed = 1 / v
+		}
+		d.msg = d.producer(speed * 1e9)
+	}
+	return d.FormatMsg(d.msg)
+}
+
+func (d *movingAverageSpeed) NextAmount(n int64, wdd ...time.Duration) {
+	var workDuration time.Duration
+	for _, wd := range wdd {
+		workDuration = wd
+	}
+	durPerByte := float64(workDuration) / float64(n)
+	if math.IsInf(durPerByte, 0) || math.IsNaN(durPerByte) {
+		return
+	}
+	d.average.Add(durPerByte)
+}
+
+// AverageSpeed decorator with dynamic unit measure adjustment. It's
+// a wrapper of NewAverageSpeed.
+func AverageSpeed(unit int, format string, wcc ...WC) Decorator {
+	return NewAverageSpeed(unit, format, time.Now(), wcc...)
+}
+
+// NewAverageSpeed decorator with dynamic unit measure adjustment and
+// user provided start time.
+//
+//	`unit` one of [0|UnitKiB|UnitKB] zero for no unit
+//
+//	`format` printf compatible verb for value, like "%f" or "%d"
+//
+//	`startTime` start time
+//
+//	`wcc` optional WC config
+//
+// format examples:
+//
+//	unit=UnitKiB, format="%.1f"  output: "1.0MiB/s"
+//	unit=UnitKiB, format="% .1f" output: "1.0 MiB/s"
+//	unit=UnitKB,  format="%.1f"  output: "1.0MB/s"
+//	unit=UnitKB,  format="% .1f" output: "1.0 MB/s"
+//
+func NewAverageSpeed(unit int, format string, startTime time.Time, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	if format == "" {
+		format = "%.0f"
+	}
+	d := &averageSpeed{
+		WC:        wc.Init(),
+		startTime: startTime,
+		producer:  chooseSpeedProducer(unit, format),
+	}
+	return d
+}
+
+type averageSpeed struct {
+	WC
+	startTime time.Time
+	producer  func(float64) string
+	msg       string
+}
+
+func (d *averageSpeed) Decor(st *Statistics) string {
+	if !st.Completed {
+		speed := float64(st.Current) / float64(time.Since(d.startTime))
+		d.msg = d.producer(speed * 1e9)
+	}
+
+	return d.FormatMsg(d.msg)
+}
+
+func (d *averageSpeed) AverageAdjust(startTime time.Time) {
+	d.startTime = startTime
+}
+
+func chooseSpeedProducer(unit int, format string) func(float64) string {
+	switch unit {
+	case UnitKiB:
+		return func(speed float64) string {
+			return fmt.Sprintf(format, &SpeedFormatter{SizeB1024(math.Round(speed))})
+		}
+	case UnitKB:
+		return func(speed float64) string {
+			return fmt.Sprintf(format, &SpeedFormatter{SizeB1000(math.Round(speed))})
+		}
+	default:
+		return func(speed float64) string {
+			return fmt.Sprintf(format, speed)
+		}
+	}
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/decor/spinner.go b/vendor/github.com/vbauerster/mpb/v4/decor/spinner.go
new file mode 100644
index 000000000..24f553142
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/decor/spinner.go
@@ -0,0 +1,35 @@
+package decor
+
+var defaultSpinnerStyle = []string{"⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"}
+
+// Spinner returns spinner decorator.
+//
+//	`frames` spinner frames, if nil or len==0, default is used
+//
+//	`wcc` optional WC config
+func Spinner(frames []string, wcc ...WC) Decorator {
+	var wc WC
+	for _, widthConf := range wcc {
+		wc = widthConf
+	}
+	if len(frames) == 0 {
+		frames = defaultSpinnerStyle
+	}
+	d := &spinnerDecorator{
+		WC:     wc.Init(),
+		frames: frames,
+	}
+	return d
+}
+
+type spinnerDecorator struct {
+	WC
+	frames []string
+	count  uint
+}
+
+func (d *spinnerDecorator) Decor(st *Statistics) string {
+	frame := d.frames[d.count%uint(len(d.frames))]
+	d.count++
+	return d.FormatMsg(frame)
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/doc.go b/vendor/github.com/vbauerster/mpb/v4/doc.go
new file mode 100644
index 000000000..5ada71774
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/doc.go
@@ -0,0 +1,2 @@
+// Package mpb is a library for rendering progress bars in terminal applications.
