Merge pull request #1256 from jonjohnsonjr/move-go-apk

go.mod

@@ -3,16 +3,15 @@ module chainguard.dev/melange
 go 1.22.3
 
 require (
-	chainguard.dev/apko v0.14.8-0.20240602194745-bf8069395db3
+	chainguard.dev/apko v0.14.8-0.20240605215612-95e33993764a
 	cloud.google.com/go/storage v1.41.0
 	dagger.io/dagger v0.11.6
 	github.com/chainguard-dev/clog v1.3.1
-	github.com/chainguard-dev/go-apk v0.0.0-20240602190255-5edcf7f32041
 	github.com/chainguard-dev/go-pkgconfig v0.0.0-20240404163941-6351b37b2a10
 	github.com/chainguard-dev/yam v0.0.7
 	github.com/charmbracelet/log v0.4.0
-	github.com/docker/cli v26.1.3+incompatible
-	github.com/docker/docker v26.1.3+incompatible
+	github.com/docker/cli v26.1.4+incompatible
+	github.com/docker/docker v26.1.4+incompatible
 	github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936
 	github.com/github/go-spdx/v2 v2.2.0
 	github.com/go-git/go-git/v5 v5.12.0
@@ -37,7 +36,7 @@ require (
 	go.opentelemetry.io/otel v1.27.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.27.0
 	go.opentelemetry.io/otel/sdk v1.27.0
-	golang.org/x/exp v0.0.0-20240531132922-fd00a4e0eefc
+	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8
 	golang.org/x/sync v0.7.0
 	golang.org/x/sys v0.21.0
 	golang.org/x/text v0.16.0
@@ -122,7 +121,7 @@ require (
 	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20240603135222-347ccf8152d4 // indirect
+	github.com/letsencrypt/boulder v0.0.0-20240605191410-3786401f107b // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -161,10 +160,10 @@ require (
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0 // indirect
 	go.opentelemetry.io/otel/metric v1.27.0 // indirect
 	go.opentelemetry.io/otel/trace v1.27.0 // indirect
-	golang.org/x/crypto v0.23.0 // indirect
-	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/crypto v0.24.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
 	golang.org/x/oauth2 v0.21.0 // indirect
-	golang.org/x/term v0.20.0 // indirect
+	golang.org/x/term v0.21.0 // indirect
 	google.golang.org/genproto v0.0.0-20240528184218-531527333157 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240521202816-d264139d666e // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect

