ci: update golangci to v2.8.0

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

.golangci.yml

@@ -121,6 +121,9 @@ linters:
       - linters:
           - revive
         text: if-return
+      - linters:
+          - revive
+        text: var-naming
     paths:
       - .*\.pb\.go$
       - examples

api/services/control/control_bench_test.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1 //nolint:revive,staticcheck
+package moby_buildkit_v1 //nolint:staticcheck
 
 import (
 	"testing"

cache/manager_test.go

@@ -2783,7 +2783,7 @@ func mapToSystemTarBlob(t *testing.T, m map[string]string) ([]byte, ocispecs.Des
 		}
 	}
 
-	cmd := exec.Command("tar", "-C", tmpdir, "-c", ".")
+	cmd := exec.CommandContext(context.TODO(), "tar", "-C", tmpdir, "-c", ".")
 	tarout, err := cmd.Output()
 	if err != nil {
 		return nil, ocispecs.Descriptor{}, err

cache/remotecache/gha/gha.go

@@ -332,7 +332,7 @@ func (ce *exporter) Finalize(ctx context.Context) (_ map[string]string, err erro
 	signDone := progress.OneOff(ctx, fmt.Sprintf("signing cache index %s", dgst))
 	defer signDone(err)
 
-	cmd := exec.Command(args[0], args[1:]...) //nolint:gosec // defined in toml config
+	cmd := exec.CommandContext(ctx, args[0], args[1:]...) //nolint:gosec // defined in toml config
 	cmd.Stdin = bytes.NewReader(dt)
 	var out bytes.Buffer
 	cmd.Stdout = &out

client/client_test.go

@@ -1021,7 +1021,8 @@ func testRawSocketMount(t *testing.T, sb integration.Sandbox) {
 
 	dir := t.TempDir()
 	sockPath := filepath.Join(dir, "test.sock")
-	l, err := net.Listen("unix", sockPath)
+	listener := net.ListenConfig{}
+	l, err := listener.Listen(context.TODO(), "unix", sockPath)
 	require.NoError(t, err)
 	defer l.Close()
 
@@ -11643,7 +11644,8 @@ func makeSSHAgentSock(t *testing.T, agent agent.Agent) (p string, err error) {
 	tmpDir := integration.Tmpdir(t)
 	sockPath := filepath.Join(tmpDir.Name, "ssh_auth_sock")
 
-	l, err := net.Listen("unix", sockPath)
+	listener := net.ListenConfig{}
+	l, err := listener.Listen(context.TODO(), "unix", sockPath)
 	if err != nil {
 		return "", err
 	}
@@ -12139,19 +12141,19 @@ func testGitResolveSourceMetadata(t *testing.T, sb integration.Sandbox) {
 	err = runInDir(gitDir, gitCommands...)
 	require.NoError(t, err)
 
-	cmd := exec.Command("git", "rev-parse", "HEAD")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "HEAD")
 	cmd.Dir = gitDir
 	out, err := cmd.Output()
 	require.NoError(t, err)
 	commitHEAD := strings.TrimSpace(string(out))
 
-	cmd = exec.Command("git", "rev-parse", "v0.1")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v0.1")
 	cmd.Dir = gitDir
 	out, err = cmd.Output()
 	require.NoError(t, err)
 	commitTag := strings.TrimSpace(string(out))
 
-	cmd = exec.Command("git", "rev-parse", "v0.1^{commit}")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v0.1^{commit}")
 	cmd.Dir = gitDir
 	out, err = cmd.Output()
 	require.NoError(t, err)
@@ -12718,13 +12720,13 @@ func testGitResolveMutatedSource(t *testing.T, sb integration.Sandbox) {
 	err = runInDir(gitDir, gitCommands...)
 	require.NoError(t, err)
 
-	cmd := exec.Command("git", "rev-parse", "v0.1")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "v0.1")
 	cmd.Dir = gitDir
 	out, err := cmd.Output()
 	require.NoError(t, err)
 	commitTag := strings.TrimSpace(string(out))
 
-	cmd = exec.Command("git", "rev-parse", "v0.1^{commit}")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v0.1^{commit}")
 	cmd.Dir = gitDir
 	out, err = cmd.Output()
 	require.NoError(t, err)
@@ -12813,9 +12815,9 @@ func runInDirEnv(dir string, env []string, cmds ...string) error {
 	for _, args := range cmds {
 		var cmd *exec.Cmd
 		if runtime.GOOS == "windows" {
-			cmd = exec.Command("powershell", "-command", args)
+			cmd = exec.CommandContext(context.TODO(), "powershell", "-command", args)
 		} else {
-			cmd = exec.Command("sh", "-c", args)
+			cmd = exec.CommandContext(context.TODO(), "sh", "-c", args)
 		}
 		cmd.Env = append(os.Environ(), env...)
 		cmd.Dir = dir

