Partial Support for RFC #44 - Disable SBOM Generation

This commit adds partial support for disabling SBOM generation by setting `BP_DISABLE_SBOM=true`. This will presently disable the expensive operation of scanning your application. It does not disable the cheap operation of adding SBOM for dependencies that are installed by the buildpack. Support to disable that will require a change to libpak.

Signed-off-by: Daniel Mikusa <[email protected]>

README.md

@@ -34,6 +34,7 @@ The buildpack will do the following:
 | `$BP_CARGO_WORKSPACE_MEMBERS` | A comma delimited list of the workspace package names (this is the package name in the member's `Cargo.toml`, not what is in the workspace's `Cargo.toml`'s member list) to install. If the project is not using workspaces, this is not used. By default, for projects with a workspace, the buildpack will build all members in a workspace. See more details below. |
 | `$BP_CARGO_EXCLUDE_FOLDERS`   | A comma delimited list of the top-level folders that should not be deleted, which means they will persist through to the generated image. This *only* applies to top level folders. You only need the folder name, not a full path.                                                                                                                                    |
 | `$BP_CARGO_TINI_DISABLED`     | Disable using `tini` to launch binary targets. Defaults to `false`, so `tini` is installed and used by default. Set to `true` and `tini` will not be installed or used.                                                                                                                                                                                                |
+| `$BP_DISABLE_SBOM`            | Disable running the SBOM scanner. Defaults to `false`, so the scan runs. With larger projects this can take time and disabling the scan will speed up builds. You may want to disable this scane when building locally for a bit of a faster build, but you should not disable this in CI/CD pipelines or when you generate your production images.                    |
 
 ### `BP_CARGO_INSTALL_ARGS`
 

buildpack.toml

@@ -55,6 +55,12 @@ api = "0.7"
     description = "Skip installing tini"
     name = "BP_CARGO_TINI_DISABLED"
 
+  [[metadata.configurations]]
+    build = true
+    default = "false"
+    description = "Skip running SBOM scan"
+    name = "BP_DISABLE_SBOM"
+
   [[metadata.dependencies]]
     cpes = ["cpe:2.3:a:tini_project:tini:0.19.0:*:*:*:*:*:*:*"]
     id = "tini"

cargo/build.go

@@ -84,6 +84,7 @@ func (b Build) Build(context libcnb.BuildContext) (libcnb.BuildResult, error) {
 
 		cargoWorkspaceMembers, _ := cr.Resolve("BP_CARGO_WORKSPACE_MEMBERS")
 		cargoInstallArgs, _ := cr.Resolve("BP_CARGO_INSTALL_ARGS")
+		skipSBOMScan := cr.ResolveBool("BP_DISABLE_SBOM")
 
 		service := b.CargoService
 		if service == nil {
@@ -110,6 +111,7 @@ func (b Build) Build(context libcnb.BuildContext) (libcnb.BuildResult, error) {
 			WithExcludeFolders(excludeFolders),
 			WithInstallArgs(cargoInstallArgs),
 			WithLogger(b.Logger),
+			WithRunSBOMScan(!skipSBOMScan),
 			WithSBOMScanner(sbomScanner),
 			WithStack(context.StackID),
 			WithWorkspaceMembers(cargoWorkspaceMembers))
@@ -123,6 +125,10 @@ func (b Build) Build(context libcnb.BuildContext) (libcnb.BuildResult, error) {
 		}
 
 		result.Layers = append(result.Layers, cargoLayer)
+
+		if skipSBOMScan {
+			result.Labels = append(result.Labels, libcnb.Label{Key: "io.paketo.sbom.disabled", Value: "true"})
+		}
 	}
 