+package mpb
diff --git a/vendor/github.com/vbauerster/mpb/v4/go.mod b/vendor/github.com/vbauerster/mpb/v4/go.mod
new file mode 100644
index 000000000..0c5ce51f1
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/go.mod
@@ -0,0 +1,9 @@
+module github.com/vbauerster/mpb/v4
+
+require (
+	github.com/VividCortex/ewma v1.1.1
+	golang.org/x/crypto v0.0.0-20191112222119-e1110fd1c708
+	golang.org/x/sys v0.0.0-20191113165036-4c7a9d0fe056 // indirect
+)
+
+go 1.13
diff --git a/vendor/github.com/vbauerster/mpb/v4/go.sum b/vendor/github.com/vbauerster/mpb/v4/go.sum
new file mode 100644
index 000000000..94a9f1a28
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/go.sum
@@ -0,0 +1,11 @@
+github.com/VividCortex/ewma v1.1.1 h1:MnEK4VOv6n0RSY4vtRe3h11qjxL3+t0B8yOL8iMXdcM=
+github.com/VividCortex/ewma v1.1.1/go.mod h1:2Tkkvm3sRDVXaiyucHiACn4cqf7DpdyLvmxzcbUokwA=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191112222119-e1110fd1c708 h1:pXVtWnwHkrWD9ru3sDxY/qFK/bfc0egRovX91EjWjf4=
+golang.org/x/crypto v0.0.0-20191112222119-e1110fd1c708/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191113165036-4c7a9d0fe056 h1:dHtDnRWQtSx0Hjq9kvKFpBh9uPPKfQN70NZZmvssGwk=
+golang.org/x/sys v0.0.0-20191113165036-4c7a9d0fe056/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/vendor/github.com/vbauerster/mpb/v4/internal/percentage.go b/vendor/github.com/vbauerster/mpb/v4/internal/percentage.go
new file mode 100644
index 000000000..7e261cb22
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/internal/percentage.go
@@ -0,0 +1,15 @@
+package internal
+
+import "math"
+
+// Percentage is a helper function, to calculate percentage.
+func Percentage(total, current int64, width int) float64 {
+	if total <= 0 {
+		return 0
+	}
+	return float64(int64(width)*current) / float64(total)
+}
+
+func PercentageRound(total, current int64, width int) float64 {
+	return math.Round(Percentage(total, current, width))
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/options.go b/vendor/github.com/vbauerster/mpb/v4/options.go
new file mode 100644
index 000000000..6b34fb340
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/options.go
@@ -0,0 +1,105 @@
+package mpb
+
+import (
+	"io"
+	"io/ioutil"
+	"sync"
+	"time"
+)
+
+// ContainerOption is a function option which changes the default
+// behavior of progress container, if passed to mpb.New(...ContainerOption).
+type ContainerOption func(*pState)
+
+// WithWaitGroup provides means to have a single joint point. If
+// *sync.WaitGroup is provided, you can safely call just p.Wait()
+// without calling Wait() on provided *sync.WaitGroup. Makes sense
+// when there are more than one bar to render.
+func WithWaitGroup(wg *sync.WaitGroup) ContainerOption {
+	return func(s *pState) {
+		s.uwg = wg
+	}
+}
+
+// WithWidth sets container width. Default is 80. Bars inherit this
+// width, as long as no BarWidth is applied.
+func WithWidth(w int) ContainerOption {
+	return func(s *pState) {
+		if w < 0 {
+			return
+		}
+		s.width = w
+	}
+}
+
+// WithRefreshRate overrides default 120ms refresh rate.
+func WithRefreshRate(d time.Duration) ContainerOption {
+	return func(s *pState) {
+		s.rr = d
+	}
+}
+
+// WithManualRefresh disables internal auto refresh time.Ticker.
+// Refresh will occur upon receive value from provided ch.
+func WithManualRefresh(ch <-chan time.Time) ContainerOption {
+	return func(s *pState) {
+		s.refreshSrc = ch
+	}
+}
+
+// WithRenderDelay delays rendering. By default rendering starts as
+// soon as bar is added, with this option it's possible to delay
+// rendering process by keeping provided chan unclosed. In other words
+// rendering will start as soon as provided chan is closed.
+func WithRenderDelay(ch <-chan struct{}) ContainerOption {
+	return func(s *pState) {
+		s.renderDelay = ch
+	}
+}
+
+// WithShutdownNotifier provided chanel will be closed, after all bars
+// have been rendered.