cmd/buildctl/dialstdio.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"io"
 	"net"
 	"os"
@@ -68,7 +69,8 @@ func dialer(address string, timeout time.Duration) (net.Conn, error) {
 	if addrParts[0] != "unix" {
 		return nil, errors.Errorf("invalid address %s (expected unix://, got %s://)", address, addrParts[0])
 	}
-	return net.DialTimeout(addrParts[0], addrParts[1], timeout)
+	dialer := net.Dialer{Timeout: timeout}
+	return dialer.DialContext(context.TODO(), addrParts[0], addrParts[1])
 }
 
 func copier(to halfWriteCloser, from halfReadCloser, debugDescription string) error {

cmd/buildkitd/main.go

@@ -708,7 +708,8 @@ func getListener(addr string, uid, gid int, secDescriptor string, tlsConfig *tls
 	case "fd":
 		return listenFD(listenAddr, tlsConfig)
 	case "tcp":
-		l, err := net.Listen("tcp", listenAddr)
+		listener := net.ListenConfig{}
+		l, err := listener.Listen(context.TODO(), "tcp", listenAddr)
 		if err != nil {
 			return nil, err
 		}

cmd/buildkitd/main_windows.go

@@ -4,7 +4,6 @@ package main
 
 import (
 	"crypto/tls"
-	"fmt"
 	"net"
 	"strings"
 
@@ -44,13 +43,18 @@ func getLocalListener(listenerPath, secDescriptor string) (net.Listener, error)
 func groupToSecurityDescriptor(group string) (string, error) {
 	sddl := "D:P(A;;GA;;;BA)(A;;GA;;;SY)"
 	if group != "" {
+		var b strings.Builder
+		b.WriteString(sddl)
 		for g := range strings.SplitSeq(group, ",") {
 			sid, err := winio.LookupSidByName(g)
 			if err != nil {
 				return "", errors.Wrapf(err, "failed to lookup sid for group %s", g)
 			}
-			sddl += fmt.Sprintf("(A;;GRGW;;;%s)", sid)
+			b.WriteString("(A;;GRGW;;;")
+			b.WriteString(sid)
+			b.WriteByte(')')
 		}
+		sddl = b.String()
 	}
 	return sddl, nil
 }

executor/resources/types/systypes.go

@@ -57,7 +57,6 @@ type SysMemoryStat struct {
 }
 
 type SysSample struct {
-	//nolint
 	Timestamp_     time.Time      `json:"timestamp"`
 	CPUStat        *SysCPUStat    `json:"cpuStat,omitempty"`
 	ProcStat       *ProcStat      `json:"procStat,omitempty"`

executor/resources/types/types.go

@@ -20,7 +20,6 @@ type Samples struct {
 
 // Sample represents a wrapper for sampled data of cgroupv2 controllers
 type Sample struct {
-	//nolint
 	Timestamp_ time.Time      `json:"timestamp"`
 	CPUStat    *CPUStat       `json:"cpuStat,omitempty"`
 	MemoryStat *MemoryStat    `json:"memoryStat,omitempty"`

frontend/dockerfile/dockerfile_addgit_test.go

@@ -2,6 +2,7 @@ package dockerfile
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -70,13 +71,13 @@ func testAddGit(t *testing.T, sb integration.Sandbox, format string) {
 	err = runShell(gitDir, gitCommands...)
 	require.NoError(t, err)
 
-	revParseCmd := exec.Command("git", "rev-parse", "v0.0.2")
+	revParseCmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "v0.0.2")
 	revParseCmd.Dir = gitDir
 	commitHashB, err := revParseCmd.Output()
 	require.NoError(t, err)
 	commitHashV2 := strings.TrimSpace(string(commitHashB))
 
-	revParseCmd = exec.Command("git", "rev-parse", "v0.0.3")
+	revParseCmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v0.0.3")
 	revParseCmd.Dir = gitDir
 	commitHashB, err = revParseCmd.Output()
 	require.NoError(t, err)
@@ -286,7 +287,7 @@ func testAddGitChecksumCache(t *testing.T, sb integration.Sandbox) {
 	err = runShell(gitDir, gitCommands...)
 	require.NoError(t, err)
 
-	revParseCmd := exec.Command("git", "rev-parse", "v0.0.2")
+	revParseCmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "v0.0.2")
 	revParseCmd.Dir = gitDir
 	commitHashB, err := revParseCmd.Output()
 	require.NoError(t, err)
@@ -433,7 +434,7 @@ COPY foo out
 	require.NoError(t, err)
 
 	// get commit SHA for v0.0.2
-	cmd := exec.Command("git", "rev-parse", "v0.0.2")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "v0.0.2")
 	cmd.Dir = gitDir
 	dt, err := cmd.CombinedOutput()
 	require.NoError(t, err)
@@ -441,7 +442,7 @@ COPY foo out
 	require.Len(t, commitHashV2, 40)
 
 	// get commit SHA for latest
-	cmd = exec.Command("git", "rev-parse", "latest")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "latest")
 	cmd.Dir = gitDir
 	dt, err = cmd.CombinedOutput()
 	require.NoError(t, err)

frontend/dockerfile/dockerfile_provenance_test.go

@@ -460,7 +460,7 @@ COPY myapp.Dockerfile /
 			)
 			require.NoError(t, err)
 