 	return result, nil

cargo/build_test.go

@@ -201,5 +201,71 @@ func testBuild(t *testing.T, context spec.G, it spec.S) {
 					}))
 			})
 		})
+
+		context("BP_DISABLE_SBOM is true", func() {
+			it.Before(func() {
+				Expect(os.Setenv("BP_DISABLE_SBOM", "true")).To(Succeed())
+			})
+
+			it.After(func() {
+				Expect(os.Unsetenv("BP_DISABLE_SBOM")).To(Succeed())
+			})
+
+			it.Focus("contributes cargo layer", func() {
+				ctx.Plan.Entries = append(ctx.Plan.Entries, libcnb.BuildpackPlanEntry{Name: "rust-cargo"})
+
+				service.On("ProjectTargets", mock.AnythingOfType("string")).Return([]string{"app1", "app2", "app3"}, nil)
+
+				result, err := cargoBuild.Build(ctx)
+				Expect(err).NotTo(HaveOccurred())
+
+				Expect(result.Labels).To(HaveLen(1))
+				Expect(result.Labels[0].Key).To(Equal("io.paketo.sbom.disabled"))
+				Expect(result.Labels[0].Value).To(Equal("true"))
+
+				Expect(result.Layers).To(HaveLen(3))
+				Expect(result.Layers[0].Name()).To(Equal("tini"))
+				Expect(result.Layers[1].Name()).To(Equal("Cargo Cache"))
+				Expect(result.Layers[2].Name()).To(Equal("Cargo"))
+
+				Expect(result.Processes).To(HaveLen(3))
+				Expect(result.Processes).To(ContainElement(
+					libcnb.Process{
+						Type:    "app1",
+						Command: "tini",
+						Arguments: []string{
+							"-g",
+							"--",
+							filepath.Join(ctx.Application.Path, "bin", "app1"),
+						},
+						Direct:  true,
+						Default: true,
+					}))
+				Expect(result.Processes).To(ContainElement(
+					libcnb.Process{
+						Type:    "app2",
+						Command: "tini",
+						Arguments: []string{
+							"-g",
+							"--",
+							filepath.Join(ctx.Application.Path, "bin", "app2"),
+						},
+						Direct:  true,
+						Default: false,
+					}))
+				Expect(result.Processes).To(ContainElement(
+					libcnb.Process{
+						Type:    "app3",
+						Command: "tini",
+						Arguments: []string{
+							"-g",
+							"--",
+							filepath.Join(ctx.Application.Path, "bin", "app3"),
+						},
+						Direct:  true,
+						Default: false,
+					}))
+			})
+		})
 	})
 }

cargo/cargo.go

@@ -51,6 +51,14 @@ func WithWorkspaceMembers(ap string) Option {
 	}
 }
 
+// WithRunSBOMScan sets workspace members
+func WithRunSBOMScan(sc bool) Option {
+	return func(cargo Cargo) Cargo {
+		cargo.RunSBOMScan = sc
+		return cargo
+	}
+}
+
 // WithSBOMScanner sets workspace members
 func WithSBOMScanner(sc sbom.SBOMScanner) Option {
 	return func(cargo Cargo) Cargo {
@@ -116,6 +124,7 @@ type Cargo struct {
 	InstallArgs        string
 	LayerContributor   libpak.LayerContributor
 	Logger             bard.Logger
+	RunSBOMScan        bool
 	SBOMScanner        sbom.SBOMScanner
 	Stack              string
 	WorkspaceMembers   string
@@ -216,8 +225,10 @@ func (c Cargo) Contribute(layer libcnb.Layer) (libcnb.Layer, error) {
 			}
 		}
 
-		if err := c.SBOMScanner.ScanLayer(layer, c.ApplicationPath, libcnb.CycloneDXJSON, libcnb.SyftJSON); err != nil {
-			return libcnb.Layer{}, fmt.Errorf("unable to create layer %s SBoM \n%w", layer.Name, err)
+		if c.RunSBOMScan {
+			if err := c.SBOMScanner.ScanLayer(layer, c.ApplicationPath, libcnb.CycloneDXJSON, libcnb.SyftJSON); err != nil {
+				return libcnb.Layer{}, fmt.Errorf("unable to create layer %s SBoM \n%w", layer.Name, err)
+			}
 		}
 
 		err = preserver.PreserveAll(targetPath, cargoHome, layer.Path)

cargo/cargo_test.go

@@ -261,7 +261,8 @@ func testCargo(t *testing.T, context spec.G, it spec.S) {
 				c, err = cargo.NewCargo(
 					cargo.WithApplicationPath(ctx.Application.Path),
 					cargo.WithCargoService(service),
-					cargo.WithSBOMScanner(sbomScanner))
+					cargo.WithSBOMScanner(sbomScanner),
+					cargo.WithRunSBOMScan(true))
 
