Merge branch 'master' into patch-1

Author: cdjohnson

README.md

@@ -23,8 +23,9 @@ And libraries:
  * `pkg/lib` - providing external interfaces for interacting with this project as an api that defines a set of standards for operator bundles and indexes.
  * `pkg/containertools` - providing an interface to interact with and shell out to common container tooling binaries (if installed on the environment)
 
-# Manifest format
+**NOTE:** The purpose of `opm` tool is to help who needs to manage index catalogues for OLM instances. However, if you are looking for a tool to help you to integrate your operator project with OLM then you should use [Operator-SDK](https://github.com/operator-framework/operator-sdk).
 
+# Manifest format
 
 We refer to a directory of files with one ClusterServiceVersion as a "bundle". A bundle typically includes a ClusterServiceVersion and the CRDs that define the owned APIs of the CSV in its manifest directory, though additional objects may be included. It also includes an annotations file in its metadata folder which defines some higher level aggregate data that helps to describe the format and package information about how the bundle should be added into an index of bundles.
 
@@ -46,7 +47,7 @@ When loading manifests into the database, the following invariants are validated
 
 Bundle directories are identified solely by the fact that they contain a ClusterServiceVersion, which provides an amount of freedom for layout of manifests.
 
-Check out the [operator bundle design](docs/design/operator-bundle.md) for more detail on the bundle format.
+Check out the [operator bundle design](docs/design/operator-bundle.md) for more detail on the bundle format. 
 
 # Bundle images
 
@@ -65,6 +66,8 @@ podman push quay.io/my-container-registry-namespace/my-manifest-bundle:latest
 
 Of course, this build step can be done with any other OCI spec container tools like `docker`, `buildah`, `libpod`, etc.
 
+Note that you do not need to create your bundle manually. [Operator-SDK](https://github.com/operator-framework/operator-sdk) provide features and helpers to build, to update, to validate and to test bundles for projects which follows the SDK layout or not. For more information check its documentations over [Integration with OLM](https://sdk.operatorframework.io/docs/olm-integration)
+
 # Building an index of Operators using `opm`
 
 Now that you have published the container image containing your manifests, how do you actually make that bundle available to other users' Kubernetes clusters so that the Operator Lifecycle Manager can install the operator? This is where the meat of the `operator-registry` project comes in. OLM has the concept of [CatalogSources](https://operator-framework.github.io/olm-book/docs/glossary.html#catalogsources) which define a reference to what packages are available to install onto a cluster. To make your bundle available, you can add the bundle to a container image which the CatalogSource points to. This image contains a database of pointers to bundle images that OLM can pull and extract the manifests from in order to install an operator. So, to make your operator available to OLM, you can generate an index image via opm with your bundle reference included:
@@ -146,7 +149,13 @@ spec:
 