-			cmd := exec.Command("git", "rev-parse", "v1")
+			cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "v1")
 			cmd.Dir = dir.Name
 			expectedGitSHA, err := cmd.Output()
 			require.NoError(t, err)

frontend/dockerfile/dockerfile_test.go

@@ -10441,9 +10441,9 @@ func runShell(dir string, cmds ...string) error {
 	for _, args := range cmds {
 		var cmd *exec.Cmd
 		if runtime.GOOS == "windows" {
-			cmd = exec.Command("powershell", "-command", args)
+			cmd = exec.CommandContext(context.TODO(), "powershell", "-command", args)
 		} else {
-			cmd = exec.Command("sh", "-c", args)
+			cmd = exec.CommandContext(context.TODO(), "sh", "-c", args)
 		}
 		cmd.Dir = dir
 		if err := cmd.Run(); err != nil {

frontend/gateway/pb/caps.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:revive,staticcheck
+package moby_buildkit_v1_frontend //nolint:staticcheck
 
 import "github.com/moby/buildkit/util/apicaps"
 

frontend/gateway/pb/exit.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:revive,staticcheck
+package moby_buildkit_v1_frontend //nolint:staticcheck
 
 import (
 	"fmt"

hack/dockerfiles/lint.Dockerfile

@@ -4,7 +4,7 @@ ARG GO_VERSION=1.25
 ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.6.1
 ARG PROTOLINT_VERSION=0.50.5
-ARG GOLANGCI_LINT_VERSION=v2.1.5
+ARG GOLANGCI_LINT_VERSION=v2.8.0
 ARG GOLANGCI_FROM_SOURCE=false
 ARG GOPLS_VERSION=v0.33.0
 # GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated simplifyrange unusedfunc unusedvariable

session/sshforward/ssh.go

@@ -80,7 +80,8 @@ func MountSSHSocket(ctx context.Context, c session.Caller, opt SocketOpt) (sockP
 
 	sockPath = filepath.Join(dir, "ssh_auth_sock")
 
-	l, err := net.Listen("unix", sockPath)
+	listener := net.ListenConfig{}
+	l, err := listener.Listen(context.TODO(), "unix", sockPath)
 	if err != nil {
 		return "", nil, errors.WithStack(err)
 	}

session/sshforward/sshprovider/agentprovider.go

@@ -194,7 +194,8 @@ func toDialer(paths []string, raw bool) (func(context.Context) (net.Conn, error)
 }
 
 func unixSocketDialer(path string) (net.Conn, error) {
-	return net.DialTimeout("unix", path, 2*time.Second)
+	dialer := net.Dialer{Timeout: 2 * time.Second}
+	return dialer.DialContext(context.TODO(), "unix", path)
 }
 
 type readOnlyAgent struct {

session/sshforward/sshprovider/agentprovider_test.go

@@ -1,6 +1,7 @@
 package sshprovider_test
 
 import (
+	"context"
 	"net"
 	"os"
 	"path/filepath"
@@ -39,7 +40,8 @@ func TestToAgentSource(t *testing.T) {
 	require.ErrorContains(t, err, "raw mode only supported with socket paths")
 
 	sockPath := filepath.Join(dir, "test.sock")
-	l, err := net.Listen("unix", sockPath)
+	listener := net.ListenConfig{}
+	l, err := listener.Listen(context.TODO(), "unix", sockPath)
 	require.NoError(t, err)
 	defer l.Close()
 

solver/errdefs/solve.go

@@ -14,7 +14,7 @@ func init() {
 	typeurl.Register((*Solve)(nil), "github.com/moby/buildkit", "errdefs.Solve+json")
 }
 
-//nolint:revive,staticcheck
+//nolint:staticcheck
 type IsSolve_Subject isSolve_Subject
 
 // SolveError will be returned when an error is encountered during a solve that

source/git/source.go

@@ -64,7 +64,7 @@ type MetadataOpts struct {
 
 // Supported returns nil if the system supports Git source
 func Supported() error {
-	if err := exec.Command("git", "version").Run(); err != nil {
+	if err := exec.CommandContext(context.TODO(), "git", "version").Run(); err != nil {
 		return errors.Wrap(err, "failed to find git binary")
 	}
 	return nil

source/git/source_test.go

@@ -201,7 +201,7 @@ func testFetchBySHA(t *testing.T, format string, keepGitDir bool) {
 
 	repo := setupGitRepo(t, format)
 
-	cmd := exec.Command("git", "rev-parse", "feature")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "feature")
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -323,7 +323,7 @@ func testFetchUnreferencedRefSha(t *testing.T, ref string, keepGitDir bool, form
 
 	repo := setupGitRepo(t, format)
 