go.sum

@@ -1,5 +1,5 @@
-chainguard.dev/apko v0.14.8-0.20240602194745-bf8069395db3 h1:Pgf49BpR2NLslQaJmLyRWlDUtaoGv5iGGYNW2N/bHu0=
-chainguard.dev/apko v0.14.8-0.20240602194745-bf8069395db3/go.mod h1:QH2ZUwyNqcxzqucfUt+LdrfngRI99TsLfkD6BZqGRgc=
+chainguard.dev/apko v0.14.8-0.20240605215612-95e33993764a h1:d9g3vpyk4Gz0xcJ/Odk228DhOWjjCA9EshbScfs4QQU=
+chainguard.dev/apko v0.14.8-0.20240605215612-95e33993764a/go.mod h1:aFEwAkFsf7sXvVFQ2ui6KRK3tbG3mIl5PmPd4JqKGVM=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.114.0 h1:OIPFAdfrFDFO2ve2U7r/H5SwSbBzEdrBdE7xkgwc+kY=
 cloud.google.com/go v0.114.0/go.mod h1:ZV9La5YYxctro1HTPug5lXH/GefROyW8PPD4T8n9J8E=
@@ -59,8 +59,6 @@ github.com/chainguard-dev/clog v1.3.1 h1:CDNCty5WKQhJzoOPubk0GdXt+bPQyargmfClqeb
 github.com/chainguard-dev/clog v1.3.1/go.mod h1:cV516KZWqYc/phZsCNwF36u/KMGS+Gj5Uqeb8Hlp95Y=
 github.com/chainguard-dev/git-urls v1.0.2 h1:pSpT7ifrpc5X55n4aTTm7FFUE+ZQHKiqpiwNkJrVcKQ=
 github.com/chainguard-dev/git-urls v1.0.2/go.mod h1:rbGgj10OS7UgZlbzdUQIQpT0k/D4+An04HJY7Ol+Y/o=
-github.com/chainguard-dev/go-apk v0.0.0-20240602190255-5edcf7f32041 h1:b2qD/YE1WZ9IufD0CJSR1nWGQi2jDi0dZxbuTVBUF/8=
-github.com/chainguard-dev/go-apk v0.0.0-20240602190255-5edcf7f32041/go.mod h1:4UVB5GXk5yVOVwe3QPdmMLMVTpYbvzygjXlRrJxJPMc=
 github.com/chainguard-dev/go-pkgconfig v0.0.0-20240404163941-6351b37b2a10 h1:XR2vgQC024I9/boh9r1ihVv8Z14+pbvWqXeYMCnZJpc=
 github.com/chainguard-dev/go-pkgconfig v0.0.0-20240404163941-6351b37b2a10/go.mod h1:1p6+MesLcjKeON5BRWa7I87mvAY0QmKjgginIM3w6BI=
 github.com/chainguard-dev/yam v0.0.7 h1:QL10NcxG8DxUciFQGvN4+SSMuxdm0fYkqM4oCxbMqIc=
@@ -98,12 +96,12 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v26.1.3+incompatible h1:bUpXT/N0kDE3VUHI2r5VMsYQgi38kYuoC0oL9yt3lqc=
-github.com/docker/cli v26.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v26.1.4+incompatible h1:I8PHdc0MtxEADqYJZvhBrW9bo8gawKwwenxRM7/rLu8=
+github.com/docker/cli v26.1.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v26.1.3+incompatible h1:lLCzRbrVZrljpVNobJu1J2FHk8V0s4BawoZippkc+xo=
-github.com/docker/docker v26.1.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v26.1.4+incompatible h1:vuTpXDuoga+Z38m1OZHzl7NKisKWaWlhjQk7IDPSLsU=
+github.com/docker/docker v26.1.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -265,8 +263,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kubescape/go-git-url v0.0.30 h1:PIbg86ae0ftee/p/Tu/6CA1ju6VoJ51G3sQWNHOm6wg=
 github.com/kubescape/go-git-url v0.0.30/go.mod h1:3ddc1HEflms1vMhD9owt/3FBES070UaYTUarcjx8jDk=
-github.com/letsencrypt/boulder v0.0.0-20240603135222-347ccf8152d4 h1:IR73Vos1I6m8yb2fP3XzEHP/G6PU6MiU/3BZA3cXQCQ=
-github.com/letsencrypt/boulder v0.0.0-20240603135222-347ccf8152d4/go.mod h1:xN4NICCU1WBlUv60BGgMyGuungNTy/aQqjEntJWmgaM=
+github.com/letsencrypt/boulder v0.0.0-20240605191410-3786401f107b h1:g4PQ+zxO6voXxB6qySemWUJgY1gFns/K/2nyJyw6sCQ=
+github.com/letsencrypt/boulder v0.0.0-20240605191410-3786401f107b/go.mod h1:xN4NICCU1WBlUv60BGgMyGuungNTy/aQqjEntJWmgaM=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
@@ -425,11 +423,11 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20240531132922-fd00a4e0eefc h1:O9NuF4s+E/PvMIy+9IUZB9znFwUIXEWSstNjek6VpVg=
-golang.org/x/exp v0.0.0-20240531132922-fd00a4e0eefc/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
+golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 h1:LoYXNGAShUG3m/ehNk4iFctuhGX/+R1ZpfJ4/ia80JM=
+golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -456,8 +454,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
 golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
@@ -503,8 +501,8 @@ golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuX
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=

pkg/build/build.go

@@ -30,12 +30,12 @@ import (
 	"strings"
 	"time"
 
