update vendor

Signed-off-by: Jess Frazelle <acidburn@microsoft.com>

vendor/github.com/containerd/continuity/.gitignore

@@ -0,0 +1,25 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+bin
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof

vendor/github.com/containerd/continuity/.mailmap

@@ -0,0 +1 @@
+Stephen J Day <stephen.day@docker.com>  Stephen Day <stevvooe@users.noreply.github.com>

vendor/github.com/containerd/continuity/.travis.yml

@@ -0,0 +1,21 @@
+language: go
+sudo: required
+
+go:
+  - 1.8.x
+  - 1.9.x
+  - tip
+
+go_import_path: github.com/containerd/continuity
+
+env:
+# NOTE: we cannot set GOOS directly (because gimme overrides the value)
+  - TRAVIS_GOOS=windows
+  - TRAVIS_GOOS=linux
+  - TRAVIS_GOOS=darwin
+
+script:
+  - export GOOS=${TRAVIS_GOOS}
+  - make build binaries
+  - if [ "$GOOS" = "linux" ]; then make vet test; fi
+  - if [ "$GOOS" != "linux" ]; then make test-compile; fi

vendor/github.com/containerd/continuity/AUTHORS

@@ -0,0 +1,16 @@
+Aaron Lehmann <aaron.lehmann@docker.com>
+Akash Gupta <akagup@microsoft.com>
+Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
+Andrew Pennebaker <apennebaker@datapipe.com>
+Brandon Philips <brandon.philips@coreos.com>
+Christopher Jones <tophj@linux.vnet.ibm.com>
+Daniel, Dao Quang Minh <dqminh89@gmail.com>
+Derek McGowan <derek@mcgstyle.net>
+Edward Pilatowicz <edward.pilatowicz@oracle.com>
+Ian Campbell <ijc@docker.com>
+Justin Cormack <justin.cormack@docker.com>
+Justin Cummins <sul3n3t@gmail.com>
+Phil Estes <estesp@gmail.com>
+Stephen J Day <stephen.day@docker.com>
+Tobias Klauser <tklauser@distanz.ch>
+Tonis Tiigi <tonistiigi@gmail.com>

vendor/github.com/containerd/continuity/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

vendor/github.com/containerd/continuity/Makefile

@@ -0,0 +1,68 @@
+# Set an output prefix, which is the local directory if not specified
+PREFIX?=$(shell pwd)
+
+# Used to populate version variable in main package.
+VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always)
+
+GO_LDFLAGS=-ldflags "-X `go list ./version`.Version=$(VERSION)"
+
+PACKAGES=$(shell go list ./... | grep -v /vendor/)
+
+.PHONY: clean all fmt vet lint build test binaries setup
+.DEFAULT: default
+# skip lint at the moment
+all: AUTHORS clean fmt vet fmt build test binaries
+
+AUTHORS: .mailmap .git/HEAD
+	 git log --format='%aN <%aE>' | sort -fu > $@
+
+# This only needs to be generated by hand when cutting full releases.
+version/version.go:
+	./version/version.sh > $@
+
+${PREFIX}/bin/continuity: version/version.go $(shell find . -type f -name '*.go')
+	@echo "+ $@"
+	@go build  -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./cmd/continuity
+
+setup:
+	@echo "+ $@"
+	@go get -u github.com/golang/lint/golint
+
+generate:
+	go generate $(PACKAGES)
+
+# Depends on binaries because vet will silently fail if it can't load compiled
+# imports
+vet: binaries
+	@echo "+ $@"
+	@go vet $(PACKAGES)
+
+fmt:
+	@echo "+ $@"
+	@test -z "$$(gofmt -s -l . | grep -v Godeps/_workspace/src/ | grep -v vendor/ | tee /dev/stderr)" || \
+		echo "+ please format Go code with 'gofmt -s'"
+
+lint:
+	@echo "+ $@"
+	@test -z "$$(golint $(PACKAGES) | grep -v Godeps/_workspace/src/ | grep -v vendor/ |tee /dev/stderr)"
+
+build:
+	@echo "+ $@"
+	@go build -v ${GO_LDFLAGS} $(PACKAGES)
+
+test:
+	@echo "+ $@"
+	@go test $(PACKAGES)
+
+test-compile:
+	@echo "+ $@"
+	@for pkg in $(PACKAGES); do go test -c $$pkg; done
+
+binaries: ${PREFIX}/bin/continuity
+	@echo "+ $@"
+	@if [ x$$GOOS = xwindows ]; then echo "+ continuity -> continuity.exe"; mv ${PREFIX}/bin/continuity ${PREFIX}/bin/continuity.exe; fi
+
+clean:
+	@echo "+ $@"
+	@rm -rf "${PREFIX}/bin/continuity" "${PREFIX}/bin/continuity.exe"
+

vendor/github.com/containerd/continuity/README.md

@@ -0,0 +1,74 @@
+# continuity
+
+[![GoDoc](https://godoc.org/github.com/containerd/continuity?status.svg)](https://godoc.org/github.com/containerd/continuity)
+[![Build Status](https://travis-ci.org/containerd/continuity.svg?branch=master)](https://travis-ci.org/containerd/continuity)
+
+A transport-agnostic, filesystem metadata manifest system
+
+This project is a staging area for experiments in providing transport agnostic
+metadata storage.
+
+Please see https://github.com/opencontainers/specs/issues/11 for more details.
+
+## Manifest Format
+
+A continuity manifest encodes filesystem metadata in Protocol Buffers.
+Please refer to [proto/manifest.proto](proto/manifest.proto).
+
+## Usage
+
+Build:
+
+```console
+$ make
+```
+
+Create a manifest (of this repo itself):
+
+```console
+$ ./bin/continuity build . > /tmp/a.pb
+```
+
+Dump a manifest:
+
+```console
+$ ./bin/continuity ls /tmp/a.pb
+...
+-rw-rw-r--      270 B   /.gitignore
+-rw-rw-r--      88 B    /.mailmap
+-rw-rw-r--      187 B   /.travis.yml
+-rw-rw-r--      359 B   /AUTHORS
+-rw-rw-r--      11 kB   /LICENSE
+-rw-rw-r--      1.5 kB  /Makefile
+...
+-rw-rw-r--      986 B   /testutil_test.go
+drwxrwxr-x      0 B     /version
+-rw-rw-r--      478 B   /version/version.go
+```
+
+Verify a manifest:
+
+```console
+$ ./bin/continuity verify . /tmp/a.pb
+```
+
+Break the directory and restore using the manifest:
+```console
+$ chmod 777 Makefile
+$ ./bin/continuity verify . /tmp/a.pb
+2017/06/23 08:00:34 error verifying manifest: resource "/Makefile" has incorrect mode: -rwxrwxrwx != -rw-rw-r--
+$ ./bin/continuity apply . /tmp/a.pb
+$ stat -c %a Makefile
+664
+$ ./bin/continuity verify . /tmp/a.pb
+```
+
+
+## Contribution Guide
+### Building Proto Package
+
+If you change the proto file you will need to rebuild the generated Go with `go generate`.
+
+```console
+$ go generate ./proto
+```

vendor/github.com/containerd/continuity/cmd/continuity/main.go

@@ -0,0 +1,11 @@
+package main
+
+import (
+	_ "crypto/sha256"
+
+	"github.com/containerd/continuity/commands"
+)
+
+func main() {
+	commands.MainCmd.Execute()
+}

vendor/github.com/containerd/continuity/commands/apply.go

@@ -0,0 +1,36 @@
+package commands
+
+import (
+	"io/ioutil"
+	"log"
+
+	"github.com/containerd/continuity"
+	"github.com/spf13/cobra"
+)
+
+var ApplyCmd = &cobra.Command{
+	Use:   "apply <root> [<manifest>]",
+	Short: "Apply the manifest to the provided root",
+	Run: func(cmd *cobra.Command, args []string) {
+		root, path := args[0], args[1]
+
+		p, err := ioutil.ReadFile(path)
+		if err != nil {
+			log.Fatalf("error reading manifest: %v", err)
+		}
+
+		m, err := continuity.Unmarshal(p)
+		if err != nil {
+			log.Fatalf("error unmarshaling manifest: %v", err)
+		}
+
+		ctx, err := continuity.NewContext(root)
+		if err != nil {
+			log.Fatalf("error getting context: %v", err)
+		}
+
+		if err := continuity.ApplyManifest(ctx, m); err != nil {
+			log.Fatalf("error applying manifest: %v", err)
+		}
+	},
+}

vendor/github.com/containerd/continuity/commands/build.go

@@ -0,0 +1,48 @@
+package commands
+
+import (
+	"log"
+	"os"
+
+	"github.com/containerd/continuity"
+	"github.com/spf13/cobra"
+)
+
+var (
+	buildCmdConfig struct {
+		format string
+	}
+
+	BuildCmd = &cobra.Command{
+		Use:   "build <root>",
+		Short: "Build a manifest for the provided root",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 1 {
+				log.Fatalln("please specify a root")
+			}
+
+			ctx, err := continuity.NewContext(args[0])
+			if err != nil {
+				log.Fatalf("error creating path context: %v", err)
+			}
+
+			m, err := continuity.BuildManifest(ctx)
+			if err != nil {
+				log.Fatalf("error generating manifest: %v", err)
+			}
+
+			p, err := continuity.Marshal(m)
+			if err != nil {
+				log.Fatalf("error marshaling manifest: %v", err)
+			}
+
+			if _, err := os.Stdout.Write(p); err != nil {
+				log.Fatalf("error writing to stdout: %v", err)
+			}
+		},
+	}
+)
+
+func init() {
+	BuildCmd.Flags().StringVar(&buildCmdConfig.format, "format", "pb", "specify the output format of the manifest")
+}

vendor/github.com/containerd/continuity/commands/dump.go

@@ -0,0 +1,44 @@
+package commands
+
+import (
+	"io/ioutil"
+	"log"
+	"os"
+
+	pb "github.com/containerd/continuity/proto"
+	"github.com/golang/protobuf/proto"
+	"github.com/spf13/cobra"
+)
+
+var DumpCmd = &cobra.Command{
+	Use:   "dump <manifest>",
+	Short: "Dump the contents of the manifest in protobuf text format",
+	Run: func(cmd *cobra.Command, args []string) {
+		var p []byte
+		var err error
+
+		if len(args) < 1 {
+			p, err = ioutil.ReadAll(os.Stdin)
+			if err != nil {
+				log.Fatalf("error reading manifest: %v", err)
+			}
+		} else {
+			p, err = ioutil.ReadFile(args[0])
+			if err != nil {
+				log.Fatalf("error reading manifest: %v", err)
+			}
+		}
+
+		var bm pb.Manifest
+
+		if err := proto.Unmarshal(p, &bm); err != nil {
+			log.Fatalf("error unmarshaling manifest: %v", err)
+		}
+
+		// TODO(stevvooe): For now, just dump the text format. Turn this into
+		// nice text output later.
+		if err := proto.MarshalText(os.Stdout, &bm); err != nil {
+			log.Fatalf("error dumping manifest: %v", err)
+		}
+	},
+}

vendor/github.com/containerd/continuity/commands/ls.go

@@ -0,0 +1,41 @@
+package commands
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"text/tabwriter"
+
+	"github.com/dustin/go-humanize"
+	"github.com/spf13/cobra"
+)
+
+var LSCmd = &cobra.Command{
+	Use:   "ls <manifest>",
+	Short: "List the contents of the manifest.",
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) != 1 {
+			log.Fatalln("please specify a manifest")
+		}
+
+		bm, err := readManifestFile(args[0])
+		if err != nil {
+			log.Fatalf("error reading manifest: %v", err)
+		}
+
+		w := tabwriter.NewWriter(os.Stdout, 0, 2, 2, ' ', 0)
+
+		for _, entry := range bm.Resource {
+			for _, path := range entry.Path {
+				if os.FileMode(entry.Mode)&os.ModeSymlink != 0 {
+					fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v -> %v\n", os.FileMode(entry.Mode), entry.User, entry.Group, humanize.Bytes(uint64(entry.Size)), path, entry.Target)
+				} else {
+					fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\n", os.FileMode(entry.Mode), entry.User, entry.Group, humanize.Bytes(uint64(entry.Size)), path)
+				}
+
+			}
+		}
+
+		w.Flush()
+	},
+}

vendor/github.com/containerd/continuity/commands/main.go

@@ -0,0 +1,82 @@
+package commands
+
+import (
+	"io"
+	"io/ioutil"
+	"os"
+	"text/tabwriter"
+
+	pb "github.com/containerd/continuity/proto"
+	"github.com/golang/protobuf/proto"
+	"github.com/spf13/cobra"
+)
+
+var (
+	MainCmd = &cobra.Command{
+		Use:   "continuity <command>",
+		Short: "A transport-agnostic filesytem metadata tool.",
+	}
+
+	// usageTemplate is nearly identical to the default template without the
+	// automatic addition of flags. Instead, Command.Use is used unmodified.
+	usageTemplate = `Usage:{{if .Runnable}}
+  {{.UseLine}}{{end}}{{if .HasSubCommands}}
+  {{ .CommandPath}} [command]{{end}}{{if gt .Aliases 0}}
+
+Aliases:
+  {{.NameAndAliases}}
+{{end}}{{if .HasExample}}
+
+Examples:
+{{ .Example }}{{end}}{{ if .HasAvailableSubCommands}}
+
+Available Commands:{{range .Commands}}{{if .IsAvailableCommand}}
+  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{ if .HasLocalFlags}}
+
+Flags:
+{{.LocalFlags.FlagUsages | trimRightSpace}}{{end}}{{ if .HasInheritedFlags}}
+
+Global Flags:
+{{.InheritedFlags.FlagUsages | trimRightSpace}}{{end}}{{if .HasHelpSubCommands}}
+
+Additional help topics:{{range .Commands}}{{if .IsHelpCommand}}
+  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{ if .HasSubCommands }}
+
+Use "{{.CommandPath}} [command] --help" for more information about a command.{{end}}
+`
+)
+
+func init() {
+	MainCmd.AddCommand(BuildCmd)
+	MainCmd.AddCommand(VerifyCmd)
+	MainCmd.AddCommand(ApplyCmd)
+	MainCmd.AddCommand(LSCmd)
+	MainCmd.AddCommand(StatsCmd)
+	MainCmd.AddCommand(DumpCmd)
+	if MountCmd != nil {
+		MainCmd.AddCommand(MountCmd)
+	}
+	MainCmd.SetUsageTemplate(usageTemplate)
+}
+
+// readManifestFile reads the manifest from the given path. This should
+// probably be provided by the continuity library.
+func readManifestFile(path string) (*pb.Manifest, error) {
+	p, err := ioutil.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	var bm pb.Manifest
+
+	if err := proto.Unmarshal(p, &bm); err != nil {
+		return nil, err
+	}
+
+	return &bm, nil
+}
+
+// newTabwriter provides a common tabwriter with defaults.
+func newTabwriter(w io.Writer) *tabwriter.Writer {
+	return tabwriter.NewWriter(os.Stdout, 0, 2, 2, ' ', 0)
+}

vendor/github.com/containerd/continuity/commands/mount.go

@@ -0,0 +1,115 @@
+// +build linux darwin freebsd
+
+package commands
+
+import (
+	"io/ioutil"
+	"log"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"syscall"
+	"time"
+
+	"bazil.org/fuse"
+	"bazil.org/fuse/fs"
+
+	"github.com/containerd/continuity"
+	"github.com/containerd/continuity/continuityfs"
+	"github.com/containerd/continuity/driver"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+var MountCmd = &cobra.Command{
+	Use:   "mount <mountpoint> [<manifest>] [<source directory>]",
+	Short: "Mount the manifest to the provided mountpoint using content from a source directory",
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) != 3 {
+			log.Fatal("Must specify mountpoint, manifest, and source directory")
+		}
+		mountpoint := args[0]
+		manifest, source := args[1], args[2]
+
+		manifestName := filepath.Base(manifest)
+
+		p, err := ioutil.ReadFile(manifest)
+		if err != nil {
+			log.Fatalf("error reading manifest: %v", err)
+		}
+
+		m, err := continuity.Unmarshal(p)
+		if err != nil {
+			log.Fatalf("error unmarshaling manifest: %v", err)
+		}
+
+		driver, err := driver.NewSystemDriver()
+		if err != nil {
+			logrus.Fatal(err)
+		}
+
+		provider := continuityfs.NewFSFileContentProvider(source, driver)
+
+		contfs, err := continuityfs.NewFSFromManifest(m, mountpoint, provider)
+		if err != nil {
+			logrus.Fatal(err)
+		}
+
+		c, err := fuse.Mount(
+			mountpoint,
+			fuse.ReadOnly(),
+			fuse.FSName(manifestName),
+			fuse.Subtype("continuity"),
+			// OSX Only options
+			fuse.LocalVolume(),
+			fuse.VolumeName("Continuity FileSystem"),
+		)
+		if err != nil {
+			logrus.Fatal(err)
+		}
+
+		<-c.Ready
+		if err := c.MountError; err != nil {
+			c.Close()
+			logrus.Fatal(err)
+		}
+
+		errChan := make(chan error, 1)
+		go func() {
+			// TODO: Create server directory to use context
+			err = fs.Serve(c, contfs)
+			if err != nil {
+				errChan <- err
+			}
+		}()
+
+		sigChan := make(chan os.Signal, 1)
+		signal.Notify(sigChan, os.Interrupt)
+		signal.Notify(sigChan, syscall.SIGTERM)
+
+		select {
+		case <-sigChan:
+			logrus.Infof("Shutting down")
+		case err = <-errChan:
+		}
+
+		go func() {
+			if err := c.Close(); err != nil {
+				logrus.Errorf("Unable to close connection %s", err)
+			}
+		}()
+
+		// Wait for any inprogress requests to be handled
+		time.Sleep(time.Second)
+
+		logrus.Infof("Attempting unmount")
+		if err := fuse.Unmount(mountpoint); err != nil {
+			logrus.Errorf("Error unmounting %s: %v", mountpoint, err)
+		}
+
+		// Handle server error
+		if err != nil {
+			logrus.Fatalf("Error serving fuse server: %v", err)
+		}
+	},
+}

vendor/github.com/containerd/continuity/commands/mount_unsupported.go

@@ -0,0 +1,9 @@
+// +build windows solaris
+
+package commands
+
+import (
+	"github.com/spf13/cobra"
+)
+
+var MountCmd *cobra.Command = nil

vendor/github.com/containerd/continuity/commands/stats.go

@@ -0,0 +1,58 @@
+package commands
+
+import (
+	"fmt"
+	"log"
+	"os"
+
+	"github.com/dustin/go-humanize"
+	"github.com/spf13/cobra"
+)
+
+var (
+	StatsCmd = &cobra.Command{
+		Use:   "stats <manifest>",
+		Short: "display statistics about the specified manifest",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 1 {
+				log.Fatalln("please specify a manifest")
+			}
+
+			bm, err := readManifestFile(args[0])
+			if err != nil {
+				log.Fatalf("error reading manifest: %v", err)
+			}
+
+			var stats struct {
+				resources   int
+				files       int
+				directories int
+				totalSize   int64
+				symlinks    int
+			}
+
+			for _, entry := range bm.Resource {
+				stats.resources++
+				stats.totalSize += int64(entry.Size)
+
+				mode := os.FileMode(entry.Mode)
+				if mode.IsRegular() {
+					stats.files += len(entry.Path) // count hardlinks!
+				} else if mode.IsDir() {
+					stats.directories++
+				} else if mode&os.ModeSymlink != 0 {
+					stats.symlinks++
+				}
+			}
+
+			w := newTabwriter(os.Stdout)
+			defer w.Flush()
+
+			fmt.Fprintf(w, "resources\t%v\n", stats.resources)
+			fmt.Fprintf(w, "directories\t%v\n", stats.directories)
+			fmt.Fprintf(w, "files\t%v\n", stats.files)
+			fmt.Fprintf(w, "symlinks\t%v\n", stats.symlinks)
+			fmt.Fprintf(w, "size\t%v\n", humanize.Bytes(uint64(stats.totalSize)))
+		},
+	}
+)

vendor/github.com/containerd/continuity/commands/verify.go

@@ -0,0 +1,41 @@
+package commands
+
+import (
+	"io/ioutil"
+	"log"
+
+	"github.com/containerd/continuity"
+	"github.com/spf13/cobra"
+)
+
+var VerifyCmd = &cobra.Command{
+	Use:   "verify <root> [<manifest>]",
+	Short: "Verify the root against the provided manifest",
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) != 2 {
+			log.Fatalln("please specify a root and manifest")
+		}
+
+		root, path := args[0], args[1]
+
+		p, err := ioutil.ReadFile(path)
+		if err != nil {
+			log.Fatalf("error reading manifest: %v", err)
+		}
+
+		m, err := continuity.Unmarshal(p)
+		if err != nil {
+			log.Fatalf("error unmarshaling manifest: %v", err)
+		}
+
+		ctx, err := continuity.NewContext(root)
+		if err != nil {
+			log.Fatalf("error getting context: %v", err)
+		}
+
+		if err := continuity.VerifyManifest(ctx, m); err != nil {
+			// TODO(stevvooe): Support more interesting error reporting.
+			log.Fatalf("error verifying manifest: %v", err)
+		}
+	},
+}