-	cmd := exec.Command("git", "rev-parse", ref)
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", ref)
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -522,7 +522,7 @@ func testFetchByTag(t *testing.T, tag, expectedCommitSubject string, isAnnotated
 	id := &GitIdentifier{Remote: repo.mainURL, Ref: tag, KeepGitDir: keepGitDir}
 
 	if checksumMode != testChecksumModeNone {
-		cmd := exec.Command("git", "rev-parse", tag)
+		cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", tag)
 		cmd.Dir = repo.mainPath
 
 		out, err := cmd.Output()
@@ -666,7 +666,7 @@ func testFetchAnnotatedTagAfterClone(t *testing.T, format string) {
 	ctx = logProgressStreams(ctx, t)
 
 	repo := setupGitRepo(t, format)
-	cmd := exec.Command("git", "rev-parse", "HEAD")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "HEAD")
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -739,7 +739,7 @@ func testFetchAnnotatedTagChecksums(t *testing.T, format string, keepGitDir bool
 	ctx = logProgressStreams(ctx, t)
 
 	repo := setupGitRepo(t, format)
-	cmd := exec.Command("git", "rev-parse", "v1.2.3")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "v1.2.3")
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -753,7 +753,7 @@ func testFetchAnnotatedTagChecksums(t *testing.T, format string, keepGitDir bool
 	require.Equal(t, expLen, len(shaTag))
 
 	// make sure this is an annotated tag
-	cmd = exec.Command("git", "cat-file", "-t", shaTag)
+	cmd = exec.CommandContext(context.TODO(), "git", "cat-file", "-t", shaTag)
 	cmd.Dir = repo.mainPath
 
 	out, err = cmd.Output()
@@ -761,7 +761,7 @@ func testFetchAnnotatedTagChecksums(t *testing.T, format string, keepGitDir bool
 	require.Equal(t, "tag\n", string(out))
 
 	// get commit that the tag points to
-	cmd = exec.Command("git", "rev-parse", "v1.2.3^{}")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v1.2.3^{}")
 	cmd.Dir = repo.mainPath
 
 	out, err = cmd.Output()
@@ -818,14 +818,14 @@ func testFetchAnnotatedTagChecksums(t *testing.T, format string, keepGitDir bool
 			require.NoError(t, err)
 			defer lm1.Unmount()
 
-			cmd = exec.Command("git", "tag", "--points-at", "HEAD")
+			cmd = exec.CommandContext(context.TODO(), "git", "tag", "--points-at", "HEAD")
 			cmd.Dir = dir
 
 			out, err = cmd.Output()
 			require.NoError(t, err)
 			require.Equal(t, "v1.2.3\n", string(out))
 
-			cmd = exec.Command("git", "rev-parse", "v1.2.3")
+			cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v1.2.3")
 			cmd.Dir = dir
 
 			out, err = cmd.Output()
@@ -858,7 +858,7 @@ func testFetchTagChangeRace(t *testing.T, format string, keepGitDir bool) {
 		t.Skip("Depends on unimplemented containerd bind-mount support on Windows")
 	}
 	repo := setupGitRepo(t, format)
-	cmd := exec.Command("git", "rev-parse", "v1.2.3")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "v1.2.3")
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -871,7 +871,7 @@ func testFetchTagChangeRace(t *testing.T, format string, keepGitDir bool) {
 	shaTag := strings.TrimSpace(string(out))
 	require.Equal(t, expLen, len(shaTag))
 
-	cmd = exec.Command("git", "rev-parse", "v1.2.3^{}")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v1.2.3^{}")
 	cmd.Dir = repo.mainPath
 
 	out, err = cmd.Output()
@@ -896,7 +896,7 @@ func testFetchTagChangeRace(t *testing.T, format string, keepGitDir bool) {
 		require.Equal(t, shaTagCommit, key1)
 	}
 
-	cmd = exec.Command("git", "rev-parse", "v1.2.3-special")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v1.2.3-special")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.Output()
 	require.NoError(t, err)
@@ -904,13 +904,13 @@ func testFetchTagChangeRace(t *testing.T, format string, keepGitDir bool) {
 	require.NotEqual(t, shaTag, shaTagNew)
 
 	// delete tag v1.2.3
-	cmd = exec.Command("git", "tag", "-d", "v1.2.3")
+	cmd = exec.CommandContext(context.TODO(), "git", "tag", "-d", "v1.2.3")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
 
 	// recreate tag v1.2.3 to point to another commit
-	cmd = exec.Command("git", "tag", "v1.2.3", shaTagNew)
+	cmd = exec.CommandContext(context.TODO(), "git", "tag", "v1.2.3", shaTagNew)
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
@@ -934,7 +934,7 @@ func testFetchTagChangeRace(t *testing.T, format string, keepGitDir bool) {
 
 	if keepGitDir {
 		// read current HEAD commit
-		cmd = exec.Command("git", "rev-parse", "HEAD")
+		cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "HEAD")
 		cmd.Dir = dir
 
 		out, err = cmd.Output()
@@ -966,7 +966,7 @@ func testFetchBranchChangeRace(t *testing.T, format string, keepGitDir bool) {
 		t.Skip("Depends on unimplemented containerd bind-mount support on Windows")
 	}
 	repo := setupGitRepo(t, format)
-	cmd := exec.Command("git", "rev-parse", "master")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "master")
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -996,7 +996,7 @@ func testFetchBranchChangeRace(t *testing.T, format string, keepGitDir bool) {
 		require.Equal(t, shaMaster, key1)
 	}
 