+func WithShutdownNotifier(ch chan struct{}) ContainerOption {
+	return func(s *pState) {
+		s.shutdownNotifier = ch
+	}
+}
+
+// WithOutput overrides default os.Stdout output. Setting it to nil
+// will effectively disable auto refresh rate and discard any output,
+// useful if you want to disable progress bars with little overhead.
+func WithOutput(w io.Writer) ContainerOption {
+	return func(s *pState) {
+		if w == nil {
+			s.refreshSrc = make(chan time.Time)
+			s.output = ioutil.Discard
+			return
+		}
+		s.output = w
+	}
+}
+
+// WithDebugOutput sets debug output.
+func WithDebugOutput(w io.Writer) ContainerOption {
+	if w == nil {
+		return nil
+	}
+	return func(s *pState) {
+		s.debugOut = w
+	}
+}
+
+// PopCompletedMode will pop and stop rendering completed bars.
+func PopCompletedMode() ContainerOption {
+	return func(s *pState) {
+		s.popCompleted = true
+	}
+}
+
+// ContainerOptOnCond returns option when condition evaluates to true.
+func ContainerOptOnCond(option ContainerOption, condition func() bool) ContainerOption {
+	if condition() {
+		return option
+	}
+	return nil
+}
diff --git a/vendor/github.com/vbauerster/mpb/priority_queue.go b/vendor/github.com/vbauerster/mpb/v4/priority_queue.go
index 7bc588c29..29d9bd5a8 100644
--- a/vendor/github.com/vbauerster/mpb/priority_queue.go
+++ b/vendor/github.com/vbauerster/mpb/v4/priority_queue.go
@@ -1,7 +1,5 @@
 package mpb
 
-import "container/heap"
-
 // A priorityQueue implements heap.Interface
 type priorityQueue []*Bar
 
@@ -18,23 +16,17 @@ func (pq priorityQueue) Swap(i, j int) {
 }
 
 func (pq *priorityQueue) Push(x interface{}) {
-	n := len(*pq)
+	s := *pq
 	bar := x.(*Bar)
-	bar.index = n
-	*pq = append(*pq, bar)
+	bar.index = len(s)
+	s = append(s, bar)
+	*pq = s
 }
 
 func (pq *priorityQueue) Pop() interface{} {
-	old := *pq
-	n := len(old)
-	bar := old[n-1]
+	s := *pq
+	*pq = s[0 : len(s)-1]
+	bar := s[len(s)-1]
 	bar.index = -1 // for safety
-	*pq = old[0 : n-1]
 	return bar
 }
-
-// update modifies the priority of a Bar in the queue.
-func (pq *priorityQueue) update(bar *Bar, priority int) {
-	bar.priority = priority
-	heap.Fix(pq, bar.index)
-}
diff --git a/vendor/github.com/vbauerster/mpb/v4/progress.go b/vendor/github.com/vbauerster/mpb/v4/progress.go
new file mode 100644
index 000000000..1150d50bd
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/progress.go
@@ -0,0 +1,394 @@
+package mpb
+
+import (
+	"bytes"
+	"container/heap"
+	"context"
+	"io"
+	"io/ioutil"
+	"log"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/vbauerster/mpb/v4/cwriter"
+	"github.com/vbauerster/mpb/v4/decor"
+)
+
+const (
+	// default RefreshRate
+	prr = 120 * time.Millisecond
+	// default width
+	pwidth = 80
+)
+
+// Progress represents the container that renders Progress bars
+type Progress struct {
+	ctx          context.Context
+	uwg          *sync.WaitGroup
+	cwg          *sync.WaitGroup
+	bwg          *sync.WaitGroup
+	operateState chan func(*pState)
+	done         chan struct{}
+	refreshCh    chan time.Time
+	once         sync.Once
+	dlogger      *log.Logger
+}
+
+type pState struct {
+	bHeap            priorityQueue
+	heapUpdated      bool
+	pMatrix          map[int][]chan int
+	aMatrix          map[int][]chan int
+	barShutdownQueue []*Bar
+	barPopQueue      []*Bar
+
+	// following are provided/overrided by user
+	idCount          int
+	width            int
+	popCompleted     bool
+	rr               time.Duration
+	uwg              *sync.WaitGroup
+	refreshSrc       <-chan time.Time
+	renderDelay      <-chan struct{}
+	shutdownNotifier chan struct{}
+	parkedBars       map[*Bar]*Bar
+	output           io.Writer
+	debugOut         io.Writer
+}
+
+// New creates new Progress container instance. It's not possible to
+// reuse instance after *Progress.Wait() method has been called.
