@@ -91,7 +91,7 @@ require (

 	github.com/rootless-containers/rootlesskit/v2 v2.3.2

 	github.com/sirupsen/logrus v1.9.3

 	github.com/spf13/cobra v1.8.1

-	github.com/spf13/pflag v1.0.5

+	github.com/spf13/pflag v1.0.6

 	github.com/tonistiigi/go-archvariant v1.0.0

 	github.com/vbatts/tar-split v0.11.6

 	github.com/vishvananda/netlink v1.3.1-0.20240922070040-084abd93d350

@@ -503,8 +503,9 @@ github.com/spdx/tools-golang v0.5.3 h1:ialnHeEYUC4+hkm5vJm4qz2x+oEJbS0mAMFrNXdQr

 github.com/spdx/tools-golang v0.5.3/go.mod h1:/ETOahiAo96Ob0/RAIBmFZw6XN0yTnyr/uFZm2NTMhI=

 github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=

 github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=

-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=

 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=

+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=

+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=

 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=

new file mode 100644

@@ -0,0 +1,4 @@

+linters:

+    disable-all: true

+    enable:

+        - nolintlint

@@ -160,7 +160,7 @@ type FlagSet struct {

 	args              []string // arguments after flags

 	argsLenAtDash     int      // len(args) when a '--' was located when parsing, or -1 if no --

 	errorHandling     ErrorHandling

-	output            io.Writer // nil means stderr; use out() accessor

+	output            io.Writer // nil means stderr; use Output() accessor

 	interspersed      bool      // allow interspersed option/non-option args

 	normalizeNameFunc func(f *FlagSet, name string) NormalizedName

@@ -255,13 +255,20 @@ func (f *FlagSet) normalizeFlagName(name string) NormalizedName {

 	return n(f, name)

 }

-func (f *FlagSet) out() io.Writer {

+// Output returns the destination for usage and error messages. os.Stderr is returned if

+// output was not set or was set to nil.

+func (f *FlagSet) Output() io.Writer {

 	if f.output == nil {

 		return os.Stderr

 	}

 	return f.output

 }

+// Name returns the name of the flag set.

+func (f *FlagSet) Name() string {

+	return f.name

+}

+

 // SetOutput sets the destination for usage and error messages.

 // If output is nil, os.Stderr is used.

 func (f *FlagSet) SetOutput(output io.Writer) {

@@ -358,7 +365,7 @@ func (f *FlagSet) ShorthandLookup(name string) *Flag {

 	}

 	if len(name) > 1 {

 		msg := fmt.Sprintf("can not look up shorthand which is more than one ASCII character: %q", name)

-		fmt.Fprintf(f.out(), msg)

+		fmt.Fprintf(f.Output(), msg)

 		panic(msg)

 	}

 	c := name[0]

@@ -482,7 +489,7 @@ func (f *FlagSet) Set(name, value string) error {

 	}

 	if flag.Deprecated != "" {

-		fmt.Fprintf(f.out(), "Flag --%s has been deprecated, %s\n", flag.Name, flag.Deprecated)

+		fmt.Fprintf(f.Output(), "Flag --%s has been deprecated, %s\n", flag.Name, flag.Deprecated)

 	}

 	return nil

 }

@@ -523,7 +530,7 @@ func Set(name, value string) error {

 // otherwise, the default values of all defined flags in the set.

 func (f *FlagSet) PrintDefaults() {

 	usages := f.FlagUsages()

-	fmt.Fprint(f.out(), usages)

+	fmt.Fprint(f.Output(), usages)

 }

 // defaultIsZeroValue returns true if the default value for this flag represents

@@ -758,7 +765,7 @@ func PrintDefaults() {

 // defaultUsage is the default function to print a usage message.

 func defaultUsage(f *FlagSet) {

-	fmt.Fprintf(f.out(), "Usage of %s:\n", f.name)

+	fmt.Fprintf(f.Output(), "Usage of %s:\n", f.name)

 	f.PrintDefaults()

 }

@@ -844,7 +851,7 @@ func (f *FlagSet) AddFlag(flag *Flag) {

 	_, alreadyThere := f.formal[normalizedFlagName]

 	if alreadyThere {

 		msg := fmt.Sprintf("%s flag redefined: %s", f.name, flag.Name)

-		fmt.Fprintln(f.out(), msg)

+		fmt.Fprintln(f.Output(), msg)

 		panic(msg) // Happens only if flags are declared with identical names

 	}

 	if f.formal == nil {

@@ -860,7 +867,7 @@ func (f *FlagSet) AddFlag(flag *Flag) {

 	}

 	if len(flag.Shorthand) > 1 {

 		msg := fmt.Sprintf("%q shorthand is more than one ASCII character", flag.Shorthand)