 # Using the catalog locally
 
-[grpcurl](https://github.com/fullstorydev/grpcurl) is a useful tool for interacting with the example catalog server.
+After starting a catalog locally:
+
+```sh
+$ docker run --rm -p 50051:50051 <index image>
+```
+
+[grpcurl](https://github.com/fullstorydev/grpcurl) is a useful tool for interacting with the api:
 
 ```sh
 $ grpcurl -plaintext  localhost:50051 list api.Registry

cmd/opm/alpha/bundle/cmd.go

@@ -15,5 +15,7 @@ func NewCmd() *cobra.Command {
 	runCmd.AddCommand(newBundleBuildCmd())
 	runCmd.AddCommand(newBundleValidateCmd())
 	runCmd.AddCommand(extractCmd)
+	runCmd.AddCommand(newBundleUnpackCmd())
+
 	return runCmd
 }

cmd/opm/alpha/bundle/unpack.go

@@ -0,0 +1,161 @@
+package bundle
+
+import (
+	"context"
+	"crypto/x509"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	dircopy "github.com/otiai10/copy"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"github.com/operator-framework/operator-registry/pkg/image"
+	"github.com/operator-framework/operator-registry/pkg/image/containerdregistry"
+	"github.com/operator-framework/operator-registry/pkg/lib/bundle"
+)
+
+func newBundleUnpackCmd() *cobra.Command {
+	unpack := &cobra.Command{
+		Use:   "unpack BUNDLE_NAME[:TAG|@DIGEST]",
+		Short: "Unpacks the content of an operator bundle",
+		Long:  "Unpacks the content of an operator bundle into a directory",
+		Args: func(cmd *cobra.Command, args []string) error {
+			return cobra.ExactArgs(1)(cmd, args)
+		},
+		RunE: unpackBundle,
+	}
+	unpack.Flags().BoolP("debug", "d", false, "enable debug log output")
+	unpack.Flags().BoolP("skip-tls", "s", false, "disable TLS verification")
+	unpack.Flags().BoolP("skip-validation", "v", false, "disable bundle validation")
+	unpack.Flags().StringP("root-ca", "c", "", "file path of a root CA to use when communicating with image registries")
+	unpack.Flags().StringP("out", "o", "./", "directory in which to unpack operator bundle content")
+
+	return unpack
+}
+
+func unpackBundle(cmd *cobra.Command, args []string) error {
+	debug, err := cmd.Flags().GetBool("debug")
+	if err != nil {
+		return err
+	}
+
+	logger := logrus.WithField("cmd", "unpack")
+	if debug {
+		logger.Logger.SetLevel(logrus.DebugLevel)
+	}
+
+	var out string
+	out, err = cmd.Flags().GetString("out")
+	if err != nil {
+		return err
+	}
+
+	if info, err := os.Stat(out); err != nil {
+		if os.IsNotExist(err) {
+			err = os.MkdirAll(out, 0755)
+		}
+		if err != nil {
+			return err
+		}
+	} else {
+		if info == nil {
+			return fmt.Errorf("failed to get output directory info")
+		}
+		if !info.IsDir() {
+			return fmt.Errorf("out %s is not a directory", out)
+		}
+	}
+
+	var (
+		registryOpts []containerdregistry.RegistryOption
+		skipTLS      bool
+	)
+	skipTLS, err = cmd.Flags().GetBool("skip-tls")
+	if err != nil {
+		return err
+	}
+	registryOpts = append(registryOpts, containerdregistry.SkipTLS(skipTLS))
+
+	var skipValidation bool
+	skipValidation, err = cmd.Flags().GetBool("skip-validation")
+	if err != nil {
+		return err
+	}
+
+	var rootCA string
+	rootCA, err = cmd.Flags().GetString("root-ca")
+	if err != nil {
+		return err
+	}
+	if rootCA != "" {
+		rootCAs := x509.NewCertPool()
+		certs, err := ioutil.ReadFile(rootCA)
+		if err != nil {
+			return err
+		}
+
+		if !rootCAs.AppendCertsFromPEM(certs) {
+			return fmt.Errorf("failed to fetch root CA from %s", rootCA)
+		}
+
+		registryOpts = append(registryOpts, containerdregistry.WithRootCAs(rootCAs))
+	}
+
+	registry, err := containerdregistry.NewRegistry(registryOpts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := registry.Destroy(); err != nil {
+			logger.Error(err)
+		}
+	}()
+
+	var (
+		ref = image.SimpleReference(args[0])
+		ctx = context.Background()
+	)
+	if err := registry.Pull(ctx, ref); err != nil {
+		return err
+	}
+
+	dir, err := ioutil.TempDir("", "bundle-")
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		err := os.RemoveAll(dir)
+		if err != nil {
+			logger.Error(err.Error())
+		}
+	}()
+	if err := registry.Unpack(ctx, ref, dir); err != nil {
+		return err
+	}
+
+	if err := registry.Destroy(); err != nil {
+		return err
+	}
+
+	if skipValidation {
+		logger.Info("skipping bundle validation")
+	} else {