 				Expect(err).ToNot(HaveOccurred())
 			})
@@ -284,6 +285,8 @@ func testCargo(t *testing.T, context spec.G, it spec.S) {
 				outputLayer, err := c.Contribute(inputLayer)
 				Expect(err).NotTo(HaveOccurred())
 
+				sbomScanner.AssertCalled(t, "ScanLayer", inputLayer, ctx.Application.Path, libcnb.CycloneDXJSON, libcnb.SyftJSON)
+
 				Expect(outputLayer.LayerTypes.Cache).To(BeTrue())
 				Expect(outputLayer.LayerTypes.Build).To(BeFalse())
 				Expect(outputLayer.LayerTypes.Launch).To(BeTrue())
@@ -327,6 +330,53 @@ func testCargo(t *testing.T, context spec.G, it spec.S) {
 				outputLayer, err := c.Contribute(inputLayer)
 				Expect(err).NotTo(HaveOccurred())
 
+				sbomScanner.AssertCalled(t, "ScanLayer", inputLayer, ctx.Application.Path, libcnb.CycloneDXJSON, libcnb.SyftJSON)
+
+				Expect(outputLayer.LayerTypes.Cache).To(BeTrue())
+				Expect(outputLayer.LayerTypes.Build).To(BeFalse())
+				Expect(outputLayer.LayerTypes.Launch).To(BeTrue())
+
+				// app files should be deleted
+				Expect(appFile).ToNot(BeAnExistingFile())
+
+				// preserver should have run
+				Expect(filepath.Join(outputLayer.Path, "mtimes.json")).To(BeARegularFile())
+				Expect(filepath.Join(cargoHome, "mtimes.json")).To(BeARegularFile())
+				Expect(filepath.Join(cacheLayer.Path, "mtimes.json")).To(BeARegularFile())
+
+				// we should have two copies of the binary, one in the layer an one in the app root
+				Expect(filepath.Join(outputLayer.Path, "bin", "my-binary")).To(BeARegularFile())
+				Expect(filepath.Join(ctx.Application.Path, "bin", "my-binary")).To(BeARegularFile())
+				Expect(filepath.Join(ctx.Application.Path, "mtimes.json")).ToNot(BeARegularFile())
+
+				// Ensure `/workspace/bin` is added to the PATH at launch
+				Expect(outputLayer.LaunchEnvironment["PATH.append"]).To(Equal(filepath.Join(ctx.Application.Path, "bin")))
+			})
+
+			it("contributes cargo layer with one member without SBOM", func() {
+				service.On("WorkspaceMembers", mock.AnythingOfType("string"), mock.AnythingOfType("libcnb.Layer")).Return([]url.URL{
+					{Scheme: "file", Path: filepath.Join(ctx.Application.Path)},
+				}, nil)
+
+				service.On("Install", mock.AnythingOfType("string"), mock.AnythingOfType("libcnb.Layer")).Return(func(srcDir string, layer libcnb.Layer) error {
+					Expect(os.MkdirAll(filepath.Join(layer.Path, "bin"), 0755)).ToNot(HaveOccurred())
+					err := ioutil.WriteFile(filepath.Join(layer.Path, "bin", "my-binary"), []byte("contents"), 0644)
+					Expect(err).ToNot(HaveOccurred())
+					return nil
+				})
+
+				service.On("ProjectTargets", mock.AnythingOfType("string")).Return([]string{"my-binary", "other"}, nil)
+
+				inputLayer, err := ctx.Layers.Layer("cargo-layer")
+				Expect(err).ToNot(HaveOccurred())
+
+				c.RunSBOMScan = false
+
+				outputLayer, err := c.Contribute(inputLayer)
+				Expect(err).NotTo(HaveOccurred())
+
+				sbomScanner.AssertNotCalled(t, "ScanLayer", inputLayer, ctx.Application.Path, libcnb.CycloneDXJSON, libcnb.SyftJSON)
+
 				Expect(outputLayer.LayerTypes.Cache).To(BeTrue())
 				Expect(outputLayer.LayerTypes.Build).To(BeFalse())
 				Expect(outputLayer.LayerTypes.Launch).To(BeTrue())
@@ -375,6 +425,8 @@ func testCargo(t *testing.T, context spec.G, it spec.S) {
 					outputLayer, err := c.Contribute(inputLayer)
 					Expect(err).NotTo(HaveOccurred())
 