+	apkofs "chainguard.dev/apko/pkg/apk/fs"
 	apko_build "chainguard.dev/apko/pkg/build"
 	apko_types "chainguard.dev/apko/pkg/build/types"
 	"chainguard.dev/apko/pkg/options"
 	"cloud.google.com/go/storage"
 	"github.com/chainguard-dev/clog"
-	apkofs "github.com/chainguard-dev/go-apk/pkg/fs"
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/storage/filesystem"
 	purl "github.com/package-url/packageurl-go"

pkg/build/package.go

@@ -38,8 +38,8 @@ import (
 	"chainguard.dev/melange/pkg/sca"
 	"chainguard.dev/melange/pkg/util"
 
+	"chainguard.dev/apko/pkg/apk/tarball"
 	"github.com/chainguard-dev/clog"
-	"github.com/chainguard-dev/go-apk/pkg/tarball"
 	"github.com/psanford/memfs"
 	"go.opentelemetry.io/otel"
 )

pkg/build/readlinkfs.go

@@ -19,7 +19,7 @@ import (
 	"os"
 	"path/filepath"
 
-	apkofs "github.com/chainguard-dev/go-apk/pkg/fs"
+	apkofs "chainguard.dev/apko/pkg/apk/fs"
 	"golang.org/x/sys/unix"
 )
 

pkg/build/sign.go

@@ -12,7 +12,7 @@ import (
 	"path/filepath"
 	"time"
 
-	sign "github.com/chainguard-dev/go-apk/pkg/signature"
+	sign "chainguard.dev/apko/pkg/apk/signature"
 	"github.com/klauspost/compress/gzip"
 	"go.opentelemetry.io/otel"
 )

pkg/build/test.go

@@ -26,12 +26,12 @@ import (
 	"runtime"
 	"strings"
 
+	apkofs "chainguard.dev/apko/pkg/apk/fs"
 	apko_build "chainguard.dev/apko/pkg/build"
 	"chainguard.dev/apko/pkg/build/types"
 	apko_types "chainguard.dev/apko/pkg/build/types"
 	"chainguard.dev/apko/pkg/options"
 	"github.com/chainguard-dev/clog"
-	apkofs "github.com/chainguard-dev/go-apk/pkg/fs"
 	"github.com/yookoala/realpath"
 	"go.opentelemetry.io/otel"
 

pkg/cli/scan.go

@@ -28,11 +28,11 @@ import (
 	"strings"
 	"time"
 
+	"chainguard.dev/apko/pkg/apk/expandapk"
 	"chainguard.dev/melange/pkg/build"
 	"chainguard.dev/melange/pkg/config"
 	"chainguard.dev/melange/pkg/sca"
 	"github.com/chainguard-dev/clog"
-	"github.com/chainguard-dev/go-apk/pkg/expandapk"
 	"github.com/spf13/cobra"
 	"go.opentelemetry.io/otel"
 )

pkg/cli/sign.go

@@ -22,9 +22,9 @@ import (
 	"io"
 	"os"
 
+	sign "chainguard.dev/apko/pkg/apk/signature"
 	pkgsign "chainguard.dev/melange/pkg/sign"
 	"github.com/chainguard-dev/clog"
-	sign "github.com/chainguard-dev/go-apk/pkg/signature"
 	"github.com/klauspost/compress/gzip"
 	"github.com/spf13/cobra"
 	"golang.org/x/sync/errgroup"

pkg/index/index.go

@@ -24,9 +24,9 @@ import (
 	"path/filepath"
 	"strings"
 
+	"chainguard.dev/apko/pkg/apk/apk"
+	sign "chainguard.dev/apko/pkg/apk/signature"
 	"github.com/chainguard-dev/clog"
-	apkrepo "github.com/chainguard-dev/go-apk/pkg/apk"
-	sign "github.com/chainguard-dev/go-apk/pkg/signature"
 	"go.opentelemetry.io/otel"
 	"golang.org/x/sync/errgroup"
 )
@@ -38,7 +38,7 @@ type Index struct {
 	MergeIndexFileFlag bool
 	SigningKey         string
 	ExpectedArch       string
-	Index              apkrepo.APKIndex
+	Index              apk.APKIndex
 }
 
 type Option func(*Index) error
@@ -133,7 +133,7 @@ func (idx *Index) LoadIndex(ctx context.Context, sourceFile string) error {
 	}
 	defer f.Close()
 
