Merge pull request #44122 from thaJeztah/20.10_bump_buildkit

[20.10] vendor: github.com/moby/buildkit 3a1eeca59a9263613d996ead67d53a4b7d45723d (v0.8 branch)

vendor.conf

@@ -33,7 +33,7 @@ github.com/imdario/mergo                            1afb36080aec31e0d1528973ebe6
 golang.org/x/sync                                   cd5d95a43a6e21273425c7ae415d3df9ea832eeb
 
 # buildkit
-github.com/moby/buildkit                            bc07b2b81b1c6a62d29981ac564b16a15ce2bfa7 # v0.8.3-4-gbc07b2b8
+github.com/moby/buildkit                            3a1eeca59a9263613d996ead67d53a4b7d45723d # v0.8.3-29-g3a1eeca5
 github.com/tonistiigi/fsutil                        0834f99b7b85462efb69b4f571a4fa3ca7da5ac9
 github.com/tonistiigi/units                         6950e57a87eaf136bbe44ef2ec8e75b9e3569de2
 github.com/grpc-ecosystem/grpc-opentracing          8e809c8a86450a29b90dcc9efbf062d0fe6d9746

vendor/github.com/moby/buildkit/README.md

@@ -189,7 +189,7 @@ buildctl build \
 buildctl build \
     --frontend gateway.v0 \
     --opt source=docker/dockerfile \
-    --opt context=git://github.com/moby/moby \
+    --opt context=https://github.com/moby/moby.git \
     --opt build-arg:APT_MIRROR=cdn-fastly.deb.debian.org
 ```
 

vendor/github.com/moby/buildkit/api/services/control/generate.go

@@ -1,3 +1,3 @@
-package moby_buildkit_v1 //nolint:golint
+package moby_buildkit_v1 //nolint:revive
 
 //go:generate protoc -I=. -I=../../../vendor/ -I=../../../../../../ --gogo_out=plugins=grpc:. control.proto

vendor/github.com/moby/buildkit/api/types/generate.go

@@ -1,3 +1,3 @@
-package moby_buildkit_v1_types //nolint:golint
+package moby_buildkit_v1_types //nolint:revive
 
 //go:generate protoc -I=. -I=../../vendor/ -I=../../../../../ --gogo_out=plugins=grpc:. worker.proto

vendor/github.com/moby/buildkit/cache/contenthash/filehash_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package contenthash

vendor/github.com/moby/buildkit/cache/contenthash/filehash_windows.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package contenthash

vendor/github.com/moby/buildkit/cache/manager.go

@@ -756,6 +756,22 @@ func (cm *cacheManager) prune(ctx context.Context, ch chan client.UsageInfo, opt
 		return nil
 	}
 
+	// calculate sizes here so that lock does not need to be held for slow process
+	for _, cr := range toDelete {
+		size := getSize(cr.md)
+
+		if size == sizeUnknown && cr.equalImmutable != nil {
+			size = getSize(cr.equalImmutable.md) // benefit from DiskUsage calc
+		}
+		if size == sizeUnknown {
+			// calling size will warm cache for next call
+			if _, err := cr.Size(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	cm.mu.Lock()
 	var err error
 	for _, cr := range toDelete {
 		cr.mu.Lock()
@@ -779,15 +795,6 @@ func (cm *cacheManager) prune(ctx context.Context, ch chan client.UsageInfo, opt
 		if c.Size == sizeUnknown && cr.equalImmutable != nil {
 			c.Size = getSize(cr.equalImmutable.md) // benefit from DiskUsage calc
 		}
-		if c.Size == sizeUnknown {
-			cr.mu.Unlock() // all the non-prune modifications already protected by cr.dead
-			s, err := cr.Size(ctx)
-			if err != nil {
-				return err
-			}
-			c.Size = s
-			cr.mu.Lock()
-		}
 
 		opt.totalSize -= c.Size
 
@@ -805,6 +812,7 @@ func (cm *cacheManager) prune(ctx context.Context, ch chan client.UsageInfo, opt
 		}
 		cr.mu.Unlock()
 	}
+	cm.mu.Unlock()
 	if err != nil {
 		return err
 	}

vendor/github.com/moby/buildkit/cache/metadata/metadata.go

@@ -205,10 +205,11 @@ func (s *Store) Close() error {
 
 type StorageItem struct {
 	id      string
+	vmu     sync.RWMutex
 	values  map[string]*Value
+	qmu     sync.Mutex
 	queue   []func(*bolt.Bucket) error
 	storage *Store
-	mu      sync.RWMutex
 }
 
 func newStorageItem(id string, b *bolt.Bucket, s *Store) (*StorageItem, error) {
@@ -242,10 +243,6 @@ func (s *StorageItem) ID() string {
 	return s.id
 }
 
