@@ -6,7 +6,7 @@ import (

 	"strings"

 	"github.com/docker/docker/pkg/idtools"

-	"github.com/docker/docker/pkg/symlink"

+	"github.com/moby/sys/symlink"

 	lcUser "github.com/opencontainers/runc/libcontainer/user"

 	"github.com/pkg/errors"

 )

@@ -9,7 +9,7 @@ import (

 	"path/filepath"

 	"strings"

-	"github.com/docker/docker/pkg/symlink"

+	"github.com/moby/sys/symlink"

 	"github.com/pkg/errors"

 )

@@ -32,13 +32,13 @@ import (

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/ioutils"

 	"github.com/docker/docker/pkg/signal"

-	"github.com/docker/docker/pkg/symlink"

 	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/restartmanager"

 	"github.com/docker/docker/volume"

 	volumemounts "github.com/docker/docker/volume/mounts"

 	units "github.com/docker/go-units"

 	agentexec "github.com/docker/swarmkit/agent/exec"

+	"github.com/moby/sys/symlink"

 	"github.com/pkg/errors"

 	"github.com/sirupsen/logrus"

 )

@@ -22,8 +22,8 @@ import (

 	"github.com/docker/docker/pkg/progress"

 	"github.com/docker/docker/pkg/streamformatter"

 	"github.com/docker/docker/pkg/stringid"

-	"github.com/docker/docker/pkg/symlink"

 	"github.com/docker/docker/pkg/system"

+	"github.com/moby/sys/symlink"

 	digest "github.com/opencontainers/go-digest"

 	"github.com/sirupsen/logrus"

 )

@@ -6,7 +6,7 @@ import (

 	"github.com/containerd/continuity/driver"

 	"github.com/containerd/continuity/pathdriver"

-	"github.com/docker/docker/pkg/symlink"

+	"github.com/moby/sys/symlink"

 )

 // ContainerFS is that represents a root file system

deleted file mode 100644

@@ -1,191 +0,0 @@

-

-                                 Apache License

-                           Version 2.0, January 2004

-                        http://www.apache.org/licenses/

-

-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

-

-   1. Definitions.

-

-      "License" shall mean the terms and conditions for use, reproduction,

-      and distribution as defined by Sections 1 through 9 of this document.

-

-      "Licensor" shall mean the copyright owner or entity authorized by

-      the copyright owner that is granting the License.

-

-      "Legal Entity" shall mean the union of the acting entity and all

-      other entities that control, are controlled by, or are under common

-      control with that entity. For the purposes of this definition,

-      "control" means (i) the power, direct or indirect, to cause the

-      direction or management of such entity, whether by contract or

-      otherwise, or (ii) ownership of fifty percent (50%) or more of the

-      outstanding shares, or (iii) beneficial ownership of such entity.

-

-      "You" (or "Your") shall mean an individual or Legal Entity

-      exercising permissions granted by this License.

-

-      "Source" form shall mean the preferred form for making modifications,

-      including but not limited to software source code, documentation

-      source, and configuration files.

-

-      "Object" form shall mean any form resulting from mechanical

-      transformation or translation of a Source form, including but

-      not limited to compiled object code, generated documentation,

-      and conversions to other media types.

-

-      "Work" shall mean the work of authorship, whether in Source or

-      Object form, made available under the License, as indicated by a

-      copyright notice that is included in or attached to the work

-      (an example is provided in the Appendix below).

-

-      "Derivative Works" shall mean any work, whether in Source or Object

-      form, that is based on (or derived from) the Work and for which the

-      editorial revisions, annotations, elaborations, or other modifications

-      represent, as a whole, an original work of authorship. For the purposes

-      of this License, Derivative Works shall not include works that remain

-      separable from, or merely link (or bind by name) to the interfaces of,

-      the Work and Derivative Works thereof.