vendor/github.com/containerd/continuity/context.go

@@ -0,0 +1,641 @@
+package continuity
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/containerd/continuity/devices"
+	driverpkg "github.com/containerd/continuity/driver"
+	"github.com/containerd/continuity/pathdriver"
+	"github.com/opencontainers/go-digest"
+)
+
+var (
+	ErrNotFound     = fmt.Errorf("not found")
+	ErrNotSupported = fmt.Errorf("not supported")
+)
+
+// Context represents a file system context for accessing resources. The
+// responsibility of the context is to convert system specific resources to
+// generic Resource objects. Most of this is safe path manipulation, as well
+// as extraction of resource details.
+type Context interface {
+	Apply(Resource) error
+	Verify(Resource) error
+	Resource(string, os.FileInfo) (Resource, error)
+	Walk(filepath.WalkFunc) error
+}
+
+// SymlinkPath is intended to give the symlink target value
+// in a root context. Target and linkname are absolute paths
+// not under the given root.
+type SymlinkPath func(root, linkname, target string) (string, error)
+
+type ContextOptions struct {
+	Digester   Digester
+	Driver     driverpkg.Driver
+	PathDriver pathdriver.PathDriver
+	Provider   ContentProvider
+}
+
+// context represents a file system context for accessing resources.
+// Generally, all path qualified access and system considerations should land
+// here.
+type context struct {
+	driver     driverpkg.Driver
+	pathDriver pathdriver.PathDriver
+	root       string
+	digester   Digester
+	provider   ContentProvider
+}
+
+// NewContext returns a Context associated with root. The default driver will
+// be used, as returned by NewDriver.
+func NewContext(root string) (Context, error) {
+	return NewContextWithOptions(root, ContextOptions{})
+}
+
+// NewContextWithOptions returns a Context associate with the root.
+func NewContextWithOptions(root string, options ContextOptions) (Context, error) {
+	// normalize to absolute path
+	pathDriver := options.PathDriver
+	if pathDriver == nil {
+		pathDriver = pathdriver.LocalPathDriver
+	}
+
+	root = pathDriver.FromSlash(root)
+	root, err := pathDriver.Abs(pathDriver.Clean(root))
+	if err != nil {
+		return nil, err
+	}
+
+	driver := options.Driver
+	if driver == nil {
+		driver, err = driverpkg.NewSystemDriver()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	digester := options.Digester
+	if digester == nil {
+		digester = simpleDigester{digest.Canonical}
+	}
+
+	// Check the root directory. Need to be a little careful here. We are
+	// allowing a link for now, but this may have odd behavior when
+	// canonicalizing paths. As long as all files are opened through the link
+	// path, this should be okay.
+	fi, err := driver.Stat(root)
+	if err != nil {
+		return nil, err
+	}
+
+	if !fi.IsDir() {
+		return nil, &os.PathError{Op: "NewContext", Path: root, Err: os.ErrInvalid}
+	}
+
+	return &context{
+		root:       root,
+		driver:     driver,
+		pathDriver: pathDriver,
+		digester:   digester,
+		provider:   options.Provider,
+	}, nil
+}
+
+// Resource returns the resource as path p, populating the entry with info
+// from fi. The path p should be the path of the resource in the context,
+// typically obtained through Walk or from the value of Resource.Path(). If fi
+// is nil, it will be resolved.
+func (c *context) Resource(p string, fi os.FileInfo) (Resource, error) {
+	fp, err := c.fullpath(p)
+	if err != nil {
+		return nil, err
+	}
+
+	if fi == nil {
+		fi, err = c.driver.Lstat(fp)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	base, err := newBaseResource(p, fi)
+	if err != nil {
+		return nil, err
+	}
+
+	base.xattrs, err = c.resolveXAttrs(fp, fi, base)
+	if err == ErrNotSupported {
+		log.Printf("resolving xattrs on %s not supported", fp)
+	} else if err != nil {
+		return nil, err
+	}
+
+	// TODO(stevvooe): Handle windows alternate data streams.
+
+	if fi.Mode().IsRegular() {
+		dgst, err := c.digest(p)
+		if err != nil {
+			return nil, err
+		}
+
+		return newRegularFile(*base, base.paths, fi.Size(), dgst)
+	}
+
+	if fi.Mode().IsDir() {
+		return newDirectory(*base)
+	}
+
+	if fi.Mode()&os.ModeSymlink != 0 {
+		// We handle relative links vs absolute links by including a
+		// beginning slash for absolute links. Effectively, the bundle's
+		// root is treated as the absolute link anchor.
+		target, err := c.driver.Readlink(fp)
+		if err != nil {
+			return nil, err
+		}
+
+		return newSymLink(*base, target)
+	}
+
+	if fi.Mode()&os.ModeNamedPipe != 0 {
+		return newNamedPipe(*base, base.paths)
+	}
+
+	if fi.Mode()&os.ModeDevice != 0 {
+		deviceDriver, ok := c.driver.(driverpkg.DeviceInfoDriver)
+		if !ok {
+			log.Printf("device extraction not supported %s", fp)
+			return nil, ErrNotSupported
+		}
+
+		// character and block devices merely need to recover the
+		// major/minor device number.
+		major, minor, err := deviceDriver.DeviceInfo(fi)
+		if err != nil {
+			return nil, err
+		}
+
+		return newDevice(*base, base.paths, major, minor)
+	}
+
+	log.Printf("%q (%v) is not supported", fp, fi.Mode())
+	return nil, ErrNotFound
+}
+
+func (c *context) verifyMetadata(resource, target Resource) error {
+	if target.Mode() != resource.Mode() {
+		return fmt.Errorf("resource %q has incorrect mode: %v != %v", target.Path(), target.Mode(), resource.Mode())
+	}
+
+	if target.UID() != resource.UID() {
+		return fmt.Errorf("unexpected uid for %q: %v != %v", target.Path(), target.UID(), resource.GID())
+	}
+
+	if target.GID() != resource.GID() {
+		return fmt.Errorf("unexpected gid for %q: %v != %v", target.Path(), target.GID(), target.GID())
+	}
+
+	if xattrer, ok := resource.(XAttrer); ok {
+		txattrer, tok := target.(XAttrer)
+		if !tok {
+			return fmt.Errorf("resource %q has xattrs but target does not support them", resource.Path())
+		}
+
+		// For xattrs, only ensure that we have those defined in the resource
+		// and their values match. We can ignore other xattrs. In other words,
+		// we only verify that target has the subset defined by resource.
+		txattrs := txattrer.XAttrs()
+		for attr, value := range xattrer.XAttrs() {
+			tvalue, ok := txattrs[attr]
+			if !ok {
+				return fmt.Errorf("resource %q target missing xattr %q", resource.Path(), attr)
+			}
+
+			if !bytes.Equal(value, tvalue) {
+				return fmt.Errorf("xattr %q value differs for resource %q", attr, resource.Path())
+			}
+		}
+	}
+
+	switch r := resource.(type) {
+	case RegularFile:
+		// TODO(stevvooe): Another reason to use a record-based approach. We
+		// have to do another type switch to get this to work. This could be
+		// fixed with an Equal function, but let's study this a little more to
+		// be sure.
+		t, ok := target.(RegularFile)
+		if !ok {
+			return fmt.Errorf("resource %q target not a regular file", r.Path())
+		}
+
+		if t.Size() != r.Size() {
+			return fmt.Errorf("resource %q target has incorrect size: %v != %v", t.Path(), t.Size(), r.Size())
+		}
+	case Directory:
+		t, ok := target.(Directory)
+		if !ok {
+			return fmt.Errorf("resource %q target not a directory", t.Path())
+		}
+	case SymLink:
+		t, ok := target.(SymLink)
+		if !ok {
+			return fmt.Errorf("resource %q target not a symlink", t.Path())
+		}
+
+		if t.Target() != r.Target() {
+			return fmt.Errorf("resource %q target has mismatched target: %q != %q", t.Path(), t.Target(), r.Target())
+		}
+	case Device:
+		t, ok := target.(Device)
+		if !ok {
+			return fmt.Errorf("resource %q is not a device", t.Path())
+		}
+
+		if t.Major() != r.Major() || t.Minor() != r.Minor() {
+			return fmt.Errorf("resource %q has mismatched major/minor numbers: %d,%d != %d,%d", t.Path(), t.Major(), t.Minor(), r.Major(), r.Minor())
+		}
+	case NamedPipe:
+		t, ok := target.(NamedPipe)
+		if !ok {
+			return fmt.Errorf("resource %q is not a named pipe", t.Path())
+		}
+	default:
+		return fmt.Errorf("cannot verify resource: %v", resource)
+	}
+
+	return nil
+}
+
+// Verify the resource in the context. An error will be returned a discrepancy
+// is found.
+func (c *context) Verify(resource Resource) error {
+	fp, err := c.fullpath(resource.Path())
+	if err != nil {
+		return err
+	}
+
+	fi, err := c.driver.Lstat(fp)
+	if err != nil {
+		return err
+	}
+
+	target, err := c.Resource(resource.Path(), fi)
+	if err != nil {
+		return err
+	}
+
+	if target.Path() != resource.Path() {
+		return fmt.Errorf("resource paths do not match: %q != %q", target.Path(), resource.Path())
+	}
+
+	if err := c.verifyMetadata(resource, target); err != nil {
+		return err
+	}
+
+	if h, isHardlinkable := resource.(Hardlinkable); isHardlinkable {
+		hardlinkKey, err := newHardlinkKey(fi)
+		if err == errNotAHardLink {
+			if len(h.Paths()) > 1 {
+				return fmt.Errorf("%q is not a hardlink to %q", h.Paths()[1], resource.Path())
+			}
+		} else if err != nil {
+			return err
+		}
+
+		for _, path := range h.Paths()[1:] {
+			fpLink, err := c.fullpath(path)
+			if err != nil {
+				return err
+			}
+
+			fiLink, err := c.driver.Lstat(fpLink)
+			if err != nil {
+				return err
+			}
+
+			targetLink, err := c.Resource(path, fiLink)
+			if err != nil {
+				return err
+			}
+
+			hardlinkKeyLink, err := newHardlinkKey(fiLink)
+			if err != nil {
+				return err
+			}
+
+			if hardlinkKeyLink != hardlinkKey {
+				return fmt.Errorf("%q is not a hardlink to %q", path, resource.Path())
+			}
+
+			if err := c.verifyMetadata(resource, targetLink); err != nil {
+				return err
+			}
+		}
+	}
+
+	switch r := resource.(type) {
+	case RegularFile:
+		t, ok := target.(RegularFile)
+		if !ok {
+			return fmt.Errorf("resource %q target not a regular file", r.Path())
+		}
+
+		// TODO(stevvooe): This may need to get a little more sophisticated
+		// for digest comparison. We may want to actually calculate the
+		// provided digests, rather than the implementations having an
+		// overlap.
+		if !digestsMatch(t.Digests(), r.Digests()) {
+			return fmt.Errorf("digests for resource %q do not match: %v != %v", t.Path(), t.Digests(), r.Digests())
+		}
+	}
+
+	return nil
+}
+
+func (c *context) checkoutFile(fp string, rf RegularFile) error {
+	if c.provider == nil {
+		return fmt.Errorf("no file provider")
+	}
+	var (
+		r   io.ReadCloser
+		err error
+	)
+	for _, dgst := range rf.Digests() {
+		r, err = c.provider.Reader(dgst)
+		if err == nil {
+			break
+		}
+	}
+	if err != nil {
+		return fmt.Errorf("file content could not be provided: %v", err)
+	}
+	defer r.Close()
+
+	return atomicWriteFile(fp, r, rf)
+}
+
+// Apply the resource to the contexts. An error will be returned if the
+// operation fails. Depending on the resource type, the resource may be
+// created. For resource that cannot be resolved, an error will be returned.
+func (c *context) Apply(resource Resource) error {
+	fp, err := c.fullpath(resource.Path())
+	if err != nil {
+		return err
+	}
+
+	if !strings.HasPrefix(fp, c.root) {
+		return fmt.Errorf("resource %v escapes root", resource)
+	}
+
+	var chmod = true
+	fi, err := c.driver.Lstat(fp)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return err
+		}
+	}
+
+	switch r := resource.(type) {
+	case RegularFile:
+		if fi == nil {
+			if err := c.checkoutFile(fp, r); err != nil {
+				return fmt.Errorf("error checking out file %q: %v", resource.Path(), err)
+			}
+			chmod = false
+		} else {
+			if !fi.Mode().IsRegular() {
+				return fmt.Errorf("file %q should be a regular file, but is not", resource.Path())
+			}
+			if fi.Size() != r.Size() {
+				if err := c.checkoutFile(fp, r); err != nil {
+					return fmt.Errorf("error checking out file %q: %v", resource.Path(), err)
+				}
+			} else {
+				for _, dgst := range r.Digests() {
+					f, err := os.Open(fp)
+					if err != nil {
+						return fmt.Errorf("failure opening file for read %q: %v", resource.Path(), err)
+					}
+					compared, err := dgst.Algorithm().FromReader(f)
+					if err == nil && dgst != compared {
+						if err := c.checkoutFile(fp, r); err != nil {
+							return fmt.Errorf("error checking out file %q: %v", resource.Path(), err)
+						}
+						break
+					}
+					if err1 := f.Close(); err == nil {
+						err = err1
+					}
+					if err != nil {
+						return fmt.Errorf("error checking digest for %q: %v", resource.Path(), err)
+					}
+				}
+			}
+		}
+	case Directory:
+		if fi == nil {
+			if err := c.driver.Mkdir(fp, resource.Mode()); err != nil {
+				return err
+			}
+		} else if !fi.Mode().IsDir() {
+			return fmt.Errorf("%q should be a directory, but is not", resource.Path())
+		}
+
+	case SymLink:
+		var target string // only possibly set if target resource is a symlink
+
+		if fi != nil {
+			if fi.Mode()&os.ModeSymlink != 0 {
+				target, err = c.driver.Readlink(fp)
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		if target != r.Target() {
+			if fi != nil {
+				if err := c.driver.Remove(fp); err != nil { // RemoveAll in case of directory?
+					return err
+				}
+			}
+
+			if err := c.driver.Symlink(r.Target(), fp); err != nil {
+				return err
+			}
+		}
+
+		// NOTE(stevvooe): Chmod on symlink is not supported on linux. We
+		// may want to maintain support for other platforms that have it.
+		chmod = false
+
+	case Device:
+		if fi == nil {
+			if err := c.driver.Mknod(fp, resource.Mode(), int(r.Major()), int(r.Minor())); err != nil {
+				return err
+			}
+		} else if (fi.Mode() & os.ModeDevice) == 0 {
+			return fmt.Errorf("%q should be a device, but is not", resource.Path())
+		} else {
+			major, minor, err := devices.DeviceInfo(fi)
+			if err != nil {
+				return err
+			}
+			if major != r.Major() || minor != r.Minor() {
+				if err := c.driver.Remove(fp); err != nil {
+					return err
+				}
+
+				if err := c.driver.Mknod(fp, resource.Mode(), int(r.Major()), int(r.Minor())); err != nil {
+					return err
+				}
+			}
+		}
+
+	case NamedPipe:
+		if fi == nil {
+			if err := c.driver.Mkfifo(fp, resource.Mode()); err != nil {
+				return err
+			}
+		} else if (fi.Mode() & os.ModeNamedPipe) == 0 {
+			return fmt.Errorf("%q should be a named pipe, but is not", resource.Path())
+		}
+	}
+
+	if h, isHardlinkable := resource.(Hardlinkable); isHardlinkable {
+		for _, path := range h.Paths() {
+			if path == resource.Path() {
+				continue
+			}
+
+			lp, err := c.fullpath(path)
+			if err != nil {
+				return err
+			}
+
+			if _, fi := c.driver.Lstat(lp); fi == nil {
+				c.driver.Remove(lp)
+			}
+			if err := c.driver.Link(fp, lp); err != nil {
+				return err
+			}
+		}
+	}
+
+	// Update filemode if file was not created
+	if chmod {
+		if err := c.driver.Lchmod(fp, resource.Mode()); err != nil {
+			return err
+		}
+	}
+
+	if err := c.driver.Lchown(fp, resource.UID(), resource.GID()); err != nil {
+		return err
+	}
+
+	if xattrer, ok := resource.(XAttrer); ok {
+		// For xattrs, only ensure that we have those defined in the resource
+		// and their values are set. We can ignore other xattrs. In other words,
+		// we only set xattres defined by resource but never remove.
+
+		if _, ok := resource.(SymLink); ok {
+			lxattrDriver, ok := c.driver.(driverpkg.LXAttrDriver)
+			if !ok {
+				return fmt.Errorf("unsupported symlink xattr for resource %q", resource.Path())
+			}
+			if err := lxattrDriver.LSetxattr(fp, xattrer.XAttrs()); err != nil {
+				return err
+			}
+		} else {
+			xattrDriver, ok := c.driver.(driverpkg.XAttrDriver)
+			if !ok {
+				return fmt.Errorf("unsupported xattr for resource %q", resource.Path())
+			}
+			if err := xattrDriver.Setxattr(fp, xattrer.XAttrs()); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// Walk provides a convenience function to call filepath.Walk correctly for
+// the context. Otherwise identical to filepath.Walk, the path argument is
+// corrected to be contained within the context.
+func (c *context) Walk(fn filepath.WalkFunc) error {
+	return c.pathDriver.Walk(c.root, func(p string, fi os.FileInfo, err error) error {
+		contained, err := c.contain(p)
+		return fn(contained, fi, err)
+	})
+}
+
+// fullpath returns the system path for the resource, joined with the context
+// root. The path p must be a part of the context.
+func (c *context) fullpath(p string) (string, error) {
+	p = c.pathDriver.Join(c.root, p)
+	if !strings.HasPrefix(p, c.root) {
+		return "", fmt.Errorf("invalid context path")
+	}
+
+	return p, nil
+}
+
+// contain cleans and santizes the filesystem path p to be an absolute path,
+// effectively relative to the context root.
+func (c *context) contain(p string) (string, error) {
+	sanitized, err := c.pathDriver.Rel(c.root, p)
+	if err != nil {
+		return "", err
+	}
+
+	// ZOMBIES(stevvooe): In certain cases, we may want to remap these to a
+	// "containment error", so the caller can decide what to do.
+	return c.pathDriver.Join("/", c.pathDriver.Clean(sanitized)), nil
+}
+
+// digest returns the digest of the file at path p, relative to the root.
+func (c *context) digest(p string) (digest.Digest, error) {
+	f, err := c.driver.Open(c.pathDriver.Join(c.root, p))
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	return c.digester.Digest(f)
+}
+
+// resolveXAttrs attempts to resolve the extended attributes for the resource
+// at the path fp, which is the full path to the resource. If the resource
+// cannot have xattrs, nil will be returned.
+func (c *context) resolveXAttrs(fp string, fi os.FileInfo, base *resource) (map[string][]byte, error) {
+	if fi.Mode().IsRegular() || fi.Mode().IsDir() {
+		xattrDriver, ok := c.driver.(driverpkg.XAttrDriver)
+		if !ok {
+			log.Println("xattr extraction not supported")
+			return nil, ErrNotSupported
+		}
+
+		return xattrDriver.Getxattr(fp)
+	}
+
+	if fi.Mode()&os.ModeSymlink != 0 {
+		lxattrDriver, ok := c.driver.(driverpkg.LXAttrDriver)
+		if !ok {
+			log.Println("xattr extraction for symlinks not supported")
+			return nil, ErrNotSupported
+		}
+
+		return lxattrDriver.LGetxattr(fp)
+	}
+
+	return nil, nil
+}

vendor/github.com/containerd/continuity/continuityfs/fuse.go

@@ -0,0 +1,306 @@
+// +build linux darwin freebsd
+
+package continuityfs
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"syscall"
+
+	"bazil.org/fuse"
+	"bazil.org/fuse/fs"
+	"github.com/containerd/continuity"
+	"github.com/opencontainers/go-digest"
+	"github.com/sirupsen/logrus"
+	"golang.org/x/net/context"
+)
+
+// File represents any file type (non directory) in the filesystem
+type File struct {
+	inode    uint64
+	uid      uint32
+	gid      uint32
+	provider FileContentProvider
+	resource continuity.Resource
+}
+
+// NewFile creates a new file with the given inode and content provider
+func NewFile(inode uint64, provider FileContentProvider) *File {
+	return &File{
+		inode:    inode,
+		provider: provider,
+	}
+}
+
+func (f *File) setResource(r continuity.Resource) (err error) {
+	// TODO: error out if uid excesses uint32?
+	f.uid = uint32(r.UID())
+	f.gid = uint32(r.GID())
+	f.resource = r
+
+	return
+}
+
+// Attr sets the fuse attribute for the file
+func (f *File) Attr(ctx context.Context, attr *fuse.Attr) (err error) {
+	// Set attributes from resource metadata
+	attr.Mode = f.resource.Mode()
+	attr.Uid = f.uid
+	attr.Gid = f.gid
+
+	if rf, ok := f.resource.(continuity.RegularFile); ok {
+		attr.Nlink = uint32(len(rf.Paths()))
+		attr.Size = uint64(rf.Size())
+	} else {
+		attr.Nlink = 1
+	}
+
+	attr.Inode = f.inode
+
+	return nil
+}
+
+// Open opens the file for read
+// currently only regular files can be opened
+func (f *File) Open(ctx context.Context, req *fuse.OpenRequest, resp *fuse.OpenResponse) (fs.Handle, error) {
+	var dgst digest.Digest
+	if rf, ok := f.resource.(continuity.RegularFile); ok {
+		digests := rf.Digests()
+		if len(digests) > 0 {
+			dgst = digests[0]
+		}
+	}
+	// TODO(dmcgowan): else check if device can be opened for read
+	r, err := f.provider.Open(f.resource.Path(), dgst)
+	if err != nil {
+		logrus.Debugf("Error opening handle: %v", err)
+		return nil, err
+	}
+	return &fileHandler{
+		reader: r,
+	}, nil
+
+}
+
+func (f *File) getDirent(name string) (fuse.Dirent, error) {
+	var t fuse.DirentType
+	switch f.resource.(type) {
+	case continuity.RegularFile:
+		t = fuse.DT_File
+	case continuity.SymLink:
+		t = fuse.DT_Link
+	case continuity.Device:
+		t = fuse.DT_Block
+	case continuity.NamedPipe:
+		t = fuse.DT_FIFO
+	default:
+		t = fuse.DT_Unknown
+	}
+
+	return fuse.Dirent{
+		Inode: f.inode,
+		Type:  t,
+		Name:  name,
+	}, nil
+}
+
+type fileHandler struct {
+	offset int64
+	reader io.ReadCloser
+}
+
+func (h *fileHandler) Read(ctx context.Context, req *fuse.ReadRequest, resp *fuse.ReadResponse) error {
+	if h.offset != req.Offset {
+		if seeker, ok := h.reader.(io.Seeker); ok {
+			if _, err := seeker.Seek(req.Offset, os.SEEK_SET); err != nil {
+				logrus.Debugf("Error seeking: %v", err)
+				return err
+			}
+			h.offset = req.Offset
+		} else {
+			return errors.New("unable to seek to offset")
+		}
+	}
+
+	n, err := h.reader.Read(resp.Data[:req.Size])
+	if err != nil {
+		logrus.Debugf("Read error: %v", err)
+		return err
+	}
+	h.offset = h.offset + int64(n)
+
+	resp.Data = resp.Data[:n]
+
+	return nil
+}
+
+func (h *fileHandler) Release(ctx context.Context, req *fuse.ReleaseRequest) error {
+	return h.reader.Close()
+}
+
+// Dir represents a file system directory
+type Dir struct {
+	inode    uint64
+	uid      uint32
+	gid      uint32
+	nodes    map[string]fs.Node
+	provider FileContentProvider
+	resource continuity.Resource
+}
+
+// Attr sets the fuse attributes for the directory
+func (d *Dir) Attr(ctx context.Context, attr *fuse.Attr) (err error) {
+	if d.resource == nil {
+		attr.Mode = os.ModeDir | 0555
+	} else {
+		attr.Mode = d.resource.Mode()
+	}
+
+	attr.Uid = d.uid
+	attr.Gid = d.gid
+	attr.Inode = d.inode
+
+	return nil
+}
+
+func (d *Dir) getDirent(name string) (fuse.Dirent, error) {
+	return fuse.Dirent{
+		Inode: d.inode,
+		Type:  fuse.DT_Dir,
+		Name:  name,
+	}, nil
+}
+
+type direnter interface {
+	getDirent(name string) (fuse.Dirent, error)
+}
+
+// Lookup looks up the filesystem node for the name within the directory
+func (d *Dir) Lookup(ctx context.Context, name string) (fs.Node, error) {
+	node, ok := d.nodes[name]
+	if !ok {
+		return nil, fuse.ENOENT
+	}
+	return node, nil
+}
+
+// ReadDirAll reads all the directory entries
+func (d *Dir) ReadDirAll(ctx context.Context) ([]fuse.Dirent, error) {
+	ents := make([]fuse.Dirent, 0, len(d.nodes))
+	for name, node := range d.nodes {
+		if nd, ok := node.(direnter); ok {
+			de, err := nd.getDirent(name)
+			if err != nil {
+				return nil, err
+			}
+			ents = append(ents, de)
+		} else {
+			logrus.Errorf("%s does not have a directory entry", name)
+		}
+	}
+
+	return ents, nil
+}
+
+func (d *Dir) setResource(r continuity.Resource) (err error) {
+	d.uid = uint32(r.UID())
+	d.gid = uint32(r.GID())
+	d.resource = r
+
+	return
+}
+
+// NewDir creates a new directory object
+func NewDir(inode uint64, provider FileContentProvider) *Dir {
+	return &Dir{
+		inode:    inode,
+		nodes:    map[string]fs.Node{},
+		provider: provider,
+	}
+}
+
+var (
+	rootPath = fmt.Sprintf("%c", filepath.Separator)
+)
+
+func addNode(path string, node fs.Node, cache map[string]*Dir, provider FileContentProvider) {
+	dirPath, file := filepath.Split(path)
+	d, ok := cache[dirPath]
+	if !ok {
+		d = NewDir(0, provider)
+		cache[dirPath] = d
+		addNode(filepath.Clean(dirPath), d, cache, provider)
+	}
+	d.nodes[file] = node
+	logrus.Debugf("%s (%#v) added to %s", file, node, dirPath)
+}
+
+type treeRoot struct {
+	root *Dir
+}
+
+func (t treeRoot) Root() (fs.Node, error) {
+	logrus.Debugf("Returning root with %#v", t.root.nodes)
+	return t.root, nil
+}
+
+// NewFSFromManifest creates a fuse filesystem using the given manifest
+// to create the node tree and the content provider to serve up
+// content for regular files.
+func NewFSFromManifest(manifest *continuity.Manifest, mountRoot string, provider FileContentProvider) (fs.FS, error) {
+	tree := treeRoot{
+		root: NewDir(0, provider),
+	}
+
+	fi, err := os.Stat(mountRoot)
+	if err != nil {
+		return nil, err
+	}
+	st, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return nil, errors.New("could not access directory")
+	}
+	tree.root.uid = st.Uid
+	tree.root.gid = st.Gid
+
+	dirCache := map[string]*Dir{
+		rootPath: tree.root,
+	}
+
+	for i, resource := range manifest.Resources {
+		inode := uint64(i) + 1
+		if _, ok := resource.(continuity.Directory); ok {
+			cleanPath := filepath.Clean(resource.Path())
+			keyPath := fmt.Sprintf("%s%c", cleanPath, filepath.Separator)
+			d, ok := dirCache[keyPath]
+			if !ok {
+				d = NewDir(inode, provider)
+				dirCache[keyPath] = d
+				addNode(cleanPath, d, dirCache, provider)
+			} else {
+				d.inode = inode
+			}
+			if err := d.setResource(resource); err != nil {
+				return nil, err
+			}
+			continue
+		}
+		f := NewFile(inode, provider)
+		if err := f.setResource(resource); err != nil {
+			return nil, err
+		}
+		if rf, ok := resource.(continuity.RegularFile); ok {
+
+			for _, p := range rf.Paths() {
+				addNode(p, f, dirCache, provider)
+			}
+		} else {
+			addNode(resource.Path(), f, dirCache, provider)
+		}
+	}
+
+	return tree, nil
+}

vendor/github.com/containerd/continuity/continuityfs/provider.go

@@ -0,0 +1,43 @@
+// +build linux darwin freebsd
+
+package continuityfs
+
+import (
+	"io"
+	"path/filepath"
+
+	"github.com/containerd/continuity/driver"
+	"github.com/opencontainers/go-digest"
+)
+
+// FileContentProvider is an object which is used to fetch
+// data and inode information about a path or digest.
+// TODO(dmcgowan): Update GetContentPath to provide a
+// filehandle or ReadWriteCloser.
+type FileContentProvider interface {
+	Path(string, digest.Digest) (string, error)
+	Open(string, digest.Digest) (io.ReadCloser, error)
+}
+
+type fsContentProvider struct {
+	root   string
+	driver driver.Driver
+}
+
+// NewFSFileContentProvider creates a new content provider which
+// gets content from a directory on an existing filesystem based
+// on the resource path.
+func NewFSFileContentProvider(root string, driver driver.Driver) FileContentProvider {
+	return &fsContentProvider{
+		root:   root,
+		driver: driver,
+	}
+}
+
+func (p *fsContentProvider) Path(path string, dgst digest.Digest) (string, error) {
+	return filepath.Join(p.root, path), nil
+}
+
+func (p *fsContentProvider) Open(path string, dgst digest.Digest) (io.ReadCloser, error) {
+	return p.driver.Open(filepath.Join(p.root, path))
+}

vendor/github.com/containerd/continuity/devices/devices.go

@@ -0,0 +1,5 @@
+package devices
+
+import "fmt"
+
+var ErrNotSupported = fmt.Errorf("not supported")

vendor/github.com/containerd/continuity/devices/devices_unix.go

@@ -0,0 +1,58 @@
+// +build linux darwin freebsd solaris
+
+package devices
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func DeviceInfo(fi os.FileInfo) (uint64, uint64, error) {
+	sys, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return 0, 0, fmt.Errorf("cannot extract device from os.FileInfo")
+	}
+
+	dev := uint64(sys.Rdev)
+	return uint64(unix.Major(dev)), uint64(unix.Minor(dev)), nil
+}
+
+// mknod provides a shortcut for syscall.Mknod
+func Mknod(p string, mode os.FileMode, maj, min int) error {
+	var (
+		m   = syscallMode(mode.Perm())
+		dev uint64
+	)
+
+	if mode&os.ModeDevice != 0 {
+		dev = unix.Mkdev(uint32(maj), uint32(min))
+
+		if mode&os.ModeCharDevice != 0 {
+			m |= unix.S_IFCHR
+		} else {
+			m |= unix.S_IFBLK
+		}
+	} else if mode&os.ModeNamedPipe != 0 {
+		m |= unix.S_IFIFO
+	}
+
+	return unix.Mknod(p, m, int(dev))
+}
+
+// syscallMode returns the syscall-specific mode bits from Go's portable mode bits.
+func syscallMode(i os.FileMode) (o uint32) {
+	o |= uint32(i.Perm())
+	if i&os.ModeSetuid != 0 {
+		o |= unix.S_ISUID
+	}
+	if i&os.ModeSetgid != 0 {
+		o |= unix.S_ISGID
+	}
+	if i&os.ModeSticky != 0 {
+		o |= unix.S_ISVTX
+	}
+	return
+}

vendor/github.com/containerd/continuity/devices/devices_windows.go

@@ -0,0 +1,11 @@
+package devices
+
+import (
+	"os"
+
+	"github.com/pkg/errors"
+)
+
+func DeviceInfo(fi os.FileInfo) (uint64, uint64, error) {
+	return 0, 0, errors.Wrap(ErrNotSupported, "cannot get device info on windows")
+}

vendor/github.com/containerd/continuity/digests.go

@@ -0,0 +1,88 @@
+package continuity
+
+import (
+	"fmt"
+	"io"
+	"sort"
+
+	"github.com/opencontainers/go-digest"
+)
+
+// Digester produces a digest for a given read stream
+type Digester interface {
+	Digest(io.Reader) (digest.Digest, error)
+}
+
+// ContentProvider produces a read stream for a given digest
+type ContentProvider interface {
+	Reader(digest.Digest) (io.ReadCloser, error)
+}
+
+type simpleDigester struct {
+	algorithm digest.Algorithm
+}
+
+func (sd simpleDigester) Digest(r io.Reader) (digest.Digest, error) {
+	digester := sd.algorithm.Digester()
+
+	if _, err := io.Copy(digester.Hash(), r); err != nil {
+		return "", err
+	}
+
+	return digester.Digest(), nil
+}
+
+// uniqifyDigests sorts and uniqifies the provided digest, ensuring that the
+// digests are not repeated and no two digests with the same algorithm have
+// different values. Because a stable sort is used, this has the effect of
+// "zipping" digest collections from multiple resources.
+func uniqifyDigests(digests ...digest.Digest) ([]digest.Digest, error) {
+	sort.Stable(digestSlice(digests)) // stable sort is important for the behavior here.
+	seen := map[digest.Digest]struct{}{}
+	algs := map[digest.Algorithm][]digest.Digest{} // detect different digests.
+
+	var out []digest.Digest
+	// uniqify the digests
+	for _, d := range digests {
+		if _, ok := seen[d]; ok {
+			continue
+		}
+
+		seen[d] = struct{}{}
+		algs[d.Algorithm()] = append(algs[d.Algorithm()], d)
+
+		if len(algs[d.Algorithm()]) > 1 {
+			return nil, fmt.Errorf("conflicting digests for %v found", d.Algorithm())
+		}
+
+		out = append(out, d)
+	}
+
+	return out, nil
+}
+
+// digestsMatch compares the two sets of digests to see if they match.
+func digestsMatch(as, bs []digest.Digest) bool {
+	all := append(as, bs...)
+
+	uniqified, err := uniqifyDigests(all...)
+	if err != nil {
+		// the only error uniqifyDigests returns is when the digests disagree.
+		return false
+	}
+
+	disjoint := len(as) + len(bs)
+	if len(uniqified) == disjoint {
+		// if these two sets have the same cardinality, we know both sides
+		// didn't share any digests.
+		return false
+	}
+
+	return true
+}
+
+type digestSlice []digest.Digest
+
+func (p digestSlice) Len() int           { return len(p) }
+func (p digestSlice) Less(i, j int) bool { return p[i] < p[j] }
+func (p digestSlice) Swap(i, j int)      { p[i], p[j] = p[j], p[i] }

vendor/github.com/containerd/continuity/digests_test.go

@@ -0,0 +1,72 @@
+package continuity
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/opencontainers/go-digest"
+)
+
+// TestUniqifyDigests ensures that we deterministically sort digest entries
+// for a resource.
+func TestUniqifyDigests(t *testing.T) {
+	for _, testcase := range []struct {
+		description string
+		input       [][]digest.Digest // input is a series of digest collections from separate resources.
+		expected    []digest.Digest
+		err         error
+	}{
+		{
+			description: "simple merge",
+			input: [][]digest.Digest{
+				{"sha1:abc", "sha256:def"},
+				{"sha1:abc", "sha256:def"},
+			},
+			expected: []digest.Digest{"sha1:abc", "sha256:def"},
+		},
+		{
+			description: "simple reversed order",
+			input: [][]digest.Digest{
+				{"sha1:abc", "sha256:def"},
+				{"sha256:def", "sha1:abc"},
+			},
+			expected: []digest.Digest{"sha1:abc", "sha256:def"},
+		},
+		{
+			description: "conflicting values for sha1",
+			input: [][]digest.Digest{
+				{"sha1:abc", "sha256:def"},
+				{"sha256:def", "sha1:def"},
+			},
+			err: fmt.Errorf("conflicting digests for sha1 found"),
+		},
+	} {
+		fatalf := func(format string, args ...interface{}) {
+			t.Fatalf(testcase.description+": "+format, args...)
+		}
+
+		var assembled []digest.Digest
+
+		for _, ds := range testcase.input {
+			assembled = append(assembled, ds...)
+		}
+
+		merged, err := uniqifyDigests(assembled...)
+		if err != testcase.err {
+			if testcase.err == nil {
+				fatalf("unexpected error uniqifying digests: %v", err)
+			}
+
+			if err != testcase.err && err.Error() != testcase.err.Error() {
+				// compare by string till we create nice error type
+				fatalf("unexpected error uniqifying digests: %v != %v", err, testcase.err)
+			}
+		}
+
+		if !reflect.DeepEqual(merged, testcase.expected) {
+			fatalf("unexpected uniquification: %v != %v", merged, testcase.expected)
+		}
+
+	}
+}