+func New(options ...ContainerOption) *Progress {
+	return NewWithContext(context.Background(), options...)
+}
+
+// NewWithContext creates new Progress container instance with provided
+// context. It's not possible to reuse instance after *Progress.Wait()
+// method has been called.
+func NewWithContext(ctx context.Context, options ...ContainerOption) *Progress {
+	s := &pState{
+		bHeap:      priorityQueue{},
+		width:      pwidth,
+		rr:         prr,
+		parkedBars: make(map[*Bar]*Bar),
+		output:     os.Stdout,
+		debugOut:   ioutil.Discard,
+	}
+
+	for _, opt := range options {
+		if opt != nil {
+			opt(s)
+		}
+	}
+
+	p := &Progress{
+		ctx:          ctx,
+		uwg:          s.uwg,
+		cwg:          new(sync.WaitGroup),
+		bwg:          new(sync.WaitGroup),
+		operateState: make(chan func(*pState)),
+		done:         make(chan struct{}),
+		dlogger:      log.New(s.debugOut, "[mpb] ", log.Lshortfile),
+	}
+
+	p.cwg.Add(1)
+	go p.serve(s, cwriter.New(s.output))
+	return p
+}
+
+// AddBar creates a new progress bar and adds to the container.
+func (p *Progress) AddBar(total int64, options ...BarOption) *Bar {
+	return p.Add(total, NewBarFiller(DefaultBarStyle, false), options...)
+}
+
+// AddSpinner creates a new spinner bar and adds to the container.
+func (p *Progress) AddSpinner(total int64, alignment SpinnerAlignment, options ...BarOption) *Bar {
+	return p.Add(total, NewSpinnerFiller(DefaultSpinnerStyle, alignment), options...)
+}
+
+// Add creates a bar which renders itself by provided filler.
+// Set total to 0, if you plan to update it later.
+func (p *Progress) Add(total int64, filler Filler, options ...BarOption) *Bar {
+	if filler == nil {
+		filler = NewBarFiller(DefaultBarStyle, false)
+	}
+	p.bwg.Add(1)
+	result := make(chan *Bar)
+	select {
+	case p.operateState <- func(ps *pState) {
+		bs := ps.makeBarState(total, filler, options...)
+		bar := newBar(p, bs)
+		if bs.runningBar != nil {
+			bs.runningBar.noPop = true
+			ps.parkedBars[bs.runningBar] = bar
+		} else {
+			heap.Push(&ps.bHeap, bar)
+			ps.heapUpdated = true
+		}
+		ps.idCount++
+		result <- bar
+	}:
+		bar := <-result
+		bar.subscribeDecorators()
+		return bar
+	case <-p.done:
+		p.bwg.Done()
+		return nil
+	}
+}
+
+func (p *Progress) dropBar(b *Bar) {
+	select {
+	case p.operateState <- func(s *pState) {
+		if b.index < 0 {
+			return
+		}
+		heap.Remove(&s.bHeap, b.index)
+		s.heapUpdated = true
+	}:
+	case <-p.done:
+	}
+}
+
+func (p *Progress) setBarPriority(b *Bar, priority int) {
+	select {
+	case p.operateState <- func(s *pState) {
+		if b.index < 0 {
+			return
+		}
+		b.priority = priority
+		heap.Fix(&s.bHeap, b.index)
+	}:
+	case <-p.done:
+	}
+}
+
+// UpdateBarPriority same as *Bar.SetPriority.
+func (p *Progress) UpdateBarPriority(b *Bar, priority int) {
+	p.setBarPriority(b, priority)
+}
+
+// BarCount returns bars count
+func (p *Progress) BarCount() int {
+	result := make(chan int, 1)
+	select {
+	case p.operateState <- func(s *pState) { result <- s.bHeap.Len() }:
+		return <-result
+	case <-p.done:
+		return 0
+	}
+}
+
+// Wait waits far all bars to complete and finally shutdowns container.
+// After this method has been called, there is no way to reuse *Progress
+// instance.