-func (s *StorageItem) View(fn func(b *bolt.Bucket) error) error {
-	return s.storage.View(s.id, fn)
-}
-
 func (s *StorageItem) Update(fn func(b *bolt.Bucket) error) error {
 	return s.storage.Update(s.id, fn)
 }
@@ -255,17 +252,19 @@ func (s *StorageItem) Metadata() *StorageItem {
 }
 
 func (s *StorageItem) Keys() []string {
+	s.vmu.RLock()
 	keys := make([]string, 0, len(s.values))
 	for k := range s.values {
 		keys = append(keys, k)
 	}
+	s.vmu.RUnlock()
 	return keys
 }
 
 func (s *StorageItem) Get(k string) *Value {
-	s.mu.RLock()
+	s.vmu.RLock()
 	v := s.values[k]
-	s.mu.RUnlock()
+	s.vmu.RUnlock()
 	return v
 }
 
@@ -307,14 +306,14 @@ func (s *StorageItem) SetExternal(k string, dt []byte) error {
 }
 
 func (s *StorageItem) Queue(fn func(b *bolt.Bucket) error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
+	s.qmu.Lock()
+	defer s.qmu.Unlock()
 	s.queue = append(s.queue, fn)
 }
 
 func (s *StorageItem) Commit() error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
+	s.qmu.Lock()
+	defer s.qmu.Unlock()
 	return errors.WithStack(s.Update(func(b *bolt.Bucket) error {
 		for _, fn := range s.queue {
 			if err := fn(b); err != nil {
@@ -327,15 +326,23 @@ func (s *StorageItem) Commit() error {
 }
 
 func (s *StorageItem) Indexes() (out []string) {
+	s.vmu.RLock()
 	for _, v := range s.values {
 		if v.Index != "" {
 			out = append(out, v.Index)
 		}
 	}
+	s.vmu.RUnlock()
 	return
 }
 
 func (s *StorageItem) SetValue(b *bolt.Bucket, key string, v *Value) error {
+	s.vmu.Lock()
+	defer s.vmu.Unlock()
+	return s.setValue(b, key, v)
+}
+
+func (s *StorageItem) setValue(b *bolt.Bucket, key string, v *Value) error {
 	if v == nil {
 		if old, ok := s.values[key]; ok {
 			if old.Index != "" {
@@ -375,16 +382,16 @@ func (s *StorageItem) SetValue(b *bolt.Bucket, key string, v *Value) error {
 var ErrSkipSetValue = errors.New("skip setting metadata value")
 
 func (s *StorageItem) GetAndSetValue(key string, fn func(*Value) (*Value, error)) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
 	return s.Update(func(b *bolt.Bucket) error {
+		s.vmu.Lock()
+		defer s.vmu.Unlock()
 		v, err := fn(s.values[key])
 		if errors.Is(err, ErrSkipSetValue) {
 			return nil
 		} else if err != nil {
 			return err
 		}
-		return s.SetValue(b, key, v)
+		return s.setValue(b, key, v)
 	})
 }
 

vendor/github.com/moby/buildkit/cache/remotecache/registry/registry.go

@@ -12,7 +12,6 @@ import (
 	"github.com/moby/buildkit/util/contentutil"
 	"github.com/moby/buildkit/util/resolver"
 	digest "github.com/opencontainers/go-digest"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 )
@@ -93,11 +92,11 @@ func (dsl *withDistributionSourceLabel) SetDistributionSourceLabel(ctx context.C
 	if err != nil {
 		return err
 	}
-	_, err = hf(ctx, ocispec.Descriptor{Digest: dgst})
+	_, err = hf(ctx, specs.Descriptor{Digest: dgst})
 	return err
 }
 
-func (dsl *withDistributionSourceLabel) SetDistributionSourceAnnotation(desc ocispec.Descriptor) ocispec.Descriptor {
+func (dsl *withDistributionSourceLabel) SetDistributionSourceAnnotation(desc specs.Descriptor) specs.Descriptor {
 	if desc.Annotations == nil {
 		desc.Annotations = map[string]string{}
 	}

vendor/github.com/moby/buildkit/client/client_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package client

vendor/github.com/moby/buildkit/cmd/buildkitd/config/gcpolicy_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package config

vendor/github.com/moby/buildkit/cmd/buildkitd/config/gcpolicy_windows.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package config

vendor/github.com/moby/buildkit/executor/oci/spec_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package oci

vendor/github.com/moby/buildkit/executor/oci/spec_windows.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package oci

vendor/github.com/moby/buildkit/executor/runcexecutor/executor_common.go

@@ -1,3 +1,4 @@
+//go:build !linux