+		validator := bundle.NewImageValidator(registry, logger)
+		if err := validator.ValidateBundleFormat(dir); err != nil {
+			return fmt.Errorf("bundle format validation failed: %s", err)
+		}
+		if err := validator.ValidateBundleContent(filepath.Join(dir, bundle.ManifestsDir)); err != nil {
+			return fmt.Errorf("bundle content validation failed: %s", err)
+		}
+	}
+
+	if err := dircopy.Copy(dir, out); err != nil {
+		return fmt.Errorf("failed to copy unpacked content to output directory: %s", err)
+	}
+
+	return nil
+}

cmd/opm/main.go

@@ -3,40 +3,15 @@ package main
 import (
 	"os"
 
-	"github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 
-	"github.com/operator-framework/operator-registry/cmd/opm/alpha"
-	"github.com/operator-framework/operator-registry/cmd/opm/index"
-	"github.com/operator-framework/operator-registry/cmd/opm/registry"
-	"github.com/operator-framework/operator-registry/cmd/opm/version"
+	"github.com/operator-framework/operator-registry/cmd/opm/root"
 	registrylib "github.com/operator-framework/operator-registry/pkg/registry"
 )
 
 func main() {
-	rootCmd := &cobra.Command{
-		Use:   "opm",
-		Short: "operator package manager",
-		Long:  "CLI to interact with operator-registry and build indexes of operator content",
-		PreRunE: func(cmd *cobra.Command, args []string) error {
-			if debug, _ := cmd.Flags().GetBool("debug"); debug {
-				logrus.SetLevel(logrus.DebugLevel)
-			}
-			return nil
-		},
-	}
-
-	rootCmd.AddCommand(registry.NewOpmRegistryCmd(), alpha.NewCmd())
-	index.AddCommand(rootCmd)
-	version.AddCommand(rootCmd)
-
-	rootCmd.Flags().Bool("debug", false, "enable debug logging")
-	if err := rootCmd.Flags().MarkHidden("debug"); err != nil {
-		logrus.Panic(err.Error())
-	}
-
-	if err := rootCmd.Execute(); err != nil {
+	cmd := root.NewCmd()
+	if err := cmd.Execute(); err != nil {
 		agg, ok := err.(utilerrors.Aggregate)
 		if !ok {
 			os.Exit(1)

cmd/opm/root/cmd.go

@@ -0,0 +1,36 @@
+package root
+
+import (
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"github.com/operator-framework/operator-registry/cmd/opm/alpha"
+	"github.com/operator-framework/operator-registry/cmd/opm/index"
+	"github.com/operator-framework/operator-registry/cmd/opm/registry"
+	"github.com/operator-framework/operator-registry/cmd/opm/version"
+)
+
+func NewCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "opm",
+		Short: "operator package manager",
+		Long:  "CLI to interact with operator-registry and build indexes of operator content",
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			if debug, _ := cmd.Flags().GetBool("debug"); debug {
+				logrus.SetLevel(logrus.DebugLevel)
+			}
+			return nil
+		},
+	}
+
+	cmd.AddCommand(registry.NewOpmRegistryCmd(), alpha.NewCmd())
+	index.AddCommand(cmd)
+	version.AddCommand(cmd)
+
+	cmd.Flags().Bool("debug", false, "enable debug logging")
+	if err := cmd.Flags().MarkHidden("debug"); err != nil {
+		logrus.Panic(err.Error())
+	}
+
+	return cmd
+}

go.mod

@@ -1,6 +1,6 @@
 module github.com/operator-framework/operator-registry
 
-go 1.13
+go 1.15
 
 require (
 	github.com/Microsoft/hcsshim v0.8.9 // indirect

pkg/image/containerdregistry/registry.go

@@ -42,7 +42,7 @@ func (r *Registry) Pull(ctx context.Context, ref image.Reference) error {
 	if err != nil {
 		return fmt.Errorf("error resolving name %s: %v", name, err)
 	}
-	r.log.Infof("resolved name: %s", name)
+	r.log.Debugf("resolved name: %s", name)
 
 	fetcher, err := r.resolver.Fetcher(ctx, name)
 	if err != nil {
@@ -82,7 +82,7 @@ func (r *Registry) Unpack(ctx context.Context, ref image.Reference, dir string)
 	}
 
 	for _, layer := range manifest.Layers {
-		r.log.Infof("unpacking layer: %v", layer)
+		r.log.Debugf("unpacking layer: %v", layer)
 		if err := r.unpackLayer(ctx, layer, dir); err != nil {
 			return err
 		}
@@ -153,7 +153,7 @@ func (r *Registry) getImage(ctx context.Context, manifest ocispec.Manifest) (*oc
 
 func (r *Registry) fetch(ctx context.Context, fetcher remotes.Fetcher, root ocispec.Descriptor) error {
 	visitor := images.HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
-		r.log.WithField("digest", desc.Digest).Info("fetched")
+		r.log.WithField("digest", desc.Digest).Debug("fetched")