-

-      "Contribution" shall mean any work of authorship, including

-      the original version of the Work and any modifications or additions

-      to that Work or Derivative Works thereof, that is intentionally

-      submitted to Licensor for inclusion in the Work by the copyright owner

-      or by an individual or Legal Entity authorized to submit on behalf of

-      the copyright owner. For the purposes of this definition, "submitted"

-      means any form of electronic, verbal, or written communication sent

-      to the Licensor or its representatives, including but not limited to

-      communication on electronic mailing lists, source code control systems,

-      and issue tracking systems that are managed by, or on behalf of, the

-      Licensor for the purpose of discussing and improving the Work, but

-      excluding communication that is conspicuously marked or otherwise

-      designated in writing by the copyright owner as "Not a Contribution."

-

-      "Contributor" shall mean Licensor and any individual or Legal Entity

-      on behalf of whom a Contribution has been received by Licensor and

-      subsequently incorporated within the Work.

-

-   2. Grant of Copyright License. Subject to the terms and conditions of

-      this License, each Contributor hereby grants to You a perpetual,

-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable

-      copyright license to reproduce, prepare Derivative Works of,

-      publicly display, publicly perform, sublicense, and distribute the

-      Work and such Derivative Works in Source or Object form.

-

-   3. Grant of Patent License. Subject to the terms and conditions of

-      this License, each Contributor hereby grants to You a perpetual,

-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable

-      (except as stated in this section) patent license to make, have made,

-      use, offer to sell, sell, import, and otherwise transfer the Work,

-      where such license applies only to those patent claims licensable

-      by such Contributor that are necessarily infringed by their

-      Contribution(s) alone or by combination of their Contribution(s)

-      with the Work to which such Contribution(s) was submitted. If You

-      institute patent litigation against any entity (including a

-      cross-claim or counterclaim in a lawsuit) alleging that the Work

-      or a Contribution incorporated within the Work constitutes direct

-      or contributory patent infringement, then any patent licenses

-      granted to You under this License for that Work shall terminate

-      as of the date such litigation is filed.

-

-   4. Redistribution. You may reproduce and distribute copies of the

-      Work or Derivative Works thereof in any medium, with or without

-      modifications, and in Source or Object form, provided that You

-      meet the following conditions:

-

-      (a) You must give any other recipients of the Work or

-          Derivative Works a copy of this License; and

-

-      (b) You must cause any modified files to carry prominent notices

-          stating that You changed the files; and

-

-      (c) You must retain, in the Source form of any Derivative Works

-          that You distribute, all copyright, patent, trademark, and

-          attribution notices from the Source form of the Work,

-          excluding those notices that do not pertain to any part of

-          the Derivative Works; and

-

-      (d) If the Work includes a "NOTICE" text file as part of its

-          distribution, then any Derivative Works that You distribute must

-          include a readable copy of the attribution notices contained

-          within such NOTICE file, excluding those notices that do not

-          pertain to any part of the Derivative Works, in at least one

-          of the following places: within a NOTICE text file distributed

-          as part of the Derivative Works; within the Source form or

-          documentation, if provided along with the Derivative Works; or,

-          within a display generated by the Derivative Works, if and

-          wherever such third-party notices normally appear. The contents

-          of the NOTICE file are for informational purposes only and

-          do not modify the License. You may add Your own attribution

-          notices within Derivative Works that You distribute, alongside

-          or as an addendum to the NOTICE text from the Work, provided

-          that such additional attribution notices cannot be construed

-          as modifying the License.

-

-      You may add Your own copyright statement to Your modifications and

-      may provide additional or different license terms and conditions

-      for use, reproduction, or distribution of Your modifications, or

-      for any such Derivative Works as a whole, provided Your use,

-      reproduction, and distribution of the Work otherwise complies with

-      the conditions stated in this License.

-

-   5. Submission of Contributions. Unless You explicitly state otherwise,

-      any Contribution intentionally submitted for inclusion in the Work

-      by You to the Licensor shall be under the terms and conditions of

-      this License, without any additional terms or conditions.

-      Notwithstanding the above, nothing herein shall supersede or modify

-      the terms of any separate license agreement you may have executed

-      with Licensor regarding such Contributions.