vendor/github.com/containerd/continuity/driver/driver.go

@@ -0,0 +1,162 @@
+package driver
+
+import (
+	"fmt"
+	"io"
+	"os"
+)
+
+var ErrNotSupported = fmt.Errorf("not supported")
+
+// Driver provides all of the system-level functions in a common interface.
+// The context should call these with full paths and should never use the `os`
+// package or any other package to access resources on the filesystem. This
+// mechanism let's us carefully control access to the context and maintain
+// path and resource integrity. It also gives us an interface to reason about
+// direct resource access.
+//
+// Implementations don't need to do much other than meet the interface. For
+// example, it is not required to wrap os.FileInfo to return correct paths for
+// the call to Name().
+type Driver interface {
+	// Note that Open() returns a File interface instead of *os.File. This
+	// is because os.File is a struct, so if Open was to return *os.File,
+	// the only way to fulfill the interface would be to call os.Open()
+	Open(path string) (File, error)
+	OpenFile(path string, flag int, perm os.FileMode) (File, error)
+
+	Stat(path string) (os.FileInfo, error)
+	Lstat(path string) (os.FileInfo, error)
+	Readlink(p string) (string, error)
+	Mkdir(path string, mode os.FileMode) error
+	Remove(path string) error
+
+	Link(oldname, newname string) error
+	Lchmod(path string, mode os.FileMode) error
+	Lchown(path string, uid, gid int64) error
+	Symlink(oldname, newname string) error
+
+	MkdirAll(path string, perm os.FileMode) error
+	RemoveAll(path string) error
+
+	// TODO(aaronl): These methods might move outside the main Driver
+	// interface in the future as more platforms are added.
+	Mknod(path string, mode os.FileMode, major int, minor int) error
+	Mkfifo(path string, mode os.FileMode) error
+}
+
+// File is the interface for interacting with files returned by continuity's Open
+// This is needed since os.File is a struct, instead of an interface, so it can't
+// be used.
+type File interface {
+	io.ReadWriteCloser
+	io.Seeker
+	Readdir(n int) ([]os.FileInfo, error)
+}
+
+func NewSystemDriver() (Driver, error) {
+	// TODO(stevvooe): Consider having this take a "hint" path argument, which
+	// would be the context root. The hint could be used to resolve required
+	// filesystem support when assembling the driver to use.
+	return &driver{}, nil
+}
+
+// XAttrDriver should be implemented on operation systems and filesystems that
+// have xattr support for regular files and directories.
+type XAttrDriver interface {
+	// Getxattr returns all of the extended attributes for the file at path.
+	// Typically, this takes a syscall call to Listxattr and Getxattr.
+	Getxattr(path string) (map[string][]byte, error)
+
+	// Setxattr sets all of the extended attributes on file at path, following
+	// any symbolic links, if necessary. All attributes on the target are
+	// replaced by the values from attr. If the operation fails to set any
+	// attribute, those already applied will not be rolled back.
+	Setxattr(path string, attr map[string][]byte) error
+}
+
+// LXAttrDriver should be implemented by drivers on operating systems and
+// filesystems that support setting and getting extended attributes on
+// symbolic links. If this is not implemented, extended attributes will be
+// ignored on symbolic links.
+type LXAttrDriver interface {
+	// LGetxattr returns all of the extended attributes for the file at path
+	// and does not follow symlinks. Typically, this takes a syscall call to
+	// Llistxattr and Lgetxattr.
+	LGetxattr(path string) (map[string][]byte, error)
+
+	// LSetxattr sets all of the extended attributes on file at path, without
+	// following symbolic links. All attributes on the target are replaced by
+	// the values from attr. If the operation fails to set any attribute,
+	// those already applied will not be rolled back.
+	LSetxattr(path string, attr map[string][]byte) error
+}
+
+type DeviceInfoDriver interface {
+	DeviceInfo(fi os.FileInfo) (maj uint64, min uint64, err error)
+}
+
+// driver is a simple default implementation that sends calls out to the "os"
+// package. Extend the "driver" type in system-specific files to add support,
+// such as xattrs, which can add support at compile time.
+type driver struct{}
+
+var _ File = &os.File{}
+
+// LocalDriver is the exported Driver struct for convenience.
+var LocalDriver Driver = &driver{}
+
+func (d *driver) Open(p string) (File, error) {
+	return os.Open(p)
+}
+
+func (d *driver) OpenFile(path string, flag int, perm os.FileMode) (File, error) {
+	return os.OpenFile(path, flag, perm)
+}
+
+func (d *driver) Stat(p string) (os.FileInfo, error) {
+	return os.Stat(p)
+}
+
+func (d *driver) Lstat(p string) (os.FileInfo, error) {
+	return os.Lstat(p)
+}
+
+func (d *driver) Readlink(p string) (string, error) {
+	return os.Readlink(p)
+}
+
+func (d *driver) Mkdir(p string, mode os.FileMode) error {
+	return os.Mkdir(p, mode)
+}
+
+// Remove is used to unlink files and remove directories.
+// This is following the golang os package api which
+// combines the operations into a higher level Remove
+// function. If explicit unlinking or directory removal
+// to mirror system call is required, they should be
+// split up at that time.
+func (d *driver) Remove(path string) error {
+	return os.Remove(path)
+}
+
+func (d *driver) Link(oldname, newname string) error {
+	return os.Link(oldname, newname)
+}
+
+func (d *driver) Lchown(name string, uid, gid int64) error {
+	// TODO: error out if uid excesses int bit width?
+	return os.Lchown(name, int(uid), int(gid))
+}
+
+func (d *driver) Symlink(oldname, newname string) error {
+	return os.Symlink(oldname, newname)
+}
+
+func (d *driver) MkdirAll(path string, perm os.FileMode) error {
+	return os.MkdirAll(path, perm)
+}
+
+func (d *driver) RemoveAll(path string) error {
+	return os.RemoveAll(path)
+}

vendor/github.com/containerd/continuity/driver/driver_unix.go

@@ -0,0 +1,122 @@
+// +build linux darwin freebsd solaris
+
+package driver
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"github.com/containerd/continuity/devices"
+	"github.com/containerd/continuity/sysx"
+)
+
+func (d *driver) Mknod(path string, mode os.FileMode, major, minor int) error {
+	return devices.Mknod(path, mode, major, minor)
+}
+
+func (d *driver) Mkfifo(path string, mode os.FileMode) error {
+	if mode&os.ModeNamedPipe == 0 {
+		return errors.New("mode passed to Mkfifo does not have the named pipe bit set")
+	}
+	// mknod with a mode that has ModeNamedPipe set creates a fifo, not a
+	// device.
+	return devices.Mknod(path, mode, 0, 0)
+}
+
+// Lchmod changes the mode of an file not following symlinks.
+func (d *driver) Lchmod(path string, mode os.FileMode) (err error) {
+	if !filepath.IsAbs(path) {
+		path, err = filepath.Abs(path)
+		if err != nil {
+			return
+		}
+	}
+
+	return sysx.Fchmodat(0, path, uint32(mode), sysx.AtSymlinkNofollow)
+}
+
+// Getxattr returns all of the extended attributes for the file at path p.
+func (d *driver) Getxattr(p string) (map[string][]byte, error) {
+	xattrs, err := sysx.Listxattr(p)
+	if err != nil {
+		return nil, fmt.Errorf("listing %s xattrs: %v", p, err)
+	}
+
+	sort.Strings(xattrs)
+	m := make(map[string][]byte, len(xattrs))
+
+	for _, attr := range xattrs {
+		value, err := sysx.Getxattr(p, attr)
+		if err != nil {
+			return nil, fmt.Errorf("getting %q xattr on %s: %v", attr, p, err)
+		}
+
+		// NOTE(stevvooe): This append/copy tricky relies on unique
+		// xattrs. Break this out into an alloc/copy if xattrs are no
+		// longer unique.
+		m[attr] = append(m[attr], value...)
+	}
+
+	return m, nil
+}
+
+// Setxattr sets all of the extended attributes on file at path, following
+// any symbolic links, if necessary. All attributes on the target are
+// replaced by the values from attr. If the operation fails to set any
+// attribute, those already applied will not be rolled back.
+func (d *driver) Setxattr(path string, attrMap map[string][]byte) error {
+	for attr, value := range attrMap {
+		if err := sysx.Setxattr(path, attr, value, 0); err != nil {
+			return fmt.Errorf("error setting xattr %q on %s: %v", attr, path, err)
+		}
+	}
+
+	return nil
+}
+
+// LGetxattr returns all of the extended attributes for the file at path p
+// not following symbolic links.
+func (d *driver) LGetxattr(p string) (map[string][]byte, error) {
+	xattrs, err := sysx.LListxattr(p)
+	if err != nil {
+		return nil, fmt.Errorf("listing %s xattrs: %v", p, err)
+	}
+
+	sort.Strings(xattrs)
+	m := make(map[string][]byte, len(xattrs))
+
+	for _, attr := range xattrs {
+		value, err := sysx.LGetxattr(p, attr)
+		if err != nil {
+			return nil, fmt.Errorf("getting %q xattr on %s: %v", attr, p, err)
+		}
+
+		// NOTE(stevvooe): This append/copy tricky relies on unique
+		// xattrs. Break this out into an alloc/copy if xattrs are no
+		// longer unique.
+		m[attr] = append(m[attr], value...)
+	}
+
+	return m, nil
+}
+
+// LSetxattr sets all of the extended attributes on file at path, not
+// following any symbolic links. All attributes on the target are
+// replaced by the values from attr. If the operation fails to set any
+// attribute, those already applied will not be rolled back.
+func (d *driver) LSetxattr(path string, attrMap map[string][]byte) error {
+	for attr, value := range attrMap {
+		if err := sysx.LSetxattr(path, attr, value, 0); err != nil {
+			return fmt.Errorf("error setting xattr %q on %s: %v", attr, path, err)
+		}
+	}
+
+	return nil
+}
+
+func (d *driver) DeviceInfo(fi os.FileInfo) (maj uint64, min uint64, err error) {
+	return devices.DeviceInfo(fi)
+}

vendor/github.com/containerd/continuity/driver/driver_windows.go

@@ -0,0 +1,21 @@
+package driver
+
+import (
+	"os"
+
+	"github.com/pkg/errors"
+)
+
+func (d *driver) Mknod(path string, mode os.FileMode, major, minor int) error {
+	return errors.Wrap(ErrNotSupported, "cannot create device node on Windows")
+}
+
+func (d *driver) Mkfifo(path string, mode os.FileMode) error {
+	return errors.Wrap(ErrNotSupported, "cannot create fifo on Windows")
+}
+
+// Lchmod changes the mode of an file not following symlinks.
+func (d *driver) Lchmod(path string, mode os.FileMode) (err error) {
+	// TODO: Use Window's equivalent
+	return os.Chmod(path, mode)
+}

vendor/github.com/containerd/continuity/driver/utils.go

@@ -0,0 +1,74 @@
+package driver
+
+import (
+	"io"
+	"io/ioutil"
+	"os"
+	"sort"
+)
+
+// ReadFile works the same as ioutil.ReadFile with the Driver abstraction
+func ReadFile(r Driver, filename string) ([]byte, error) {
+	f, err := r.Open(filename)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	data, err := ioutil.ReadAll(f)
+	if err != nil {
+		return nil, err
+	}
+
+	return data, nil
+}
+
+// WriteFile works the same as ioutil.WriteFile with the Driver abstraction
+func WriteFile(r Driver, filename string, data []byte, perm os.FileMode) error {
+	f, err := r.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	n, err := f.Write(data)
+	if err != nil {
+		return err
+	} else if n != len(data) {
+		return io.ErrShortWrite
+	}
+
+	return nil
+}
+
+// ReadDir works the same as ioutil.ReadDir with the Driver abstraction
+func ReadDir(r Driver, dirname string) ([]os.FileInfo, error) {
+	f, err := r.Open(dirname)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	dirs, err := f.Readdir(-1)
+	if err != nil {
+		return nil, err
+	}
+
+	sort.Sort(fileInfos(dirs))
+	return dirs, nil
+}
+
+// Simple implementation of the sort.Interface for os.FileInfo
+type fileInfos []os.FileInfo
+
+func (fis fileInfos) Len() int {
+	return len(fis)
+}
+
+func (fis fileInfos) Less(i, j int) bool {
+	return fis[i].Name() < fis[j].Name()
+}
+
+func (fis fileInfos) Swap(i, j int) {
+	fis[i], fis[j] = fis[j], fis[i]
+}

vendor/github.com/containerd/continuity/fs/copy.go

@@ -0,0 +1,119 @@
+package fs
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/pkg/errors"
+)
+
+var bufferPool = &sync.Pool{
+	New: func() interface{} {
+		buffer := make([]byte, 32*1024)
+		return &buffer
+	},
+}
+
+// CopyDir copies the directory from src to dst.
+// Most efficient copy of files is attempted.
+func CopyDir(dst, src string) error {
+	inodes := map[uint64]string{}
+	return copyDirectory(dst, src, inodes)
+}
+
+func copyDirectory(dst, src string, inodes map[uint64]string) error {
+	stat, err := os.Stat(src)
+	if err != nil {
+		return errors.Wrapf(err, "failed to stat %s", src)
+	}
+	if !stat.IsDir() {
+		return errors.Errorf("source is not directory")
+	}
+
+	if st, err := os.Stat(dst); err != nil {
+		if err := os.Mkdir(dst, stat.Mode()); err != nil {
+			return errors.Wrapf(err, "failed to mkdir %s", dst)
+		}
+	} else if !st.IsDir() {
+		return errors.Errorf("cannot copy to non-directory: %s", dst)
+	} else {
+		if err := os.Chmod(dst, stat.Mode()); err != nil {
+			return errors.Wrapf(err, "failed to chmod on %s", dst)
+		}
+	}
+
+	fis, err := ioutil.ReadDir(src)
+	if err != nil {
+		return errors.Wrapf(err, "failed to read %s", src)
+	}
+
+	if err := copyFileInfo(stat, dst); err != nil {
+		return errors.Wrapf(err, "failed to copy file info for %s", dst)
+	}
+
+	for _, fi := range fis {
+		source := filepath.Join(src, fi.Name())
+		target := filepath.Join(dst, fi.Name())
+
+		switch {
+		case fi.IsDir():
+			if err := copyDirectory(target, source, inodes); err != nil {
+				return err
+			}
+			continue
+		case (fi.Mode() & os.ModeType) == 0:
+			link, err := getLinkSource(target, fi, inodes)
+			if err != nil {
+				return errors.Wrap(err, "failed to get hardlink")
+			}
+			if link != "" {
+				if err := os.Link(link, target); err != nil {
+					return errors.Wrap(err, "failed to create hard link")
+				}
+			} else if err := copyFile(source, target); err != nil {
+				return errors.Wrap(err, "failed to copy files")
+			}
+		case (fi.Mode() & os.ModeSymlink) == os.ModeSymlink:
+			link, err := os.Readlink(source)
+			if err != nil {
+				return errors.Wrapf(err, "failed to read link: %s", source)
+			}
+			if err := os.Symlink(link, target); err != nil {
+				return errors.Wrapf(err, "failed to create symlink: %s", target)
+			}
+		case (fi.Mode() & os.ModeDevice) == os.ModeDevice:
+			if err := copyDevice(target, fi); err != nil {
+				return errors.Wrapf(err, "failed to create device")
+			}
+		default:
+			// TODO: Support pipes and sockets
+			return errors.Wrapf(err, "unsupported mode %s", fi.Mode())
+		}
+		if err := copyFileInfo(fi, target); err != nil {
+			return errors.Wrap(err, "failed to copy file info")
+		}
+
+		if err := copyXAttrs(target, source); err != nil {
+			return errors.Wrap(err, "failed to copy xattrs")
+		}
+	}
+
+	return nil
+}
+
+func copyFile(source, target string) error {
+	src, err := os.Open(source)
+	if err != nil {
+		return errors.Wrapf(err, "failed to open source %s", source)
+	}
+	defer src.Close()
+	tgt, err := os.Create(target)
+	if err != nil {
+		return errors.Wrapf(err, "failed to open target %s", target)
+	}
+	defer tgt.Close()
+
+	return copyFileContent(tgt, src)
+}

vendor/github.com/containerd/continuity/fs/copy_linux.go

@@ -0,0 +1,95 @@
+package fs
+
+import (
+	"io"
+	"os"
+	"syscall"
+
+	"github.com/containerd/continuity/sysx"
+	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
+)
+
+func copyFileInfo(fi os.FileInfo, name string) error {
+	st := fi.Sys().(*syscall.Stat_t)
+	if err := os.Lchown(name, int(st.Uid), int(st.Gid)); err != nil {
+		if os.IsPermission(err) {
+			// Normally if uid/gid are the same this would be a no-op, but some
+			// filesystems may still return EPERM... for instance NFS does this.
+			// In such a case, this is not an error.
+			if dstStat, err2 := os.Lstat(name); err2 == nil {
+				st2 := dstStat.Sys().(*syscall.Stat_t)
+				if st.Uid == st2.Uid && st.Gid == st2.Gid {
+					err = nil
+				}
+			}
+		}
+		if err != nil {
+			return errors.Wrapf(err, "failed to chown %s", name)
+		}
+	}
+
+	if (fi.Mode() & os.ModeSymlink) != os.ModeSymlink {
+		if err := os.Chmod(name, fi.Mode()); err != nil {
+			return errors.Wrapf(err, "failed to chmod %s", name)
+		}
+	}
+
+	timespec := []unix.Timespec{unix.Timespec(StatAtime(st)), unix.Timespec(StatMtime(st))}
+	if err := unix.UtimesNanoAt(unix.AT_FDCWD, name, timespec, unix.AT_SYMLINK_NOFOLLOW); err != nil {
+		return errors.Wrapf(err, "failed to utime %s", name)
+	}
+
+	return nil
+}
+
+func copyFileContent(dst, src *os.File) error {
+	st, err := src.Stat()
+	if err != nil {
+		return errors.Wrap(err, "unable to stat source")
+	}
+
+	n, err := unix.CopyFileRange(int(src.Fd()), nil, int(dst.Fd()), nil, int(st.Size()), 0)
+	if err != nil {
+		if err != unix.ENOSYS && err != unix.EXDEV {
+			return errors.Wrap(err, "copy file range failed")
+		}
+
+		buf := bufferPool.Get().(*[]byte)
+		_, err = io.CopyBuffer(dst, src, *buf)
+		bufferPool.Put(buf)
+		return err
+	}
+
+	if int64(n) != st.Size() {
+		return errors.Wrapf(err, "short copy: %d of %d", int64(n), st.Size())
+	}
+
+	return nil
+}
+
+func copyXAttrs(dst, src string) error {
+	xattrKeys, err := sysx.LListxattr(src)
+	if err != nil {
+		return errors.Wrapf(err, "failed to list xattrs on %s", src)
+	}
+	for _, xattr := range xattrKeys {
+		data, err := sysx.LGetxattr(src, xattr)
+		if err != nil {
+			return errors.Wrapf(err, "failed to get xattr %q on %s", xattr, src)
+		}
+		if err := sysx.LSetxattr(dst, xattr, data, 0); err != nil {
+			return errors.Wrapf(err, "failed to set xattr %q on %s", xattr, dst)
+		}
+	}
+
+	return nil
+}
+
+func copyDevice(dst string, fi os.FileInfo) error {
+	st, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return errors.New("unsupported stat type")
+	}
+	return unix.Mknod(dst, uint32(fi.Mode()), int(st.Rdev))
+}

vendor/github.com/containerd/continuity/fs/copy_test.go

@@ -0,0 +1,71 @@
+package fs
+
+import (
+	"io/ioutil"
+	"os"
+	"testing"
+
+	_ "crypto/sha256"
+
+	"github.com/containerd/continuity/fs/fstest"
+	"github.com/pkg/errors"
+)
+
+// TODO: Create copy directory which requires privilege
+//  chown
+//  mknod
+//  setxattr fstest.SetXAttr("/home", "trusted.overlay.opaque", "y"),
+
+func TestCopyDirectory(t *testing.T) {
+	apply := fstest.Apply(
+		fstest.CreateDir("/etc/", 0755),
+		fstest.CreateFile("/etc/hosts", []byte("localhost 127.0.0.1"), 0644),
+		fstest.Link("/etc/hosts", "/etc/hosts.allow"),
+		fstest.CreateDir("/usr/local/lib", 0755),
+		fstest.CreateFile("/usr/local/lib/libnothing.so", []byte{0x00, 0x00}, 0755),
+		fstest.Symlink("libnothing.so", "/usr/local/lib/libnothing.so.2"),
+		fstest.CreateDir("/home", 0755),
+	)
+
+	if err := testCopy(apply); err != nil {
+		t.Fatalf("Copy test failed: %+v", err)
+	}
+}
+
+// This test used to fail because link-no-nothing.txt would be copied first,
+// then file operations in dst during the CopyDir would follow the symlink and
+// fail.
+func TestCopyDirectoryWithLocalSymlink(t *testing.T) {
+	apply := fstest.Apply(
+		fstest.CreateFile("nothing.txt", []byte{0x00, 0x00}, 0755),
+		fstest.Symlink("nothing.txt", "link-no-nothing.txt"),
+	)
+
+	if err := testCopy(apply); err != nil {
+		t.Fatalf("Copy test failed: %+v", err)
+	}
+}
+
+func testCopy(apply fstest.Applier) error {
+	t1, err := ioutil.TempDir("", "test-copy-src-")
+	if err != nil {
+		return errors.Wrap(err, "failed to create temporary directory")
+	}
+	defer os.RemoveAll(t1)
+
+	t2, err := ioutil.TempDir("", "test-copy-dst-")
+	if err != nil {
+		return errors.Wrap(err, "failed to create temporary directory")
+	}
+	defer os.RemoveAll(t2)
+
+	if err := apply.Apply(t1); err != nil {
+		return errors.Wrap(err, "failed to apply changes")
+	}
+
+	if err := CopyDir(t2, t1); err != nil {
+		return errors.Wrap(err, "failed to copy")
+	}
+
+	return fstest.CheckDirectoryEqual(t1, t2)
+}

vendor/github.com/containerd/continuity/fs/copy_unix.go

@@ -0,0 +1,80 @@
+// +build solaris darwin freebsd
+
+package fs
+
+import (
+	"io"
+	"os"
+	"syscall"
+
+	"github.com/containerd/continuity/sysx"
+	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
+)
+
+func copyFileInfo(fi os.FileInfo, name string) error {
+	st := fi.Sys().(*syscall.Stat_t)
+	if err := os.Lchown(name, int(st.Uid), int(st.Gid)); err != nil {
+		if os.IsPermission(err) {
+			// Normally if uid/gid are the same this would be a no-op, but some
+			// filesystems may still return EPERM... for instance NFS does this.
+			// In such a case, this is not an error.
+			if dstStat, err2 := os.Lstat(name); err2 == nil {
+				st2 := dstStat.Sys().(*syscall.Stat_t)
+				if st.Uid == st2.Uid && st.Gid == st2.Gid {
+					err = nil
+				}
+			}
+		}
+		if err != nil {
+			return errors.Wrapf(err, "failed to chown %s", name)
+		}
+	}
+
+	if (fi.Mode() & os.ModeSymlink) != os.ModeSymlink {
+		if err := os.Chmod(name, fi.Mode()); err != nil {
+			return errors.Wrapf(err, "failed to chmod %s", name)
+		}
+	}
+
+	timespec := []syscall.Timespec{StatAtime(st), StatMtime(st)}
+	if err := syscall.UtimesNano(name, timespec); err != nil {
+		return errors.Wrapf(err, "failed to utime %s", name)
+	}
+
+	return nil
+}
+
+func copyFileContent(dst, src *os.File) error {
+	buf := bufferPool.Get().(*[]byte)
+	_, err := io.CopyBuffer(dst, src, *buf)
+	bufferPool.Put(buf)
+
+	return err
+}
+
+func copyXAttrs(dst, src string) error {
+	xattrKeys, err := sysx.LListxattr(src)
+	if err != nil {
+		return errors.Wrapf(err, "failed to list xattrs on %s", src)
+	}
+	for _, xattr := range xattrKeys {
+		data, err := sysx.LGetxattr(src, xattr)
+		if err != nil {
+			return errors.Wrapf(err, "failed to get xattr %q on %s", xattr, src)
+		}
+		if err := sysx.LSetxattr(dst, xattr, data, 0); err != nil {
+			return errors.Wrapf(err, "failed to set xattr %q on %s", xattr, dst)
+		}
+	}
+
+	return nil
+}
+
+func copyDevice(dst string, fi os.FileInfo) error {
+	st, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return errors.New("unsupported stat type")
+	}
+	return unix.Mknod(dst, uint32(fi.Mode()), int(st.Rdev))
+}

vendor/github.com/containerd/continuity/fs/copy_windows.go

@@ -0,0 +1,33 @@
+package fs
+
+import (
+	"io"
+	"os"
+
+	"github.com/pkg/errors"
+)
+
+func copyFileInfo(fi os.FileInfo, name string) error {
+	if err := os.Chmod(name, fi.Mode()); err != nil {
+		return errors.Wrapf(err, "failed to chmod %s", name)
+	}
+
+	// TODO: copy windows specific metadata
+
+	return nil
+}
+
+func copyFileContent(dst, src *os.File) error {
+	buf := bufferPool.Get().(*[]byte)
+	_, err := io.CopyBuffer(dst, src, *buf)
+	bufferPool.Put(buf)
+	return err
+}
+
+func copyXAttrs(dst, src string) error {
+	return nil
+}
+
+func copyDevice(dst string, fi os.FileInfo) error {
+	return errors.New("device copy not supported")
+}

vendor/github.com/containerd/continuity/fs/diff.go

@@ -0,0 +1,310 @@
+package fs
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/sync/errgroup"
+
+	"github.com/sirupsen/logrus"
+)
+
+// ChangeKind is the type of modification that
+// a change is making.
+type ChangeKind int
+
+const (
+	// ChangeKindUnmodified represents an unmodified
+	// file
+	ChangeKindUnmodified = iota
+
+	// ChangeKindAdd represents an addition of
+	// a file
+	ChangeKindAdd
+
+	// ChangeKindModify represents a change to
+	// an existing file
+	ChangeKindModify
+
+	// ChangeKindDelete represents a delete of
+	// a file
+	ChangeKindDelete
+)
+
+func (k ChangeKind) String() string {
+	switch k {
+	case ChangeKindUnmodified:
+		return "unmodified"
+	case ChangeKindAdd:
+		return "add"
+	case ChangeKindModify:
+		return "modify"
+	case ChangeKindDelete:
+		return "delete"
+	default:
+		return ""
+	}
+}
+
+// Change represents single change between a diff and its parent.
+type Change struct {
+	Kind ChangeKind
+	Path string
+}
+
+// ChangeFunc is the type of function called for each change
+// computed during a directory changes calculation.
+type ChangeFunc func(ChangeKind, string, os.FileInfo, error) error
+
+// Changes computes changes between two directories calling the
+// given change function for each computed change. The first
+// directory is intended to the base directory and second
+// directory the changed directory.
+//
+// The change callback is called by the order of path names and
+// should be appliable in that order.
+//  Due to this apply ordering, the following is true
+//  - Removed directory trees only create a single change for the root
+//    directory removed. Remaining changes are implied.
+//  - A directory which is modified to become a file will not have
+//    delete entries for sub-path items, their removal is implied
+//    by the removal of the parent directory.
+//
+// Opaque directories will not be treated specially and each file
+// removed from the base directory will show up as a removal.
+//
+// File content comparisons will be done on files which have timestamps
+// which may have been truncated. If either of the files being compared
+// has a zero value nanosecond value, each byte will be compared for
+// differences. If 2 files have the same seconds value but different
+// nanosecond values where one of those values is zero, the files will
+// be considered unchanged if the content is the same. This behavior
+// is to account for timestamp truncation during archiving.
+func Changes(ctx context.Context, a, b string, changeFn ChangeFunc) error {
+	if a == "" {
+		logrus.Debugf("Using single walk diff for %s", b)
+		return addDirChanges(ctx, changeFn, b)
+	} else if diffOptions := detectDirDiff(b, a); diffOptions != nil {
+		logrus.Debugf("Using single walk diff for %s from %s", diffOptions.diffDir, a)
+		return diffDirChanges(ctx, changeFn, a, diffOptions)
+	}
+
+	logrus.Debugf("Using double walk diff for %s from %s", b, a)
+	return doubleWalkDiff(ctx, changeFn, a, b)
+}
+
+func addDirChanges(ctx context.Context, changeFn ChangeFunc, root string) error {
+	return filepath.Walk(root, func(path string, f os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// Rebase path
+		path, err = filepath.Rel(root, path)
+		if err != nil {
+			return err
+		}
+
+		path = filepath.Join(string(os.PathSeparator), path)
+
+		// Skip root
+		if path == string(os.PathSeparator) {
+			return nil
+		}
+
+		return changeFn(ChangeKindAdd, path, f, nil)
+	})
+}
+
+// diffDirOptions is used when the diff can be directly calculated from
+// a diff directory to its base, without walking both trees.
+type diffDirOptions struct {
+	diffDir      string
+	skipChange   func(string) (bool, error)
+	deleteChange func(string, string, os.FileInfo) (string, error)
+}
+
+// diffDirChanges walks the diff directory and compares changes against the base.
+func diffDirChanges(ctx context.Context, changeFn ChangeFunc, base string, o *diffDirOptions) error {
+	changedDirs := make(map[string]struct{})
+	return filepath.Walk(o.diffDir, func(path string, f os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// Rebase path
+		path, err = filepath.Rel(o.diffDir, path)
+		if err != nil {
+			return err
+		}
+
+		path = filepath.Join(string(os.PathSeparator), path)
+
+		// Skip root
+		if path == string(os.PathSeparator) {
+			return nil
+		}
+
+		// TODO: handle opaqueness, start new double walker at this
+		// location to get deletes, and skip tree in single walker
+
+		if o.skipChange != nil {
+			if skip, err := o.skipChange(path); skip {
+				return err
+			}
+		}
+
+		var kind ChangeKind
+
+		deletedFile, err := o.deleteChange(o.diffDir, path, f)
+		if err != nil {
+			return err
+		}
+
+		// Find out what kind of modification happened
+		if deletedFile != "" {
+			path = deletedFile
+			kind = ChangeKindDelete
+			f = nil
+		} else {
+			// Otherwise, the file was added
+			kind = ChangeKindAdd
+
+			// ...Unless it already existed in a base, in which case, it's a modification
+			stat, err := os.Stat(filepath.Join(base, path))
+			if err != nil && !os.IsNotExist(err) {
+				return err
+			}
+			if err == nil {
+				// The file existed in the base, so that's a modification
+
+				// However, if it's a directory, maybe it wasn't actually modified.
+				// If you modify /foo/bar/baz, then /foo will be part of the changed files only because it's the parent of bar
+				if stat.IsDir() && f.IsDir() {
+					if f.Size() == stat.Size() && f.Mode() == stat.Mode() && sameFsTime(f.ModTime(), stat.ModTime()) {
+						// Both directories are the same, don't record the change
+						return nil
+					}
+				}
+				kind = ChangeKindModify
+			}
+		}
+
+		// If /foo/bar/file.txt is modified, then /foo/bar must be part of the changed files.
+		// This block is here to ensure the change is recorded even if the
+		// modify time, mode and size of the parent directory in the rw and ro layers are all equal.
+		// Check https://github.com/docker/docker/pull/13590 for details.
+		if f.IsDir() {
+			changedDirs[path] = struct{}{}
+		}
+		if kind == ChangeKindAdd || kind == ChangeKindDelete {
+			parent := filepath.Dir(path)
+			if _, ok := changedDirs[parent]; !ok && parent != "/" {
+				pi, err := os.Stat(filepath.Join(o.diffDir, parent))
+				if err := changeFn(ChangeKindModify, parent, pi, err); err != nil {
+					return err
+				}
+				changedDirs[parent] = struct{}{}
+			}
+		}
+
+		return changeFn(kind, path, f, nil)
+	})
+}
+
+// doubleWalkDiff walks both directories to create a diff
+func doubleWalkDiff(ctx context.Context, changeFn ChangeFunc, a, b string) (err error) {
+	g, ctx := errgroup.WithContext(ctx)
+
+	var (
+		c1 = make(chan *currentPath)
+		c2 = make(chan *currentPath)
+
+		f1, f2 *currentPath
+		rmdir  string
+	)
+	g.Go(func() error {
+		defer close(c1)
+		return pathWalk(ctx, a, c1)
+	})
+	g.Go(func() error {
+		defer close(c2)
+		return pathWalk(ctx, b, c2)
+	})
+	g.Go(func() error {
+		for c1 != nil || c2 != nil {
+			if f1 == nil && c1 != nil {
+				f1, err = nextPath(ctx, c1)
+				if err != nil {
+					return err
+				}
+				if f1 == nil {
+					c1 = nil
+				}
+			}
+
+			if f2 == nil && c2 != nil {
+				f2, err = nextPath(ctx, c2)
+				if err != nil {
+					return err
+				}
+				if f2 == nil {
+					c2 = nil
+				}
+			}
+			if f1 == nil && f2 == nil {
+				continue
+			}
+
+			var f os.FileInfo
+			k, p := pathChange(f1, f2)
+			switch k {
+			case ChangeKindAdd:
+				if rmdir != "" {
+					rmdir = ""
+				}
+				f = f2.f
+				f2 = nil
+			case ChangeKindDelete:
+				// Check if this file is already removed by being
+				// under of a removed directory
+				if rmdir != "" && strings.HasPrefix(f1.path, rmdir) {
+					f1 = nil
+					continue
+				} else if f1.f.IsDir() {
+					rmdir = f1.path + string(os.PathSeparator)
+				} else if rmdir != "" {
+					rmdir = ""
+				}
+				f1 = nil
+			case ChangeKindModify:
+				same, err := sameFile(f1, f2)
+				if err != nil {
+					return err
+				}
+				if f1.f.IsDir() && !f2.f.IsDir() {
+					rmdir = f1.path + string(os.PathSeparator)
+				} else if rmdir != "" {
+					rmdir = ""
+				}
+				f = f2.f
+				f1 = nil
+				f2 = nil
+				if same {
+					if !isLinked(f) {
+						continue
+					}
+					k = ChangeKindUnmodified
+				}
+			}
+			if err := changeFn(k, p, f, nil); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
+	return g.Wait()
+}