-	index, err := apkrepo.IndexFromArchive(f)
+	index, err := apk.IndexFromArchive(f)
 	if err != nil {
 		return fmt.Errorf("failed to read apkindex from archive file: %w", err)
 	}
@@ -148,7 +148,7 @@ func (idx *Index) LoadIndex(ctx context.Context, sourceFile string) error {
 
 func (idx *Index) UpdateIndex(ctx context.Context) error {
 	log := clog.FromContext(ctx)
-	packages := make([]*apkrepo.Package, len(idx.PackageFiles))
+	packages := make([]*apk.Package, len(idx.PackageFiles))
 	var g errgroup.Group
 	g.SetLimit(4)
 	for i, apkFile := range idx.PackageFiles {
@@ -160,7 +160,13 @@ func (idx *Index) UpdateIndex(ctx context.Context) error {
 				return fmt.Errorf("failed to open package %s: %w", apkFile, err)
 			}
 			defer f.Close()
-			pkg, err := apkrepo.ParsePackage(ctx, f)
+
+			stat, err := f.Stat()
+			if err != nil {
+				return err
+			}
+
+			pkg, err := apk.ParsePackage(ctx, f, uint64(stat.Size()))
 			if err != nil {
 				return fmt.Errorf("failed to parse package %s: %w", apkFile, err)
 			}
@@ -231,7 +237,7 @@ func (idx *Index) GenerateIndex(ctx context.Context) error {
 
 func (idx *Index) WriteArchiveIndex(ctx context.Context, destinationFile string) error {
 	log := clog.FromContext(ctx)
-	archive, err := apkrepo.ArchiveFromIndex(&idx.Index)
+	archive, err := apk.ArchiveFromIndex(&idx.Index)
 	if err != nil {
 		return fmt.Errorf("failed to create archive from index object: %w", err)
 	}

pkg/index/index_test.go

@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
+	"chainguard.dev/apko/pkg/apk/apk"
+	"chainguard.dev/apko/pkg/apk/expandapk"
 	"github.com/chainguard-dev/clog/slogtest"
-	"github.com/chainguard-dev/go-apk/pkg/apk"
-	"github.com/chainguard-dev/go-apk/pkg/expandapk"
 	"github.com/google/go-cmp/cmp"
 )
 

pkg/linter/linter.go

@@ -26,8 +26,8 @@ import (
 	"regexp"
 	"strings"
 
+	"chainguard.dev/apko/pkg/apk/expandapk"
 	linter_defaults "chainguard.dev/melange/pkg/linter/defaults"
-	"github.com/chainguard-dev/go-apk/pkg/expandapk"
 
 	"gopkg.in/ini.v1"
 )

pkg/sca/sca.go

@@ -27,8 +27,8 @@ import (
 	"strings"
 	"unicode"
 
+	apkofs "chainguard.dev/apko/pkg/apk/fs"
 	"github.com/chainguard-dev/clog"
-	apkofs "github.com/chainguard-dev/go-apk/pkg/fs"
 	"github.com/chainguard-dev/go-pkgconfig"
 
 	"chainguard.dev/melange/pkg/config"

pkg/sca/sca_test.go

@@ -22,11 +22,11 @@ import (
 	"testing"
 	"time"
 
+	"chainguard.dev/apko/pkg/apk/apk"
+	"chainguard.dev/apko/pkg/apk/expandapk"
 	"chainguard.dev/melange/pkg/config"
 	"chainguard.dev/melange/pkg/util"
 	"github.com/chainguard-dev/clog/slogtest"
-	"github.com/chainguard-dev/go-apk/pkg/apk"
-	"github.com/chainguard-dev/go-apk/pkg/expandapk"
 	"github.com/google/go-cmp/cmp"
 	"gopkg.in/ini.v1"
 )