-

-   6. Trademarks. This License does not grant permission to use the trade

-      names, trademarks, service marks, or product names of the Licensor,

-      except as required for reasonable and customary use in describing the

-      origin of the Work and reproducing the content of the NOTICE file.

-

-   7. Disclaimer of Warranty. Unless required by applicable law or

-      agreed to in writing, Licensor provides the Work (and each

-      Contributor provides its Contributions) on an "AS IS" BASIS,

-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-      implied, including, without limitation, any warranties or conditions

-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A

-      PARTICULAR PURPOSE. You are solely responsible for determining the

-      appropriateness of using or redistributing the Work and assume any

-      risks associated with Your exercise of permissions under this License.

-

-   8. Limitation of Liability. In no event and under no legal theory,

-      whether in tort (including negligence), contract, or otherwise,

-      unless required by applicable law (such as deliberate and grossly

-      negligent acts) or agreed to in writing, shall any Contributor be

-      liable to You for damages, including any direct, indirect, special,

-      incidental, or consequential damages of any character arising as a

-      result of this License or out of the use or inability to use the

-      Work (including but not limited to damages for loss of goodwill,

-      work stoppage, computer failure or malfunction, or any and all

-      other commercial damages or losses), even if such Contributor

-      has been advised of the possibility of such damages.

-

-   9. Accepting Warranty or Additional Liability. While redistributing

-      the Work or Derivative Works thereof, You may choose to offer,

-      and charge a fee for, acceptance of support, warranty, indemnity,

-      or other liability obligations and/or rights consistent with this

-      License. However, in accepting such obligations, You may act only

-      on Your own behalf and on Your sole responsibility, not on behalf

-      of any other Contributor, and only if You agree to indemnify,

-      defend, and hold each Contributor harmless for any liability

-      incurred by, or claims asserted against, such Contributor by reason

-      of your accepting any such warranty or additional liability.

-

-   END OF TERMS AND CONDITIONS

-

-   Copyright 2014-2018 Docker, Inc.

-

-   Licensed under the Apache License, Version 2.0 (the "License");

-   you may not use this file except in compliance with the License.

-   You may obtain a copy of the License at

-

-       http://www.apache.org/licenses/LICENSE-2.0

-

-   Unless required by applicable law or agreed to in writing, software

-   distributed under the License is distributed on an "AS IS" BASIS,

-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

-   See the License for the specific language governing permissions and

-   limitations under the License.

deleted file mode 100644

@@ -1,27 +0,0 @@

-Copyright (c) 2014-2018 The Docker & Go Authors. All rights reserved.

-

-Redistribution and use in source and binary forms, with or without

-modification, are permitted provided that the following conditions are

-met:

-

-   * Redistributions of source code must retain the above copyright

-notice, this list of conditions and the following disclaimer.

-   * Redistributions in binary form must reproduce the above

-copyright notice, this list of conditions and the following disclaimer

-in the documentation and/or other materials provided with the

-distribution.

-   * Neither the name of Google Inc. nor the names of its

-contributors may be used to endorse or promote products derived from

-this software without specific prior written permission.

-

-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

deleted file mode 100644

@@ -1,6 +0,0 @@

-Package symlink implements EvalSymlinksInScope which is an extension of filepath.EvalSymlinks,

-as well as a Windows long-path aware version of filepath.EvalSymlinks

-from the [Go standard library](https://golang.org/pkg/path/filepath).

-

-The code from filepath.EvalSymlinks has been adapted in fs.go.