 // +build !linux
 
 package runcexecutor

vendor/github.com/moby/buildkit/frontend/dockerfile/dockerfile2llb/convert_norunnetwork.go

@@ -1,3 +1,4 @@
+//go:build !dfrunnetwork
 // +build !dfrunnetwork
 
 package dockerfile2llb

vendor/github.com/moby/buildkit/frontend/dockerfile/dockerfile2llb/convert_norunsecurity.go

@@ -1,3 +1,4 @@
+//go:build !dfrunsecurity
 // +build !dfrunsecurity
 
 package dockerfile2llb

vendor/github.com/moby/buildkit/frontend/dockerfile/dockerfile2llb/convert_runnetwork.go

@@ -1,3 +1,4 @@
+//go:build dfrunnetwork
 // +build dfrunnetwork
 
 package dockerfile2llb

vendor/github.com/moby/buildkit/frontend/dockerfile/dockerfile2llb/convert_runsecurity.go

@@ -1,3 +1,4 @@
+//go:build dfrunsecurity
 // +build dfrunsecurity
 
 package dockerfile2llb

vendor/github.com/moby/buildkit/frontend/dockerfile/instructions/commands_runnetwork.go

@@ -1,3 +1,4 @@
+//go:build dfrunnetwork
 // +build dfrunnetwork
 
 package instructions

vendor/github.com/moby/buildkit/frontend/dockerfile/instructions/commands_runsecurity.go

@@ -1,3 +1,4 @@
+//go:build dfrunsecurity
 // +build dfrunsecurity
 
 package instructions

vendor/github.com/moby/buildkit/frontend/dockerfile/instructions/errors_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package instructions

vendor/github.com/moby/buildkit/frontend/dockerfile/instructions/parse.go

@@ -648,7 +648,7 @@ func errExactlyOneArgument(command string) error {
 }
 
 func errNoDestinationArgument(command string) error {
-	return errors.Errorf("%s requires at least two arguments, but only one was provided. Destination could not be determined.", command)
+	return errors.Errorf("%s requires at least two arguments, but only one was provided. Destination could not be determined", command)
 }
 
 func errBlankCommandNames(command string) error {

vendor/github.com/moby/buildkit/frontend/dockerfile/shell/equal_env_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package shell

vendor/github.com/moby/buildkit/frontend/gateway/pb/caps.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:golint
+package moby_buildkit_v1_frontend //nolint:revive
 
 import "github.com/moby/buildkit/util/apicaps"
 

vendor/github.com/moby/buildkit/frontend/gateway/pb/generate.go

@@ -1,3 +1,3 @@
-package moby_buildkit_v1_frontend //nolint:golint
+package moby_buildkit_v1_frontend //nolint:revive
 
 //go:generate protoc -I=. -I=../../../vendor/ -I=../../../../../../ --gogo_out=plugins=grpc:. gateway.proto

vendor/github.com/moby/buildkit/go.mod

@@ -9,8 +9,7 @@ require (
 	github.com/Microsoft/hcsshim v0.8.10
 	github.com/codahale/hdrhistogram v0.0.0-20160425231609-f8ad88b59a58 // indirect
 	github.com/containerd/console v1.0.1
-	// containerd: the actual version is replaced in replace()
-	github.com/containerd/containerd v1.4.1-0.20201117152358-0edc412565dc
+	github.com/containerd/containerd v1.4.1-0.20201117152358-0edc412565dc // the actual version is replaced in replace()
 	github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe
 	github.com/containerd/go-cni v1.0.1
 	github.com/containerd/go-runc v0.0.0-20201020171139-16b287bc67d0
@@ -64,7 +63,7 @@ require (
 	golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9
 	golang.org/x/net v0.0.0-20200707034311-ab3426394381
 	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208
-	golang.org/x/sys v0.0.0-20201013081832-0aaa2718063a
+	golang.org/x/sys v0.0.0-20210507161434-a76c4d0a0096
 	golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1
 	// genproto: the actual version is replaced in replace()
 	google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece
@@ -72,11 +71,16 @@ require (
 )
 
 replace (
-	// containerd: Forked from 0edc412565dcc6e3d6125ff9e4b009ad4b89c638 (20201117) with:
+	// containerd: vendoring from the docker/20.10 branch in https://github.com/moby/containerd
+	//
+	// Forked from 0edc412565dcc6e3d6125ff9e4b009ad4b89c638 (20201117) with:
+	// - `images: validate document type before unmarshal`   (eb9ba7ed8d46d48fb22362f9d91fff6fb837e37e)
+	// - `schema1: reject ambiguous documents`               (70c88f507579277ab7af23b06666e3b57d4b4f2d)
+	// - `Fix the Inheritable capability defaults`           (6906b57c721f9114377ceb069662b196876915c0)
 	// - `Adjust overlay tests to expect "index=off"`        (#4719, for ease of cherry-picking #5076)
 	// - `overlay: support "userxattr" option (kernel 5.11)` (#5076)
 	// - `docker: avoid concurrent map access panic`         (#4855)
-	github.com/containerd/containerd => github.com/AkihiroSuda/containerd v1.1.1-0.20210312044057-48f85a131bb8
+	github.com/containerd/containerd => github.com/moby/containerd v0.0.0-20220901192706-96c5ae04b678
 	// protobuf: corresponds to containerd
 	github.com/golang/protobuf => github.com/golang/protobuf v1.3.5
 	github.com/hashicorp/go-immutable-radix => github.com/tonistiigi/go-immutable-radix v0.0.0-20170803185627-826af9ccf0fe

vendor/github.com/moby/buildkit/snapshot/localmounter_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package snapshot

vendor/github.com/moby/buildkit/solver/errdefs/solve.go

@@ -14,7 +14,7 @@ func init() {
 	typeurl.Register((*Solve)(nil), "github.com/moby/buildkit", "errdefs.Solve+json")
 }
 
-//nolint:golint
+//nolint:revive
 type IsSolve_Subject isSolve_Subject
 
 // SolveError will be returned when an error is encountered during a solve that

vendor/github.com/moby/buildkit/solver/llbsolver/file/user_nolinux.go

@@ -1,3 +1,4 @@
+//go:build !linux
 // +build !linux
 
 package file

vendor/github.com/moby/buildkit/source/git/gitsource_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package git

vendor/github.com/moby/buildkit/source/git/gitsource_windows.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package git

vendor/github.com/moby/buildkit/source/git/redact_credentials_go114.go

@@ -0,0 +1,31 @@
+//go:build !go1.15
+// +build !go1.15
+
+package git
+
+import "net/url"
+
+// redactCredentials takes a URL and redacts a password from it.
+// e.g. "https://user:password@github.com/user/private-repo-failure.git" will be changed to
+// "https://user:xxxxx@github.com/user/private-repo-failure.git"
+func redactCredentials(s string) string {
+	u, err := url.Parse(s)
+	if err != nil {
+		return s // string is not a URL, just return it
+	}
+
+	return urlRedacted(u)
+}
+
+// urlRedacted comes from go's url.Redacted() which isn't available on go < 1.15
+func urlRedacted(u *url.URL) string {
+	if u == nil {
+		return ""
+	}
+
+	ru := *u
+	if _, has := ru.User.Password(); has {
+		ru.User = url.UserPassword(ru.User.Username(), "xxxxx")
+	}
+	return ru.String()
+}

vendor/github.com/moby/buildkit/util/apicaps/pb/generate.go

@@ -1,3 +1,3 @@
-package moby_buildkit_v1_apicaps //nolint:golint
+package moby_buildkit_v1_apicaps //nolint:revive
 
 //go:generate protoc -I=. -I=../../../vendor/ -I=../../../../../../ --gogo_out=plugins=grpc:. caps.proto

vendor/github.com/moby/buildkit/util/appdefaults/appdefaults_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package appdefaults

vendor/github.com/moby/buildkit/util/archutil/386_binary.go

@@ -1,3 +1,4 @@
+//go:build !386
 // +build !386
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/386_check.go

@@ -1,3 +1,4 @@
+//go:build !386
 // +build !386
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/386_check_386.go

@@ -1,3 +1,4 @@
+//go:build 386
 // +build 386
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/amd64_binary.go

@@ -1,3 +1,4 @@
+//go:build !amd64
 // +build !amd64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/amd64_check.go

@@ -1,3 +1,4 @@
+//go:build !amd64
 // +build !amd64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/amd64_check_amd64.go

@@ -1,3 +1,4 @@
+//go:build amd64
 // +build amd64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/arm64_binary.go