-		fmt.Fprintf(f.out(), msg)

+		fmt.Fprintf(f.Output(), msg)

 		panic(msg)

 	}

 	if f.shorthands == nil {

@@ -870,7 +877,7 @@ func (f *FlagSet) AddFlag(flag *Flag) {

 	used, alreadyThere := f.shorthands[c]

 	if alreadyThere {

 		msg := fmt.Sprintf("unable to redefine %q shorthand in %q flagset: it's already used for %q flag", c, f.name, used.Name)

-		fmt.Fprintf(f.out(), msg)

+		fmt.Fprintf(f.Output(), msg)

 		panic(msg)

 	}

 	f.shorthands[c] = flag

@@ -909,7 +916,7 @@ func VarP(value Value, name, shorthand, usage string) {

 func (f *FlagSet) failf(format string, a ...interface{}) error {

 	err := fmt.Errorf(format, a...)

 	if f.errorHandling != ContinueOnError {

-		fmt.Fprintln(f.out(), err)

+		fmt.Fprintln(f.Output(), err)

 		f.usage()

 	}

 	return err

@@ -1060,7 +1067,7 @@ func (f *FlagSet) parseSingleShortArg(shorthands string, args []string, fn parse

 	}

 	if flag.ShorthandDeprecated != "" {

-		fmt.Fprintf(f.out(), "Flag shorthand -%s has been deprecated, %s\n", flag.Shorthand, flag.ShorthandDeprecated)

+		fmt.Fprintf(f.Output(), "Flag shorthand -%s has been deprecated, %s\n", flag.Shorthand, flag.ShorthandDeprecated)

 	}

 	err = fn(flag, value)

@@ -16,6 +16,9 @@ func newIPValue(val net.IP, p *net.IP) *ipValue {

 func (i *ipValue) String() string { return net.IP(*i).String() }

 func (i *ipValue) Set(s string) error {

+	if s == "" {

+		return nil

+	}

 	ip := net.ParseIP(strings.TrimSpace(s))

 	if ip == nil {

 		return fmt.Errorf("failed to parse IP: %q", s)

new file mode 100644

@@ -0,0 +1,147 @@

+package pflag

+

+import (

+	"fmt"

+	"io"

+	"net"

+	"strings"

+)

+

+// -- ipNetSlice Value

+type ipNetSliceValue struct {

+	value   *[]net.IPNet

+	changed bool

+}

+

+func newIPNetSliceValue(val []net.IPNet, p *[]net.IPNet) *ipNetSliceValue {

+	ipnsv := new(ipNetSliceValue)

+	ipnsv.value = p

+	*ipnsv.value = val

+	return ipnsv

+}

+

+// Set converts, and assigns, the comma-separated IPNet argument string representation as the []net.IPNet value of this flag.

+// If Set is called on a flag that already has a []net.IPNet assigned, the newly converted values will be appended.

+func (s *ipNetSliceValue) Set(val string) error {

+

+	// remove all quote characters

+	rmQuote := strings.NewReplacer(`"`, "", `'`, "", "`", "")

+

+	// read flag arguments with CSV parser

+	ipNetStrSlice, err := readAsCSV(rmQuote.Replace(val))

+	if err != nil && err != io.EOF {

+		return err

+	}

+

+	// parse ip values into slice

+	out := make([]net.IPNet, 0, len(ipNetStrSlice))

+	for _, ipNetStr := range ipNetStrSlice {

+		_, n, err := net.ParseCIDR(strings.TrimSpace(ipNetStr))

+		if err != nil {

+			return fmt.Errorf("invalid string being converted to CIDR: %s", ipNetStr)

+		}

+		out = append(out, *n)

+	}

+

+	if !s.changed {

+		*s.value = out

+	} else {

+		*s.value = append(*s.value, out...)

+	}

+

+	s.changed = true

+

+	return nil

+}

+

+// Type returns a string that uniquely represents this flag's type.

+func (s *ipNetSliceValue) Type() string {

+	return "ipNetSlice"

+}

+

+// String defines a "native" format for this net.IPNet slice flag value.