vendor/github.com/containerd/continuity/fs/diff_test.go

@@ -0,0 +1,406 @@
+package fs
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/containerd/continuity/fs/fstest"
+	"github.com/pkg/errors"
+)
+
+// TODO: Additional tests
+// - capability test (requires privilege)
+// - chown test (requires privilege)
+// - symlink test
+// - hardlink test
+
+func skipDiffTestOnWindows(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("diff implementation is incomplete on windows")
+	}
+}
+
+func TestSimpleDiff(t *testing.T) {
+	skipDiffTestOnWindows(t)
+	l1 := fstest.Apply(
+		fstest.CreateDir("/etc", 0755),
+		fstest.CreateFile("/etc/hosts", []byte("mydomain 10.0.0.1"), 0644),
+		fstest.CreateFile("/etc/profile", []byte("PATH=/usr/bin"), 0644),
+		fstest.CreateFile("/etc/unchanged", []byte("PATH=/usr/bin"), 0644),
+		fstest.CreateFile("/etc/unexpected", []byte("#!/bin/sh"), 0644),
+	)
+	l2 := fstest.Apply(
+		fstest.CreateFile("/etc/hosts", []byte("mydomain 10.0.0.120"), 0644),
+		fstest.CreateFile("/etc/profile", []byte("PATH=/usr/bin"), 0666),
+		fstest.CreateDir("/root", 0700),
+		fstest.CreateFile("/root/.bashrc", []byte("PATH=/usr/sbin:/usr/bin"), 0644),
+		fstest.Remove("/etc/unexpected"),
+	)
+	diff := []TestChange{
+		Modify("/etc/hosts"),
+		Modify("/etc/profile"),
+		Delete("/etc/unexpected"),
+		Add("/root"),
+		Add("/root/.bashrc"),
+	}
+
+	if err := testDiffWithBase(l1, l2, diff); err != nil {
+		t.Fatalf("Failed diff with base: %+v", err)
+	}
+}
+
+func TestNestedDeletion(t *testing.T) {
+	skipDiffTestOnWindows(t)
+	l1 := fstest.Apply(
+		fstest.CreateDir("/d0", 0755),
+		fstest.CreateDir("/d1", 0755),
+		fstest.CreateDir("/d1/d2", 0755),
+		fstest.CreateFile("/d1/d2/f1", []byte("mydomain 10.0.0.1"), 0644),
+	)
+	l2 := fstest.Apply(
+		fstest.RemoveAll("/d0"),
+		fstest.RemoveAll("/d1"),
+	)
+	diff := []TestChange{
+		Delete("/d0"),
+		Delete("/d1"),
+	}
+
+	if err := testDiffWithBase(l1, l2, diff); err != nil {
+		t.Fatalf("Failed diff with base: %+v", err)
+	}
+}
+
+func TestDirectoryReplace(t *testing.T) {
+	skipDiffTestOnWindows(t)
+	l1 := fstest.Apply(
+		fstest.CreateDir("/dir1", 0755),
+		fstest.CreateFile("/dir1/f1", []byte("#####"), 0644),
+		fstest.CreateDir("/dir1/f2", 0755),
+		fstest.CreateFile("/dir1/f2/f3", []byte("#!/bin/sh"), 0644),
+	)
+	l2 := fstest.Apply(
+		fstest.CreateFile("/dir1/f11", []byte("#New file here"), 0644),
+		fstest.RemoveAll("/dir1/f2"),
+		fstest.CreateFile("/dir1/f2", []byte("Now file"), 0666),
+	)
+	diff := []TestChange{
+		Add("/dir1/f11"),
+		Modify("/dir1/f2"),
+	}
+
+	if err := testDiffWithBase(l1, l2, diff); err != nil {
+		t.Fatalf("Failed diff with base: %+v", err)
+	}
+}
+
+func TestRemoveDirectoryTree(t *testing.T) {
+	l1 := fstest.Apply(
+		fstest.CreateDir("/dir1/dir2/dir3", 0755),
+		fstest.CreateFile("/dir1/f1", []byte("f1"), 0644),
+		fstest.CreateFile("/dir1/dir2/f2", []byte("f2"), 0644),
+	)
+	l2 := fstest.Apply(
+		fstest.RemoveAll("/dir1"),
+	)
+	diff := []TestChange{
+		Delete("/dir1"),
+	}
+
+	if err := testDiffWithBase(l1, l2, diff); err != nil {
+		t.Fatalf("Failed diff with base: %+v", err)
+	}
+}
+
+func TestFileReplace(t *testing.T) {
+	l1 := fstest.Apply(
+		fstest.CreateFile("/dir1", []byte("a file, not a directory"), 0644),
+	)
+	l2 := fstest.Apply(
+		fstest.Remove("/dir1"),
+		fstest.CreateDir("/dir1/dir2", 0755),
+		fstest.CreateFile("/dir1/dir2/f1", []byte("also a file"), 0644),
+	)
+	diff := []TestChange{
+		Modify("/dir1"),
+		Add("/dir1/dir2"),
+		Add("/dir1/dir2/f1"),
+	}
+
+	if err := testDiffWithBase(l1, l2, diff); err != nil {
+		t.Fatalf("Failed diff with base: %+v", err)
+	}
+}
+
+func TestParentDirectoryPermission(t *testing.T) {
+	skipDiffTestOnWindows(t)
+	l1 := fstest.Apply(
+		fstest.CreateDir("/dir1", 0700),
+		fstest.CreateDir("/dir2", 0751),
+		fstest.CreateDir("/dir3", 0777),
+	)
+	l2 := fstest.Apply(
+		fstest.CreateDir("/dir1/d", 0700),
+		fstest.CreateFile("/dir1/d/f", []byte("irrelevant"), 0644),
+		fstest.CreateFile("/dir1/f", []byte("irrelevant"), 0644),
+		fstest.CreateFile("/dir2/f", []byte("irrelevant"), 0644),
+		fstest.CreateFile("/dir3/f", []byte("irrelevant"), 0644),
+	)
+	diff := []TestChange{
+		Add("/dir1/d"),
+		Add("/dir1/d/f"),
+		Add("/dir1/f"),
+		Add("/dir2/f"),
+		Add("/dir3/f"),
+	}
+
+	if err := testDiffWithBase(l1, l2, diff); err != nil {
+		t.Fatalf("Failed diff with base: %+v", err)
+	}
+}
+
+func TestUpdateWithSameTime(t *testing.T) {
+	skipDiffTestOnWindows(t)
+	tt := time.Now().Truncate(time.Second)
+	t1 := tt.Add(5 * time.Nanosecond)
+	t2 := tt.Add(6 * time.Nanosecond)
+	l1 := fstest.Apply(
+		fstest.CreateFile("/file-modified-time", []byte("1"), 0644),
+		fstest.Chtimes("/file-modified-time", t1, t1),
+		fstest.CreateFile("/file-no-change", []byte("1"), 0644),
+		fstest.Chtimes("/file-no-change", t1, t1),
+		fstest.CreateFile("/file-same-time", []byte("1"), 0644),
+		fstest.Chtimes("/file-same-time", t1, t1),
+		fstest.CreateFile("/file-truncated-time-1", []byte("1"), 0644),
+		fstest.Chtimes("/file-truncated-time-1", tt, tt),
+		fstest.CreateFile("/file-truncated-time-2", []byte("1"), 0644),
+		fstest.Chtimes("/file-truncated-time-2", tt, tt),
+		fstest.CreateFile("/file-truncated-time-3", []byte("1"), 0644),
+		fstest.Chtimes("/file-truncated-time-3", t1, t1),
+	)
+	l2 := fstest.Apply(
+		fstest.CreateFile("/file-modified-time", []byte("2"), 0644),
+		fstest.Chtimes("/file-modified-time", t2, t2),
+		fstest.CreateFile("/file-no-change", []byte("1"), 0644),
+		fstest.Chtimes("/file-no-change", t1, t1),
+		fstest.CreateFile("/file-same-time", []byte("2"), 0644),
+		fstest.Chtimes("/file-same-time", t1, t1),
+		fstest.CreateFile("/file-truncated-time-1", []byte("1"), 0644),
+		fstest.Chtimes("/file-truncated-time-1", t1, t1),
+		fstest.CreateFile("/file-truncated-time-2", []byte("2"), 0644),
+		fstest.Chtimes("/file-truncated-time-2", tt, tt),
+		fstest.CreateFile("/file-truncated-time-3", []byte("1"), 0644),
+		fstest.Chtimes("/file-truncated-time-3", tt, tt),
+	)
+	diff := []TestChange{
+		Modify("/file-modified-time"),
+		// Include changes with truncated timestamps. Comparing newly
+		// extracted tars which have truncated timestamps will be
+		// expected to produce changes. The expectation is that diff
+		// archives are generated once and kept, newly generated diffs
+		// will not consider cases where only one side is truncated.
+		Modify("/file-truncated-time-1"),
+		Modify("/file-truncated-time-2"),
+		Modify("/file-truncated-time-3"),
+	}
+
+	if err := testDiffWithBase(l1, l2, diff); err != nil {
+		t.Fatalf("Failed diff with base: %+v", err)
+	}
+}
+
+// buildkit#172
+func TestLchtimes(t *testing.T) {
+	skipDiffTestOnWindows(t)
+	mtimes := []time.Time{
+		time.Unix(0, 0),  // nsec is 0
+		time.Unix(0, 42), // nsec > 0
+	}
+	for _, mtime := range mtimes {
+		atime := time.Unix(424242, 42)
+		l1 := fstest.Apply(
+			fstest.CreateFile("/foo", []byte("foo"), 0644),
+			fstest.Symlink("/foo", "/lnk0"),
+			fstest.Lchtimes("/lnk0", atime, mtime),
+		)
+		l2 := fstest.Apply() // empty
+		diff := []TestChange{}
+		if err := testDiffWithBase(l1, l2, diff); err != nil {
+			t.Fatalf("Failed diff with base: %+v", err)
+		}
+	}
+}
+
+func testDiffWithBase(base, diff fstest.Applier, expected []TestChange) error {
+	t1, err := ioutil.TempDir("", "diff-with-base-lower-")
+	if err != nil {
+		return errors.Wrap(err, "failed to create temp dir")
+	}
+	defer os.RemoveAll(t1)
+	t2, err := ioutil.TempDir("", "diff-with-base-upper-")
+	if err != nil {
+		return errors.Wrap(err, "failed to create temp dir")
+	}
+	defer os.RemoveAll(t2)
+
+	if err := base.Apply(t1); err != nil {
+		return errors.Wrap(err, "failed to apply base filesystem")
+	}
+
+	if err := CopyDir(t2, t1); err != nil {
+		return errors.Wrap(err, "failed to copy base directory")
+	}
+
+	if err := diff.Apply(t2); err != nil {
+		return errors.Wrap(err, "failed to apply diff filesystem")
+	}
+
+	changes, err := collectChanges(t1, t2)
+	if err != nil {
+		return errors.Wrap(err, "failed to collect changes")
+	}
+
+	return checkChanges(t2, changes, expected)
+}
+
+func TestBaseDirectoryChanges(t *testing.T) {
+	apply := fstest.Apply(
+		fstest.CreateDir("/etc", 0755),
+		fstest.CreateFile("/etc/hosts", []byte("mydomain 10.0.0.1"), 0644),
+		fstest.CreateFile("/etc/profile", []byte("PATH=/usr/bin"), 0644),
+		fstest.CreateDir("/root", 0700),
+		fstest.CreateFile("/root/.bashrc", []byte("PATH=/usr/sbin:/usr/bin"), 0644),
+	)
+	changes := []TestChange{
+		Add("/etc"),
+		Add("/etc/hosts"),
+		Add("/etc/profile"),
+		Add("/root"),
+		Add("/root/.bashrc"),
+	}
+
+	if err := testDiffWithoutBase(apply, changes); err != nil {
+		t.Fatalf("Failed diff without base: %+v", err)
+	}
+}
+
+func testDiffWithoutBase(apply fstest.Applier, expected []TestChange) error {
+	tmp, err := ioutil.TempDir("", "diff-without-base-")
+	if err != nil {
+		return errors.Wrap(err, "failed to create temp dir")
+	}
+	defer os.RemoveAll(tmp)
+
+	if err := apply.Apply(tmp); err != nil {
+		return errors.Wrap(err, "failed to apply filesytem changes")
+	}
+
+	changes, err := collectChanges("", tmp)
+	if err != nil {
+		return errors.Wrap(err, "failed to collect changes")
+	}
+
+	return checkChanges(tmp, changes, expected)
+}
+
+func checkChanges(root string, changes, expected []TestChange) error {
+	if len(changes) != len(expected) {
+		return errors.Errorf("Unexpected number of changes:\n%s", diffString(changes, expected))
+	}
+	for i := range changes {
+		if changes[i].Path != expected[i].Path || changes[i].Kind != expected[i].Kind {
+			return errors.Errorf("Unexpected change at %d:\n%s", i, diffString(changes, expected))
+		}
+		if changes[i].Kind != ChangeKindDelete {
+			filename := filepath.Join(root, changes[i].Path)
+			efi, err := os.Stat(filename)
+			if err != nil {
+				return errors.Wrapf(err, "failed to stat %q", filename)
+			}
+			afi := changes[i].FileInfo
+			if afi.Size() != efi.Size() {
+				return errors.Errorf("Unexpected change size %d, %q has size %d", afi.Size(), filename, efi.Size())
+			}
+			if afi.Mode() != efi.Mode() {
+				return errors.Errorf("Unexpected change mode %s, %q has mode %s", afi.Mode(), filename, efi.Mode())
+			}
+			if afi.ModTime() != efi.ModTime() {
+				return errors.Errorf("Unexpected change modtime %s, %q has modtime %s", afi.ModTime(), filename, efi.ModTime())
+			}
+			if expected := filepath.Join(root, changes[i].Path); changes[i].Source != expected {
+				return errors.Errorf("Unexpected source path %s, expected %s", changes[i].Source, expected)
+			}
+		}
+	}
+
+	return nil
+}
+
+type TestChange struct {
+	Kind     ChangeKind
+	Path     string
+	FileInfo os.FileInfo
+	Source   string
+}
+
+func collectChanges(a, b string) ([]TestChange, error) {
+	changes := []TestChange{}
+	err := Changes(context.Background(), a, b, func(k ChangeKind, p string, f os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		changes = append(changes, TestChange{
+			Kind:     k,
+			Path:     p,
+			FileInfo: f,
+			Source:   filepath.Join(b, p),
+		})
+		return nil
+	})
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to compute changes")
+	}
+
+	return changes, nil
+}
+
+func diffString(c1, c2 []TestChange) string {
+	return fmt.Sprintf("got(%d):\n%s\nexpected(%d):\n%s", len(c1), changesString(c1), len(c2), changesString(c2))
+
+}
+
+func changesString(c []TestChange) string {
+	strs := make([]string, len(c))
+	for i := range c {
+		strs[i] = fmt.Sprintf("\t%s\t%s", c[i].Kind, c[i].Path)
+	}
+	return strings.Join(strs, "\n")
+}
+
+func Add(p string) TestChange {
+	return TestChange{
+		Kind: ChangeKindAdd,
+		Path: filepath.FromSlash(p),
+	}
+}
+
+func Delete(p string) TestChange {
+	return TestChange{
+		Kind: ChangeKindDelete,
+		Path: filepath.FromSlash(p),
+	}
+}
+
+func Modify(p string) TestChange {
+	return TestChange{
+		Kind: ChangeKindModify,
+		Path: filepath.FromSlash(p),
+	}
+}

vendor/github.com/containerd/continuity/fs/diff_unix.go

@@ -0,0 +1,58 @@
+// +build !windows
+
+package fs
+
+import (
+	"bytes"
+	"os"
+	"syscall"
+
+	"github.com/containerd/continuity/sysx"
+	"github.com/pkg/errors"
+)
+
+// detectDirDiff returns diff dir options if a directory could
+// be found in the mount info for upper which is the direct
+// diff with the provided lower directory
+func detectDirDiff(upper, lower string) *diffDirOptions {
+	// TODO: get mount options for upper
+	// TODO: detect AUFS
+	// TODO: detect overlay
+	return nil
+}
+
+// compareSysStat returns whether the stats are equivalent,
+// whether the files are considered the same file, and
+// an error
+func compareSysStat(s1, s2 interface{}) (bool, error) {
+	ls1, ok := s1.(*syscall.Stat_t)
+	if !ok {
+		return false, nil
+	}
+	ls2, ok := s2.(*syscall.Stat_t)
+	if !ok {
+		return false, nil
+	}
+
+	return ls1.Mode == ls2.Mode && ls1.Uid == ls2.Uid && ls1.Gid == ls2.Gid && ls1.Rdev == ls2.Rdev, nil
+}
+
+func compareCapabilities(p1, p2 string) (bool, error) {
+	c1, err := sysx.LGetxattr(p1, "security.capability")
+	if err != nil && err != sysx.ENODATA {
+		return false, errors.Wrapf(err, "failed to get xattr for %s", p1)
+	}
+	c2, err := sysx.LGetxattr(p2, "security.capability")
+	if err != nil && err != sysx.ENODATA {
+		return false, errors.Wrapf(err, "failed to get xattr for %s", p2)
+	}
+	return bytes.Equal(c1, c2), nil
+}
+
+func isLinked(f os.FileInfo) bool {
+	s, ok := f.Sys().(*syscall.Stat_t)
+	if !ok {
+		return false
+	}
+	return !f.IsDir() && s.Nlink > 1
+}

vendor/github.com/containerd/continuity/fs/diff_windows.go

@@ -0,0 +1,32 @@
+package fs
+
+import (
+	"os"
+
+	"golang.org/x/sys/windows"
+)
+
+func detectDirDiff(upper, lower string) *diffDirOptions {
+	return nil
+}
+
+func compareSysStat(s1, s2 interface{}) (bool, error) {
+	f1, ok := s1.(windows.Win32FileAttributeData)
+	if !ok {
+		return false, nil
+	}
+	f2, ok := s2.(windows.Win32FileAttributeData)
+	if !ok {
+		return false, nil
+	}
+	return f1.FileAttributes == f2.FileAttributes, nil
+}
+
+func compareCapabilities(p1, p2 string) (bool, error) {
+	// TODO: Use windows equivalent
+	return true, nil
+}
+
+func isLinked(os.FileInfo) bool {
+	return false
+}

vendor/github.com/containerd/continuity/fs/dtype_linux.go

@@ -0,0 +1,87 @@
+// +build linux
+
+package fs
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"syscall"
+	"unsafe"
+)
+
+func locateDummyIfEmpty(path string) (string, error) {
+	children, err := ioutil.ReadDir(path)
+	if err != nil {
+		return "", err
+	}
+	if len(children) != 0 {
+		return "", nil
+	}
+	dummyFile, err := ioutil.TempFile(path, "fsutils-dummy")
+	if err != nil {
+		return "", err
+	}
+	name := dummyFile.Name()
+	err = dummyFile.Close()
+	return name, err
+}
+
+// SupportsDType returns whether the filesystem mounted on path supports d_type
+func SupportsDType(path string) (bool, error) {
+	// locate dummy so that we have at least one dirent
+	dummy, err := locateDummyIfEmpty(path)
+	if err != nil {
+		return false, err
+	}
+	if dummy != "" {
+		defer os.Remove(dummy)
+	}
+
+	visited := 0
+	supportsDType := true
+	fn := func(ent *syscall.Dirent) bool {
+		visited++
+		if ent.Type == syscall.DT_UNKNOWN {
+			supportsDType = false
+			// stop iteration
+			return true
+		}
+		// continue iteration
+		return false
+	}
+	if err = iterateReadDir(path, fn); err != nil {
+		return false, err
+	}
+	if visited == 0 {
+		return false, fmt.Errorf("did not hit any dirent during iteration %s", path)
+	}
+	return supportsDType, nil
+}
+
+func iterateReadDir(path string, fn func(*syscall.Dirent) bool) error {
+	d, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer d.Close()
+	fd := int(d.Fd())
+	buf := make([]byte, 4096)
+	for {
+		nbytes, err := syscall.ReadDirent(fd, buf)
+		if err != nil {
+			return err
+		}
+		if nbytes == 0 {
+			break
+		}
+		for off := 0; off < nbytes; {
+			ent := (*syscall.Dirent)(unsafe.Pointer(&buf[off]))
+			if stop := fn(ent); stop {
+				return nil
+			}
+			off += int(ent.Reclen)
+		}
+	}
+	return nil
+}

vendor/github.com/containerd/continuity/fs/dtype_linux_test.go

@@ -0,0 +1,59 @@
+// +build linux
+
+package fs
+
+import (
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"testing"
+
+	"github.com/containerd/continuity/testutil"
+)
+
+func testSupportsDType(t *testing.T, expected bool, mkfs ...string) {
+	testutil.RequiresRoot(t)
+	mnt, err := ioutil.TempDir("", "containerd-fs-test-supports-dtype")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(mnt)
+
+	deviceName, cleanupDevice, err := testutil.NewLoopback(100 << 20) // 100 MB
+	if err != nil {
+		t.Fatal(err)
+	}
+	if out, err := exec.Command(mkfs[0], append(mkfs[1:], deviceName)...).CombinedOutput(); err != nil {
+		// not fatal
+		t.Skipf("could not mkfs (%v) %s: %v (out: %q)", mkfs, deviceName, err, string(out))
+	}
+	if out, err := exec.Command("mount", deviceName, mnt).CombinedOutput(); err != nil {
+		// not fatal
+		t.Skipf("could not mount %s: %v (out: %q)", deviceName, err, string(out))
+	}
+	defer func() {
+		testutil.Unmount(t, mnt)
+		cleanupDevice()
+	}()
+	// check whether it supports d_type
+	result, err := SupportsDType(mnt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Logf("Supports d_type: %v", result)
+	if expected != result {
+		t.Fatalf("expected %+v, got: %+v", expected, result)
+	}
+}
+
+func TestSupportsDTypeWithFType0XFS(t *testing.T) {
+	testSupportsDType(t, false, "mkfs.xfs", "-m", "crc=0", "-n", "ftype=0")
+}
+
+func TestSupportsDTypeWithFType1XFS(t *testing.T) {
+	testSupportsDType(t, true, "mkfs.xfs", "-m", "crc=0", "-n", "ftype=1")
+}
+
+func TestSupportsDTypeWithExt4(t *testing.T) {
+	testSupportsDType(t, true, "mkfs.ext4", "-F")
+}

vendor/github.com/containerd/continuity/fs/dtype_test.go

@@ -0,0 +1,26 @@
+package fs
+
+import (
+	"testing"
+
+	"github.com/containerd/continuity/testutil"
+)
+
+func TestRequiresRootNOP(t *testing.T) {
+
+	// This is a dummy test case that exist to call
+	// testutil.RequiresRoot() on non-linux platforms.  This is
+	// needed because the Makfile root-coverage tests target
+	// determines which packages contain root test by grepping for
+	// testutil.RequiresRoot.  Within the fs package, the only test
+	// that references this symbol is in dtype_linux_test.go, but
+	// that file is only built on linux.  Since the Makefile is not
+	// go build tag aware it sees this file and then tries to run
+	// the following command on all platforms: "go test ...
+	// github.com/containerd/continuity/fs -test.root".  On
+	// non-linux platforms this fails because there are no tests in
+	// the "fs" package that reference testutil.RequiresRoot.  To
+	// fix this problem we'll add a reference to this symbol below.
+
+	testutil.RequiresRoot(t)
+}

vendor/github.com/containerd/continuity/fs/du.go

@@ -0,0 +1,22 @@
+package fs
+
+import "context"
+
+// Usage of disk information
+type Usage struct {
+	Inodes int64
+	Size   int64
+}
+
+// DiskUsage counts the number of inodes and disk usage for the resources under
+// path.
+func DiskUsage(roots ...string) (Usage, error) {
+	return diskUsage(roots...)
+}
+
+// DiffUsage counts the numbers of inodes and disk usage in the
+// diff between the 2 directories. The first path is intended
+// as the base directory and the second as the changed directory.
+func DiffUsage(ctx context.Context, a, b string) (Usage, error) {
+	return diffUsage(ctx, a, b)
+}

vendor/github.com/containerd/continuity/fs/du_unix.go

@@ -0,0 +1,88 @@
+// +build !windows
+
+package fs
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+type inode struct {
+	// TODO(stevvooe): Can probably reduce memory usage by not tracking
+	// device, but we can leave this right for now.
+	dev, ino uint64
+}
+
+func newInode(stat *syscall.Stat_t) inode {
+	return inode{
+		// Dev is uint32 on darwin/bsd, uint64 on linux/solaris
+		dev: uint64(stat.Dev), // nolint: unconvert
+		// Ino is uint32 on bsd, uint64 on darwin/linux/solaris
+		ino: uint64(stat.Ino), // nolint: unconvert
+	}
+}
+
+func diskUsage(roots ...string) (Usage, error) {
+
+	var (
+		size   int64
+		inodes = map[inode]struct{}{} // expensive!
+	)
+
+	for _, root := range roots {
+		if err := filepath.Walk(root, func(path string, fi os.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+
+			inoKey := newInode(fi.Sys().(*syscall.Stat_t))
+			if _, ok := inodes[inoKey]; !ok {
+				inodes[inoKey] = struct{}{}
+				size += fi.Size()
+			}
+
+			return nil
+		}); err != nil {
+			return Usage{}, err
+		}
+	}
+
+	return Usage{
+		Inodes: int64(len(inodes)),
+		Size:   size,
+	}, nil
+}
+
+func diffUsage(ctx context.Context, a, b string) (Usage, error) {
+	var (
+		size   int64
+		inodes = map[inode]struct{}{} // expensive!
+	)
+
+	if err := Changes(ctx, a, b, func(kind ChangeKind, _ string, fi os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if kind == ChangeKindAdd || kind == ChangeKindModify {
+			inoKey := newInode(fi.Sys().(*syscall.Stat_t))
+			if _, ok := inodes[inoKey]; !ok {
+				inodes[inoKey] = struct{}{}
+				size += fi.Size()
+			}
+
+			return nil
+
+		}
+		return nil
+	}); err != nil {
+		return Usage{}, err
+	}
+
+	return Usage{
+		Inodes: int64(len(inodes)),
+		Size:   size,
+	}, nil
+}