+					sbomScanner.AssertCalled(t, "ScanLayer", inputLayer, ctx.Application.Path, libcnb.CycloneDXJSON, libcnb.SyftJSON)
+
 					Expect(outputLayer.LayerTypes.Cache).To(BeTrue())
 					Expect(outputLayer.LayerTypes.Build).To(BeFalse())
 					Expect(outputLayer.LayerTypes.Launch).To(BeTrue())
@@ -421,6 +473,8 @@ func testCargo(t *testing.T, context spec.G, it spec.S) {
 				outputLayer, err := c.Contribute(inputLayer)
 				Expect(err).NotTo(HaveOccurred())
 
+				sbomScanner.AssertCalled(t, "ScanLayer", inputLayer, ctx.Application.Path, libcnb.CycloneDXJSON, libcnb.SyftJSON)
+
 				Expect(outputLayer.LayerTypes.Cache).To(BeTrue())
 				Expect(outputLayer.LayerTypes.Build).To(BeFalse())
 				Expect(outputLayer.LayerTypes.Launch).To(BeTrue())

go.mod

@@ -1,6 +1,6 @@
 module github.com/paketo-community/cargo
 
-go 1.16
+go 1.17
 
 require (
 	github.com/buildpacks/libcnb v1.26.0
@@ -10,3 +10,23 @@ require (
 	github.com/sclevine/spec v1.4.0
 	github.com/stretchr/testify v1.7.1
 )
+
+require (
+	github.com/BurntSushi/toml v1.1.0 // indirect
+	github.com/Masterminds/semver/v3 v3.1.1 // indirect
+	github.com/creack/pty v1.1.18 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/heroku/color v0.0.6 // indirect
+	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/mattn/go-colorable v0.1.12 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/stretchr/objx v0.4.0 // indirect
+	golang.org/x/net v0.0.0-20220513224357-95641704303c // indirect
+	golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a // indirect
+	golang.org/x/text v0.3.7 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20220512140231-539c8e751b99 // indirect
+)

go.sum

@@ -37,10 +37,12 @@ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpO
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/mattn/go-colorable v0.1.2 h1:/bC9yWikZXAL9uJdulbSfyVNIR3n3trXl+v8+1sx8mU=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-isatty v0.0.8 h1:HLtExJ+uU2HOZ+wI0Tt5DtUDrx8yhUqDcp7fYERX4CE=
+github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
@@ -68,8 +70,9 @@ github.com/sclevine/spec v1.4.0 h1:z/Q9idDcay5m5irkZ28M7PtQM4aOISzOpj4bUPkDee8=
 github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.3.0 h1:NGXK3lHquSN08v5vWalVI/L8XU9hdzE/G6xsrze47As=
 github.com/stretchr/objx v0.3.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/objx v0.4.0 h1:M2gUjqZET1qApGOWNSnZ49BAIMX4F/1plDv3+l31EJ4=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
@@ -86,8 +89,9 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f h1:oA4XRj0qtSt8Yo1Zms0CUlsT3KG69V2UGQWPBxujDmc=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220513224357-95641704303c h1:nF9mHSvoKBLkQNQhJZNsc66z2UzAMUbLGjC95CF3pU0=
+golang.org/x/net v0.0.0-20220513224357-95641704303c/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -105,9 +109,12 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220209214540-3681064d5158 h1:rm+CHSpPEEW2IsXUib1ThaHIjuBVZjxNgSKmBLFfD4c=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a h1:N2T1jUrTQE9Re6TFF5PhvEHXHCguynGhKjWVsIUt5cY=
+golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -141,5 +148,6 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20220512140231-539c8e751b99 h1:dbuHpmKjkDzSOMKAWl10QNlgaZUd3V1q99xc81tt2Kc=
+gopkg.in/yaml.v3 v3.0.0-20220512140231-539c8e751b99/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=