 		r.log.Debug(desc)
 		return nil, nil
 	})

pkg/lib/bundle/validate.go

@@ -146,17 +146,17 @@ func (i imageValidator) ValidateBundleFormat(directory string) error {
 	if !annotationsFound {
 		validationErrors = append(validationErrors, fmt.Errorf("Could not find annotations file"))
 	} else {
-		i.logger.Info("Found annotations file")
+		i.logger.Debug("Found annotations file")
 		errs := validateAnnotations(mediaType, fileAnnotations)
 		if errs != nil {
 			validationErrors = append(validationErrors, errs...)
 		}
 	}
 
 	if !dependenciesFound {
-		i.logger.Info("Could not find optional dependencies file")
+		i.logger.Debug("Could not find optional dependencies file")
 	} else {
-		i.logger.Info("Found dependencies file")
+		i.logger.Debug("Found dependencies file")
 		errs := validateDependencies(dependenciesFile)
 		if errs != nil {
 			validationErrors = append(validationErrors, errs...)

pkg/lib/image/registry.go

@@ -13,7 +13,6 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
-	"k8s.io/apimachinery/pkg/util/wait"
 	"math/big"
 	"net"
 	"net/http"
@@ -25,6 +24,7 @@ import (
 	_ "github.com/docker/distribution/registry/storage/driver/filesystem" // Driver for persisting docker image data to the filesystem.
 	_ "github.com/docker/distribution/registry/storage/driver/inmemory"   // Driver for keeping docker image data in memory.
 	"github.com/phayes/freeport"
+	"k8s.io/apimachinery/pkg/util/wait"
 )
 
 // RunDockerRegistry runs a docker registry on an available port and returns its host string if successful, otherwise it returns an error.
@@ -67,7 +67,7 @@ func RunDockerRegistry(ctx context.Context, rootDir string) (string, string, err
 	config.HTTP.Addr = host
 	config.HTTP.TLS.Certificate = certfile.Name()
 	config.HTTP.TLS.Key = keyfile.Name()
-	config.Log.Level = "debug"
+	config.Log.Level = "error"
 
 	if rootDir != "" {
 		config.Storage = map[string]configuration.Parameters{"filesystem": map[string]interface{}{
@@ -100,7 +100,7 @@ func RunDockerRegistry(ctx context.Context, rootDir string) (string, string, err
 			RootCAs:            certPool,
 		}}
 		client := &http.Client{Transport: tr}
-		r, err := client.Get("https://"+host+"/v2/")
+		r, err := client.Get("https://" + host + "/v2/")
 		if err != nil {
 			return false, nil
 		}
@@ -128,7 +128,7 @@ func certToPem(der []byte) ([]byte, error) {
 func keyToPem(key *ecdsa.PrivateKey) ([]byte, error) {
 	b, err := x509.MarshalECPrivateKey(key)
 	if err != nil {
-		return nil, fmt.Errorf( "unable to marshal private key: %v", err)
+		return nil, fmt.Errorf("unable to marshal private key: %v", err)
 	}
 	out := &bytes.Buffer{}
 	if err := pem.Encode(out, &pem.Block{Type: "EC PRIVATE KEY", Bytes: b}); err != nil {
@@ -137,7 +137,7 @@ func keyToPem(key *ecdsa.PrivateKey) ([]byte, error) {
 	return out.Bytes(), nil
 }
 
-func GenerateCerts(caWriter, certWriter, keyWriter io.Writer, pool *x509.CertPool ) error {
+func GenerateCerts(caWriter, certWriter, keyWriter io.Writer, pool *x509.CertPool) error {
 	priv, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
 	if err != nil {
 		return err
@@ -153,7 +153,7 @@ func GenerateCerts(caWriter, certWriter, keyWriter io.Writer, pool *x509.CertPoo
 		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 		BasicConstraintsValid: true,
-		IsCA: true,
+		IsCA:                  true,
 	}
 	cert := x509.Certificate{
 		SerialNumber: big.NewInt(2),

test/e2e/e2e_suite_test.go

@@ -8,6 +8,9 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+	"github.com/spf13/cobra"
+
+	opmroot "github.com/operator-framework/operator-registry/cmd/opm/root"
 )
 
 // quay.io is the default registry used if no local registry endpoint is provided
@@ -18,6 +21,9 @@ var (
 	dockerUsername = os.Getenv("DOCKER_USERNAME")
 	dockerPassword = os.Getenv("DOCKER_PASSWORD")
 	dockerHost     = os.Getenv("DOCKER_REGISTRY_HOST") // 'DOCKER_HOST' is reserved for the docker daemon
+
+	// opm command under test.
+	opm *cobra.Command
 )
 
 func TestE2E(t *testing.T) {
@@ -26,6 +32,13 @@ func TestE2E(t *testing.T) {
 }
 
 var _ = BeforeSuite(func() {
+	// Configure test registry (hostnames, credentials, etc.)
+	configureRegistry()
+