vendor/github.com/containerd/continuity/fs/du_windows.go

@@ -0,0 +1,60 @@
+// +build windows
+
+package fs
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+)
+
+func diskUsage(roots ...string) (Usage, error) {
+	var (
+		size int64
+	)
+
+	// TODO(stevvooe): Support inodes (or equivalent) for windows.
+
+	for _, root := range roots {
+		if err := filepath.Walk(root, func(path string, fi os.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+
+			size += fi.Size()
+			return nil
+		}); err != nil {
+			return Usage{}, err
+		}
+	}
+
+	return Usage{
+		Size: size,
+	}, nil
+}
+
+func diffUsage(ctx context.Context, a, b string) (Usage, error) {
+	var (
+		size int64
+	)
+
+	if err := Changes(ctx, a, b, func(kind ChangeKind, _ string, fi os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if kind == ChangeKindAdd || kind == ChangeKindModify {
+			size += fi.Size()
+
+			return nil
+
+		}
+		return nil
+	}); err != nil {
+		return Usage{}, err
+	}
+
+	return Usage{
+		Size: size,
+	}, nil
+}

vendor/github.com/containerd/continuity/fs/fstest/compare.go

@@ -0,0 +1,53 @@
+package fstest
+
+import (
+	"io/ioutil"
+	"os"
+
+	"github.com/containerd/continuity"
+	"github.com/pkg/errors"
+)
+
+// CheckDirectoryEqual compares two directory paths to make sure that
+// the content of the directories is the same.
+func CheckDirectoryEqual(d1, d2 string) error {
+	c1, err := continuity.NewContext(d1)
+	if err != nil {
+		return errors.Wrap(err, "failed to build context")
+	}
+
+	c2, err := continuity.NewContext(d2)
+	if err != nil {
+		return errors.Wrap(err, "failed to build context")
+	}
+
+	m1, err := continuity.BuildManifest(c1)
+	if err != nil {
+		return errors.Wrap(err, "failed to build manifest")
+	}
+
+	m2, err := continuity.BuildManifest(c2)
+	if err != nil {
+		return errors.Wrap(err, "failed to build manifest")
+	}
+
+	diff := diffResourceList(m1.Resources, m2.Resources)
+	if diff.HasDiff() {
+		return errors.Errorf("directory diff between %s and %s\n%s", d1, d2, diff.String())
+	}
+
+	return nil
+}
+
+// CheckDirectoryEqualWithApplier compares directory against applier
+func CheckDirectoryEqualWithApplier(root string, a Applier) error {
+	applied, err := ioutil.TempDir("", "fstest")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(applied)
+	if err := a.Apply(applied); err != nil {
+		return err
+	}
+	return CheckDirectoryEqual(applied, root)
+}

vendor/github.com/containerd/continuity/fs/fstest/continuity_util.go

@@ -0,0 +1,189 @@
+package fstest
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/containerd/continuity"
+)
+
+type resourceUpdate struct {
+	Original continuity.Resource
+	Updated  continuity.Resource
+}
+
+func (u resourceUpdate) String() string {
+	return fmt.Sprintf("%s(mode: %o, uid: %d, gid: %d) -> %s(mode: %o, uid: %d, gid: %d)",
+		u.Original.Path(), u.Original.Mode(), u.Original.UID(), u.Original.GID(),
+		u.Updated.Path(), u.Updated.Mode(), u.Updated.UID(), u.Updated.GID(),
+	)
+}
+
+type resourceListDifference struct {
+	Additions []continuity.Resource
+	Deletions []continuity.Resource
+	Updates   []resourceUpdate
+}
+
+func (l resourceListDifference) HasDiff() bool {
+	return len(l.Additions) > 0 || len(l.Deletions) > 0 || len(l.Updates) > 0
+}
+
+func (l resourceListDifference) String() string {
+	buf := bytes.NewBuffer(nil)
+	for _, add := range l.Additions {
+		fmt.Fprintf(buf, "+ %s\n", add.Path())
+	}
+	for _, del := range l.Deletions {
+		fmt.Fprintf(buf, "- %s\n", del.Path())
+	}
+	for _, upt := range l.Updates {
+		fmt.Fprintf(buf, "~ %s\n", upt.String())
+	}
+	return string(buf.Bytes())
+}
+
+// diffManifest compares two resource lists and returns the list
+// of adds updates and deletes, resource lists are not reordered
+// before doing difference.
+func diffResourceList(r1, r2 []continuity.Resource) resourceListDifference {
+	i1 := 0
+	i2 := 0
+	var d resourceListDifference
+
+	for i1 < len(r1) && i2 < len(r2) {
+		p1 := r1[i1].Path()
+		p2 := r2[i2].Path()
+		switch {
+		case p1 < p2:
+			d.Deletions = append(d.Deletions, r1[i1])
+			i1++
+		case p1 == p2:
+			if !compareResource(r1[i1], r2[i2]) {
+				d.Updates = append(d.Updates, resourceUpdate{
+					Original: r1[i1],
+					Updated:  r2[i2],
+				})
+			}
+			i1++
+			i2++
+		case p1 > p2:
+			d.Additions = append(d.Additions, r2[i2])
+			i2++
+		}
+	}
+
+	for i1 < len(r1) {
+		d.Deletions = append(d.Deletions, r1[i1])
+		i1++
+
+	}
+	for i2 < len(r2) {
+		d.Additions = append(d.Additions, r2[i2])
+		i2++
+	}
+
+	return d
+}
+
+func compareResource(r1, r2 continuity.Resource) bool {
+	if r1.Path() != r2.Path() {
+		return false
+	}
+	if r1.Mode() != r2.Mode() {
+		return false
+	}
+	if r1.UID() != r2.UID() {
+		return false
+	}
+	if r1.GID() != r2.GID() {
+		return false
+	}
+
+	// TODO(dmcgowan): Check if is XAttrer
+
+	return compareResourceTypes(r1, r2)
+
+}
+
+func compareResourceTypes(r1, r2 continuity.Resource) bool {
+	switch t1 := r1.(type) {
+	case continuity.RegularFile:
+		t2, ok := r2.(continuity.RegularFile)
+		if !ok {
+			return false
+		}
+		return compareRegularFile(t1, t2)
+	case continuity.Directory:
+		t2, ok := r2.(continuity.Directory)
+		if !ok {
+			return false
+		}
+		return compareDirectory(t1, t2)
+	case continuity.SymLink:
+		t2, ok := r2.(continuity.SymLink)
+		if !ok {
+			return false
+		}
+		return compareSymLink(t1, t2)
+	case continuity.NamedPipe:
+		t2, ok := r2.(continuity.NamedPipe)
+		if !ok {
+			return false
+		}
+		return compareNamedPipe(t1, t2)
+	case continuity.Device:
+		t2, ok := r2.(continuity.Device)
+		if !ok {
+			return false
+		}
+		return compareDevice(t1, t2)
+	default:
+		// TODO(dmcgowan): Should this panic?
+		return r1 == r2
+	}
+}
+
+func compareRegularFile(r1, r2 continuity.RegularFile) bool {
+	if r1.Size() != r2.Size() {
+		return false
+	}
+	p1 := r1.Paths()
+	p2 := r2.Paths()
+	if len(p1) != len(p2) {
+		return false
+	}
+	for i := range p1 {
+		if p1[i] != p2[i] {
+			return false
+		}
+	}
+	d1 := r1.Digests()
+	d2 := r2.Digests()
+	if len(d1) != len(d2) {
+		return false
+	}
+	for i := range d1 {
+		if d1[i] != d2[i] {
+			return false
+		}
+	}
+
+	return true
+}
+
+func compareSymLink(r1, r2 continuity.SymLink) bool {
+	return r1.Target() == r2.Target()
+}
+
+func compareDirectory(r1, r2 continuity.Directory) bool {
+	return true
+}
+
+func compareNamedPipe(r1, r2 continuity.NamedPipe) bool {
+	return true
+}
+
+func compareDevice(r1, r2 continuity.Device) bool {
+	return r1.Major() == r2.Major() && r1.Minor() == r2.Minor()
+}

vendor/github.com/containerd/continuity/fs/fstest/file.go

@@ -0,0 +1,120 @@
+package fstest
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// Applier applies single file changes
+type Applier interface {
+	Apply(root string) error
+}
+
+type applyFn func(root string) error
+
+func (a applyFn) Apply(root string) error {
+	return a(root)
+}
+
+// CreateFile returns a file applier which creates a file as the
+// provided name with the given content and permission.
+func CreateFile(name string, content []byte, perm os.FileMode) Applier {
+	return applyFn(func(root string) error {
+		fullPath := filepath.Join(root, name)
+		if err := ioutil.WriteFile(fullPath, content, perm); err != nil {
+			return err
+		}
+		return os.Chmod(fullPath, perm)
+	})
+}
+
+// Remove returns a file applier which removes the provided file name
+func Remove(name string) Applier {
+	return applyFn(func(root string) error {
+		return os.Remove(filepath.Join(root, name))
+	})
+}
+
+// RemoveAll returns a file applier which removes the provided file name
+// as in os.RemoveAll
+func RemoveAll(name string) Applier {
+	return applyFn(func(root string) error {
+		return os.RemoveAll(filepath.Join(root, name))
+	})
+}
+
+// CreateDir returns a file applier to create the directory with
+// the provided name and permission
+func CreateDir(name string, perm os.FileMode) Applier {
+	return applyFn(func(root string) error {
+		fullPath := filepath.Join(root, name)
+		if err := os.MkdirAll(fullPath, perm); err != nil {
+			return err
+		}
+		return os.Chmod(fullPath, perm)
+	})
+}
+
+// Rename returns a file applier which renames a file
+func Rename(old, new string) Applier {
+	return applyFn(func(root string) error {
+		return os.Rename(filepath.Join(root, old), filepath.Join(root, new))
+	})
+}
+
+// Chown returns a file applier which changes the ownership of a file
+func Chown(name string, uid, gid int) Applier {
+	return applyFn(func(root string) error {
+		return os.Chown(filepath.Join(root, name), uid, gid)
+	})
+}
+
+// Chtimes changes access and mod time of file.
+// Use Lchtimes for symbolic links.
+func Chtimes(name string, atime, mtime time.Time) Applier {
+	return applyFn(func(root string) error {
+		return os.Chtimes(filepath.Join(root, name), atime, mtime)
+	})
+}
+
+// Chmod returns a file applier which changes the file permission
+func Chmod(name string, perm os.FileMode) Applier {
+	return applyFn(func(root string) error {
+		return os.Chmod(filepath.Join(root, name), perm)
+	})
+}
+
+// Symlink returns a file applier which creates a symbolic link
+func Symlink(oldname, newname string) Applier {
+	return applyFn(func(root string) error {
+		return os.Symlink(oldname, filepath.Join(root, newname))
+	})
+}
+
+// Link returns a file applier which creates a hard link
+func Link(oldname, newname string) Applier {
+	return applyFn(func(root string) error {
+		return os.Link(filepath.Join(root, oldname), filepath.Join(root, newname))
+	})
+}
+
+// TODO: Make platform specific, windows applier is always no-op
+//func Mknod(name string, mode int32, dev int) Applier {
+//	return func(root string) error {
+//		return return syscall.Mknod(path, mode, dev)
+//	}
+//}
+
+// Apply returns a new applier from the given appliers
+func Apply(appliers ...Applier) Applier {
+	return applyFn(func(root string) error {
+		for _, a := range appliers {
+			if err := a.Apply(root); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}

vendor/github.com/containerd/continuity/fs/fstest/file_unix.go

@@ -0,0 +1,29 @@
+// +build !windows
+
+package fstest
+
+import (
+	"path/filepath"
+	"time"
+
+	"github.com/containerd/continuity/sysx"
+	"golang.org/x/sys/unix"
+)
+
+// SetXAttr sets the xatter for the file
+func SetXAttr(name, key, value string) Applier {
+	return applyFn(func(root string) error {
+		return sysx.LSetxattr(name, key, []byte(value), 0)
+	})
+}
+
+// Lchtimes changes access and mod time of file without following symlink
+func Lchtimes(name string, atime, mtime time.Time) Applier {
+	return applyFn(func(root string) error {
+		path := filepath.Join(root, name)
+		at := unix.NsecToTimespec(atime.UnixNano())
+		mt := unix.NsecToTimespec(mtime.UnixNano())
+		utimes := [2]unix.Timespec{at, mt}
+		return unix.UtimesNanoAt(unix.AT_FDCWD, path, utimes[0:], unix.AT_SYMLINK_NOFOLLOW)
+	})
+}

vendor/github.com/containerd/continuity/fs/fstest/file_windows.go

@@ -0,0 +1,14 @@
+package fstest
+
+import (
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+// Lchtimes changes access and mod time of file without following symlink
+func Lchtimes(name string, atime, mtime time.Time) Applier {
+	return applyFn(func(root string) error {
+		return errors.New("Not implemented")
+	})
+}

vendor/github.com/containerd/continuity/fs/fstest/testsuite.go

@@ -0,0 +1,220 @@
+package fstest
+
+import (
+	"context"
+	"io/ioutil"
+	"os"
+	"testing"
+)
+
+// TestApplier applies the test context
+type TestApplier interface {
+	TestContext(context.Context) (context.Context, func(), error)
+	Apply(context.Context, Applier) (string, func(), error)
+}
+
+// FSSuite runs the path test suite
+func FSSuite(t *testing.T, a TestApplier) {
+	t.Run("Basic", makeTest(t, a, basicTest))
+	t.Run("Deletion", makeTest(t, a, deletionTest))
+	t.Run("Update", makeTest(t, a, updateTest))
+	t.Run("DirectoryPermission", makeTest(t, a, directoryPermissionsTest))
+	t.Run("ParentDirectoryPermission", makeTest(t, a, parentDirectoryPermissionsTest))
+	t.Run("HardlinkUnmodified", makeTest(t, a, hardlinkUnmodified))
+	t.Run("HardlinkBeforeUnmodified", makeTest(t, a, hardlinkBeforeUnmodified))
+	t.Run("HardlinkBeforeModified", makeTest(t, a, hardlinkBeforeModified))
+}
+
+func makeTest(t *testing.T, ta TestApplier, as []Applier) func(t *testing.T) {
+	return func(t *testing.T) {
+		ctx, cleanup, err := ta.TestContext(context.Background())
+		if err != nil {
+			t.Fatalf("Unable to get test context: %+v", err)
+		}
+		defer cleanup()
+
+		applyDir, err := ioutil.TempDir("", "test-expected-")
+		if err != nil {
+			t.Fatalf("Unable to make temp directory: %+v", err)
+		}
+		defer os.RemoveAll(applyDir)
+
+		for i, a := range as {
+			testDir, c, err := ta.Apply(ctx, a)
+			if err != nil {
+				t.Fatalf("Apply failed at %d: %+v", i, err)
+			}
+			if err := a.Apply(applyDir); err != nil {
+				if c != nil {
+					c()
+				}
+				t.Fatalf("Error applying change to apply directory: %+v", err)
+			}
+
+			err = CheckDirectoryEqual(applyDir, testDir)
+			if c != nil {
+				c()
+			}
+			if err != nil {
+				t.Fatalf("Directories not equal at %d (expected <> tested): %+v", i, err)
+			}
+		}
+	}
+}
+
+var (
+	// baseApplier creates a basic filesystem layout
+	// with multiple types of files for basic tests.
+	baseApplier = Apply(
+		CreateDir("/etc/", 0755),
+		CreateFile("/etc/hosts", []byte("127.0.0.1 localhost"), 0644),
+		Link("/etc/hosts", "/etc/hosts.allow"),
+		CreateDir("/usr/local/lib", 0755),
+		CreateFile("/usr/local/lib/libnothing.so", []byte{0x00, 0x00}, 0755),
+		Symlink("libnothing.so", "/usr/local/lib/libnothing.so.2"),
+		CreateDir("/home", 0755),
+		CreateDir("/home/derek", 0700),
+	)
+
+	// basicTest covers basic operations
+	basicTest = []Applier{
+		baseApplier,
+		Apply(
+			CreateFile("/etc/hosts", []byte("127.0.0.1 localhost.localdomain"), 0644),
+			CreateFile("/etc/fstab", []byte("/dev/sda1\t/\text4\tdefaults 1 1\n"), 0600),
+			CreateFile("/etc/badfile", []byte(""), 0666),
+			CreateFile("/home/derek/.zshrc", []byte("#ZSH is just better\n"), 0640),
+		),
+		Apply(
+			Remove("/etc/badfile"),
+			Rename("/home/derek", "/home/notderek"),
+		),
+		Apply(
+			RemoveAll("/usr"),
+			Remove("/etc/hosts.allow"),
+		),
+		Apply(
+			RemoveAll("/home"),
+			CreateDir("/home/derek", 0700),
+			CreateFile("/home/derek/.bashrc", []byte("#not going away\n"), 0640),
+			Link("/etc/hosts", "/etc/hosts.allow"),
+		),
+	}
+
+	// deletionTest covers various deletion scenarios to ensure
+	// deletions are properly picked up and applied
+	deletionTest = []Applier{
+		Apply(
+			CreateDir("/test/somedir", 0755),
+			CreateDir("/lib", 0700),
+			CreateFile("/lib/hidden", []byte{}, 0644),
+		),
+		Apply(
+			CreateFile("/test/a", []byte{}, 0644),
+			CreateFile("/test/b", []byte{}, 0644),
+			CreateDir("/test/otherdir", 0755),
+			CreateFile("/test/otherdir/.empty", []byte{}, 0644),
+			RemoveAll("/lib"),
+			CreateDir("/lib", 0700),
+			CreateFile("/lib/not-hidden", []byte{}, 0644),
+		),
+		Apply(
+			Remove("/test/a"),
+			Remove("/test/b"),
+			RemoveAll("/test/otherdir"),
+			CreateFile("/lib/newfile", []byte{}, 0644),
+		),
+	}
+
+	// updateTest covers file updates for content and permission
+	updateTest = []Applier{
+		Apply(
+			CreateDir("/d1", 0755),
+			CreateDir("/d2", 0700),
+			CreateFile("/d1/f1", []byte("something..."), 0644),
+			CreateFile("/d1/f2", []byte("else..."), 0644),
+			CreateFile("/d1/f3", []byte("entirely..."), 0644),
+		),
+		Apply(
+			CreateFile("/d1/f1", []byte("file content of a different length"), 0664),
+			Remove("/d1/f3"),
+			CreateFile("/d1/f3", []byte("updated content"), 0664),
+			Chmod("/d1/f2", 0766),
+			Chmod("/d2", 0777),
+		),
+	}
+
+	// directoryPermissionsTest covers directory permissions on update
+	directoryPermissionsTest = []Applier{
+		Apply(
+			CreateDir("/d1", 0700),
+			CreateDir("/d2", 0751),
+			CreateDir("/d3", 0777),
+		),
+		Apply(
+			CreateFile("/d1/f", []byte("irrelevant"), 0644),
+			CreateDir("/d1/d", 0700),
+			CreateFile("/d1/d/f", []byte("irrelevant"), 0644),
+			CreateFile("/d2/f", []byte("irrelevant"), 0644),
+			CreateFile("/d3/f", []byte("irrelevant"), 0644),
+		),
+	}
+
+	// parentDirectoryPermissionsTest covers directory permissions for updated
+	// files
+	parentDirectoryPermissionsTest = []Applier{
+		Apply(
+			CreateDir("/d1", 0700),
+			CreateDir("/d1/a", 0700),
+			CreateDir("/d1/a/b", 0700),
+			CreateDir("/d1/a/b/c", 0700),
+			CreateFile("/d1/a/b/f", []byte("content1"), 0644),
+			CreateDir("/d2", 0751),
+			CreateDir("/d2/a/b", 0751),
+			CreateDir("/d2/a/b/c", 0751),
+			CreateFile("/d2/a/b/f", []byte("content1"), 0644),
+		),
+		Apply(
+			CreateFile("/d1/a/b/f", []byte("content1"), 0644),
+			Chmod("/d1/a/b/c", 0700),
+			CreateFile("/d2/a/b/f", []byte("content2"), 0644),
+			Chmod("/d2/a/b/c", 0751),
+		),
+	}
+
+	hardlinkUnmodified = []Applier{
+		baseApplier,
+		Apply(
+			CreateFile("/etc/hosts", []byte("127.0.0.1 localhost.localdomain"), 0644),
+		),
+		Apply(
+			Link("/etc/hosts", "/etc/hosts.deny"),
+		),
+	}
+
+	// Hardlink name before with modification
+	// Tests link is created for unmodified files when new hardlinked file is seen first
+	hardlinkBeforeUnmodified = []Applier{
+		baseApplier,
+		Apply(
+			CreateFile("/etc/hosts", []byte("127.0.0.1 localhost.localdomain"), 0644),
+		),
+		Apply(
+			Link("/etc/hosts", "/etc/before-hosts"),
+		),
+	}
+
+	// Hardlink name after without modification
+	// tests link is created for modified file with new hardlink
+	hardlinkBeforeModified = []Applier{
+		baseApplier,
+		Apply(
+			CreateFile("/etc/hosts", []byte("127.0.0.1 localhost.localdomain"), 0644),
+		),
+		Apply(
+			Remove("/etc/hosts"),
+			CreateFile("/etc/hosts", []byte("127.0.0.1 localhost"), 0644),
+			Link("/etc/hosts", "/etc/before-hosts"),
+		),
+	}
+)

vendor/github.com/containerd/continuity/fs/hardlink.go

@@ -0,0 +1,27 @@
+package fs
+
+import "os"
+
+// GetLinkInfo returns an identifier representing the node a hardlink is pointing
+// to. If the file is not hard linked then 0 will be returned.
+func GetLinkInfo(fi os.FileInfo) (uint64, bool) {
+	return getLinkInfo(fi)
+}
+
+// getLinkSource returns a path for the given name and
+// file info to its link source in the provided inode
+// map. If the given file name is not in the map and
+// has other links, it is added to the inode map
+// to be a source for other link locations.
+func getLinkSource(name string, fi os.FileInfo, inodes map[uint64]string) (string, error) {
+	inode, isHardlink := getLinkInfo(fi)
+	if !isHardlink {
+		return "", nil
+	}
+
+	path, ok := inodes[inode]
+	if !ok {
+		inodes[inode] = name
+	}
+	return path, nil
+}

vendor/github.com/containerd/continuity/fs/hardlink_unix.go

@@ -0,0 +1,18 @@
+// +build !windows
+
+package fs
+
+import (
+	"os"
+	"syscall"
+)
+
+func getLinkInfo(fi os.FileInfo) (uint64, bool) {
+	s, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return 0, false
+	}
+
+	// Ino is uint32 on bsd, uint64 on darwin/linux/solaris
+	return uint64(s.Ino), !fi.IsDir() && s.Nlink > 1 // nolint: unconvert
+}

vendor/github.com/containerd/continuity/fs/hardlink_windows.go

@@ -0,0 +1,7 @@
+package fs
+
+import "os"
+
+func getLinkInfo(fi os.FileInfo) (uint64, bool) {
+	return 0, false
+}

vendor/github.com/containerd/continuity/fs/path.go

@@ -0,0 +1,276 @@
+package fs
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+var (
+	errTooManyLinks = errors.New("too many links")
+)
+
+type currentPath struct {
+	path     string
+	f        os.FileInfo
+	fullPath string
+}
+
+func pathChange(lower, upper *currentPath) (ChangeKind, string) {
+	if lower == nil {
+		if upper == nil {
+			panic("cannot compare nil paths")
+		}
+		return ChangeKindAdd, upper.path
+	}
+	if upper == nil {
+		return ChangeKindDelete, lower.path
+	}
+	// TODO: compare by directory
+
+	switch i := strings.Compare(lower.path, upper.path); {
+	case i < 0:
+		// File in lower that is not in upper
+		return ChangeKindDelete, lower.path
+	case i > 0:
+		// File in upper that is not in lower
+		return ChangeKindAdd, upper.path
+	default:
+		return ChangeKindModify, upper.path
+	}
+}
+
+func sameFile(f1, f2 *currentPath) (bool, error) {
+	if os.SameFile(f1.f, f2.f) {
+		return true, nil
+	}
+
+	equalStat, err := compareSysStat(f1.f.Sys(), f2.f.Sys())
+	if err != nil || !equalStat {
+		return equalStat, err
+	}
+
+	if eq, err := compareCapabilities(f1.fullPath, f2.fullPath); err != nil || !eq {
+		return eq, err
+	}
+
+	// If not a directory also check size, modtime, and content
+	if !f1.f.IsDir() {
+		if f1.f.Size() != f2.f.Size() {
+			return false, nil
+		}
+		t1 := f1.f.ModTime()
+		t2 := f2.f.ModTime()
+
+		if t1.Unix() != t2.Unix() {
+			return false, nil
+		}
+
+		// If the timestamp may have been truncated in both of the
+		// files, check content of file to determine difference
+		if t1.Nanosecond() == 0 && t2.Nanosecond() == 0 {
+			var eq bool
+			if (f1.f.Mode() & os.ModeSymlink) == os.ModeSymlink {
+				eq, err = compareSymlinkTarget(f1.fullPath, f2.fullPath)
+			} else if f1.f.Size() > 0 {
+				eq, err = compareFileContent(f1.fullPath, f2.fullPath)
+			}
+			if err != nil || !eq {
+				return eq, err
+			}
+		} else if t1.Nanosecond() != t2.Nanosecond() {
+			return false, nil
+		}
+	}
+
+	return true, nil
+}
+
+func compareSymlinkTarget(p1, p2 string) (bool, error) {
+	t1, err := os.Readlink(p1)
+	if err != nil {
+		return false, err
+	}
+	t2, err := os.Readlink(p2)
+	if err != nil {
+		return false, err
+	}
+	return t1 == t2, nil
+}
+
+const compareChuckSize = 32 * 1024
+
+// compareFileContent compares the content of 2 same sized files
+// by comparing each byte.
+func compareFileContent(p1, p2 string) (bool, error) {
+	f1, err := os.Open(p1)
+	if err != nil {
+		return false, err
+	}
+	defer f1.Close()
+	f2, err := os.Open(p2)
+	if err != nil {
+		return false, err
+	}
+	defer f2.Close()
+
+	b1 := make([]byte, compareChuckSize)
+	b2 := make([]byte, compareChuckSize)
+	for {
+		n1, err1 := f1.Read(b1)
+		if err1 != nil && err1 != io.EOF {
+			return false, err1
+		}
+		n2, err2 := f2.Read(b2)
+		if err2 != nil && err2 != io.EOF {
+			return false, err2
+		}
+		if n1 != n2 || !bytes.Equal(b1[:n1], b2[:n2]) {
+			return false, nil
+		}
+		if err1 == io.EOF && err2 == io.EOF {
+			return true, nil
+		}
+	}
+}
+
+func pathWalk(ctx context.Context, root string, pathC chan<- *currentPath) error {
+	return filepath.Walk(root, func(path string, f os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// Rebase path
+		path, err = filepath.Rel(root, path)
+		if err != nil {
+			return err
+		}
+
+		path = filepath.Join(string(os.PathSeparator), path)
+
+		// Skip root
+		if path == string(os.PathSeparator) {
+			return nil
+		}
+
+		p := &currentPath{
+			path:     path,
+			f:        f,
+			fullPath: filepath.Join(root, path),
+		}
+
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case pathC <- p:
+			return nil
+		}
+	})
+}
+
+func nextPath(ctx context.Context, pathC <-chan *currentPath) (*currentPath, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case p := <-pathC:
+		return p, nil
+	}
+}
+
+// RootPath joins a path with a root, evaluating and bounding any
+// symlink to the root directory.
+func RootPath(root, path string) (string, error) {
+	if path == "" {
+		return root, nil
+	}
+	var linksWalked int // to protect against cycles
+	for {
+		i := linksWalked
+		newpath, err := walkLinks(root, path, &linksWalked)
+		if err != nil {
+			return "", err
+		}
+		path = newpath
+		if i == linksWalked {
+			newpath = filepath.Join("/", newpath)
+			if path == newpath {
+				return filepath.Join(root, newpath), nil
+			}
+			path = newpath
+		}
+	}
+}
+
+func walkLink(root, path string, linksWalked *int) (newpath string, islink bool, err error) {
+	if *linksWalked > 255 {
+		return "", false, errTooManyLinks
+	}
+
+	path = filepath.Join("/", path)
+	if path == "/" {
+		return path, false, nil
+	}
+	realPath := filepath.Join(root, path)
+
+	fi, err := os.Lstat(realPath)
+	if err != nil {
+		// If path does not yet exist, treat as non-symlink
+		if os.IsNotExist(err) {
+			return path, false, nil
+		}
+		return "", false, err
+	}
+	if fi.Mode()&os.ModeSymlink == 0 {
+		return path, false, nil
+	}
+	newpath, err = os.Readlink(realPath)
+	if err != nil {
+		return "", false, err
+	}
+	if filepath.IsAbs(newpath) && strings.HasPrefix(newpath, root) {
+		newpath = newpath[:len(root)]
+		if !strings.HasPrefix(newpath, "/") {
+			newpath = "/" + newpath
+		}
+	}
+	*linksWalked++
+	return newpath, true, nil
+}
+
+func walkLinks(root, path string, linksWalked *int) (string, error) {
+	switch dir, file := filepath.Split(path); {
+	case dir == "":
+		newpath, _, err := walkLink(root, file, linksWalked)
+		return newpath, err
+	case file == "":
+		if os.IsPathSeparator(dir[len(dir)-1]) {
+			if dir == "/" {
+				return dir, nil
+			}
+			return walkLinks(root, dir[:len(dir)-1], linksWalked)
+		}
+		newpath, _, err := walkLink(root, dir, linksWalked)
+		return newpath, err
+	default:
+		newdir, err := walkLinks(root, dir, linksWalked)
+		if err != nil {
+			return "", err
+		}
+		newpath, islink, err := walkLink(root, filepath.Join(newdir, file), linksWalked)
+		if err != nil {
+			return "", err
+		}
+		if !islink {
+			return newpath, nil
+		}
+		if filepath.IsAbs(newpath) {
+			return newpath, nil
+		}
+		return filepath.Join(newdir, newpath), nil
+	}
+}