-	cmd = exec.Command("git", "rev-parse", "feature")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "feature")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.Output()
 	require.NoError(t, err)
@@ -1004,7 +1004,7 @@ func testFetchBranchChangeRace(t *testing.T, format string, keepGitDir bool) {
 	require.NotEqual(t, shaMaster, shaFeature)
 
 	// checkout feature as master
-	cmd = exec.Command("git", "checkout", "-B", "master", "feature")
+	cmd = exec.CommandContext(context.TODO(), "git", "checkout", "-B", "master", "feature")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
@@ -1028,7 +1028,7 @@ func testFetchBranchChangeRace(t *testing.T, format string, keepGitDir bool) {
 
 	if keepGitDir {
 		// read current HEAD commit
-		cmd = exec.Command("git", "rev-parse", "HEAD")
+		cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "HEAD")
 		cmd.Dir = dir
 
 		out, err = cmd.Output()
@@ -1060,7 +1060,7 @@ func testFetchBranchRemoveRace(t *testing.T, format string, keepGitDir bool) {
 		t.Skip("Depends on unimplemented containerd bind-mount support on Windows")
 	}
 	repo := setupGitRepo(t, format)
-	cmd := exec.Command("git", "rev-parse", "feature")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "feature")
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -1090,7 +1090,7 @@ func testFetchBranchRemoveRace(t *testing.T, format string, keepGitDir bool) {
 		require.Equal(t, shaFeature, key1)
 	}
 
-	cmd = exec.Command("git", "rev-parse", "master")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "master")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.Output()
 	require.NoError(t, err)
@@ -1098,22 +1098,22 @@ func testFetchBranchRemoveRace(t *testing.T, format string, keepGitDir bool) {
 	require.NotEqual(t, shaMaster, shaFeature)
 
 	// change feature to point to master
-	cmd = exec.Command("git", "branch", "-f", "feature", "master")
+	cmd = exec.CommandContext(context.TODO(), "git", "branch", "-f", "feature", "master")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
 
-	cmd = exec.Command("git", "reflog", "expire", "--expire-unreachable=now", "--expire=now", "--all")
+	cmd = exec.CommandContext(context.TODO(), "git", "reflog", "expire", "--expire-unreachable=now", "--expire=now", "--all")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
 
-	cmd = exec.Command("git", "gc", "--prune=now", "--aggressive")
+	cmd = exec.CommandContext(context.TODO(), "git", "gc", "--prune=now", "--aggressive")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
 
-	cmd = exec.Command("git", "cat-file", "-t", shaFeature)
+	cmd = exec.CommandContext(context.TODO(), "git", "cat-file", "-t", shaFeature)
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.Error(t, err, string(out))
@@ -1145,7 +1145,7 @@ func testFetchMutatedTag(t *testing.T, format string, keepGitDir bool) {
 		t.Skip("Depends on unimplemented containerd bind-mount support on Windows")
 	}
 	repo := setupGitRepo(t, format)
-	cmd := exec.Command("git", "rev-parse", "v1.2.3")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "v1.2.3")
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -1173,13 +1173,13 @@ func testFetchMutatedTag(t *testing.T, format string, keepGitDir bool) {
 	ref.Release(context.TODO())
 
 	// mutate the tag to point to another commit
-	cmd = exec.Command("git", "tag", "-f", "v1.2.3", "feature")
+	cmd = exec.CommandContext(context.TODO(), "git", "tag", "-f", "v1.2.3", "feature")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
 
 	// verify that the tag now points to a different commit
-	cmd = exec.Command("git", "rev-parse", "v1.2.3")
+	cmd = exec.CommandContext(context.TODO(), "git", "rev-parse", "v1.2.3")
 	cmd.Dir = repo.mainPath
 
 	out, err = cmd.Output()
@@ -1231,7 +1231,7 @@ func testFetchMutatedBranch(t *testing.T, format string, keepGitDir bool) {
 		t.Skip("Depends on unimplemented containerd bind-mount support on Windows")
 	}
 	repo := setupGitRepo(t, format)
-	cmd := exec.Command("git", "rev-parse", "feature")
+	cmd := exec.CommandContext(context.TODO(), "git", "rev-parse", "feature")
 	cmd.Dir = repo.mainPath
 
 	out, err := cmd.Output()
@@ -1259,12 +1259,12 @@ func testFetchMutatedBranch(t *testing.T, format string, keepGitDir bool) {
 	ref.Release(context.TODO())
 
 	// mutate the branch to point to become parent dir
-	cmd = exec.Command("git", "branch", "-D", "feature")
+	cmd = exec.CommandContext(context.TODO(), "git", "branch", "-D", "feature")
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
 
-	cmd = exec.Command("git", "branch", "feature/new", shaBranch)
+	cmd = exec.CommandContext(context.TODO(), "git", "branch", "feature/new", shaBranch)
 	cmd.Dir = repo.mainPath
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
@@ -2258,7 +2258,7 @@ func serveGitRepo(t *testing.T, root string) string {
 	t.Helper()
 	gitpath, err := exec.LookPath("git")
 	require.NoError(t, err)
-	gitversion, _ := exec.Command(gitpath, "version").CombinedOutput()
+	gitversion, _ := exec.CommandContext(context.TODO(), gitpath, "version").CombinedOutput()
 	t.Logf("%s", gitversion) // E.g. "git version 2.30.2"
 