+	opm = opmroot.NewCmd() // Creating multiple instances would cause flag registration conflicts
+})
+
+func configureRegistry() {
 	switch {
 	case dockerUsername == "" && dockerPassword == "" && dockerHost == "":
 		// No registry credentials or local registry host provided
@@ -46,4 +59,4 @@ var _ = BeforeSuite(func() {
 	Expect(err).ToNot(HaveOccurred(), "Error logging into %s: %s", dockerHost, out)
 
 	By(fmt.Sprintf("Using container image registry %s", dockerHost))
-})
+}

test/e2e/opm_bundle_test.go

@@ -0,0 +1,122 @@
+package e2e_test
+
+import (
+	"bytes"
+	"context"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	"golang.org/x/mod/sumdb/dirhash"
+
+	libimage "github.com/operator-framework/operator-registry/pkg/lib/image"
+)
+
+var _ = Describe("opm alpha bundle", func() {
+	// out captures opm command output
+	var out bytes.Buffer
+
+	BeforeEach(func() {
+		// Reset the command's output buffer
+		out = bytes.Buffer{}
+		opm.SetOut(&out)
+		opm.SetErr(&out)
+	})
+
+	Context("for an invalid bundle", func() {
+		var (
+			bundleRef      string
+			bundleChecksum string
+			tmpDir         string
+			rootCA         string
+			stopRegistry   func()
+		)
+
+		BeforeEach(func() {
+			ctx, cancel := context.WithCancel(context.Background())
+			stopRegistry = func() {
+				cancel()
+				<-ctx.Done()
+			}
+
+			// Spin up an in-process docker registry with a set of preconfigured test images
+			var (
+				// Directory containing the docker registry filesystem
+				goldenFiles = "../../pkg/image/testdata/golden"
+
+				host string
+				err  error
+			)
+			host, rootCA, err = libimage.RunDockerRegistry(ctx, goldenFiles)
+			Expect(err).ToNot(HaveOccurred())
+
+			// Create a bundle ref using the local registry host name and the namespace/name of a bundle we already know the content of
+			bundleRef = host + "/olmtest/kiali@sha256:a1bec450c104ceddbb25b252275eb59f1f1e6ca68e0ced76462042f72f7057d8"
+
+			// Generate a checksum of the expected content for the bundle under test
+			bundleChecksum, err = dirhash.HashDir(filepath.Join(goldenFiles, "bundles/kiali"), "", dirhash.DefaultHash)
+			Expect(err).ToNot(HaveOccurred())
+
+			// Set up a temporary directory that we can use for testing
+			tmpDir, err = ioutil.TempDir("", "opm-alpha-bundle-")
+			Expect(err).ToNot(HaveOccurred())
+		})
+
+		AfterEach(func() {
+			stopRegistry()
+			if CurrentGinkgoTestDescription().Failed {
+				// Skip additional cleanup
+				return
+			}
+
+			Expect(os.RemoveAll(tmpDir)).To(Succeed())
+		})
+
+		It("fails to unpack", func() {
+			unpackDir := filepath.Join(tmpDir, "unpacked")
+			opm.SetArgs([]string{
+				"alpha",
+				"bundle",
+				"unpack",
+				"--root-ca",
+				rootCA,
+				"--out",
+				unpackDir,
+				bundleRef,
+			})
+
+			Expect(opm.Execute()).ToNot(Succeed())
+			result, err := ioutil.ReadAll(&out)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(string(result)).To(ContainSubstring("bundle content validation failed"))
+		})
+
+		It("unpacks successfully", func() {
+			By("setting --skip-validation")
+
+			unpackDir := filepath.Join(tmpDir, "unpacked")
+			opm.SetArgs([]string{
+				"alpha",
+				"bundle",
+				"unpack",
+				"--root-ca",
+				rootCA,
+				"--out",
+				unpackDir,
+				bundleRef,
+				"--skip-validation",
+			})
+
+			Expect(opm.Execute()).To(Succeed())
+			result, err := ioutil.ReadAll(&out)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(result).ToNot(ContainSubstring("bundle content validation failed"))
+
+			checksum, err := dirhash.HashDir(unpackDir, "", dirhash.DefaultHash)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(checksum).To(Equal(bundleChecksum))
+		})
+	})
+})

vendor/modules.txt

@@ -8,6 +8,7 @@ github.com/Microsoft/go-winio
 github.com/Microsoft/go-winio/pkg/guid
 github.com/Microsoft/go-winio/vhd
 # github.com/Microsoft/hcsshim v0.8.9
+## explicit
 github.com/Microsoft/hcsshim
 github.com/Microsoft/hcsshim/internal/cow
 github.com/Microsoft/hcsshim/internal/hcs
@@ -33,30 +34,35 @@ github.com/PuerkitoBio/urlesc
 # github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d
 github.com/Shopify/logrus-bugsnag
 # github.com/antihax/optional v0.0.0-20180407024304-ca021399b1a6
+## explicit
 github.com/antihax/optional