vendor/github.com/containerd/continuity/fs/path_test.go

@@ -0,0 +1,294 @@
+// +build !windows
+
+package fs
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/containerd/continuity/fs/fstest"
+	"github.com/pkg/errors"
+)
+
+type RootCheck struct {
+	unresolved string
+	expected   string
+	scope      func(string) string
+	cause      error
+}
+
+func TestRootPath(t *testing.T) {
+	tests := []struct {
+		name   string
+		apply  fstest.Applier
+		checks []RootCheck
+	}{
+		{
+			name:   "SymlinkAbsolute",
+			apply:  Symlink("/b", "fs/a/d"),
+			checks: Check("fs/a/d/c/data", "b/c/data"),
+		},
+		{
+			name:   "SymlinkRelativePath",
+			apply:  Symlink("a", "fs/i"),
+			checks: Check("fs/i", "fs/a"),
+		},
+		{
+			name:   "SymlinkSkipSymlinksOutsideScope",
+			apply:  Symlink("realdir", "linkdir"),
+			checks: CheckWithScope("foo/bar", "foo/bar", "linkdir"),
+		},
+		{
+			name:   "SymlinkLastLink",
+			apply:  Symlink("/b", "fs/a/d"),
+			checks: Check("fs/a/d", "b"),
+		},
+		{
+			name:  "SymlinkRelativeLinkChangeScope",
+			apply: Symlink("../b", "fs/a/e"),
+			checks: CheckAll(
+				Check("fs/a/e/c/data", "fs/b/c/data"),
+				CheckWithScope("e", "b", "fs/a"), // Original return
+			),
+		},
+		{
+			name:  "SymlinkDeepRelativeLinkChangeScope",
+			apply: Symlink("../../../../test", "fs/a/f"),
+			checks: CheckAll(
+				Check("fs/a/f", "test"),             // Original return
+				CheckWithScope("a/f", "test", "fs"), // Original return
+			),
+		},
+		{
+			name: "SymlinkRelativeLinkChain",
+			apply: fstest.Apply(
+				Symlink("../g", "fs/b/h"),
+				fstest.Symlink("../../../../../../../../../../../../root", "fs/g"),
+			),
+			checks: Check("fs/b/h", "root"),
+		},
+		{
+			name:   "SymlinkBreakoutPath",
+			apply:  Symlink("../i/a", "fs/j/k"),
+			checks: CheckWithScope("k", "i/a", "fs/j"),
+		},
+		{
+			name:   "SymlinkToRoot",
+			apply:  Symlink("/", "foo"),
+			checks: Check("foo", ""),
+		},
+		{
+			name:   "SymlinkSlashDotdot",
+			apply:  Symlink("/../../", "foo"),
+			checks: Check("foo", ""),
+		},
+		{
+			name:   "SymlinkDotdot",
+			apply:  Symlink("../../", "foo"),
+			checks: Check("foo", ""),
+		},
+		{
+			name:   "SymlinkRelativePath2",
+			apply:  Symlink("baz/target", "bar/foo"),
+			checks: Check("bar/foo", "bar/baz/target"),
+		},
+		{
+			name: "SymlinkScopeLink",
+			apply: fstest.Apply(
+				Symlink("root2", "root"),
+				Symlink("../bar", "root2/foo"),
+			),
+			checks: CheckWithScope("foo", "bar", "root"),
+		},
+		{
+			name: "SymlinkSelf",
+			apply: fstest.Apply(
+				Symlink("foo", "root/foo"),
+			),
+			checks: ErrorWithScope("foo", "root", errTooManyLinks),
+		},
+		{
+			name: "SymlinkCircular",
+			apply: fstest.Apply(
+				Symlink("foo", "bar"),
+				Symlink("bar", "foo"),
+			),
+			checks: ErrorWithScope("foo", "", errTooManyLinks), //TODO: Test for circular error
+		},
+		{
+			name: "SymlinkCircularUnderRoot",
+			apply: fstest.Apply(
+				Symlink("baz", "root/bar"),
+				Symlink("../bak", "root/baz"),
+				Symlink("/bar", "root/bak"),
+			),
+			checks: ErrorWithScope("bar", "root", errTooManyLinks), // TODO: Test for circular error
+		},
+		{
+			name: "SymlinkComplexChain",
+			apply: fstest.Apply(
+				fstest.CreateDir("root2", 0777),
+				Symlink("root2", "root"),
+				Symlink("r/s", "root/a"),
+				Symlink("../root/t", "root/r"),
+				Symlink("/../u", "root/root/t/s/b"),
+				Symlink(".", "root/u/c"),
+				Symlink("../v", "root/u/x/y"),
+				Symlink("/../w", "root/u/v"),
+			),
+			checks: CheckWithScope("a/b/c/x/y/z", "w/z", "root"), // Original return
+		},
+		{
+			name: "SymlinkBreakoutNonExistent",
+			apply: fstest.Apply(
+				Symlink("/", "root/slash"),
+				Symlink("/idontexist/../slash", "root/sym"),
+			),
+			checks: CheckWithScope("sym/file", "file", "root"),
+		},
+		{
+			name: "SymlinkNoLexicalCleaning",
+			apply: fstest.Apply(
+				Symlink("/foo/bar", "root/sym"),
+				Symlink("/sym/../baz", "root/hello"),
+			),
+			checks: CheckWithScope("hello", "foo/baz", "root"),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, makeRootPathTest(t, test.apply, test.checks))
+	}
+
+	// Add related tests which are unable to follow same pattern
+	t.Run("SymlinkRootScope", testRootPathSymlinkRootScope)
+	t.Run("SymlinkEmpty", testRootPathSymlinkEmpty)
+}
+
+func testRootPathSymlinkRootScope(t *testing.T) {
+	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkRootScope")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpdir)
+
+	expected, err := filepath.EvalSymlinks(tmpdir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rewrite, err := RootPath("/", tmpdir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rewrite != expected {
+		t.Fatalf("expected %q got %q", expected, rewrite)
+	}
+}
+func testRootPathSymlinkEmpty(t *testing.T) {
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	res, err := RootPath(wd, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res != wd {
+		t.Fatalf("expected %q got %q", wd, res)
+	}
+}
+
+func makeRootPathTest(t *testing.T, apply fstest.Applier, checks []RootCheck) func(t *testing.T) {
+	return func(t *testing.T) {
+		applyDir, err := ioutil.TempDir("", "test-root-path-")
+		if err != nil {
+			t.Fatalf("Unable to make temp directory: %+v", err)
+		}
+		defer os.RemoveAll(applyDir)
+
+		if apply != nil {
+			if err := apply.Apply(applyDir); err != nil {
+				t.Fatalf("Apply failed: %+v", err)
+			}
+		}
+
+		for i, check := range checks {
+			root := applyDir
+			if check.scope != nil {
+				root = check.scope(root)
+			}
+
+			actual, err := RootPath(root, check.unresolved)
+			if check.cause != nil {
+				if err == nil {
+					t.Errorf("(Check %d) Expected error %q, %q evaluated as %q", i+1, check.cause.Error(), check.unresolved, actual)
+				}
+				if errors.Cause(err) != check.cause {
+					t.Fatalf("(Check %d) Failed to evaluate root path: %+v", i+1, err)
+				}
+			} else {
+				expected := filepath.Join(root, check.expected)
+				if err != nil {
+					t.Fatalf("(Check %d) Failed to evaluate root path: %+v", i+1, err)
+				}
+				if actual != expected {
+					t.Errorf("(Check %d) Unexpected evaluated path %q, expected %q", i+1, actual, expected)
+				}
+			}
+		}
+	}
+}
+
+func Check(unresolved, expected string) []RootCheck {
+	return []RootCheck{
+		{
+			unresolved: unresolved,
+			expected:   expected,
+		},
+	}
+}
+
+func CheckWithScope(unresolved, expected, scope string) []RootCheck {
+	return []RootCheck{
+		{
+			unresolved: unresolved,
+			expected:   expected,
+			scope: func(root string) string {
+				return filepath.Join(root, scope)
+			},
+		},
+	}
+}
+
+func ErrorWithScope(unresolved, scope string, cause error) []RootCheck {
+	return []RootCheck{
+		{
+			unresolved: unresolved,
+			cause:      cause,
+			scope: func(root string) string {
+				return filepath.Join(root, scope)
+			},
+		},
+	}
+}
+
+func CheckAll(checks ...[]RootCheck) []RootCheck {
+	all := make([]RootCheck, 0, len(checks))
+	for _, c := range checks {
+		all = append(all, c...)
+	}
+	return all
+}
+
+func Symlink(oldname, newname string) fstest.Applier {
+	dir := filepath.Dir(newname)
+	if dir != "" {
+		return fstest.Apply(
+			fstest.CreateDir(dir, 0755),
+			fstest.Symlink(oldname, newname),
+		)
+	}
+	return fstest.Symlink(oldname, newname)
+}

vendor/github.com/containerd/continuity/fs/stat_bsd.go

@@ -0,0 +1,28 @@
+// +build darwin freebsd
+
+package fs
+
+import (
+	"syscall"
+	"time"
+)
+
+// StatAtime returns the access time from a stat struct
+func StatAtime(st *syscall.Stat_t) syscall.Timespec {
+	return st.Atimespec
+}
+
+// StatCtime returns the created time from a stat struct
+func StatCtime(st *syscall.Stat_t) syscall.Timespec {
+	return st.Ctimespec
+}
+
+// StatMtime returns the modified time from a stat struct
+func StatMtime(st *syscall.Stat_t) syscall.Timespec {
+	return st.Mtimespec
+}
+
+// StatATimeAsTime returns the access time as a time.Time
+func StatATimeAsTime(st *syscall.Stat_t) time.Time {
+	return time.Unix(int64(st.Atimespec.Sec), int64(st.Atimespec.Nsec)) // nolint: unconvert
+}

vendor/github.com/containerd/continuity/fs/stat_linux.go

@@ -0,0 +1,27 @@
+package fs
+
+import (
+	"syscall"
+	"time"
+)
+
+// StatAtime returns the Atim
+func StatAtime(st *syscall.Stat_t) syscall.Timespec {
+	return st.Atim
+}
+
+// StatCtime returns the Ctim
+func StatCtime(st *syscall.Stat_t) syscall.Timespec {
+	return st.Ctim
+}
+
+// StatMtime returns the Mtim
+func StatMtime(st *syscall.Stat_t) syscall.Timespec {
+	return st.Mtim
+}
+
+// StatATimeAsTime returns st.Atim as a time.Time
+func StatATimeAsTime(st *syscall.Stat_t) time.Time {
+	// The int64 conversions ensure the line compiles for 32-bit systems as well.
+	return time.Unix(int64(st.Atim.Sec), int64(st.Atim.Nsec)) // nolint: unconvert
+}

vendor/github.com/containerd/continuity/fs/time.go

@@ -0,0 +1,13 @@
+package fs
+
+import "time"
+
+// Gnu tar and the go tar writer don't have sub-second mtime
+// precision, which is problematic when we apply changes via tar
+// files, we handle this by comparing for exact times, *or* same
+// second count and either a or b having exactly 0 nanoseconds
+func sameFsTime(a, b time.Time) bool {
+	return a == b ||
+		(a.Unix() == b.Unix() &&
+			(a.Nanosecond() == 0 || b.Nanosecond() == 0))
+}

vendor/github.com/containerd/continuity/groups_unix.go

@@ -0,0 +1,113 @@
+package continuity
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+)
+
+// TODO(stevvooe): This needs a lot of work before we can call it useful.
+
+type groupIndex struct {
+	byName map[string]*group
+	byGID  map[int]*group
+}
+
+func getGroupIndex() (*groupIndex, error) {
+	f, err := os.Open("/etc/group")
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	groups, err := parseGroups(f)
+	if err != nil {
+		return nil, err
+	}
+
+	return newGroupIndex(groups), nil
+}
+
+func newGroupIndex(groups []group) *groupIndex {
+	gi := &groupIndex{
+		byName: make(map[string]*group),
+		byGID:  make(map[int]*group),
+	}
+
+	for i, group := range groups {
+		gi.byGID[group.gid] = &groups[i]
+		gi.byName[group.name] = &groups[i]
+	}
+
+	return gi
+}
+
+type group struct {
+	name    string
+	gid     int
+	members []string
+}
+
+func getGroupName(gid int) (string, error) {
+	f, err := os.Open("/etc/group")
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	groups, err := parseGroups(f)
+	if err != nil {
+		return "", err
+	}
+
+	for _, group := range groups {
+		if group.gid == gid {
+			return group.name, nil
+		}
+	}
+
+	return "", fmt.Errorf("no group for gid")
+}
+
+// parseGroups parses an /etc/group file for group names, ids and membership.
+// This is unix specific.
+func parseGroups(rd io.Reader) ([]group, error) {
+	var groups []group
+	scanner := bufio.NewScanner(rd)
+
+	for scanner.Scan() {
+		if strings.HasPrefix(scanner.Text(), "#") {
+			continue // skip comment
+		}
+
+		parts := strings.SplitN(scanner.Text(), ":", 4)
+
+		if len(parts) != 4 {
+			return nil, fmt.Errorf("bad entry: %q", scanner.Text())
+		}
+
+		name, _, sgid, smembers := parts[0], parts[1], parts[2], parts[3]
+
+		gid, err := strconv.Atoi(sgid)
+		if err != nil {
+			return nil, fmt.Errorf("bad gid: %q", gid)
+		}
+
+		members := strings.Split(smembers, ",")
+
+		groups = append(groups, group{
+			name:    name,
+			gid:     gid,
+			members: members,
+		})
+	}
+
+	if scanner.Err() != nil {
+		return nil, scanner.Err()
+	}
+
+	return groups, nil
+}

vendor/github.com/containerd/continuity/hardlinks.go

@@ -0,0 +1,57 @@
+package continuity
+
+import (
+	"fmt"
+	"os"
+)
+
+var (
+	errNotAHardLink = fmt.Errorf("invalid hardlink")
+)
+
+type hardlinkManager struct {
+	hardlinks map[hardlinkKey][]Resource
+}
+
+func newHardlinkManager() *hardlinkManager {
+	return &hardlinkManager{
+		hardlinks: map[hardlinkKey][]Resource{},
+	}
+}
+
+// Add attempts to add the resource to the hardlink manager. If the resource
+// cannot be considered as a hardlink candidate, errNotAHardLink is returned.
+func (hlm *hardlinkManager) Add(fi os.FileInfo, resource Resource) error {
+	if _, ok := resource.(Hardlinkable); !ok {
+		return errNotAHardLink
+	}
+
+	key, err := newHardlinkKey(fi)
+	if err != nil {
+		return err
+	}
+
+	hlm.hardlinks[key] = append(hlm.hardlinks[key], resource)
+
+	return nil
+}
+
+// Merge processes the current state of the hardlink manager and merges any
+// shared nodes into hardlinked resources.
+func (hlm *hardlinkManager) Merge() ([]Resource, error) {
+	var resources []Resource
+	for key, linked := range hlm.hardlinks {
+		if len(linked) < 1 {
+			return nil, fmt.Errorf("no hardlink entrys for dev, inode pair: %#v", key)
+		}
+
+		merged, err := Merge(linked...)
+		if err != nil {
+			return nil, fmt.Errorf("error merging hardlink: %v", err)
+		}
+
+		resources = append(resources, merged)
+	}
+
+	return resources, nil
+}

vendor/github.com/containerd/continuity/hardlinks_unix.go

@@ -0,0 +1,36 @@
+// +build linux darwin freebsd solaris
+
+package continuity
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+)
+
+// hardlinkKey provides a tuple-key for managing hardlinks. This is system-
+// specific.
+type hardlinkKey struct {
+	dev   uint64
+	inode uint64
+}
+
+// newHardlinkKey returns a hardlink key for the provided file info. If the
+// resource does not represent a possible hardlink, errNotAHardLink will be
+// returned.
+func newHardlinkKey(fi os.FileInfo) (hardlinkKey, error) {
+	sys, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return hardlinkKey{}, fmt.Errorf("cannot resolve (*syscall.Stat_t) from os.FileInfo")
+	}
+
+	if sys.Nlink < 2 {
+		// NOTE(stevvooe): This is not always true for all filesystems. We
+		// should somehow detect this and provided a slow "polyfill" that
+		// leverages os.SameFile if we detect a filesystem where link counts
+		// is not really supported.
+		return hardlinkKey{}, errNotAHardLink
+	}
+
+	return hardlinkKey{dev: uint64(sys.Dev), inode: uint64(sys.Ino)}, nil
+}

vendor/github.com/containerd/continuity/hardlinks_windows.go

@@ -0,0 +1,12 @@
+package continuity
+
+import "os"
+
+type hardlinkKey struct{}
+
+func newHardlinkKey(fi os.FileInfo) (hardlinkKey, error) {
+	// NOTE(stevvooe): Obviously, this is not yet implemented. However, the
+	// makings of an implementation are available in src/os/types_windows.go. More
+	// investigation needs to be done to figure out exactly how to do this.
+	return hardlinkKey{}, errNotAHardLink
+}

vendor/github.com/containerd/continuity/ioutils.go

@@ -0,0 +1,39 @@
+package continuity
+
+import (
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+)
+
+// atomicWriteFile writes data to a file by first writing to a temp
+// file and calling rename.
+func atomicWriteFile(filename string, r io.Reader, rf RegularFile) error {
+	f, err := ioutil.TempFile(filepath.Dir(filename), ".tmp-"+filepath.Base(filename))
+	if err != nil {
+		return err
+	}
+	err = os.Chmod(f.Name(), rf.Mode())
+	if err != nil {
+		f.Close()
+		return err
+	}
+	n, err := io.Copy(f, r)
+	if err == nil && n < rf.Size() {
+		f.Close()
+		return io.ErrShortWrite
+	}
+	if err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	return os.Rename(f.Name(), filename)
+}

vendor/github.com/containerd/continuity/manifest.go

@@ -0,0 +1,144 @@
+package continuity
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"sort"
+
+	pb "github.com/containerd/continuity/proto"
+	"github.com/golang/protobuf/proto"
+)
+
+// Manifest provides the contents of a manifest. Users of this struct should
+// not typically modify any fields directly.
+type Manifest struct {
+	// Resources specifies all the resources for a manifest in order by path.
+	Resources []Resource
+}
+
+func Unmarshal(p []byte) (*Manifest, error) {
+	var bm pb.Manifest
+
+	if err := proto.Unmarshal(p, &bm); err != nil {
+		return nil, err
+	}
+
+	var m Manifest
+	for _, b := range bm.Resource {
+		r, err := fromProto(b)
+		if err != nil {
+			return nil, err
+		}
+
+		m.Resources = append(m.Resources, r)
+	}
+
+	return &m, nil
+}
+
+func Marshal(m *Manifest) ([]byte, error) {
+	var bm pb.Manifest
+	for _, resource := range m.Resources {
+		bm.Resource = append(bm.Resource, toProto(resource))
+	}
+
+	return proto.Marshal(&bm)
+}
+
+func MarshalText(w io.Writer, m *Manifest) error {
+	var bm pb.Manifest
+	for _, resource := range m.Resources {
+		bm.Resource = append(bm.Resource, toProto(resource))
+	}
+
+	return proto.MarshalText(w, &bm)
+}
+
+// BuildManifest creates the manifest for the given context
+func BuildManifest(ctx Context) (*Manifest, error) {
+	resourcesByPath := map[string]Resource{}
+	hardlinks := newHardlinkManager()
+
+	if err := ctx.Walk(func(p string, fi os.FileInfo, err error) error {
+		if err != nil {
+			return fmt.Errorf("error walking %s: %v", p, err)
+		}
+
+		if p == "/" {
+			// skip root
+			return nil
+		}
+
+		resource, err := ctx.Resource(p, fi)
+		if err != nil {
+			if err == ErrNotFound {
+				return nil
+			}
+			log.Printf("error getting resource %q: %v", p, err)
+			return err
+		}
+
+		// add to the hardlink manager
+		if err := hardlinks.Add(fi, resource); err == nil {
+			// Resource has been accepted by hardlink manager so we don't add
+			// it to the resourcesByPath until we merge at the end.
+			return nil
+		} else if err != errNotAHardLink {
+			// handle any other case where we have a proper error.
+			return fmt.Errorf("adding hardlink %s: %v", p, err)
+		}
+
+		resourcesByPath[p] = resource
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	// merge and post-process the hardlinks.
+	hardlinked, err := hardlinks.Merge()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, resource := range hardlinked {
+		resourcesByPath[resource.Path()] = resource
+	}
+
+	var resources []Resource
+	for _, resource := range resourcesByPath {
+		resources = append(resources, resource)
+	}
+
+	sort.Stable(ByPath(resources))
+
+	return &Manifest{
+		Resources: resources,
+	}, nil
+}
+
+// VerifyManifest verifies all the resources in a manifest
+// against files from the given context.
+func VerifyManifest(ctx Context, manifest *Manifest) error {
+	for _, resource := range manifest.Resources {
+		if err := ctx.Verify(resource); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// ApplyManifest applies on the resources in a manifest to
+// the given context.
+func ApplyManifest(ctx Context, manifest *Manifest) error {
+	for _, resource := range manifest.Resources {
+		if err := ctx.Apply(resource); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

vendor/github.com/containerd/continuity/manifest_test.go

@@ -0,0 +1,420 @@
+// +build !windows
+
+package continuity
+
+import (
+	"bytes"
+	_ "crypto/sha256"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"math/rand"
+	"os"
+	"path/filepath"
+	"sort"
+	"syscall"
+	"testing"
+
+	"github.com/containerd/continuity/devices"
+	"github.com/opencontainers/go-digest"
+)
+
+// Hard things:
+//  1. Groups/gid - no standard library support.
+//  2. xattrs - must choose package to provide this.
+//  3. ADS - no clue where to start.
+
+func TestWalkFS(t *testing.T) {
+	rand.Seed(1)
+
+	// Testing:
+	// 1. Setup different files:
+	//		- links
+	//			- sibling directory - relative
+	//			- sibling directory - absolute
+	//			- parent directory - absolute
+	//			- parent directory - relative
+	//		- illegal links
+	//			- parent directory - relative, out of root
+	//			- parent directory - absolute, out of root
+	//		- regular files
+	//		- character devices
+	//		- what about sticky bits?
+	// 2. Build the manifest.
+	// 3. Verify expected result.
+	testResources := []dresource{
+		{
+			path: "a",
+			mode: 0644,
+		},
+		{
+			kind:   rhardlink,
+			path:   "a-hardlink",
+			target: "a",
+		},
+		{
+			kind: rdirectory,
+			path: "b",
+			mode: 0755,
+		},
+		{
+			kind:   rhardlink,
+			path:   "b/a-hardlink",
+			target: "a",
+		},
+		{
+			path: "b/a",
+			mode: 0600 | os.ModeSticky,
+		},
+		{
+			kind: rdirectory,
+			path: "c",
+			mode: 0755,
+		},
+		{
+			path: "c/a",
+			mode: 0644,
+		},
+		{
+			kind:   rrelsymlink,
+			path:   "c/ca-relsymlink",
+			mode:   0600,
+			target: "a",
+		},
+		{
+			kind:   rrelsymlink,
+			path:   "c/a-relsymlink",
+			mode:   0600,
+			target: "../a",
+		},
+		{
+			kind:   rabssymlink,
+			path:   "c/a-abssymlink",
+			mode:   0600,
+			target: "a",
+		},
+		// TODO(stevvooe): Make sure we can test this case and get proper
+		// errors when it is encountered.
+		// {
+		// 	// create a bad symlink and make sure we don't include it.
+		// 	kind:   relsymlink,
+		// 	path:   "c/a-badsymlink",
+		// 	mode:   0600,
+		// 	target: "../../..",
+		// },
+
+		// TODO(stevvooe): Must add tests for xattrs, with symlinks,
+		// directorys and regular files.
+
+		{
+			kind: rnamedpipe,
+			path: "fifo",
+			mode: 0666 | os.ModeNamedPipe,
+		},
+
+		{
+			kind: rdirectory,
+			path: "/dev",
+			mode: 0755,
+		},
+
+		// NOTE(stevvooe): Below here, we add a few simple character devices.
+		// Block devices are untested but should be nearly the same as
+		// character devices.
+		// devNullResource,
+		// devZeroResource,
+	}
+
+	root, err := ioutil.TempDir("", "continuity-test-")
+	if err != nil {
+		t.Fatalf("error creating temporary directory: %v", err)
+	}
+
+	defer os.RemoveAll(root)
+
+	generateTestFiles(t, root, testResources)
+
+	ctx, err := NewContext(root)
+	if err != nil {
+		t.Fatalf("error getting context: %v", err)
+	}
+
+	m, err := BuildManifest(ctx)
+	if err != nil {
+		t.Fatalf("error building manifest: %v", err)
+	}
+
+	var b bytes.Buffer
+	MarshalText(&b, m)
+	t.Log(b.String())
+
+	// TODO(dmcgowan): always verify, currently hard links not supported
+	//if err := VerifyManifest(ctx, m); err != nil {
+	//	t.Fatalf("error verifying manifest: %v")
+	//}
+
+	expectedResources, err := expectedResourceList(root, testResources)
+	if err != nil {
+		// TODO(dmcgowan): update function to panic, this would mean test setup error
+		t.Fatalf("error creating resource list: %v", err)
+	}
+
+	// Diff resources
+	diff := diffResourceList(expectedResources, m.Resources)
+	if diff.HasDiff() {
+		t.Log("Resource list difference")
+		for _, a := range diff.Additions {
+			t.Logf("Unexpected resource: %#v", a)
+		}
+		for _, d := range diff.Deletions {
+			t.Logf("Missing resource: %#v", d)
+		}
+		for _, u := range diff.Updates {
+			t.Logf("Changed resource:\n\tExpected: %#v\n\tActual:   %#v", u.Original, u.Updated)
+		}
+
+		t.FailNow()
+	}
+}
+
+// TODO(stevvooe): At this time, we have a nice testing framework to define
+// and build resources. This will likely be a pre-cursor to the packages
+// public interface.
+type kind int
+
+func (k kind) String() string {
+	switch k {
+	case rfile:
+		return "file"
+	case rdirectory:
+		return "directory"
+	case rhardlink:
+		return "hardlink"
+	case rchardev:
+		return "chardev"
+	case rnamedpipe:
+		return "namedpipe"
+	}
+
+	panic(fmt.Sprintf("unknown kind: %v", int(k)))
+}
+
+const (
+	rfile kind = iota
+	rdirectory
+	rhardlink
+	rrelsymlink
+	rabssymlink
+	rchardev
+	rnamedpipe
+)
+
+type dresource struct {
+	kind         kind
+	path         string
+	mode         os.FileMode
+	target       string // hard/soft link target
+	digest       digest.Digest
+	size         int
+	uid          int64
+	gid          int64
+	major, minor int
+}
+
+func generateTestFiles(t *testing.T, root string, resources []dresource) {
+	for i, resource := range resources {
+		p := filepath.Join(root, resource.path)
+		switch resource.kind {
+		case rfile:
+			size := rand.Intn(4 << 20)
+			d := make([]byte, size)
+			randomBytes(d)
+			dgst := digest.FromBytes(d)
+			resources[i].digest = dgst
+			resources[i].size = size
+
+			// this relies on the proper directory parent being defined.
+			if err := ioutil.WriteFile(p, d, resource.mode); err != nil {
+				t.Fatalf("error writing %q: %v", p, err)
+			}
+		case rdirectory:
+			if err := os.Mkdir(p, resource.mode); err != nil {
+				t.Fatalf("error creating directory %q: %v", p, err)
+			}
+		case rhardlink:
+			target := filepath.Join(root, resource.target)
+			if err := os.Link(target, p); err != nil {
+				t.Fatalf("error creating hardlink: %v", err)
+			}
+		case rrelsymlink:
+			if err := os.Symlink(resource.target, p); err != nil {
+				t.Fatalf("error creating symlink: %v", err)
+			}
+		case rabssymlink:
+			// for absolute links, we join with root.
+			target := filepath.Join(root, resource.target)
+
+			if err := os.Symlink(target, p); err != nil {
+				t.Fatalf("error creating symlink: %v", err)
+			}
+		case rchardev, rnamedpipe:
+			if err := devices.Mknod(p, resource.mode, resource.major, resource.minor); err != nil {
+				t.Fatalf("error creating device %q: %v", p, err)
+			}
+		default:
+			t.Fatalf("unknown resource type: %v", resource.kind)
+		}
+
+		st, err := os.Lstat(p)
+		if err != nil {
+			t.Fatalf("error statting after creation: %v", err)
+		}
+		resources[i].uid = int64(st.Sys().(*syscall.Stat_t).Uid)
+		resources[i].gid = int64(st.Sys().(*syscall.Stat_t).Gid)
+		resources[i].mode = st.Mode()
+
+		// TODO: Readback and join xattr
+	}
+
+	// log the test root for future debugging
+	if err := filepath.Walk(root, func(p string, fi os.FileInfo, err error) error {
+		if fi.Mode()&os.ModeSymlink != 0 {
+			target, err := os.Readlink(p)
+			if err != nil {
+				return err
+			}
+			t.Log(fi.Mode(), p, "->", target)
+		} else {
+			t.Log(fi.Mode(), p)
+		}
+
+		return nil
+	}); err != nil {
+		t.Fatalf("error walking created root: %v", err)
+	}
+
+	var b bytes.Buffer
+	if err := tree(&b, root); err != nil {
+		t.Fatalf("error running tree: %v", err)
+	}
+	t.Logf("\n%s", b.String())
+}
+
+func randomBytes(p []byte) {
+	for i := range p {
+		p[i] = byte(rand.Intn(1<<8 - 1))
+	}
+}
+
+// expectedResourceList sorts the set of resources into the order
+// expected in the manifest and collapses hardlinks
+func expectedResourceList(root string, resources []dresource) ([]Resource, error) {
+	resourceMap := map[string]Resource{}
+	paths := []string{}
+	for _, r := range resources {
+		absPath := r.path
+		if !filepath.IsAbs(absPath) {
+			absPath = "/" + absPath
+		}
+		switch r.kind {
+		case rfile:
+			f := &regularFile{
+				resource: resource{
+					paths: []string{absPath},
+					mode:  r.mode,
+					uid:   r.uid,
+					gid:   r.gid,
+				},
+				size:    int64(r.size),
+				digests: []digest.Digest{r.digest},
+			}
+			resourceMap[absPath] = f
+			paths = append(paths, absPath)
+		case rdirectory:
+			d := &directory{
+				resource: resource{
+					paths: []string{absPath},
+					mode:  r.mode,
+					uid:   r.uid,
+					gid:   r.gid,
+				},
+			}
+			resourceMap[absPath] = d
+			paths = append(paths, absPath)
+		case rhardlink:
+			targetPath := r.target
+			if !filepath.IsAbs(targetPath) {
+				targetPath = "/" + targetPath
+			}
+			target, ok := resourceMap[targetPath]
+			if !ok {
+				return nil, errors.New("must specify target before hardlink for test resources")
+			}
+			rf, ok := target.(*regularFile)
+			if !ok {
+				return nil, errors.New("hardlink target must be regular file")
+			}
+			// TODO(dmcgowan): full merge
+			rf.paths = append(rf.paths, absPath)
+			// TODO(dmcgowan): check if first path is now different, changes source order and should update
+			// resource map key, to avoid canonically ordered first should be regular file
+			sort.Stable(sort.StringSlice(rf.paths))
+		case rrelsymlink, rabssymlink:
+			targetPath := r.target
+			if r.kind == rabssymlink && !filepath.IsAbs(r.target) {
+				// for absolute links, we join with root.
+				targetPath = filepath.Join(root, targetPath)
+			}
+			s := &symLink{
+				resource: resource{
+					paths: []string{absPath},
+					mode:  r.mode,
+					uid:   r.uid,
+					gid:   r.gid,
+				},
+				target: targetPath,
+			}
+			resourceMap[absPath] = s
+			paths = append(paths, absPath)
+		case rchardev:
+			d := &device{
+				resource: resource{
+					paths: []string{absPath},
+					mode:  r.mode,
+					uid:   r.uid,
+					gid:   r.gid,
+				},
+				major: uint64(r.major),
+				minor: uint64(r.minor),
+			}
+			resourceMap[absPath] = d
+			paths = append(paths, absPath)
+		case rnamedpipe:
+			p := &namedPipe{
+				resource: resource{
+					paths: []string{absPath},
+					mode:  r.mode,
+					uid:   r.uid,
+					gid:   r.gid,
+				},
+			}
+			resourceMap[absPath] = p
+			paths = append(paths, absPath)
+		default:
+			return nil, fmt.Errorf("unknown resource type: %v", r.kind)
+		}
+	}
+
+	if len(resourceMap) < len(paths) {
+		return nil, errors.New("resource list has duplicated paths")
+	}
+
+	sort.Strings(paths)
+
+	manifestResources := make([]Resource, len(paths))
+	for i, p := range paths {
+		manifestResources[i] = resourceMap[p]
+	}
+
+	return manifestResources, nil
+}