 	// Serve all repositories under root using the Smart HTTP protocol so
@@ -2306,9 +2306,9 @@ func runShellEnv(t *testing.T, dir string, env []string, cmds ...string) {
 	for _, args := range cmds {
 		var cmd *exec.Cmd
 		if runtime.GOOS == "windows" {
-			cmd = exec.Command("powershell", "-command", args)
+			cmd = exec.CommandContext(context.TODO(), "powershell", "-command", args)
 		} else {
-			cmd = exec.Command("sh", "-c", args)
+			cmd = exec.CommandContext(context.TODO(), "sh", "-c", args)
 		}
 		cmd.Dir = dir
 		cmd.Env = append(os.Environ(), env...)

source/git/source_unix_nolinux.go

@@ -28,7 +28,7 @@ func gitMain() {
 	unix.Umask(0022)
 
 	// Reexec git command
-	cmd := exec.Command(os.Args[1], os.Args[2:]...) //nolint:gosec // reexec
+	cmd := exec.CommandContext(context.Background(), os.Args[1], os.Args[2:]...) //nolint:gosec // reexec
 	cmd.SysProcAttr = &reexecSysProcAttr
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr

source/http/source.go

@@ -672,7 +672,7 @@ func (hs *httpSourceHandler) Snapshot(ctx context.Context, jobCtx solver.JobCont
 }
 
 func (hs *httpSourceHandler) newHTTPRequest(ctx context.Context, g session.Group) (*http.Request, error) {
-	req, err := http.NewRequest(http.MethodGet, hs.src.URL, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, hs.src.URL, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -716,7 +716,7 @@ func (hs *httpSourceHandler) newHTTPRequest(ctx context.Context, g session.Group
 		}
 	}
 
-	return req.WithContext(ctx), nil
+	return req, nil
 }
 
 func getFileName(urlStr, manualFilename string, resp *http.Response) string {

sourcepolicy/pb/json.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_sourcepolicy //nolint:revive,staticcheck
+package moby_buildkit_v1_sourcepolicy //nolint:staticcheck
 
 import (
 	"github.com/moby/buildkit/util/gogo/proto"

sourcepolicy/pb/json_test.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_sourcepolicy //nolint:revive,staticcheck
+package moby_buildkit_v1_sourcepolicy //nolint:staticcheck
 
 import (
 	"encoding/json"

util/archutil/check_unix.go

@@ -5,6 +5,7 @@ package archutil
 import (
 	"bytes"
 	"compress/gzip"
+	"context"
 	"io"
 	"os"
 	"os/exec"
@@ -46,7 +47,7 @@ func check(arch, bin string) (string, error) {
 	}
 	f.Close()
 
-	cmd := exec.Command("/check")
+	cmd := exec.CommandContext(context.TODO(), "/check")
 	withChroot(cmd, tmpdir)
 	err = cmd.Run()
 	if arch != "amd64" {

util/entitlements/security/security_linux.go

@@ -120,7 +120,7 @@ func getFreeLoopID() (int, error) {
 	}
 	defer fd.Close()
 
-	const _LOOP_CTL_GET_FREE = 0x4C82 //nolint:revive,staticcheck
+	const _LOOP_CTL_GET_FREE = 0x4C82 //nolint:staticcheck
 	r1, _, uerr := unix.Syscall(unix.SYS_IOCTL, fd.Fd(), _LOOP_CTL_GET_FREE, 0)
 	if uerr == 0 {
 		return int(r1), nil

util/gitutil/git_cli.go

@@ -145,7 +145,7 @@ func (cli *GitCLI) Run(ctx context.Context, args ...string) (_ []byte, err error
 		if cli.exec == nil {
 			cmd = exec.CommandContext(ctx, gitBinary)
 		} else {
-			cmd = exec.Command(gitBinary)
+			cmd = exec.CommandContext(context.TODO(), gitBinary)
 		}
 
 		cmd.Dir = cli.dir

util/testutil/dockerd/client/client.go

@@ -235,14 +235,17 @@ func (cli *Client) Dialer() func(context.Context) (net.Conn, error) {
 		}
 		switch cli.proto {
 		case "unix":
-			return net.Dial(cli.proto, cli.addr)
+			dialer := net.Dialer{}
+			return dialer.DialContext(ctx, cli.proto, cli.addr)
 		case "npipe":
 			return DialPipe(cli.addr, 32*time.Second)
 		default:
 			if tlsConfig := cli.tlsConfig(); tlsConfig != nil {
-				return tls.Dial(cli.proto, cli.addr, tlsConfig)
+				dialer := tls.Dialer{Config: tlsConfig}
+				return dialer.DialContext(ctx, cli.proto, cli.addr)
 			}
-			return net.Dial(cli.proto, cli.addr)
+			dialer := net.Dialer{}
+			return dialer.DialContext(ctx, cli.proto, cli.addr)
 		}
 	}
 }