-Please read the LICENSE.BSD file that governs fs.go and LICENSE.APACHE for fs_test.go.

new file mode 100644

@@ -0,0 +1,12 @@

+package symlink // import "github.com/docker/docker/pkg/symlink"

+

+import "github.com/moby/sys/symlink"

+

+var (

+	// EvalSymlinks is deprecated and moved to github.com/moby/sys/symlink

+	// Deprecated: use github.com/moby/sys/symlink.EvalSymlinks instead

+	EvalSymlinks = symlink.EvalSymlinks

+	// FollowSymlinkInScope is deprecated and moved to github.com/moby/sys/symlink

+	// Deprecated: use github.com/moby/sys/symlink.FollowSymlinkInScope instead

+	FollowSymlinkInScope = symlink.FollowSymlinkInScope

+)

deleted file mode 100644

@@ -1,142 +0,0 @@

-// Copyright 2012 The Go Authors. All rights reserved.

-// Use of this source code is governed by a BSD-style

-// license that can be found in the LICENSE.BSD file.

-

-// This code is a modified version of path/filepath/symlink.go from the Go standard library.

-

-package symlink // import "github.com/docker/docker/pkg/symlink"

-

-import (

-	"bytes"

-	"errors"

-	"os"

-	"path/filepath"

-	"strings"

-)

-

-// FollowSymlinkInScope is a wrapper around evalSymlinksInScope that returns an

-// absolute path. This function handles paths in a platform-agnostic manner.

-func FollowSymlinkInScope(path, root string) (string, error) {

-	path, err := filepath.Abs(filepath.FromSlash(path))

-	if err != nil {

-		return "", err

-	}

-	root, err = filepath.Abs(filepath.FromSlash(root))

-	if err != nil {

-		return "", err

-	}

-	return evalSymlinksInScope(path, root)

-}

-

-// evalSymlinksInScope will evaluate symlinks in `path` within a scope `root` and return

-// a result guaranteed to be contained within the scope `root`, at the time of the call.

-// Symlinks in `root` are not evaluated and left as-is.

-// Errors encountered while attempting to evaluate symlinks in path will be returned.

-// Non-existing paths are valid and do not constitute an error.

-// `path` has to contain `root` as a prefix, or else an error will be returned.

-// Trying to break out from `root` does not constitute an error.

-//

-// Example:

-//   If /foo/bar -> /outside,

-//   FollowSymlinkInScope("/foo/bar", "/foo") == "/foo/outside" instead of "/outside"

-//

-// IMPORTANT: it is the caller's responsibility to call evalSymlinksInScope *after* relevant symlinks

-// are created and not to create subsequently, additional symlinks that could potentially make a

-// previously-safe path, unsafe. Example: if /foo/bar does not exist, evalSymlinksInScope("/foo/bar", "/foo")

-// would return "/foo/bar". If one makes /foo/bar a symlink to /baz subsequently, then "/foo/bar" should

-// no longer be considered safely contained in "/foo".

-func evalSymlinksInScope(path, root string) (string, error) {

-	root = filepath.Clean(root)

-	if path == root {

-		return path, nil

-	}

-	if !strings.HasPrefix(path, root) {

-		return "", errors.New("evalSymlinksInScope: " + path + " is not in " + root)

-	}

-	const maxIter = 255

-	originalPath := path

-	// given root of "/a" and path of "/a/b/../../c" we want path to be "/b/../../c"

-	path = path[len(root):]

-	if root == string(filepath.Separator) {

-		path = string(filepath.Separator) + path

-	}

-	if !strings.HasPrefix(path, string(filepath.Separator)) {

-		return "", errors.New("evalSymlinksInScope: " + path + " is not in " + root)

-	}

-	path = filepath.Clean(path)

-	// consume path by taking each frontmost path element,

-	// expanding it if it's a symlink, and appending it to b

-	var b bytes.Buffer

-	// b here will always be considered to be the "current absolute path inside

-	// root" when we append paths to it, we also append a slash and use

-	// filepath.Clean after the loop to trim the trailing slash

-	for n := 0; path != ""; n++ {

-		if n > maxIter {

-			return "", errors.New("evalSymlinksInScope: too many links in " + originalPath)

-		}

-

-		// find next path component, p

-		i := strings.IndexRune(path, filepath.Separator)

-		var p string

-		if i == -1 {

-			p, path = path, ""

-		} else {

-			p, path = path[:i], path[i+1:]