vendor/github.com/containerd/continuity/manifest_test_darwin.go

@@ -0,0 +1,23 @@
+// +build ignore
+
+package continuity
+
+import "os"
+
+var (
+	devNullResource = resource{
+		kind:  chardev,
+		path:  "/dev/null",
+		major: 3,
+		minor: 2,
+		mode:  0666 | os.ModeDevice | os.ModeCharDevice,
+	}
+
+	devZeroResource = resource{
+		kind:  chardev,
+		path:  "/dev/zero",
+		major: 3,
+		minor: 3,
+		mode:  0666 | os.ModeDevice | os.ModeCharDevice,
+	}
+)

vendor/github.com/containerd/continuity/pathdriver/path_driver.go

@@ -0,0 +1,85 @@
+package pathdriver
+
+import (
+	"path/filepath"
+)
+
+// PathDriver provides all of the path manipulation functions in a common
+// interface. The context should call these and never use the `filepath`
+// package or any other package to manipulate paths.
+type PathDriver interface {
+	Join(paths ...string) string
+	IsAbs(path string) bool
+	Rel(base, target string) (string, error)
+	Base(path string) string
+	Dir(path string) string
+	Clean(path string) string
+	Split(path string) (dir, file string)
+	Separator() byte
+	Abs(path string) (string, error)
+	Walk(string, filepath.WalkFunc) error
+	FromSlash(path string) string
+	ToSlash(path string) string
+	Match(pattern, name string) (matched bool, err error)
+}
+
+// pathDriver is a simple default implementation calls the filepath package.
+type pathDriver struct{}
+
+// LocalPathDriver is the exported pathDriver struct for convenience.
+var LocalPathDriver PathDriver = &pathDriver{}
+
+func (*pathDriver) Join(paths ...string) string {
+	return filepath.Join(paths...)
+}
+
+func (*pathDriver) IsAbs(path string) bool {
+	return filepath.IsAbs(path)
+}
+
+func (*pathDriver) Rel(base, target string) (string, error) {
+	return filepath.Rel(base, target)
+}
+
+func (*pathDriver) Base(path string) string {
+	return filepath.Base(path)
+}
+
+func (*pathDriver) Dir(path string) string {
+	return filepath.Dir(path)
+}
+
+func (*pathDriver) Clean(path string) string {
+	return filepath.Clean(path)
+}
+
+func (*pathDriver) Split(path string) (dir, file string) {
+	return filepath.Split(path)
+}
+
+func (*pathDriver) Separator() byte {
+	return filepath.Separator
+}
+
+func (*pathDriver) Abs(path string) (string, error) {
+	return filepath.Abs(path)
+}
+
+// Note that filepath.Walk calls os.Stat, so if the context wants to
+// to call Driver.Stat() for Walk, they need to create a new struct that
+// overrides this method.
+func (*pathDriver) Walk(root string, walkFn filepath.WalkFunc) error {
+	return filepath.Walk(root, walkFn)
+}
+
+func (*pathDriver) FromSlash(path string) string {
+	return filepath.FromSlash(path)
+}
+
+func (*pathDriver) ToSlash(path string) string {
+	return filepath.ToSlash(path)
+}
+
+func (*pathDriver) Match(pattern, name string) (bool, error) {
+	return filepath.Match(pattern, name)
+}

vendor/github.com/containerd/continuity/proto/gen.go

@@ -0,0 +1,3 @@
+package proto
+
+//go:generate protoc --go_out=. manifest.proto

vendor/github.com/containerd/continuity/proto/manifest.pb.go

@@ -0,0 +1,181 @@
+// Code generated by protoc-gen-go.
+// source: manifest.proto
+// DO NOT EDIT!
+
+/*
+Package proto is a generated protocol buffer package.
+
+It is generated from these files:
+	manifest.proto
+
+It has these top-level messages:
+	Manifest
+	Resource
+	XAttr
+	ADSEntry
+*/
+package proto
+
+import proto1 "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto1.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto1.ProtoPackageIsVersion2 // please upgrade the proto package
+
+// Manifest specifies the entries in a container bundle, keyed and sorted by
+// path.
+type Manifest struct {
+	Resource []*Resource `protobuf:"bytes,1,rep,name=resource" json:"resource,omitempty"`
+}
+
+func (m *Manifest) Reset()                    { *m = Manifest{} }
+func (m *Manifest) String() string            { return proto1.CompactTextString(m) }
+func (*Manifest) ProtoMessage()               {}
+func (*Manifest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+
+func (m *Manifest) GetResource() []*Resource {
+	if m != nil {
+		return m.Resource
+	}
+	return nil
+}
+
+type Resource struct {
+	// Path specifies the path from the bundle root. If more than one
+	// path is present, the entry may represent a hardlink, rather than using
+	// a link target. The path format is operating system specific.
+	Path []string `protobuf:"bytes,1,rep,name=path" json:"path,omitempty"`
+	// Uid specifies the user id for the resource.
+	Uid int64 `protobuf:"varint,2,opt,name=uid" json:"uid,omitempty"`
+	// Gid specifies the group id for the resource.
+	Gid int64 `protobuf:"varint,3,opt,name=gid" json:"gid,omitempty"`
+	// user and group are not currently used but their field numbers have been
+	// reserved for future use. As such, they are marked as deprecated.
+	User  string `protobuf:"bytes,4,opt,name=user" json:"user,omitempty"`
+	Group string `protobuf:"bytes,5,opt,name=group" json:"group,omitempty"`
+	// Mode defines the file mode and permissions. We've used the same
+	// bit-packing from Go's os package,
+	// http://golang.org/pkg/os/#FileMode, since they've done the work of
+	// creating a cross-platform layout.
+	Mode uint32 `protobuf:"varint,6,opt,name=mode" json:"mode,omitempty"`
+	// Size specifies the size in bytes of the resource. This is only valid
+	// for regular files.
+	Size uint64 `protobuf:"varint,7,opt,name=size" json:"size,omitempty"`
+	// Digest specifies the content digest of the target file. Only valid for
+	// regular files. The strings are formatted in OCI style, i.e. <alg>:<encoded>.
+	// For detailed information about the format, please refer to OCI Image Spec:
+	// https://github.com/opencontainers/image-spec/blob/master/descriptor.md#digests-and-verification
+	// The digests are sorted in lexical order and implementations may choose
+	// which algorithms they prefer.
+	Digest []string `protobuf:"bytes,8,rep,name=digest" json:"digest,omitempty"`
+	// Target defines the target of a hard or soft link. Absolute links start
+	// with a slash and specify the resource relative to the bundle root.
+	// Relative links do not start with a slash and are relative to the
+	// resource path.
+	Target string `protobuf:"bytes,9,opt,name=target" json:"target,omitempty"`
+	// Major specifies the major device number for character and block devices.
+	Major uint64 `protobuf:"varint,10,opt,name=major" json:"major,omitempty"`
+	// Minor specifies the minor device number for character and block devices.
+	Minor uint64 `protobuf:"varint,11,opt,name=minor" json:"minor,omitempty"`
+	// Xattr provides storage for extended attributes for the target resource.
+	Xattr []*XAttr `protobuf:"bytes,12,rep,name=xattr" json:"xattr,omitempty"`
+	// Ads stores one or more alternate data streams for the target resource.
+	Ads []*ADSEntry `protobuf:"bytes,13,rep,name=ads" json:"ads,omitempty"`
+}
+
+func (m *Resource) Reset()                    { *m = Resource{} }
+func (m *Resource) String() string            { return proto1.CompactTextString(m) }
+func (*Resource) ProtoMessage()               {}
+func (*Resource) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
+
+func (m *Resource) GetXattr() []*XAttr {
+	if m != nil {
+		return m.Xattr
+	}
+	return nil
+}
+
+func (m *Resource) GetAds() []*ADSEntry {
+	if m != nil {
+		return m.Ads
+	}
+	return nil
+}
+
+// XAttr encodes extended attributes for a resource.
+type XAttr struct {
+	// Name specifies the attribute name.
+	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// Data specifies the associated data for the attribute.
+	Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (m *XAttr) Reset()                    { *m = XAttr{} }
+func (m *XAttr) String() string            { return proto1.CompactTextString(m) }
+func (*XAttr) ProtoMessage()               {}
+func (*XAttr) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
+
+// ADSEntry encodes information for a Windows Alternate Data Stream.
+type ADSEntry struct {
+	// Name specifices the stream name.
+	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// Data specifies the stream data.
+	// See also the description about the digest below.
+	Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+	// Digest is a CAS representation of the stream data.
+	//
+	// At least one of data or digest MUST be specified, and either one of them
+	// SHOULD be specified.
+	//
+	// How to access the actual data using the digest is implementation-specific,
+	// and implementations can choose not to implement digest.
+	// So, digest SHOULD be used only when the stream data is large.
+	Digest string `protobuf:"bytes,3,opt,name=digest" json:"digest,omitempty"`
+}
+
+func (m *ADSEntry) Reset()                    { *m = ADSEntry{} }
+func (m *ADSEntry) String() string            { return proto1.CompactTextString(m) }
+func (*ADSEntry) ProtoMessage()               {}
+func (*ADSEntry) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
+
+func init() {
+	proto1.RegisterType((*Manifest)(nil), "proto.Manifest")
+	proto1.RegisterType((*Resource)(nil), "proto.Resource")
+	proto1.RegisterType((*XAttr)(nil), "proto.XAttr")
+	proto1.RegisterType((*ADSEntry)(nil), "proto.ADSEntry")
+}
+
+func init() { proto1.RegisterFile("manifest.proto", fileDescriptor0) }
+
+var fileDescriptor0 = []byte{
+	// 317 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x8c, 0x90, 0x4f, 0x4b, 0xf3, 0x40,
+	0x10, 0xc6, 0x49, 0x93, 0xf4, 0x4d, 0xa7, 0xed, 0xab, 0x2c, 0x52, 0xe6, 0x18, 0x73, 0x0a, 0x08,
+	0x15, 0xf4, 0xe0, 0xb9, 0xa2, 0x17, 0xc1, 0xcb, 0x7a, 0xf1, 0xba, 0xba, 0x6b, 0x5c, 0x21, 0xd9,
+	0xb0, 0xd9, 0x80, 0xfa, 0xe5, 0xfc, 0x6a, 0x32, 0xb3, 0x69, 0xd1, 0x9b, 0xa7, 0x3c, 0xcf, 0x6f,
+	0xfe, 0x64, 0xf6, 0x81, 0xff, 0xad, 0xea, 0xec, 0x8b, 0x19, 0xc2, 0xb6, 0xf7, 0x2e, 0x38, 0x91,
+	0xf3, 0xa7, 0xba, 0x82, 0xe2, 0x7e, 0x2a, 0x88, 0x33, 0x28, 0xbc, 0x19, 0xdc, 0xe8, 0x9f, 0x0d,
+	0x26, 0x65, 0x5a, 0x2f, 0x2f, 0x8e, 0x62, 0xf3, 0x56, 0x4e, 0x58, 0x1e, 0x1a, 0xaa, 0xaf, 0x19,
+	0x14, 0x7b, 0x2c, 0x04, 0x64, 0xbd, 0x0a, 0xaf, 0x3c, 0xb5, 0x90, 0xac, 0xc5, 0x31, 0xa4, 0xa3,
+	0xd5, 0x38, 0x2b, 0x93, 0x3a, 0x95, 0x24, 0x89, 0x34, 0x56, 0x63, 0x1a, 0x49, 0x63, 0xb5, 0xd8,
+	0x40, 0x36, 0x0e, 0xc6, 0x63, 0x56, 0x26, 0xf5, 0xe2, 0x7a, 0x86, 0x89, 0x64, 0x2f, 0x10, 0xf2,
+	0xc6, 0xbb, 0xb1, 0xc7, 0xfc, 0x50, 0x88, 0x80, 0xfe, 0xd4, 0x3a, 0x6d, 0x70, 0x5e, 0x26, 0xf5,
+	0x5a, 0xb2, 0x26, 0x36, 0xd8, 0x4f, 0x83, 0xff, 0xca, 0xa4, 0xce, 0x24, 0x6b, 0xb1, 0x81, 0xb9,
+	0xb6, 0x8d, 0x19, 0x02, 0x16, 0x7c, 0xd3, 0xe4, 0x88, 0x07, 0xe5, 0x1b, 0x13, 0x70, 0x41, 0xab,
+	0xe5, 0xe4, 0xc4, 0x09, 0xe4, 0xad, 0x7a, 0x73, 0x1e, 0x81, 0x97, 0x44, 0xc3, 0xd4, 0x76, 0xce,
+	0xe3, 0x72, 0xa2, 0x64, 0x44, 0x05, 0xf9, 0xbb, 0x0a, 0xc1, 0xe3, 0x8a, 0x43, 0x5a, 0x4d, 0x21,
+	0x3d, 0xee, 0x42, 0xf0, 0x32, 0x96, 0xc4, 0x29, 0xa4, 0x4a, 0x0f, 0xb8, 0xfe, 0x15, 0xe3, 0xee,
+	0xe6, 0xe1, 0xb6, 0x0b, 0xfe, 0x43, 0x52, 0xad, 0x3a, 0x87, 0x9c, 0x47, 0xe8, 0xfe, 0x4e, 0xb5,
+	0x94, 0x39, 0x5d, 0xc4, 0x9a, 0x98, 0x56, 0x41, 0x71, 0x7c, 0x2b, 0xc9, 0xba, 0xba, 0x83, 0x62,
+	0xbf, 0xe1, 0xaf, 0x33, 0x3f, 0x72, 0x48, 0xe3, 0x7b, 0xa3, 0x7b, 0x9a, 0xf3, 0x45, 0x97, 0xdf,
+	0x01, 0x00, 0x00, 0xff, 0xff, 0xef, 0x27, 0x99, 0xf7, 0x17, 0x02, 0x00, 0x00,
+}

vendor/github.com/containerd/continuity/proto/manifest.proto

@@ -0,0 +1,97 @@
+syntax = "proto3";
+
+package proto;
+
+// Manifest specifies the entries in a container bundle, keyed and sorted by
+// path.
+message Manifest {
+    repeated Resource resource = 1;
+}
+
+message Resource {
+    // Path specifies the path from the bundle root. If more than one
+    // path is present, the entry may represent a hardlink, rather than using
+    // a link target. The path format is operating system specific.
+    repeated string path = 1;
+
+    // NOTE(stevvooe): Need to define clear precedence for user/group/uid/gid precedence.
+
+    // Uid specifies the user id for the resource.
+    int64 uid = 2;
+
+    // Gid specifies the group id for the resource.
+    int64 gid = 3;
+
+    // user and group are not currently used but their field numbers have been
+    // reserved for future use. As such, they are marked as deprecated.
+    string user = 4 [deprecated=true]; // "deprecated" stands for "reserved" here
+    string group = 5 [deprecated=true]; // "deprecated" stands for "reserved" here
+
+    // Mode defines the file mode and permissions. We've used the same
+    // bit-packing from Go's os package,
+    // http://golang.org/pkg/os/#FileMode, since they've done the work of
+    // creating a cross-platform layout.
+    uint32 mode = 6;
+
+    // NOTE(stevvooe): Beyond here, we start defining type specific fields.
+
+    // Size specifies the size in bytes of the resource. This is only valid
+    // for regular files.
+    uint64 size = 7;
+
+    // Digest specifies the content digest of the target file. Only valid for
+    // regular files. The strings are formatted in OCI style, i.e. <alg>:<encoded>.
+    // For detailed information about the format, please refer to OCI Image Spec:
+    // https://github.com/opencontainers/image-spec/blob/master/descriptor.md#digests-and-verification
+    // The digests are sorted in lexical order and implementations may choose
+    // which algorithms they prefer.
+    repeated string digest = 8;
+
+    // Target defines the target of a hard or soft link. Absolute links start
+    // with a slash and specify the resource relative to the bundle root.
+    // Relative links do not start with a slash and are relative to the
+    // resource path.
+    string target = 9;
+
+    // Major specifies the major device number for character and block devices.
+    uint64 major = 10;
+
+    // Minor specifies the minor device number for character and block devices.
+    uint64 minor = 11;
+
+    // Xattr provides storage for extended attributes for the target resource.
+    repeated XAttr xattr = 12;
+
+    // Ads stores one or more alternate data streams for the target resource.
+    repeated ADSEntry ads = 13;
+
+}
+
+// XAttr encodes extended attributes for a resource.
+message XAttr {
+    // Name specifies the attribute name.
+    string name = 1;
+
+    // Data specifies the associated data for the attribute.
+    bytes data = 2;
+}
+
+// ADSEntry encodes information for a Windows Alternate Data Stream.
+message ADSEntry {
+    // Name specifices the stream name.
+    string name = 1;
+
+    // Data specifies the stream data.
+    // See also the description about the digest below.
+    bytes data = 2;
+
+    // Digest is a CAS representation of the stream data.
+    //
+    // At least one of data or digest MUST be specified, and either one of them
+    // SHOULD be specified.
+    //
+    // How to access the actual data using the digest is implementation-specific,
+    // and implementations can choose not to implement digest.
+    // So, digest SHOULD be used only when the stream data is large.
+    string digest = 3;
+}