 # github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a
 github.com/asaskevich/govalidator
 # github.com/beorn7/perks v1.0.1
 github.com/beorn7/perks/quantile
 # github.com/blang/semver v3.5.1+incompatible
+## explicit
 github.com/blang/semver
 # github.com/blang/semver/v4 v4.0.0
 github.com/blang/semver/v4
 # github.com/bshuster-repo/logrus-logstash-hook v0.4.1
 github.com/bshuster-repo/logrus-logstash-hook
 # github.com/bugsnag/bugsnag-go v1.5.3
+## explicit
 github.com/bugsnag/bugsnag-go
 github.com/bugsnag/bugsnag-go/device
 github.com/bugsnag/bugsnag-go/errors
 github.com/bugsnag/bugsnag-go/headers
 github.com/bugsnag/bugsnag-go/sessions
 # github.com/bugsnag/panicwrap v1.2.0
+## explicit
 github.com/bugsnag/panicwrap
 # github.com/cespare/xxhash/v2 v2.1.1
 github.com/cespare/xxhash/v2
 # github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f
 github.com/containerd/cgroups/stats/v1
 # github.com/containerd/containerd v1.3.2 => github.com/ecordell/containerd v1.3.1-0.20200629153125-0ff1a1be2fa5
+## explicit
 github.com/containerd/containerd/archive
 github.com/containerd/containerd/archive/compression
 github.com/containerd/containerd/containers
@@ -83,18 +89,22 @@ github.com/containerd/containerd/snapshots
 github.com/containerd/containerd/sys
 github.com/containerd/containerd/version
 # github.com/containerd/continuity v0.0.0-20200413184840-d3ef23f19fbb
+## explicit
 github.com/containerd/continuity/fs
 github.com/containerd/continuity/sysx
 # github.com/containerd/ttrpc v1.0.1
+## explicit
 github.com/containerd/ttrpc
 # github.com/davecgh/go-spew v1.1.1
 github.com/davecgh/go-spew/spew
 # github.com/docker/cli v0.0.0-20200130152716-5d0cf8839492
+## explicit
 github.com/docker/cli/cli/config
 github.com/docker/cli/cli/config/configfile
 github.com/docker/cli/cli/config/credentials
 github.com/docker/cli/cli/config/types
 # github.com/docker/distribution v2.7.1+incompatible => github.com/docker/distribution v0.0.0-20191216044856-a8371794149d
+## explicit
 github.com/docker/distribution
 github.com/docker/distribution/configuration
 github.com/docker/distribution/context
@@ -136,6 +146,7 @@ github.com/docker/distribution/registry/storage/driver/middleware
 github.com/docker/distribution/uuid
 github.com/docker/distribution/version
 # github.com/docker/docker v1.4.2-0.20200203170920-46ec8731fbce
+## explicit
 github.com/docker/docker/api/types
 github.com/docker/docker/api/types/blkiodev
 github.com/docker/docker/api/types/container
@@ -160,16 +171,21 @@ github.com/docker/docker/registry
 github.com/docker/docker/registry/resumable
 github.com/docker/docker/rootless
 # github.com/docker/docker-credential-helpers v0.6.3
+## explicit
 github.com/docker/docker-credential-helpers/client
 github.com/docker/docker-credential-helpers/credentials
 # github.com/docker/go-connections v0.4.0
 github.com/docker/go-connections/nat
 github.com/docker/go-connections/tlsconfig
+# github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c
+## explicit
 # github.com/docker/go-metrics v0.0.1
+## explicit
 github.com/docker/go-metrics
 # github.com/docker/go-units v0.4.0
 github.com/docker/go-units
 # github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7
+## explicit
 github.com/docker/libtrust
 # github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96
 github.com/docker/spdystream
@@ -179,9 +195,11 @@ github.com/evanphx/json-patch
 # github.com/fsnotify/fsnotify v1.4.9
 github.com/fsnotify/fsnotify
 # github.com/garyburd/redigo v1.6.0
+## explicit
 github.com/garyburd/redigo/internal
 github.com/garyburd/redigo/redis
 # github.com/ghodss/yaml v1.0.0
+## explicit
 github.com/ghodss/yaml
 # github.com/go-logr/logr v0.3.0
 github.com/go-logr/logr
@@ -194,6 +212,7 @@ github.com/go-openapi/spec
 # github.com/go-openapi/swag v0.19.5
 github.com/go-openapi/swag
 # github.com/gofrs/uuid v3.3.0+incompatible
+## explicit
 github.com/gofrs/uuid
 # github.com/gogo/protobuf v1.3.1
 github.com/gogo/protobuf/gogoproto
@@ -202,20 +221,24 @@ github.com/gogo/protobuf/protoc-gen-gogo/descriptor
 github.com/gogo/protobuf/sortkeys
 github.com/gogo/protobuf/types
 # github.com/golang-migrate/migrate/v4 v4.6.2
+## explicit
 github.com/golang-migrate/migrate/v4/source