-		}

-

-		if p == "" {

-			continue

-		}

-

-		// this takes a b.String() like "b/../" and a p like "c" and turns it

-		// into "/b/../c" which then gets filepath.Cleaned into "/c" and then

-		// root gets prepended and we Clean again (to remove any trailing slash

-		// if the first Clean gave us just "/")

-		cleanP := filepath.Clean(string(filepath.Separator) + b.String() + p)

-		if isDriveOrRoot(cleanP) {

-			// never Lstat "/" itself, or drive letters on Windows

-			b.Reset()

-			continue

-		}

-		fullP := filepath.Clean(root + cleanP)

-

-		fi, err := os.Lstat(fullP)

-		if os.IsNotExist(err) {

-			// if p does not exist, accept it

-			b.WriteString(p)

-			b.WriteRune(filepath.Separator)

-			continue

-		}

-		if err != nil {

-			return "", err

-		}

-		if fi.Mode()&os.ModeSymlink == 0 {

-			b.WriteString(p)

-			b.WriteRune(filepath.Separator)

-			continue

-		}

-

-		// it's a symlink, put it at the front of path

-		dest, err := os.Readlink(fullP)

-		if err != nil {

-			return "", err

-		}

-		if isAbs(dest) {

-			b.Reset()

-		}

-		path = dest + string(filepath.Separator) + path

-	}

-

-	// see note above on "fullP := ..." for why this is double-cleaned and

-	// what's happening here

-	return filepath.Clean(root + filepath.Clean(string(filepath.Separator)+b.String())), nil

-}

-

-// EvalSymlinks returns the path name after the evaluation of any symbolic

-// links.

-// If path is relative the result will be relative to the current directory,

-// unless one of the components is an absolute symbolic link.

-// This version has been updated to support long paths prepended with `\\?\`.

-func EvalSymlinks(path string) (string, error) {

-	return evalSymlinks(path)

-}

deleted file mode 100644

@@ -1,17 +0,0 @@

-// +build !windows

-

-package symlink // import "github.com/docker/docker/pkg/symlink"

-

-import (

-	"path/filepath"

-)

-

-func evalSymlinks(path string) (string, error) {

-	return filepath.EvalSymlinks(path)

-}

-

-func isDriveOrRoot(p string) bool {

-	return p == string(filepath.Separator)

-}

-

-var isAbs = filepath.IsAbs

deleted file mode 100644

@@ -1,407 +0,0 @@

-// +build !windows

-

-// Licensed under the Apache License, Version 2.0; See LICENSE.APACHE

-

-package symlink // import "github.com/docker/docker/pkg/symlink"

-

-import (

-	"fmt"

-	"io/ioutil"

-	"os"

-	"path/filepath"

-	"testing"

-)

-

-// TODO Windows: This needs some serious work to port to Windows. For now,

-// turning off testing in this package.

-

-type dirOrLink struct {

-	path   string

-	target string

-}

-

-func makeFs(tmpdir string, fs []dirOrLink) error {

-	for _, s := range fs {

-		s.path = filepath.Join(tmpdir, s.path)

-		if s.target == "" {

-			os.MkdirAll(s.path, 0755)

-			continue

-		}

-		if err := os.MkdirAll(filepath.Dir(s.path), 0755); err != nil {

-			return err

-		}

-		if err := os.Symlink(s.target, s.path); err != nil && !os.IsExist(err) {

-			return err

-		}

-	}

-	return nil

-}

-

-func testSymlink(tmpdir, path, expected, scope string) error {

-	rewrite, err := FollowSymlinkInScope(filepath.Join(tmpdir, path), filepath.Join(tmpdir, scope))

-	if err != nil {

-		return err

-	}

-	expected, err = filepath.Abs(filepath.Join(tmpdir, expected))

-	if err != nil {

-		return err

-	}

-	if expected != rewrite {

-		return fmt.Errorf("Expected %q got %q", expected, rewrite)