vendor/github.com/containerd/continuity/resource.go

@@ -0,0 +1,574 @@
+package continuity
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"reflect"
+	"sort"
+
+	pb "github.com/containerd/continuity/proto"
+	"github.com/opencontainers/go-digest"
+)
+
+// TODO(stevvooe): A record based model, somewhat sketched out at the bottom
+// of this file, will be more flexible. Another possibly is to tie the package
+// interface directly to the protobuf type. This will have efficiency
+// advantages at the cost coupling the nasty codegen types to the exported
+// interface.
+
+type Resource interface {
+	// Path provides the primary resource path relative to the bundle root. In
+	// cases where resources have more than one path, such as with hard links,
+	// this will return the primary path, which is often just the first entry.
+	Path() string
+
+	// Mode returns the
+	Mode() os.FileMode
+
+	UID() int64
+	GID() int64
+}
+
+// ByPath provides the canonical sort order for a set of resources. Use with
+// sort.Stable for deterministic sorting.
+type ByPath []Resource
+
+func (bp ByPath) Len() int           { return len(bp) }
+func (bp ByPath) Swap(i, j int)      { bp[i], bp[j] = bp[j], bp[i] }
+func (bp ByPath) Less(i, j int) bool { return bp[i].Path() < bp[j].Path() }
+
+type XAttrer interface {
+	XAttrs() map[string][]byte
+}
+
+// Hardlinkable is an interface that a resource type satisfies if it can be a
+// hardlink target.
+type Hardlinkable interface {
+	// Paths returns all paths of the resource, including the primary path
+	// returned by Resource.Path. If len(Paths()) > 1, the resource is a hard
+	// link.
+	Paths() []string
+}
+
+type RegularFile interface {
+	Resource
+	XAttrer
+	Hardlinkable
+
+	Size() int64
+	Digests() []digest.Digest
+}
+
+// Merge two or more Resources into new file. Typically, this should be
+// used to merge regular files as hardlinks. If the files are not identical,
+// other than Paths and Digests, the merge will fail and an error will be
+// returned.
+func Merge(fs ...Resource) (Resource, error) {
+	if len(fs) < 1 {
+		return nil, fmt.Errorf("please provide a resource to merge")
+	}
+
+	if len(fs) == 1 {
+		return fs[0], nil
+	}
+
+	var paths []string
+	var digests []digest.Digest
+	bypath := map[string][]Resource{}
+
+	// The attributes are all compared against the first to make sure they
+	// agree before adding to the above collections. If any of these don't
+	// correctly validate, the merge fails.
+	prototype := fs[0]
+	xattrs := make(map[string][]byte)
+
+	// initialize xattrs for use below. All files must have same xattrs.
+	if prototypeXAttrer, ok := prototype.(XAttrer); ok {
+		for attr, value := range prototypeXAttrer.XAttrs() {
+			xattrs[attr] = value
+		}
+	}
+
+	for _, f := range fs {
+		h, isHardlinkable := f.(Hardlinkable)
+		if !isHardlinkable {
+			return nil, errNotAHardLink
+		}
+
+		if f.Mode() != prototype.Mode() {
+			return nil, fmt.Errorf("modes do not match: %v != %v", f.Mode(), prototype.Mode())
+		}
+
+		if f.UID() != prototype.UID() {
+			return nil, fmt.Errorf("uid does not match: %v != %v", f.UID(), prototype.UID())
+		}
+
+		if f.GID() != prototype.GID() {
+			return nil, fmt.Errorf("gid does not match: %v != %v", f.GID(), prototype.GID())
+		}
+
+		if xattrer, ok := f.(XAttrer); ok {
+			fxattrs := xattrer.XAttrs()
+			if !reflect.DeepEqual(fxattrs, xattrs) {
+				return nil, fmt.Errorf("resource %q xattrs do not match: %v != %v", f, fxattrs, xattrs)
+			}
+		}
+
+		for _, p := range h.Paths() {
+			pfs, ok := bypath[p]
+			if !ok {
+				// ensure paths are unique by only appending on a new path.
+				paths = append(paths, p)
+			}
+
+			bypath[p] = append(pfs, f)
+		}
+
+		if regFile, isRegFile := f.(RegularFile); isRegFile {
+			prototypeRegFile, prototypeIsRegFile := prototype.(RegularFile)
+			if !prototypeIsRegFile {
+				return nil, errors.New("prototype is not a regular file")
+			}
+
+			if regFile.Size() != prototypeRegFile.Size() {
+				return nil, fmt.Errorf("size does not match: %v != %v", regFile.Size(), prototypeRegFile.Size())
+			}
+
+			digests = append(digests, regFile.Digests()...)
+		} else if device, isDevice := f.(Device); isDevice {
+			prototypeDevice, prototypeIsDevice := prototype.(Device)
+			if !prototypeIsDevice {
+				return nil, errors.New("prototype is not a device")
+			}
+
+			if device.Major() != prototypeDevice.Major() {
+				return nil, fmt.Errorf("major number does not match: %v != %v", device.Major(), prototypeDevice.Major())
+			}
+			if device.Minor() != prototypeDevice.Minor() {
+				return nil, fmt.Errorf("minor number does not match: %v != %v", device.Minor(), prototypeDevice.Minor())
+			}
+		} else if _, isNamedPipe := f.(NamedPipe); isNamedPipe {
+			_, prototypeIsNamedPipe := prototype.(NamedPipe)
+			if !prototypeIsNamedPipe {
+				return nil, errors.New("prototype is not a named pipe")
+			}
+		} else {
+			return nil, errNotAHardLink
+		}
+	}
+
+	sort.Stable(sort.StringSlice(paths))
+
+	// Choose a "canonical" file. Really, it is just the first file to sort
+	// against. We also effectively select the very first digest as the
+	// "canonical" one for this file.
+	first := bypath[paths[0]][0]
+
+	resource := resource{
+		paths:  paths,
+		mode:   first.Mode(),
+		uid:    first.UID(),
+		gid:    first.GID(),
+		xattrs: xattrs,
+	}
+
+	switch typedF := first.(type) {
+	case RegularFile:
+		var err error
+		digests, err = uniqifyDigests(digests...)
+		if err != nil {
+			return nil, err
+		}
+
+		return &regularFile{
+			resource: resource,
+			size:     typedF.Size(),
+			digests:  digests,
+		}, nil
+	case Device:
+		return &device{
+			resource: resource,
+			major:    typedF.Major(),
+			minor:    typedF.Minor(),
+		}, nil
+
+	case NamedPipe:
+		return &namedPipe{
+			resource: resource,
+		}, nil
+
+	default:
+		return nil, errNotAHardLink
+	}
+}
+
+type Directory interface {
+	Resource
+	XAttrer
+
+	// Directory is a no-op method to identify directory objects by interface.
+	Directory()
+}
+
+type SymLink interface {
+	Resource
+
+	// Target returns the target of the symlink contained in the .
+	Target() string
+}
+
+type NamedPipe interface {
+	Resource
+	Hardlinkable
+	XAttrer
+
+	// Pipe is a no-op method to allow consistent resolution of NamedPipe
+	// interface.
+	Pipe()
+}
+
+type Device interface {
+	Resource
+	Hardlinkable
+	XAttrer
+
+	Major() uint64
+	Minor() uint64
+}
+
+type resource struct {
+	paths    []string
+	mode     os.FileMode
+	uid, gid int64
+	xattrs   map[string][]byte
+}
+
+var _ Resource = &resource{}
+
+func (r *resource) Path() string {
+	if len(r.paths) < 1 {
+		return ""
+	}
+
+	return r.paths[0]
+}
+
+func (r *resource) Mode() os.FileMode {
+	return r.mode
+}
+
+func (r *resource) UID() int64 {
+	return r.uid
+}
+
+func (r *resource) GID() int64 {
+	return r.gid
+}
+
+type regularFile struct {
+	resource
+	size    int64
+	digests []digest.Digest
+}
+
+var _ RegularFile = &regularFile{}
+
+// newRegularFile returns the RegularFile, using the populated base resource
+// and one or more digests of the content.
+func newRegularFile(base resource, paths []string, size int64, dgsts ...digest.Digest) (RegularFile, error) {
+	if !base.Mode().IsRegular() {
+		return nil, fmt.Errorf("not a regular file")
+	}
+
+	base.paths = make([]string, len(paths))
+	copy(base.paths, paths)
+
+	// make our own copy of digests
+	ds := make([]digest.Digest, len(dgsts))
+	copy(ds, dgsts)
+
+	return &regularFile{
+		resource: base,
+		size:     size,
+		digests:  ds,
+	}, nil
+}
+
+func (rf *regularFile) Paths() []string {
+	paths := make([]string, len(rf.paths))
+	copy(paths, rf.paths)
+	return paths
+}
+
+func (rf *regularFile) Size() int64 {
+	return rf.size
+}
+
+func (rf *regularFile) Digests() []digest.Digest {
+	digests := make([]digest.Digest, len(rf.digests))
+	copy(digests, rf.digests)
+	return digests
+}
+
+func (rf *regularFile) XAttrs() map[string][]byte {
+	xattrs := make(map[string][]byte, len(rf.xattrs))
+
+	for attr, value := range rf.xattrs {
+		xattrs[attr] = append(xattrs[attr], value...)
+	}
+
+	return xattrs
+}
+
+type directory struct {
+	resource
+}
+
+var _ Directory = &directory{}
+
+func newDirectory(base resource) (Directory, error) {
+	if !base.Mode().IsDir() {
+		return nil, fmt.Errorf("not a directory")
+	}
+
+	return &directory{
+		resource: base,
+	}, nil
+}
+
+func (d *directory) Directory() {}
+
+func (d *directory) XAttrs() map[string][]byte {
+	xattrs := make(map[string][]byte, len(d.xattrs))
+
+	for attr, value := range d.xattrs {
+		xattrs[attr] = append(xattrs[attr], value...)
+	}
+
+	return xattrs
+}
+
+type symLink struct {
+	resource
+	target string
+}
+
+var _ SymLink = &symLink{}
+
+func newSymLink(base resource, target string) (SymLink, error) {
+	if base.Mode()&os.ModeSymlink == 0 {
+		return nil, fmt.Errorf("not a symlink")
+	}
+
+	return &symLink{
+		resource: base,
+		target:   target,
+	}, nil
+}
+
+func (l *symLink) Target() string {
+	return l.target
+}
+
+type namedPipe struct {
+	resource
+}
+
+var _ NamedPipe = &namedPipe{}
+
+func newNamedPipe(base resource, paths []string) (NamedPipe, error) {
+	if base.Mode()&os.ModeNamedPipe == 0 {
+		return nil, fmt.Errorf("not a namedpipe")
+	}
+
+	base.paths = make([]string, len(paths))
+	copy(base.paths, paths)
+
+	return &namedPipe{
+		resource: base,
+	}, nil
+}
+
+func (np *namedPipe) Pipe() {}
+
+func (np *namedPipe) Paths() []string {
+	paths := make([]string, len(np.paths))
+	copy(paths, np.paths)
+	return paths
+}
+
+func (np *namedPipe) XAttrs() map[string][]byte {
+	xattrs := make(map[string][]byte, len(np.xattrs))
+
+	for attr, value := range np.xattrs {
+		xattrs[attr] = append(xattrs[attr], value...)
+	}
+
+	return xattrs
+}
+
+type device struct {
+	resource
+	major, minor uint64
+}
+
+var _ Device = &device{}
+
+func newDevice(base resource, paths []string, major, minor uint64) (Device, error) {
+	if base.Mode()&os.ModeDevice == 0 {
+		return nil, fmt.Errorf("not a device")
+	}
+
+	base.paths = make([]string, len(paths))
+	copy(base.paths, paths)
+
+	return &device{
+		resource: base,
+		major:    major,
+		minor:    minor,
+	}, nil
+}
+
+func (d *device) Paths() []string {
+	paths := make([]string, len(d.paths))
+	copy(paths, d.paths)
+	return paths
+}
+
+func (d *device) XAttrs() map[string][]byte {
+	xattrs := make(map[string][]byte, len(d.xattrs))
+
+	for attr, value := range d.xattrs {
+		xattrs[attr] = append(xattrs[attr], value...)
+	}
+
+	return xattrs
+}
+
+func (d device) Major() uint64 {
+	return d.major
+}
+
+func (d device) Minor() uint64 {
+	return d.minor
+}
+
+// toProto converts a resource to a protobuf record. We'd like to push this
+// the individual types but we want to keep this all together during
+// prototyping.
+func toProto(resource Resource) *pb.Resource {
+	b := &pb.Resource{
+		Path: []string{resource.Path()},
+		Mode: uint32(resource.Mode()),
+		Uid:  resource.UID(),
+		Gid:  resource.GID(),
+	}
+
+	if xattrer, ok := resource.(XAttrer); ok {
+		// Sorts the XAttrs by name for consistent ordering.
+		keys := []string{}
+		xattrs := xattrer.XAttrs()
+		for k := range xattrs {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+
+		for _, k := range keys {
+			b.Xattr = append(b.Xattr, &pb.XAttr{Name: k, Data: xattrs[k]})
+		}
+	}
+
+	switch r := resource.(type) {
+	case RegularFile:
+		b.Path = r.Paths()
+		b.Size = uint64(r.Size())
+
+		for _, dgst := range r.Digests() {
+			b.Digest = append(b.Digest, dgst.String())
+		}
+	case SymLink:
+		b.Target = r.Target()
+	case Device:
+		b.Major, b.Minor = r.Major(), r.Minor()
+		b.Path = r.Paths()
+	case NamedPipe:
+		b.Path = r.Paths()
+	}
+
+	// enforce a few stability guarantees that may not be provided by the
+	// resource implementation.
+	sort.Strings(b.Path)
+
+	return b
+}
+
+// fromProto converts from a protobuf Resource to a Resource interface.
+func fromProto(b *pb.Resource) (Resource, error) {
+	base := &resource{
+		paths: b.Path,
+		mode:  os.FileMode(b.Mode),
+		uid:   b.Uid,
+		gid:   b.Gid,
+	}
+
+	base.xattrs = make(map[string][]byte, len(b.Xattr))
+
+	for _, attr := range b.Xattr {
+		base.xattrs[attr.Name] = attr.Data
+	}
+
+	switch {
+	case base.Mode().IsRegular():
+		dgsts := make([]digest.Digest, len(b.Digest))
+		for i, dgst := range b.Digest {
+			// TODO(stevvooe): Should we be validating at this point?
+			dgsts[i] = digest.Digest(dgst)
+		}
+
+		return newRegularFile(*base, b.Path, int64(b.Size), dgsts...)
+	case base.Mode().IsDir():
+		return newDirectory(*base)
+	case base.Mode()&os.ModeSymlink != 0:
+		return newSymLink(*base, b.Target)
+	case base.Mode()&os.ModeNamedPipe != 0:
+		return newNamedPipe(*base, b.Path)
+	case base.Mode()&os.ModeDevice != 0:
+		return newDevice(*base, b.Path, b.Major, b.Minor)
+	}
+
+	return nil, fmt.Errorf("unknown resource record (%#v): %s", b, base.Mode())
+}
+
+// NOTE(stevvooe): An alternative model that supports inline declaration.
+// Convenient for unit testing where inline declarations may be desirable but
+// creates an awkward API for the standard use case.
+
+// type ResourceKind int
+
+// const (
+// 	ResourceRegularFile = iota + 1
+// 	ResourceDirectory
+// 	ResourceSymLink
+// 	Resource
+// )
+
+// type Resource struct {
+// 	Kind         ResourceKind
+// 	Paths        []string
+// 	Mode         os.FileMode
+// 	UID          string
+// 	GID          string
+// 	Size         int64
+// 	Digests      []digest.Digest
+// 	Target       string
+// 	Major, Minor int
+// 	XAttrs       map[string][]byte
+// }
+
+// type RegularFile struct {
+// 	Paths   []string
+//  Size 	int64
+// 	Digests []digest.Digest
+// 	Perm    os.FileMode // os.ModePerm + sticky, setuid, setgid
+// }

vendor/github.com/containerd/continuity/resource_test.go

@@ -0,0 +1,156 @@
+package continuity
+
+type resourceUpdate struct {
+	Original Resource
+	Updated  Resource
+}
+
+type resourceListDifference struct {
+	Additions []Resource
+	Deletions []Resource
+	Updates   []resourceUpdate
+}
+
+func (l resourceListDifference) HasDiff() bool {
+	return len(l.Additions) > 0 || len(l.Deletions) > 0 || len(l.Updates) > 0
+}
+
+// diffManifest compares two resource lists and returns the list
+// of adds updates and deletes, resource lists are not reordered
+// before doing difference.
+func diffResourceList(r1, r2 []Resource) resourceListDifference {
+	i1 := 0
+	i2 := 0
+	var d resourceListDifference
+
+	for i1 < len(r1) && i2 < len(r2) {
+		p1 := r1[i1].Path()
+		p2 := r2[i2].Path()
+		switch {
+		case p1 < p2:
+			d.Deletions = append(d.Deletions, r1[i1])
+			i1++
+		case p1 == p2:
+			if !compareResource(r1[i1], r2[i2]) {
+				d.Updates = append(d.Updates, resourceUpdate{
+					Original: r1[i1],
+					Updated:  r2[i2],
+				})
+			}
+			i1++
+			i2++
+		case p1 > p2:
+			d.Additions = append(d.Additions, r2[i2])
+			i2++
+		}
+	}
+
+	for i1 < len(r1) {
+		d.Deletions = append(d.Deletions, r1[i1])
+		i1++
+
+	}
+	for i2 < len(r2) {
+		d.Additions = append(d.Additions, r2[i2])
+		i2++
+	}
+
+	return d
+}
+
+func compareResource(r1, r2 Resource) bool {
+	if r1.Path() != r2.Path() {
+		return false
+	}
+	if r1.Mode() != r2.Mode() {
+		return false
+	}
+	if r1.UID() != r2.UID() {
+		return false
+	}
+	if r1.GID() != r2.GID() {
+		return false
+	}
+
+	// TODO(dmcgowan): Check if is XAttrer
+
+	switch t1 := r1.(type) {
+	case RegularFile:
+		t2, ok := r2.(RegularFile)
+		if !ok {
+			return false
+		}
+		return compareRegularFile(t1, t2)
+	case Directory:
+		t2, ok := r2.(Directory)
+		if !ok {
+			return false
+		}
+		return compareDirectory(t1, t2)
+	case SymLink:
+		t2, ok := r2.(SymLink)
+		if !ok {
+			return false
+		}
+		return compareSymLink(t1, t2)
+	case NamedPipe:
+		t2, ok := r2.(NamedPipe)
+		if !ok {
+			return false
+		}
+		return compareNamedPipe(t1, t2)
+	case Device:
+		t2, ok := r2.(Device)
+		if !ok {
+			return false
+		}
+		return compareDevice(t1, t2)
+	default:
+		// TODO(dmcgowan): Should this panic?
+		return r1 == r2
+	}
+}
+
+func compareRegularFile(r1, r2 RegularFile) bool {
+	if r1.Size() != r2.Size() {
+		return false
+	}
+	p1 := r1.Paths()
+	p2 := r2.Paths()
+	if len(p1) != len(p2) {
+		return false
+	}
+	for i := range p1 {
+		if p1[i] != p2[i] {
+			return false
+		}
+	}
+	d1 := r1.Digests()
+	d2 := r2.Digests()
+	if len(d1) != len(d2) {
+		return false
+	}
+	for i := range d1 {
+		if d1[i] != d2[i] {
+			return false
+		}
+	}
+
+	return true
+}
+
+func compareSymLink(r1, r2 SymLink) bool {
+	return r1.Target() == r2.Target()
+}
+
+func compareDirectory(r1, r2 Directory) bool {
+	return true
+}
+
+func compareNamedPipe(r1, r2 NamedPipe) bool {
+	return true
+}
+
+func compareDevice(r1, r2 Device) bool {
+	return r1.Major() == r2.Major() && r1.Minor() == r2.Minor()
+}

vendor/github.com/containerd/continuity/resource_unix.go

@@ -0,0 +1,37 @@
+// +build linux darwin freebsd solaris
+
+package continuity
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+)
+
+// newBaseResource returns a *resource, populated with data from p and fi,
+// where p will be populated directly.
+func newBaseResource(p string, fi os.FileInfo) (*resource, error) {
+	// TODO(stevvooe): This need to be resolved for the container's root,
+	// where here we are really getting the host OS's value. We need to allow
+	// this be passed in and fixed up to make these uid/gid mappings portable.
+	// Either this can be part of the driver or we can achieve it through some
+	// other mechanism.
+	sys, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		// TODO(stevvooe): This may not be a hard error for all platforms. We
+		// may want to move this to the driver.
+		return nil, fmt.Errorf("unable to resolve syscall.Stat_t from (os.FileInfo).Sys(): %#v", fi)
+	}
+
+	return &resource{
+		paths: []string{p},
+		mode:  fi.Mode(),
+
+		uid: int64(sys.Uid),
+		gid: int64(sys.Gid),
+
+		// NOTE(stevvooe): Population of shared xattrs field is deferred to
+		// the resource types that populate it. Since they are a property of
+		// the context, they must set there.
+	}, nil
+}

vendor/github.com/containerd/continuity/resource_windows.go

@@ -0,0 +1,12 @@
+package continuity
+
+import "os"
+
+// newBaseResource returns a *resource, populated with data from p and fi,
+// where p will be populated directly.
+func newBaseResource(p string, fi os.FileInfo) (*resource, error) {
+	return &resource{
+		paths: []string{p},
+		mode:  fi.Mode(),
+	}, nil
+}

vendor/github.com/containerd/continuity/sysx/asm.s

@@ -0,0 +1,10 @@
+// Copyright 2014 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !gccgo
+
+#include "textflag.h"
+
+TEXT ·use(SB),NOSPLIT,$0
+	RET

vendor/github.com/containerd/continuity/sysx/chmod_darwin.go

@@ -0,0 +1,18 @@
+package sysx
+
+const (
+	// AtSymlinkNoFollow defined from AT_SYMLINK_NOFOLLOW in <sys/fcntl.h>
+	AtSymlinkNofollow = 0x20
+)
+
+const (
+
+	// SYS_FCHMODAT defined from golang.org/sys/unix
+	SYS_FCHMODAT = 467
+)
+
+// These functions will be generated by generate.sh
+//    $ GOOS=darwin GOARCH=386 ./generate.sh chmod
+//    $ GOOS=darwin GOARCH=amd64 ./generate.sh chmod
+
+//sys  Fchmodat(dirfd int, path string, mode uint32, flags int) (err error)

vendor/github.com/containerd/continuity/sysx/chmod_darwin_386.go

@@ -0,0 +1,25 @@
+// mksyscall.pl -l32 chmod_darwin.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	use(unsafe.Pointer(_p0))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/chmod_darwin_amd64.go

@@ -0,0 +1,25 @@
+// mksyscall.pl chmod_darwin.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	use(unsafe.Pointer(_p0))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/chmod_freebsd.go

@@ -0,0 +1,17 @@
+package sysx
+
+const (
+	// AtSymlinkNoFollow defined from AT_SYMLINK_NOFOLLOW in <sys/fcntl.h>
+	AtSymlinkNofollow = 0x200
+)
+
+const (
+
+	// SYS_FCHMODAT defined from golang.org/sys/unix
+	SYS_FCHMODAT = 490
+)
+
+// These functions will be generated by generate.sh
+//    $ GOOS=freebsd GOARCH=amd64 ./generate.sh chmod
+
+//sys  Fchmodat(dirfd int, path string, mode uint32, flags int) (err error)

vendor/github.com/containerd/continuity/sysx/chmod_freebsd_amd64.go

@@ -0,0 +1,25 @@
+// mksyscall.pl chmod_freebsd.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	use(unsafe.Pointer(_p0))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/chmod_linux.go

@@ -0,0 +1,12 @@
+package sysx
+
+import "syscall"
+
+const (
+	// AtSymlinkNoFollow defined from AT_SYMLINK_NOFOLLOW in /usr/include/linux/fcntl.h
+	AtSymlinkNofollow = 0x100
+)
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) error {
+	return syscall.Fchmodat(dirfd, path, mode, flags)
+}

vendor/github.com/containerd/continuity/sysx/chmod_solaris.go

@@ -0,0 +1,11 @@
+package sysx
+
+import "golang.org/x/sys/unix"
+
+const (
+	AtSymlinkNofollow = unix.AT_SYMLINK_NOFOLLOW
+)
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) error {
+	return unix.Fchmodat(dirfd, path, mode, flags)
+}

vendor/github.com/containerd/continuity/sysx/generate.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -e
+
+mksyscall="$(go env GOROOT)/src/syscall/mksyscall.pl"
+
+fix() {
+	sed 's,^package syscall$,package sysx,' \
+		| sed 's,^import "unsafe"$,import (\n\t"syscall"\n\t"unsafe"\n),' \
+		| gofmt -r='BytePtrFromString -> syscall.BytePtrFromString' \
+		| gofmt -r='Syscall6 -> syscall.Syscall6' \
+		| gofmt -r='Syscall -> syscall.Syscall' \
+		| gofmt -r='SYS_GETXATTR -> syscall.SYS_GETXATTR' \
+		| gofmt -r='SYS_LISTXATTR -> syscall.SYS_LISTXATTR' \
+		| gofmt -r='SYS_SETXATTR -> syscall.SYS_SETXATTR' \
+		| gofmt -r='SYS_REMOVEXATTR -> syscall.SYS_REMOVEXATTR' \
+		| gofmt -r='SYS_LGETXATTR -> syscall.SYS_LGETXATTR' \
+		| gofmt -r='SYS_LLISTXATTR -> syscall.SYS_LLISTXATTR' \
+		| gofmt -r='SYS_LSETXATTR -> syscall.SYS_LSETXATTR' \
+		| gofmt -r='SYS_LREMOVEXATTR -> syscall.SYS_LREMOVEXATTR'
+}
+
+if [ "$GOARCH" == "" ] || [ "$GOOS" == "" ]; then
+	echo "Must specify \$GOARCH and \$GOOS"
+	exit 1
+fi
+
+mkargs=""
+
+if [ "$GOARCH" == "386" ] || [ "$GOARCH" == "arm" ]; then
+	mkargs="-l32"
+fi
+
+for f in "$@"; do
+	$mksyscall $mkargs "${f}_${GOOS}.go" | fix > "${f}_${GOOS}_${GOARCH}.go"
+done
+

vendor/github.com/containerd/continuity/sysx/nodata_linux.go

@@ -0,0 +1,7 @@
+package sysx
+
+import (
+	"syscall"
+)
+
+const ENODATA = syscall.ENODATA

vendor/github.com/containerd/continuity/sysx/nodata_solaris.go

@@ -0,0 +1,8 @@
+package sysx
+
+import (
+	"syscall"
+)
+
+// This should actually be a set that contains ENOENT and EPERM
+const ENODATA = syscall.ENOENT

vendor/github.com/containerd/continuity/sysx/nodata_unix.go

@@ -0,0 +1,9 @@
+// +build darwin freebsd
+
+package sysx
+
+import (
+	"syscall"
+)
+
+const ENODATA = syscall.ENOATTR

vendor/github.com/containerd/continuity/sysx/sys.go

@@ -0,0 +1,37 @@
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var _zero uintptr
+
+// use is a no-op, but the compiler cannot see that it is.
+// Calling use(p) ensures that p is kept live until that point.
+//go:noescape
+func use(p unsafe.Pointer)
+
+// Do the interface allocations only once for common
+// Errno values.
+var (
+	errEAGAIN error = syscall.EAGAIN
+	errEINVAL error = syscall.EINVAL
+	errENOENT error = syscall.ENOENT
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case syscall.EAGAIN:
+		return errEAGAIN
+	case syscall.EINVAL:
+		return errEINVAL
+	case syscall.ENOENT:
+		return errENOENT
+	}
+	return e
+}

vendor/github.com/containerd/continuity/sysx/xattr.go

@@ -0,0 +1,67 @@
+package sysx
+
+import (
+	"bytes"
+	"fmt"
+	"syscall"
+)
+
+const defaultXattrBufferSize = 5
+
+var ErrNotSupported = fmt.Errorf("not supported")
+
+type listxattrFunc func(path string, dest []byte) (int, error)
+
+func listxattrAll(path string, listFunc listxattrFunc) ([]string, error) {
+	var p []byte // nil on first execution
+
+	for {
+		n, err := listFunc(path, p) // first call gets buffer size.
+		if err != nil {
+			return nil, err
+		}
+
+		if n > len(p) {
+			p = make([]byte, n)
+			continue
+		}
+
+		p = p[:n]
+
+		ps := bytes.Split(bytes.TrimSuffix(p, []byte{0}), []byte{0})
+		var entries []string
+		for _, p := range ps {
+			s := string(p)
+			if s != "" {
+				entries = append(entries, s)
+			}
+		}
+
+		return entries, nil
+	}
+}
+
+type getxattrFunc func(string, string, []byte) (int, error)
+
+func getxattrAll(path, attr string, getFunc getxattrFunc) ([]byte, error) {
+	p := make([]byte, defaultXattrBufferSize)
+	for {
+		n, err := getFunc(path, attr, p)
+		if err != nil {
+			if errno, ok := err.(syscall.Errno); ok && errno == syscall.ERANGE {
+				p = make([]byte, len(p)*2) // this can't be ideal.
+				continue                   // try again!
+			}
+
+			return nil, err
+		}
+
+		// realloc to correct size and repeat
+		if n > len(p) {
+			p = make([]byte, n)
+			continue
+		}
+
+		return p[:n], nil
+	}
+}

vendor/github.com/containerd/continuity/sysx/xattr_darwin.go

@@ -0,0 +1,71 @@
+package sysx
+
+// These functions will be generated by generate.sh
+//    $ GOOS=darwin GOARCH=386 ./generate.sh xattr
+//    $ GOOS=darwin GOARCH=amd64 ./generate.sh xattr
+
+//sys  getxattr(path string, attr string, dest []byte, pos int, options int) (sz int, err error)
+//sys  setxattr(path string, attr string, data []byte, flags int) (err error)
+//sys  removexattr(path string, attr string, options int) (err error)
+//sys  listxattr(path string, dest []byte, options int) (sz int, err error)
+//sys  Fchmodat(dirfd int, path string, mode uint32, flags int) (err error)
+
+const (
+	xattrNoFollow = 0x01
+)
+
+func listxattrFollow(path string, dest []byte) (sz int, err error) {
+	return listxattr(path, dest, 0)
+}
+
+// Listxattr calls syscall getxattr
+func Listxattr(path string) ([]string, error) {
+	return listxattrAll(path, listxattrFollow)
+}
+
+// Removexattr calls syscall getxattr
+func Removexattr(path string, attr string) (err error) {
+	return removexattr(path, attr, 0)
+}
+
+// Setxattr calls syscall setxattr
+func Setxattr(path string, attr string, data []byte, flags int) (err error) {
+	return setxattr(path, attr, data, flags)
+}
+
+func getxattrFollow(path, attr string, dest []byte) (sz int, err error) {
+	return getxattr(path, attr, dest, 0, 0)
+}
+
+// Getxattr calls syscall getxattr
+func Getxattr(path, attr string) ([]byte, error) {
+	return getxattrAll(path, attr, getxattrFollow)
+}
+
+func listxattrNoFollow(path string, dest []byte) (sz int, err error) {
+	return listxattr(path, dest, xattrNoFollow)
+}
+
+// LListxattr calls syscall listxattr with XATTR_NOFOLLOW
+func LListxattr(path string) ([]string, error) {
+	return listxattrAll(path, listxattrNoFollow)
+}
+
+// LRemovexattr calls syscall removexattr with XATTR_NOFOLLOW
+func LRemovexattr(path string, attr string) (err error) {
+	return removexattr(path, attr, xattrNoFollow)
+}
+
+// Setxattr calls syscall setxattr with XATTR_NOFOLLOW
+func LSetxattr(path string, attr string, data []byte, flags int) (err error) {
+	return setxattr(path, attr, data, flags|xattrNoFollow)
+}
+
+func getxattrNoFollow(path, attr string, dest []byte) (sz int, err error) {
+	return getxattr(path, attr, dest, 0, xattrNoFollow)
+}
+
+// LGetxattr calls syscall getxattr with XATTR_NOFOLLOW
+func LGetxattr(path, attr string) ([]byte, error) {
+	return getxattrAll(path, attr, getxattrNoFollow)
+}

vendor/github.com/containerd/continuity/sysx/xattr_darwin_386.go

@@ -0,0 +1,111 @@
+// mksyscall.pl -l32 xattr_darwin.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getxattr(path string, attr string, dest []byte, pos int, options int) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_GETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), uintptr(pos), uintptr(options))
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_SETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func removexattr(path string, attr string, options int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_REMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(options))
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func listxattr(path string, dest []byte, options int) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)), uintptr(options), 0, 0)
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/xattr_darwin_amd64.go

@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_darwin.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getxattr(path string, attr string, dest []byte, pos int, options int) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_GETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), uintptr(pos), uintptr(options))
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_SETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func removexattr(path string, attr string, options int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_REMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(options))
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func listxattr(path string, dest []byte, options int) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)), uintptr(options), 0, 0)
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/xattr_freebsd.go

@@ -0,0 +1,12 @@
+package sysx
+
+import (
+	"errors"
+)
+
+// Initial stub version for FreeBSD. FreeBSD has a different
+// syscall API from Darwin and Linux for extended attributes;
+// it is also not widely used. It is not exposed at all by the
+// Go syscall package, so we need to implement directly eventually.
+
+var unsupported = errors.New("extended attributes unsupported on FreeBSD")

vendor/github.com/containerd/continuity/sysx/xattr_linux.go

@@ -0,0 +1,61 @@
+package sysx
+
+import "syscall"
+
+// These functions will be generated by generate.sh
+//    $ GOOS=linux GOARCH=386 ./generate.sh xattr
+//    $ GOOS=linux GOARCH=amd64 ./generate.sh xattr
+//    $ GOOS=linux GOARCH=arm ./generate.sh xattr
+//    $ GOOS=linux GOARCH=arm64 ./generate.sh xattr
+//    $ GOOS=linux GOARCH=ppc64 ./generate.sh xattr
+//    $ GOOS=linux GOARCH=ppc64le ./generate.sh xattr
+//    $ GOOS=linux GOARCH=s390x ./generate.sh xattr
+
+// Listxattr calls syscall listxattr and reads all content
+// and returns a string array
+func Listxattr(path string) ([]string, error) {
+	return listxattrAll(path, syscall.Listxattr)
+}
+
+// Removexattr calls syscall removexattr
+func Removexattr(path string, attr string) (err error) {
+	return syscall.Removexattr(path, attr)
+}
+
+// Setxattr calls syscall setxattr
+func Setxattr(path string, attr string, data []byte, flags int) (err error) {
+	return syscall.Setxattr(path, attr, data, flags)
+}
+
+// Getxattr calls syscall getxattr
+func Getxattr(path, attr string) ([]byte, error) {
+	return getxattrAll(path, attr, syscall.Getxattr)
+}
+
+//sys llistxattr(path string, dest []byte) (sz int, err error)
+
+// LListxattr lists xattrs, not following symlinks
+func LListxattr(path string) ([]string, error) {
+	return listxattrAll(path, llistxattr)
+}
+
+//sys lremovexattr(path string, attr string) (err error)
+
+// LRemovexattr removes an xattr, not following symlinks
+func LRemovexattr(path string, attr string) (err error) {
+	return lremovexattr(path, attr)
+}
+
+//sys lsetxattr(path string, attr string, data []byte, flags int) (err error)
+
+// LSetxattr sets an xattr, not following symlinks
+func LSetxattr(path string, attr string, data []byte, flags int) (err error) {
+	return lsetxattr(path, attr, data, flags)
+}
+
+//sys lgetxattr(path string, attr string, dest []byte) (sz int, err error)
+
+// LGetxattr gets an xattr, not following symlinks
+func LGetxattr(path, attr string) ([]byte, error) {
+	return getxattrAll(path, attr, lgetxattr)
+}

vendor/github.com/containerd/continuity/sysx/xattr_linux_386.go

@@ -0,0 +1,111 @@
+// mksyscall.pl -l32 xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/xattr_linux_amd64.go

@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/xattr_linux_arm.go

@@ -0,0 +1,111 @@
+// mksyscall.pl -l32 xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/xattr_linux_arm64.go

@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/xattr_linux_ppc64.go

@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/xattr_linux_ppc64le.go

@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}

vendor/github.com/containerd/continuity/sysx/xattr_linux_s390x.go

@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}