 github.com/golang-migrate/migrate/v4/source/file
 # github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e
 github.com/golang/groupcache/lru
 # github.com/golang/mock v1.4.1
+## explicit
 github.com/golang/mock/gomock
 # github.com/golang/protobuf v1.4.3
+## explicit
 github.com/golang/protobuf/proto
 github.com/golang/protobuf/protoc-gen-go/descriptor
 github.com/golang/protobuf/ptypes
 github.com/golang/protobuf/ptypes/any
 github.com/golang/protobuf/ptypes/duration
 github.com/golang/protobuf/ptypes/timestamp
 # github.com/google/go-cmp v0.5.2
+## explicit
 github.com/google/go-cmp/cmp
 github.com/google/go-cmp/cmp/cmpopts
 github.com/google/go-cmp/cmp/internal/diff
@@ -230,10 +253,12 @@ github.com/googleapis/gnostic/extensions
 github.com/googleapis/gnostic/jsonschema
 github.com/googleapis/gnostic/openapiv2
 # github.com/gorilla/handlers v1.4.2
+## explicit
 github.com/gorilla/handlers
 # github.com/gorilla/mux v1.7.2
 github.com/gorilla/mux
 # github.com/grpc-ecosystem/grpc-health-probe v0.3.2
+## explicit
 github.com/grpc-ecosystem/grpc-health-probe
 # github.com/hashicorp/golang-lru v0.5.4
 github.com/hashicorp/golang-lru
@@ -253,10 +278,12 @@ github.com/mailru/easyjson/buffer
 github.com/mailru/easyjson/jlexer
 github.com/mailru/easyjson/jwriter
 # github.com/mattn/go-sqlite3 v1.10.0
+## explicit
 github.com/mattn/go-sqlite3
 # github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369
 github.com/matttproud/golang_protobuf_extensions/pbutil
 # github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2
+## explicit
 github.com/maxbrunsfeld/counterfeiter/v6
 github.com/maxbrunsfeld/counterfeiter/v6/arguments
 github.com/maxbrunsfeld/counterfeiter/v6/command
@@ -281,6 +308,7 @@ github.com/nxadm/tail/util
 github.com/nxadm/tail/watch
 github.com/nxadm/tail/winfile
 # github.com/onsi/ginkgo v1.14.1
+## explicit
 github.com/onsi/ginkgo
 github.com/onsi/ginkgo/config
 github.com/onsi/ginkgo/ginkgo
@@ -308,6 +336,7 @@ github.com/onsi/ginkgo/reporters/stenographer/support/go-colorable
 github.com/onsi/ginkgo/reporters/stenographer/support/go-isatty
 github.com/onsi/ginkgo/types
 # github.com/onsi/gomega v1.10.2
+## explicit
 github.com/onsi/gomega
 github.com/onsi/gomega/format
 github.com/onsi/gomega/gstruct/errors
@@ -324,11 +353,14 @@ github.com/onsi/gomega/types
 # github.com/opencontainers/go-digest v1.0.0
 github.com/opencontainers/go-digest
 # github.com/opencontainers/image-spec v1.0.2-0.20190823105129-775207bd45b6
+## explicit
 github.com/opencontainers/image-spec/specs-go
 github.com/opencontainers/image-spec/specs-go/v1
 # github.com/opencontainers/runc v0.1.1
+## explicit
 github.com/opencontainers/runc/libcontainer/system
 # github.com/operator-framework/api v0.5.0
+## explicit
 github.com/operator-framework/api/pkg/lib/version
 github.com/operator-framework/api/pkg/manifests
 github.com/operator-framework/api/pkg/operators
@@ -338,10 +370,13 @@ github.com/operator-framework/api/pkg/validation/errors
 github.com/operator-framework/api/pkg/validation/interfaces
 github.com/operator-framework/api/pkg/validation/internal
 # github.com/otiai10/copy v1.2.0
+## explicit
 github.com/otiai10/copy
 # github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2
+## explicit
 github.com/phayes/freeport
 # github.com/pkg/errors v0.9.1
+## explicit
 github.com/pkg/errors
 # github.com/pmezard/go-difflib v1.0.0
 github.com/pmezard/go-difflib/difflib
@@ -362,21 +397,28 @@ github.com/prometheus/procfs/internal/util
 # github.com/russross/blackfriday v1.5.2
 github.com/russross/blackfriday
 # github.com/sirupsen/logrus v1.6.0
+## explicit
 github.com/sirupsen/logrus
 # github.com/spf13/cobra v1.1.1
+## explicit
 github.com/spf13/cobra
 # github.com/spf13/pflag v1.0.5
 github.com/spf13/pflag
 # github.com/stretchr/testify v1.6.1
+## explicit
 github.com/stretchr/testify/assert
 github.com/stretchr/testify/require
 # github.com/yvasiyarov/go-metrics v0.0.0-20150112132944-c25f46c4b940
+## explicit
 github.com/yvasiyarov/go-metrics
 # github.com/yvasiyarov/gorelic v0.0.7
+## explicit
 github.com/yvasiyarov/gorelic
 # github.com/yvasiyarov/newrelic_platform_go v0.0.0-20160601141957-9c099fbc30e9
+## explicit
 github.com/yvasiyarov/newrelic_platform_go