util/testutil/dockerd/daemon.go

@@ -2,6 +2,7 @@ package dockerd
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"os"
@@ -140,7 +141,7 @@ func (d *Daemon) StartWithError(daemonLogs map[string]*bytes.Buffer, providedArg
 	}
 
 	d.args = append(d.args, providedArgs...)
-	d.cmd = exec.Command(dockerdBinary, d.args...)
+	d.cmd = exec.CommandContext(context.TODO(), dockerdBinary, d.args...)
 	d.cmd.Env = append(d.envs, "DOCKER_SERVICE_PREFER_OFFLINE_IMAGE=1", "BUILDKIT_DEBUG_EXEC_OUTPUT=1", "BUILDKIT_DEBUG_PANIC_ON_ERROR=1")
 
 	if daemonLogs != nil {

util/testutil/echoserver/server.go

@@ -1,6 +1,7 @@
 package echoserver
 
 import (
+	"context"
 	"io"
 	"net"
 )
@@ -11,7 +12,8 @@ type TestServer interface {
 }
 
 func NewTestServer(response string) (TestServer, error) {
-	ln, err := net.Listen("tcp", ":") //nolint:gosec // server only used in tests
+	listener := net.ListenConfig{}
+	ln, err := listener.Listen(context.TODO(), "tcp", ":")
 	if err != nil {
 		return nil, err
 	}

util/testutil/helpers/azurite.go

@@ -40,7 +40,8 @@ func NewAzuriteServer(t *testing.T, sb integration.Sandbox, opts AzuriteOpts) (a
 		}
 	}()
 
-	l, err := net.Listen("tcp", "localhost:0")
+	listener := net.ListenConfig{}
+	l, err := listener.Listen(context.TODO(), "tcp", "localhost:0")
 	if err != nil {
 		return "", nil, err
 	}
@@ -56,7 +57,7 @@ func NewAzuriteServer(t *testing.T, sb integration.Sandbox, opts AzuriteOpts) (a
 	address = fmt.Sprintf("http://%s/%s", addr, opts.AccountName)
 
 	// start server
-	cmd := exec.Command(azuriteBin, "--disableProductStyleUrl", "--blobHost", host, "--blobPort", port, "--location", t.TempDir())
+	cmd := exec.CommandContext(context.TODO(), azuriteBin, "--disableProductStyleUrl", "--blobHost", host, "--blobPort", port, "--location", t.TempDir())
 	cmd.Env = append(os.Environ(), []string{
 		"AZURITE_ACCOUNTS=" + opts.AccountName + ":" + opts.AccountKey,
 	}...)
@@ -77,11 +78,10 @@ func waitAzurite(ctx context.Context, address string, d time.Duration) error {
 	step := 1 * time.Second
 	i := 0
 	for {
-		req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s?comp=list", address), nil)
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("%s?comp=list", address), nil)
 		if err != nil {
 			return errors.Wrapf(err, "failed to create request")
 		}
-		req = req.WithContext(ctx)
 		if resp, err := http.DefaultClient.Do(req); err == nil {
 			resp.Body.Close()
 			break

util/testutil/helpers/minio.go

@@ -47,7 +47,8 @@ func NewMinioServer(t *testing.T, sb integration.Sandbox, opts MinioOpts) (addre
 		}
 	}()
 
-	l, err := net.Listen("tcp", "localhost:0")
+	listener := net.ListenConfig{}
+	l, err := listener.Listen(context.TODO(), "tcp", "localhost:0")
 	if err != nil {
 		return "", "", nil, err
 	}
@@ -59,7 +60,7 @@ func NewMinioServer(t *testing.T, sb integration.Sandbox, opts MinioOpts) (addre
 	address = "http://" + addr
 
 	// start server
-	cmd := exec.Command(minioBin, "server", "--json", "--address", addr, t.TempDir())
+	cmd := exec.CommandContext(context.TODO(), minioBin, "server", "--json", "--address", addr, t.TempDir())
 	cmd.Env = append(os.Environ(), []string{
 		"MINIO_ROOT_USER=" + opts.AccessKeyID,
 		"MINIO_ROOT_PASSWORD=" + opts.SecretAccessKey,
@@ -76,22 +77,22 @@ func NewMinioServer(t *testing.T, sb integration.Sandbox, opts MinioOpts) (addre
 
 	// create alias config
 	alias := randomString(10)
-	cmd = exec.Command(mcBin, "alias", "set", alias, address, opts.AccessKeyID, opts.SecretAccessKey)
+	cmd = exec.CommandContext(context.TODO(), mcBin, "alias", "set", alias, address, opts.AccessKeyID, opts.SecretAccessKey)
 	if err := integration.RunCmd(cmd, sb.Logs()); err != nil {
 		return "", "", nil, err
 	}
 	deferF.Append(func() error {
-		return exec.Command(mcBin, "alias", "rm", alias).Run()
+		return exec.CommandContext(context.TODO(), mcBin, "alias", "rm", alias).Run()
 	})
 
