fix(deps): update github.com/tonistiigi/fsutil digest to ca65610

Signed-off-by: Mend Renovate <bot@renovateapp.com>

go.mod

@@ -99,7 +99,7 @@ require (
 	github.com/sirupsen/logrus v1.10.2
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	github.com/tonistiigi/fsutil v0.0.0-20261009124904-c1c5bffae3b5
+	github.com/tonistiigi/fsutil v0.0.0-20261027232937-ca65610c2295
 	github.com/tonistiigi/go-archvariant v1.0.0
 	github.com/vbatts/tar-split v0.12.3
 	github.com/vishvananda/netlink v1.3.1

go.sum

@@ -655,8 +655,8 @@ github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
 github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 h1:r0p7fK56l8WPequOaR3i9LBqfPtEdXIQbUTzT55iqT4=
 github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323/go.mod h1:3Iuxbr0P7D3zUzBMAZB+ois3h/et0shEz0qApgHYGpY=
-github.com/tonistiigi/fsutil v0.0.0-20261009124904-c1c5bffae3b5 h1:8lXvMJtQaRZoIlWqBKQFDYyjuzSuokpzb3uMMb6cjwE=
-github.com/tonistiigi/fsutil v0.0.0-20261009124904-c1c5bffae3b5/go.mod h1:oO0lfhK8QAY3alnpiYXcRVjyVx95XGWZE3K2M+AqfcM=
+github.com/tonistiigi/fsutil v0.0.0-20261027232937-ca65610c2295 h1:ZsuzD6v7DvLAjJ4E1I9nuJ04NnOtE72PM0lOO/ApG/Q=
+github.com/tonistiigi/fsutil v0.0.0-20261027232937-ca65610c2295/go.mod h1:oO0lfhK8QAY3alnpiYXcRVjyVx95XGWZE3K2M+AqfcM=
 github.com/tonistiigi/go-actions-cache v0.0.0-20260930145529-afe8013b5ac4 h1:RkHGDzvazJu1TzNvesQpnN5RwNxvU3e7O2UdJqjaj2Q=
 github.com/tonistiigi/go-actions-cache v0.0.0-20260930145529-afe8013b5ac4/go.mod h1:PhGlvWoWwfUaY1K5xm8HHjcinBw/rD9FLQTPTxHbxyw=
 github.com/tonistiigi/go-archvariant v1.0.0 h1:5LC1eDWiBNflnTF1prCiX09yfNHIxDC/aukdhCdTyb0=

vendor/github.com/tonistiigi/fsutil/diskwriter.go

@@ -230,9 +230,9 @@ func (dw *DiskWriter) HandleChange(kind ChangeKind, p string, fi os.FileInfo, er
 func (dw *DiskWriter) requestAsyncFileData(p, dest string, fi os.FileInfo, st *types.Stat) {
 	// todo: limit worker threads
 	dw.eg.Go(func() error {
-		if err := dw.processChange(dw.egCtx, ChangeKindAdd, p, fi, &lazyFileWriter{
-			dest: dest,
-		}); err != nil {
+		w := &lazyFileWriter{dest: dest}
+		if err := dw.processChange(dw.egCtx, ChangeKindAdd, p, fi, w); err != nil {
+			w.Close()
 			return err
 		}
 		return chtimes(dest, st.ModTime) // TODO: parent dirs

vendor/github.com/tonistiigi/fsutil/receive.go

@@ -423,6 +423,7 @@ func (r *receiver) asyncDataFunc(ctx context.Context, p string, wc io.WriteClose
 	r.pipes[id] = wwc
 	r.muPipes.Unlock()
 	if err := r.conn.SendMsg(&types.Packet{Type: types.PACKET_REQ, ID: id}); err != nil {
+		wwc.abandon()
 		return err
 	}
 	err := wwc.Wait(ctx)
@@ -437,28 +438,61 @@ func (r *receiver) asyncDataFunc(ctx context.Context, p string, wc io.WriteClose
 
 type wrappedWriteCloser struct {
 	io.WriteCloser
-	err  error
-	once sync.Once
-	done chan struct{}
+	mu        sync.Mutex // serializes the receive loop with Wait
+	closed    bool
+	abandoned bool
+	err       error
+	done      chan struct{}
 }
 
 func newWrappedWriteCloser(wc io.WriteCloser) *wrappedWriteCloser {
 	return &wrappedWriteCloser{WriteCloser: wc, done: make(chan struct{})}
 }
 
+func (w *wrappedWriteCloser) Write(dt []byte) (int, error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.abandoned {
+		// The request was abandoned and the disk writer owns the
+		// underlying writer again. Drop the data.
+		return len(dt), nil
+	}
+	return w.WriteCloser.Write(dt)
+}
+
 func (w *wrappedWriteCloser) Close() error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.closed || w.abandoned {
+		return w.err
+	}
+	w.closed = true
 	w.err = w.WriteCloser.Close()
-	w.once.Do(func() { close(w.done) })
+	close(w.done)
 	return w.err
 }
 
 func (w *wrappedWriteCloser) Wait(ctx context.Context) error {
 	select {
 	case <-ctx.Done():
-		return ctx.Err()
 	case <-w.done:
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.closed {
 		return w.err
 	}
+	// Cancelled. The receive loop may still get data for this file. Make sure
+	// it does not touch the underlying writer after we return.
+	w.abandoned = true
+	return ctx.Err()
+}
+
+// abandon stops the receive loop from using the underlying writer.
+func (w *wrappedWriteCloser) abandon() {
+	w.mu.Lock()
+	w.abandoned = true
+	w.mu.Unlock()
 }
 
 type stack[T any] struct {

vendor/github.com/tonistiigi/fsutil/tarwriter.go

@@ -61,6 +61,10 @@ func WriteTar(ctx context.Context, fs FS, w io.Writer) error {
 			hdr.PAXRecords["SCHILY.xattr."+k] = string(v)
 		}
 
+		// Without a format the tar writer rounds the modification time to the
+		// nearest second. PAX keeps the sub-second part.
+		hdr.Format = tar.FormatPAX
+
 		if err := tw.WriteHeader(hdr); err != nil {
 			return errors.Wrapf(err, "failed to write file header %s", name)
 		}

vendor/modules.txt

@@ -1696,7 +1696,7 @@ github.com/tinylib/msgp/msgp
 # github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323
 ## explicit; go 1.21
 github.com/tonistiigi/dchapes-mode
-# github.com/tonistiigi/fsutil v0.0.0-20261009124904-c1c5bffae3b5
+# github.com/tonistiigi/fsutil v0.0.0-20261027232937-ca65610c2295
 ## explicit; go 1.25.0
 github.com/tonistiigi/fsutil
 github.com/tonistiigi/fsutil/copy