+func (p *Progress) Wait() {
+	if p.uwg != nil {
+		// wait for user wg
+		p.uwg.Wait()
+	}
+
+	// wait for bars to quit, if any
+	p.bwg.Wait()
+
+	p.once.Do(p.shutdown)
+
+	// wait for container to quit
+	p.cwg.Wait()
+}
+
+func (p *Progress) shutdown() {
+	close(p.done)
+}
+
+func (p *Progress) serve(s *pState, cw *cwriter.Writer) {
+	defer p.cwg.Done()
+
+	p.refreshCh = s.newTicker(p.done)
+
+	for {
+		select {
+		case op := <-p.operateState:
+			op(s)
+		case <-p.refreshCh:
+			if err := s.render(cw); err != nil {
+				go p.dlogger.Println(err)
+			}
+		case <-s.shutdownNotifier:
+			return
+		}
+	}
+}
+
+func (s *pState) render(cw *cwriter.Writer) error {
+	if s.heapUpdated {
+		s.updateSyncMatrix()
+		s.heapUpdated = false
+	}
+	syncWidth(s.pMatrix)
+	syncWidth(s.aMatrix)
+
+	tw, err := cw.GetWidth()
+	if err != nil {
+		tw = s.width
+	}
+	for i := 0; i < s.bHeap.Len(); i++ {
+		bar := s.bHeap[i]
+		go bar.render(tw)
+	}
+
+	return s.flush(cw)
+}
+
+func (s *pState) flush(cw *cwriter.Writer) error {
+	var lineCount int
+	bm := make(map[*Bar]struct{}, s.bHeap.Len())
+	for s.bHeap.Len() > 0 {
+		b := heap.Pop(&s.bHeap).(*Bar)
+		cw.ReadFrom(<-b.frameCh)
+		if b.toShutdown {
+			// shutdown at next flush
+			// this ensures no bar ends up with less than 100% rendered
+			defer func() {
+				s.barShutdownQueue = append(s.barShutdownQueue, b)
+			}()
+		}
+		lineCount += b.extendedLines + 1
+		bm[b] = struct{}{}
+	}
+
+	for _, b := range s.barShutdownQueue {
+		if parkedBar := s.parkedBars[b]; parkedBar != nil {
+			parkedBar.priority = b.priority
+			heap.Push(&s.bHeap, parkedBar)
+			delete(s.parkedBars, b)
+			b.toDrop = true
+		}
+		if b.toDrop {
+			delete(bm, b)
+			s.heapUpdated = true
+		} else if s.popCompleted {
+			if b := b; !b.noPop {
+				defer func() {
+					s.barPopQueue = append(s.barPopQueue, b)
+				}()
+			}
+		}
+		b.cancel()
+	}
+	s.barShutdownQueue = s.barShutdownQueue[0:0]
+
+	for _, b := range s.barPopQueue {
+		delete(bm, b)
+		s.heapUpdated = true
+		lineCount -= b.extendedLines + 1
+	}
+	s.barPopQueue = s.barPopQueue[0:0]
+
+	for b := range bm {
+		heap.Push(&s.bHeap, b)
+	}
+
+	return cw.Flush(lineCount)
+}
+
+func (s *pState) newTicker(done <-chan struct{}) chan time.Time {
+	ch := make(chan time.Time)
+	if s.shutdownNotifier == nil {
+		s.shutdownNotifier = make(chan struct{})
+	}
+	go func() {
+		if s.renderDelay != nil {
+			<-s.renderDelay
+		}
+		if s.refreshSrc == nil {
+			ticker := time.NewTicker(s.rr)
+			defer ticker.Stop()
+			s.refreshSrc = ticker.C
+		}
+		for {
+			select {
+			case tick := <-s.refreshSrc:
+				ch <- tick
+			case <-done:
+				close(s.shutdownNotifier)
+				return
+			}
+		}
+	}()
+	return ch
+}
+
+func (s *pState) updateSyncMatrix() {
+	s.pMatrix = make(map[int][]chan int)
+	s.aMatrix = make(map[int][]chan int)
+	for i := 0; i < s.bHeap.Len(); i++ {
+		bar := s.bHeap[i]
+		table := bar.wSyncTable()
+		pRow, aRow := table[0], table[1]
+
+		for i, ch := range pRow {
+			s.pMatrix[i] = append(s.pMatrix[i], ch)
+		}
+
+		for i, ch := range aRow {
+			s.aMatrix[i] = append(s.aMatrix[i], ch)
+		}
+	}
+}
+
+func (s *pState) makeBarState(total int64, filler Filler, options ...BarOption) *bState {
+	bs := &bState{
+		total:    total,
+		baseF:    extractBaseFiller(filler),