-	}

-	return nil

-}

-

-func TestFollowSymlinkAbsolute(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkAbsolute")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-	if err := makeFs(tmpdir, []dirOrLink{{path: "testdata/fs/a/d", target: "/b"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "testdata/fs/a/d/c/data", "testdata/b/c/data", "testdata"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkRelativePath(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkRelativePath")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-	if err := makeFs(tmpdir, []dirOrLink{{path: "testdata/fs/i", target: "a"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "testdata/fs/i", "testdata/fs/a", "testdata"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkSkipSymlinksOutsideScope(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkSkipSymlinksOutsideScope")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-	if err := makeFs(tmpdir, []dirOrLink{

-		{path: "linkdir", target: "realdir"},

-		{path: "linkdir/foo/bar"},

-	}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "linkdir/foo/bar", "linkdir/foo/bar", "linkdir/foo"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkInvalidScopePathPair(t *testing.T) {

-	if _, err := FollowSymlinkInScope("toto", "testdata"); err == nil {

-		t.Fatal("expected an error")

-	}

-}

-

-func TestFollowSymlinkLastLink(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkLastLink")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-	if err := makeFs(tmpdir, []dirOrLink{{path: "testdata/fs/a/d", target: "/b"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "testdata/fs/a/d", "testdata/b", "testdata"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkRelativeLinkChangeScope(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkRelativeLinkChangeScope")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-	if err := makeFs(tmpdir, []dirOrLink{{path: "testdata/fs/a/e", target: "../b"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "testdata/fs/a/e/c/data", "testdata/fs/b/c/data", "testdata"); err != nil {

-		t.Fatal(err)

-	}

-	// avoid letting allowing symlink e lead us to ../b

-	// normalize to the "testdata/fs/a"

-	if err := testSymlink(tmpdir, "testdata/fs/a/e", "testdata/fs/a/b", "testdata/fs/a"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkDeepRelativeLinkChangeScope(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkDeepRelativeLinkChangeScope")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	if err := makeFs(tmpdir, []dirOrLink{{path: "testdata/fs/a/f", target: "../../../../test"}}); err != nil {

-		t.Fatal(err)

-	}

-	// avoid letting symlink f lead us out of the "testdata" scope

-	// we don't normalize because symlink f is in scope and there is no

-	// information leak

-	if err := testSymlink(tmpdir, "testdata/fs/a/f", "testdata/test", "testdata"); err != nil {

-		t.Fatal(err)

-	}

-	// avoid letting symlink f lead us out of the "testdata/fs" scope

-	// we don't normalize because symlink f is in scope and there is no

-	// information leak

-	if err := testSymlink(tmpdir, "testdata/fs/a/f", "testdata/fs/test", "testdata/fs"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkRelativeLinkChain(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkRelativeLinkChain")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	// avoid letting symlink g (pointed at by symlink h) take out of scope

-	// TODO: we should probably normalize to scope here because ../[....]/root

-	// is out of scope and we leak information

-	if err := makeFs(tmpdir, []dirOrLink{

-		{path: "testdata/fs/b/h", target: "../g"},

-		{path: "testdata/fs/g", target: "../../../../../../../../../../../../root"},

-	}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "testdata/fs/b/h", "testdata/root", "testdata"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkBreakoutPath(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkBreakoutPath")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	// avoid letting symlink -> ../directory/file escape from scope

-	// normalize to "testdata/fs/j"

-	if err := makeFs(tmpdir, []dirOrLink{{path: "testdata/fs/j/k", target: "../i/a"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "testdata/fs/j/k", "testdata/fs/j/i/a", "testdata/fs/j"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkToRoot(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkToRoot")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	// make sure we don't allow escaping to /

-	// normalize to dir

-	if err := makeFs(tmpdir, []dirOrLink{{path: "foo", target: "/"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "foo", "", ""); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkSlashDotdot(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkSlashDotdot")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-	tmpdir = filepath.Join(tmpdir, "dir", "subdir")