 # go.etcd.io/bbolt v1.3.5
+## explicit
 go.etcd.io/bbolt
 # go.opencensus.io v0.22.3
 go.opencensus.io
@@ -389,10 +431,12 @@ golang.org/x/crypto/acme
 golang.org/x/crypto/acme/autocert
 golang.org/x/crypto/ssh/terminal
 # golang.org/x/mod v0.3.0
+## explicit
 golang.org/x/mod/module
 golang.org/x/mod/semver
 golang.org/x/mod/sumdb/dirhash
 # golang.org/x/net v0.0.0-20201110031124-69a78807bb2b
+## explicit
 golang.org/x/net/context
 golang.org/x/net/context/ctxhttp
 golang.org/x/net/html
@@ -405,9 +449,11 @@ golang.org/x/net/idna
 golang.org/x/net/internal/timeseries
 golang.org/x/net/trace
 # golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
+## explicit
 golang.org/x/oauth2
 golang.org/x/oauth2/internal
 # golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
+## explicit
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore
 # golang.org/x/sys v0.0.0-20201112073958-5cba982894dd
@@ -470,6 +516,7 @@ google.golang.org/appengine/urlfetch
 # google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a
 google.golang.org/genproto/googleapis/rpc/status
 # google.golang.org/grpc v1.30.0
+## explicit
 google.golang.org/grpc
 google.golang.org/grpc/attributes
 google.golang.org/grpc/backoff
@@ -514,8 +561,10 @@ google.golang.org/grpc/stats
 google.golang.org/grpc/status
 google.golang.org/grpc/tap
 # google.golang.org/grpc/cmd/protoc-gen-go-grpc v0.0.0-20200709232328-d8193ee9cc3e
+## explicit
 google.golang.org/grpc/cmd/protoc-gen-go-grpc
 # google.golang.org/protobuf v1.25.0
+## explicit
 google.golang.org/protobuf/cmd/protoc-gen-go
 google.golang.org/protobuf/cmd/protoc-gen-go/internal_gengo
 google.golang.org/protobuf/compiler/protogen
@@ -556,10 +605,12 @@ gopkg.in/inf.v0
 # gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7
 gopkg.in/tomb.v1
 # gopkg.in/yaml.v2 v2.3.0
+## explicit
 gopkg.in/yaml.v2
 # gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776
 gopkg.in/yaml.v3
 # k8s.io/api v0.20.0
+## explicit
 k8s.io/api/admissionregistration/v1
 k8s.io/api/admissionregistration/v1beta1
 k8s.io/api/apiserverinternal/v1alpha1
@@ -604,6 +655,7 @@ k8s.io/api/storage/v1
 k8s.io/api/storage/v1alpha1
 k8s.io/api/storage/v1beta1
 # k8s.io/apiextensions-apiserver v0.20.0
+## explicit
 k8s.io/apiextensions-apiserver/pkg/apihelpers
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/install
@@ -616,6 +668,7 @@ k8s.io/apiextensions-apiserver/pkg/apiserver/schema/objectmeta
 k8s.io/apiextensions-apiserver/pkg/apiserver/schema/pruning
 k8s.io/apiextensions-apiserver/pkg/apiserver/validation
 # k8s.io/apimachinery v0.20.0
+## explicit
 k8s.io/apimachinery/pkg/api/equality
 k8s.io/apimachinery/pkg/api/errors
 k8s.io/apimachinery/pkg/api/meta
@@ -664,6 +717,7 @@ k8s.io/apimachinery/third_party/forked/golang/json
 k8s.io/apimachinery/third_party/forked/golang/netutil
 k8s.io/apimachinery/third_party/forked/golang/reflect
 # k8s.io/apiserver v0.20.0
+## explicit
 k8s.io/apiserver/pkg/apis/apiserver
 k8s.io/apiserver/pkg/apis/apiserver/install
 k8s.io/apiserver/pkg/apis/apiserver/v1
@@ -674,6 +728,7 @@ k8s.io/apiserver/pkg/server/egressselector/metrics
 k8s.io/apiserver/pkg/storage/names
 k8s.io/apiserver/pkg/util/webhook
 # k8s.io/client-go v0.20.0
+## explicit
 k8s.io/client-go/discovery
 k8s.io/client-go/discovery/fake
 k8s.io/client-go/kubernetes
@@ -798,6 +853,7 @@ k8s.io/component-base/metrics
 k8s.io/component-base/metrics/legacyregistry
 k8s.io/component-base/version
 # k8s.io/klog v1.0.0
+## explicit
 k8s.io/klog
 # k8s.io/klog/v2 v2.4.0
 k8s.io/klog/v2
@@ -809,6 +865,7 @@ k8s.io/kube-openapi/pkg/validation/strfmt
 k8s.io/kube-openapi/pkg/validation/strfmt/bson
 k8s.io/kube-openapi/pkg/validation/validate
 # k8s.io/kubectl v0.20.0
+## explicit
 k8s.io/kubectl/pkg/util/interrupt
 k8s.io/kubectl/pkg/util/templates
 k8s.io/kubectl/pkg/util/term
@@ -824,3 +881,5 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client/proto/client
 sigs.k8s.io/structured-merge-diff/v4/value
 # sigs.k8s.io/yaml v1.2.0
 sigs.k8s.io/yaml
+# github.com/containerd/containerd => github.com/ecordell/containerd v1.3.1-0.20200629153125-0ff1a1be2fa5
+# github.com/docker/distribution => github.com/docker/distribution v0.0.0-20191216044856-a8371794149d