+		filler:   filler,
+		priority: s.idCount,
+		id:       s.idCount,
+		width:    s.width,
+		debugOut: s.debugOut,
+		extender: func(r io.Reader, _ int, _ *decor.Statistics) (io.Reader, int) {
+			return r, 0
+		},
+	}
+
+	for _, opt := range options {
+		if opt != nil {
+			opt(bs)
+		}
+	}
+
+	if s.popCompleted && !bs.noPop {
+		bs.priority = -1
+	}
+
+	bs.bufP = bytes.NewBuffer(make([]byte, 0, bs.width))
+	bs.bufB = bytes.NewBuffer(make([]byte, 0, bs.width))
+	bs.bufA = bytes.NewBuffer(make([]byte, 0, bs.width))
+
+	return bs
+}
+
+func syncWidth(matrix map[int][]chan int) {
+	for _, column := range matrix {
+		column := column
+		go func() {
+			var maxWidth int
+			for _, ch := range column {
+				if w := <-ch; w > maxWidth {
+					maxWidth = w
+				}
+			}
+			for _, ch := range column {
+				ch <- maxWidth
+			}
+		}()
+	}
+}
+
+func extractBaseFiller(f Filler) Filler {
+	if f, ok := f.(Wrapper); ok {
+		return extractBaseFiller(f.Base())
+	}
+	return f
+}
diff --git a/vendor/github.com/vbauerster/mpb/v4/proxyreader.go b/vendor/github.com/vbauerster/mpb/v4/proxyreader.go
new file mode 100644
index 000000000..736142412
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v4/proxyreader.go
@@ -0,0 +1,45 @@
+package mpb
+
+import (
+	"io"
+	"time"
+)
+
+type proxyReader struct {
+	io.ReadCloser
+	bar *Bar
+	iT  time.Time
+}
+
+func (prox *proxyReader) Read(p []byte) (n int, err error) {
+	n, err = prox.ReadCloser.Read(p)
+	if n > 0 {
+		prox.bar.IncrBy(n, time.Since(prox.iT))
+		prox.iT = time.Now()
+	}
+	if err == io.EOF {
+		go func() {
+			prox.bar.SetTotal(0, true)
+		}()
+	}
+	return
+}
+
+type proxyWriterTo struct {
+	*proxyReader
+	wt io.WriterTo
+}
+
+func (prox *proxyWriterTo) WriteTo(w io.Writer) (n int64, err error) {
+	n, err = prox.wt.WriteTo(w)
+	if n > 0 {
+		prox.bar.IncrInt64(n, time.Since(prox.iT))
+		prox.iT = time.Now()
+	}
+	if err == io.EOF {
+		go func() {
+			prox.bar.SetTotal(0, true)
+		}()
+	}
+	return
+}
diff --git a/vendor/github.com/vbauerster/mpb/spinner_filler.go b/vendor/github.com/vbauerster/mpb/v4/spinner_filler.go
index 36299fef0..9f383fb33 100644
--- a/vendor/github.com/vbauerster/mpb/spinner_filler.go
+++ b/vendor/github.com/vbauerster/mpb/v4/spinner_filler.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"github.com/vbauerster/mpb/decor"
+	"github.com/vbauerster/mpb/v4/decor"
 )
 
 // SpinnerAlignment enum.
@@ -18,7 +18,8 @@ const (
 	SpinnerOnRight
 )
 
-var defaultSpinnerStyle = []string{"⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"}
+// DefaultSpinnerStyle is applied when bar constructed with *Progress.AddSpinner method.
+var DefaultSpinnerStyle = []string{"⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"}
 
 type spinnerFiller struct {
 	frames    []string
@@ -26,6 +27,18 @@ type spinnerFiller struct {
 	alignment SpinnerAlignment
 }
 
+// NewSpinnerFiller constucts mpb.Filler, to be used with *Progress.Add method.
+func NewSpinnerFiller(style []string, alignment SpinnerAlignment) Filler {
+	if len(style) == 0 {
+		style = DefaultSpinnerStyle
+	}
+	filler := &spinnerFiller{
+		frames:    style,
+		alignment: alignment,
+	}
+	return filler
+}
+
 func (s *spinnerFiller) Fill(w io.Writer, width int, stat *decor.Statistics) {
 
 	frame := s.frames[s.count%uint(len(s.frames))]