@@ -1,3 +1,4 @@
+//go:build !arm64
 // +build !arm64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/arm64_check.go

@@ -1,3 +1,4 @@
+//go:build !arm64
 // +build !arm64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/arm64_check_arm64.go

@@ -1,3 +1,4 @@
+//go:build arm64
 // +build arm64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/arm_binary.go

@@ -1,3 +1,4 @@
+//go:build !arm
 // +build !arm
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/arm_check.go

@@ -1,3 +1,4 @@
+//go:build !arm
 // +build !arm
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/arm_check_arm.go

@@ -1,3 +1,4 @@
+//go:build arm
 // +build arm
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/check_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/check_windows.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/ppc64le_binary.go

@@ -1,3 +1,4 @@
+//go:build !ppc64le
 // +build !ppc64le
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/ppc64le_check.go

@@ -1,3 +1,4 @@
+//go:build !ppc64le
 // +build !ppc64le
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/ppc64le_check_ppc64le.go

@@ -1,3 +1,4 @@
+//go:build ppc64le
 // +build ppc64le
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/riscv64_binary.go

@@ -1,3 +1,4 @@
+//go:build !riscv64
 // +build !riscv64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/riscv64_check.go

@@ -1,3 +1,4 @@
+//go:build !riscv64
 // +build !riscv64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/riscv64_check_riscv64.go

@@ -1,3 +1,4 @@
+//go:build riscv64
 // +build riscv64
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/s390x_binary.go

@@ -1,3 +1,4 @@
+//go:build !s390x
 // +build !s390x
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/s390x_check.go

@@ -1,3 +1,4 @@
+//go:build !s390x
 // +build !s390x
 
 package archutil

vendor/github.com/moby/buildkit/util/archutil/s390x_check_s390x.go

@@ -1,3 +1,4 @@
+//go:build s390x
 // +build s390x
 
 package archutil

vendor/github.com/moby/buildkit/util/entitlements/security/security_linux.go

@@ -154,7 +154,7 @@ func getFreeLoopID() (int, error) {
 	}
 	defer fd.Close()
 
-	const _LOOP_CTL_GET_FREE = 0x4C82 //nolint:golint
+	const _LOOP_CTL_GET_FREE = 0x4C82 //nolint:revive
 	r1, _, uerr := unix.Syscall(unix.SYS_IOCTL, fd.Fd(), _LOOP_CTL_GET_FREE, 0)
 	if uerr == 0 {
 		return int(r1), nil

vendor/github.com/moby/buildkit/util/network/host.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package network

vendor/github.com/moby/buildkit/util/rootless/specconv/specconv_nonlinux.go

@@ -1,3 +1,4 @@
+//go:build !linux
 // +build !linux
 
 package specconv

vendor/github.com/moby/buildkit/util/system/path_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package system

vendor/github.com/moby/buildkit/util/system/path_windows.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package system

vendor/github.com/moby/buildkit/util/system/seccomp_linux.go

@@ -1,3 +1,4 @@
+//go:build linux && seccomp
 // +build linux,seccomp
 
 package system

vendor/github.com/moby/buildkit/util/system/seccomp_nolinux.go

@@ -1,3 +1,4 @@
+//go:build !linux && seccomp
 // +build !linux,seccomp
 
 package system

vendor/github.com/moby/buildkit/util/system/seccomp_noseccomp.go

@@ -1,3 +1,4 @@
+//go:build !seccomp
 // +build !seccomp
 
 package system

vendor/github.com/moby/buildkit/util/winlayers/differ.go

@@ -108,8 +108,7 @@ func (s *winDiffer) Compare(ctx context.Context, lower, upper []mount.Mount, opt
 				if err != nil {
 					return errors.Wrap(err, "failed to get compressed stream")
 				}
-				var w io.Writer = io.MultiWriter(compressed, dgstr.Hash())
-				w, discard, done := makeWindowsLayer(w)
+				w, discard, done := makeWindowsLayer(io.MultiWriter(compressed, dgstr.Hash()))
 				err = archive.WriteDiff(ctx, w, lowerRoot, upperRoot)
 				if err != nil {
 					discard(err)