-

-	// make sure we don't allow escaping to /

-	// normalize to dir

-	if err := makeFs(tmpdir, []dirOrLink{{path: "foo", target: "/../../"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "foo", "", ""); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkDotdot(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkDotdot")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-	tmpdir = filepath.Join(tmpdir, "dir", "subdir")

-

-	// make sure we stay in scope without leaking information

-	// this also checks for escaping to /

-	// normalize to dir

-	if err := makeFs(tmpdir, []dirOrLink{{path: "foo", target: "../../"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "foo", "", ""); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkRelativePath2(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkRelativePath2")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	if err := makeFs(tmpdir, []dirOrLink{{path: "bar/foo", target: "baz/target"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "bar/foo", "bar/baz/target", ""); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkScopeLink(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkScopeLink")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	if err := makeFs(tmpdir, []dirOrLink{

-		{path: "root2"},

-		{path: "root", target: "root2"},

-		{path: "root2/foo", target: "../bar"},

-	}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "root/foo", "root/bar", "root"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkRootScope(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkRootScope")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	expected, err := filepath.EvalSymlinks(tmpdir)

-	if err != nil {

-		t.Fatal(err)

-	}

-	rewrite, err := FollowSymlinkInScope(tmpdir, "/")

-	if err != nil {

-		t.Fatal(err)

-	}

-	if rewrite != expected {

-		t.Fatalf("expected %q got %q", expected, rewrite)

-	}

-}

-

-func TestFollowSymlinkEmpty(t *testing.T) {

-	res, err := FollowSymlinkInScope("", "")

-	if err != nil {

-		t.Fatal(err)

-	}

-	wd, err := os.Getwd()

-	if err != nil {

-		t.Fatal(err)

-	}

-	if res != wd {

-		t.Fatalf("expected %q got %q", wd, res)

-	}

-}

-

-func TestFollowSymlinkCircular(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkCircular")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	if err := makeFs(tmpdir, []dirOrLink{{path: "root/foo", target: "foo"}}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "root/foo", "", "root"); err == nil {

-		t.Fatal("expected an error for foo -> foo")

-	}

-

-	if err := makeFs(tmpdir, []dirOrLink{

-		{path: "root/bar", target: "baz"},

-		{path: "root/baz", target: "../bak"},

-		{path: "root/bak", target: "/bar"},

-	}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "root/foo", "", "root"); err == nil {

-		t.Fatal("expected an error for bar -> baz -> bak -> bar")

-	}

-}

-

-func TestFollowSymlinkComplexChainWithTargetPathsContainingLinks(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkComplexChainWithTargetPathsContainingLinks")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	if err := makeFs(tmpdir, []dirOrLink{

-		{path: "root2"},

-		{path: "root", target: "root2"},

-		{path: "root/a", target: "r/s"},

-		{path: "root/r", target: "../root/t"},

-		{path: "root/root/t/s/b", target: "/../u"},

-		{path: "root/u/c", target: "."},

-		{path: "root/u/x/y", target: "../v"},

-		{path: "root/u/v", target: "/../w"},

-	}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "root/a/b/c/x/y/z", "root/w/z", "root"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkBreakoutNonExistent(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkBreakoutNonExistent")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	if err := makeFs(tmpdir, []dirOrLink{

-		{path: "root/slash", target: "/"},

-		{path: "root/sym", target: "/idontexist/../slash"},

-	}); err != nil {

-		t.Fatal(err)

-	}

-	if err := testSymlink(tmpdir, "root/sym/file", "root/file", "root"); err != nil {

-		t.Fatal(err)

-	}

-}

-

-func TestFollowSymlinkNoLexicalCleaning(t *testing.T) {

-	tmpdir, err := ioutil.TempDir("", "TestFollowSymlinkNoLexicalCleaning")

-	if err != nil {

-		t.Fatal(err)

-	}

-	defer os.RemoveAll(tmpdir)

-

-	if err := makeFs(tmpdir, []dirOrLink{

-		{path: "root/sym", target: "/foo/bar"},

-		{path: "root/hello", target: "/sym/../baz"},

-	}); err != nil {