 	// create bucket
-	cmd = exec.Command(mcBin, "mb", "--region", opts.Region, fmt.Sprintf("%s/%s", alias, bucket)) // #nosec G204
+	cmd = exec.CommandContext(context.TODO(), mcBin, "mb", "--region", opts.Region, fmt.Sprintf("%s/%s", alias, bucket)) // #nosec G204
 	if err := integration.RunCmd(cmd, sb.Logs()); err != nil {
 		return "", "", nil, err
 	}
 
 	// trace
-	cmd = exec.Command(mcBin, "admin", "trace", "--json", alias)
+	cmd = exec.CommandContext(context.TODO(), mcBin, "admin", "trace", "--json", alias)
 	traceStop, err := integration.StartCmd(cmd, sb.Logs())
 	if err != nil {
 		return "", "", nil, err
@@ -105,11 +106,10 @@ func waitMinio(ctx context.Context, address string, d time.Duration) error {
 	step := 1 * time.Second
 	i := 0
 	for {
-		req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/minio/health/live", address), nil)
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("%s/minio/health/live", address), nil)
 		if err != nil {
 			return errors.Wrapf(err, "failed to create request")
 		}
-		req = req.WithContext(ctx)
 		if resp, err := http.DefaultClient.Do(req); err == nil {
 			resp.Body.Close()
 			break

util/testutil/integration/registry.go

@@ -56,7 +56,7 @@ http:
 		}
 	}
 
-	cmd := exec.Command("registry", "serve", filepath.Join(dir, "config.yaml")) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), "registry", "serve", filepath.Join(dir, "config.yaml")) //nolint:gosec // test utility
 	rc, err := cmd.StderrPipe()
 	if err != nil {
 		return "", nil, err

util/testutil/integration/sandbox.go

@@ -76,7 +76,7 @@ func (sb *sandbox) Cmd(args ...string) *exec.Cmd {
 			args = split
 		}
 	}
-	cmd := exec.Command("buildctl", args...)
+	cmd := exec.CommandContext(context.TODO(), "buildctl", args...)
 	cmd.Env = append(cmd.Env, os.Environ()...)
 	cmd.Env = append(cmd.Env, "BUILDKIT_HOST="+sb.Address())
 	if v := os.Getenv("GO_TEST_COVERPROFILE"); v != "" {
@@ -188,7 +188,7 @@ func printBuildkitdDebugLogs(t *testing.T, addr string) {
 }
 
 func RootlessSupported(uid int) bool {
-	cmd := exec.Command("sudo", "-u", fmt.Sprintf("#%d", uid), "-i", "--", "exec", "unshare", "-U", "true") //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), "sudo", "-u", fmt.Sprintf("#%d", uid), "-i", "--", "exec", "unshare", "-U", "true") //nolint:gosec // test utility
 	b, err := cmd.CombinedOutput()
 	if err != nil {
 		bklog.L.Warnf("rootless mode is not supported on this host: %v (%s)", err, string(b))

util/testutil/workers/containerd.go

@@ -191,7 +191,7 @@ disabled_plugins = ["io.containerd.grpc.v1.cri"]
 		}, c.ExtraEnv...), "containerd-rootless.sh", "-c", configFile)
 	}
 
-	cmd := exec.Command(containerdArgs[0], containerdArgs[1:]...) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), containerdArgs[0], containerdArgs[1:]...) //nolint:gosec // test utility
 	cmd.Env = append(os.Environ(), c.ExtraEnv...)
 
 	ctdStop, err := integration.StartCmd(cmd, cfg.Logs)
@@ -278,7 +278,7 @@ func runStargzSnapshotter(cfg *integration.BackendConfig) (address string, cl fu
 
 	address = filepath.Join(tmpStargzDir, "containerd-stargz-grpc.sock")
 	stargzRootDir := filepath.Join(tmpStargzDir, "root")
-	cmd := exec.Command(binary,
+	cmd := exec.CommandContext(context.TODO(), binary,
 		"--log-level", "debug",
 		"--address", address,
 		"--root", stargzRootDir)

util/testutil/workers/dockerd.go

@@ -207,7 +207,8 @@ func (c Moby) New(ctx context.Context, cfg *integration.BackendConfig) (b integr
 	f.Close()
 	os.Remove(localPath)
 
-	listener, err := net.Listen(buildkitdNetworkProtocol, getBuildkitdNetworkAddr(localPath))
+	listenerConfig := net.ListenConfig{}
+	listener, err := listenerConfig.Listen(context.TODO(), buildkitdNetworkProtocol, getBuildkitdNetworkAddr(localPath))
 	if err != nil {
 		return nil, nil, errors.Wrapf(err, "dockerd listener error: %s", integration.FormatLogs(cfg.Logs))
 	}

util/testutil/workers/util.go

@@ -2,6 +2,7 @@ package workers
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"os"
 	"os/exec"
@@ -95,7 +96,7 @@ func runBuildkitd(
 	debugAddress := getBuildkitdDebugAddr(tmpdir)
 
 	args = append(args, "--root", tmpdir, "--addr", address, "--debug")
-	cmd := exec.Command(args[0], args[1:]...) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), args[0], args[1:]...) //nolint:gosec // test utility
 	cmd.Env = append(
 		os.Environ(),
 		"BUILDKIT_DEBUG_EXEC_OUTPUT=1",