+func (s *ipNetSliceValue) String() string {

+

+	ipNetStrSlice := make([]string, len(*s.value))

+	for i, n := range *s.value {

+		ipNetStrSlice[i] = n.String()

+	}

+

+	out, _ := writeAsCSV(ipNetStrSlice)

+	return "[" + out + "]"

+}

+

+func ipNetSliceConv(val string) (interface{}, error) {

+	val = strings.Trim(val, "[]")

+	// Emtpy string would cause a slice with one (empty) entry

+	if len(val) == 0 {

+		return []net.IPNet{}, nil

+	}

+	ss := strings.Split(val, ",")

+	out := make([]net.IPNet, len(ss))

+	for i, sval := range ss {

+		_, n, err := net.ParseCIDR(strings.TrimSpace(sval))

+		if err != nil {

+			return nil, fmt.Errorf("invalid string being converted to CIDR: %s", sval)

+		}

+		out[i] = *n

+	}

+	return out, nil

+}

+

+// GetIPNetSlice returns the []net.IPNet value of a flag with the given name

+func (f *FlagSet) GetIPNetSlice(name string) ([]net.IPNet, error) {

+	val, err := f.getFlagType(name, "ipNetSlice", ipNetSliceConv)

+	if err != nil {

+		return []net.IPNet{}, err

+	}

+	return val.([]net.IPNet), nil

+}

+

+// IPNetSliceVar defines a ipNetSlice flag with specified name, default value, and usage string.

+// The argument p points to a []net.IPNet variable in which to store the value of the flag.

+func (f *FlagSet) IPNetSliceVar(p *[]net.IPNet, name string, value []net.IPNet, usage string) {

+	f.VarP(newIPNetSliceValue(value, p), name, "", usage)

+}

+

+// IPNetSliceVarP is like IPNetSliceVar, but accepts a shorthand letter that can be used after a single dash.

+func (f *FlagSet) IPNetSliceVarP(p *[]net.IPNet, name, shorthand string, value []net.IPNet, usage string) {

+	f.VarP(newIPNetSliceValue(value, p), name, shorthand, usage)

+}

+

+// IPNetSliceVar defines a []net.IPNet flag with specified name, default value, and usage string.

+// The argument p points to a []net.IPNet variable in which to store the value of the flag.

+func IPNetSliceVar(p *[]net.IPNet, name string, value []net.IPNet, usage string) {

+	CommandLine.VarP(newIPNetSliceValue(value, p), name, "", usage)

+}

+

+// IPNetSliceVarP is like IPNetSliceVar, but accepts a shorthand letter that can be used after a single dash.

+func IPNetSliceVarP(p *[]net.IPNet, name, shorthand string, value []net.IPNet, usage string) {

+	CommandLine.VarP(newIPNetSliceValue(value, p), name, shorthand, usage)

+}

+

+// IPNetSlice defines a []net.IPNet flag with specified name, default value, and usage string.

+// The return value is the address of a []net.IPNet variable that stores the value of that flag.

+func (f *FlagSet) IPNetSlice(name string, value []net.IPNet, usage string) *[]net.IPNet {

+	p := []net.IPNet{}

+	f.IPNetSliceVarP(&p, name, "", value, usage)

+	return &p

+}

+

+// IPNetSliceP is like IPNetSlice, but accepts a shorthand letter that can be used after a single dash.

+func (f *FlagSet) IPNetSliceP(name, shorthand string, value []net.IPNet, usage string) *[]net.IPNet {

+	p := []net.IPNet{}

+	f.IPNetSliceVarP(&p, name, shorthand, value, usage)

+	return &p

+}

+

+// IPNetSlice defines a []net.IPNet flag with specified name, default value, and usage string.

+// The return value is the address of a []net.IP variable that stores the value of the flag.

+func IPNetSlice(name string, value []net.IPNet, usage string) *[]net.IPNet {

+	return CommandLine.IPNetSliceP(name, "", value, usage)

+}

+

+// IPNetSliceP is like IPNetSlice, but accepts a shorthand letter that can be used after a single dash.

+func IPNetSliceP(name, shorthand string, value []net.IPNet, usage string) *[]net.IPNet {

+	return CommandLine.IPNetSliceP(name, shorthand, value, usage)

+}

@@ -31,11 +31,7 @@ func (s *stringArrayValue) Append(val string) error {

 func (s *stringArrayValue) Replace(val []string) error {

 	out := make([]string, len(val))

 	for i, d := range val {

-		var err error

 		out[i] = d

-		if err != nil {

-			return err

-		}

 	}

 	*s.value = out

 	return nil

@@ -1107,7 +1107,7 @@ github.com/spdx/tools-golang/spdx/v2/v2_3

 # github.com/spf13/cobra v1.8.1

 ## explicit; go 1.15

 github.com/spf13/cobra

-# github.com/spf13/pflag v1.0.5

+# github.com/spf13/pflag v1.0.6

 ## explicit; go 1.12

 github.com/spf13/pflag

 # github.com/stretchr/testify v1.10.0