all: move to JSON deser based on encoding/json/v2

cmd/clairctl/client.go

@@ -211,7 +211,6 @@ func (c *Client) IndexReport(ctx context.Context, id claircore.Digest, m *clairc
 	}
 	var report claircore.IndexReport
 	dec := codec.GetDecoder(rd)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&report); err != nil {
 		zlog.Debug(ctx).
 			Err(err).
@@ -275,7 +274,6 @@ func (c *Client) VulnerabilityReport(ctx context.Context, id claircore.Digest) (
 	}
 	var report claircore.VulnerabilityReport
 	dec := codec.GetDecoder(res.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&report); err != nil {
 		zlog.Debug(ctx).
 			Err(err).

cmd/clairctl/jsonformatter.go

@@ -8,17 +8,16 @@ import (
 
 var _ Formatter = (*jsonFormatter)(nil)
 
-// JsonFormatter is a very simple formatter; it just calls
-// (*json.Encoder).Encode.
+// JsonFormatter outputs JSON.
 type jsonFormatter struct {
-	enc *codec.Encoder
+	enc codec.Encoder
 	c   io.Closer
 }
 
 func (f *jsonFormatter) Format(r *Result) error {
 	return f.enc.Encode(r.Report)
 }
+
 func (f *jsonFormatter) Close() error {
-	codec.PutEncoder(f.enc)
 	return f.c.Close()
 }

cmd/clairctl/manifest.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path"
 	"strings"
+	"sync"
 
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
@@ -36,21 +37,15 @@ func manifestAction(c *cli.Context) error {
 	}
 
 	result := make(chan *claircore.Manifest)
-	done := make(chan struct{})
 	eg, ctx := errgroup.WithContext(c.Context)
-	go func() {
-		defer close(done)
-		enc := codec.GetEncoder(os.Stdout)
-		defer codec.PutEncoder(enc)
-		for m := range result {
-			enc.MustEncode(m)
-		}
-	}()
+	var workers sync.WaitGroup
+	workers.Add(args.Len())
 
-	for i := 0; i < args.Len(); i++ {
+	for i := range args.Len() {
 		name := args.Get(i)
 		zlog.Debug(ctx).Str("name", name).Msg("fetching")
 		eg.Go(func() error {
+			defer workers.Done()
 			m, err := Inspect(ctx, name)
 			if err != nil {
 				zlog.Debug(ctx).
@@ -66,11 +61,24 @@ func manifestAction(c *cli.Context) error {
 			return nil
 		})
 	}
+	eg.Go(func() error {
+		workers.Wait()
+		close(result)
+		return nil
+	})
+	eg.Go(func() error {
+		enc := codec.GetEncoder(os.Stdout)
+		for m := range result {
+			if err := enc.Encode(m); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
 	if err := eg.Wait(); err != nil {
 		return err
 	}
-	close(result)
-	<-done
 	return nil
 }
 

go.mod

@@ -12,6 +12,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/grafana/pyroscope-go/godeltaprof v0.1.9
 	github.com/jackc/pgx/v5 v5.7.6
+	github.com/kaptinlin/jsonschema v0.4.6
 	github.com/klauspost/compress v1.18.1
 	github.com/prometheus/client_golang v1.23.2
 	github.com/quay/clair/config v1.4.3
@@ -22,7 +23,6 @@ require (
 	github.com/rogpeppe/go-internal v1.14.1
 	github.com/rs/zerolog v1.34.0
 	github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80
-	github.com/ugorji/go/codec v1.2.14
 	github.com/urfave/cli/v2 v2.27.7
 	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
@@ -42,6 +42,7 @@ require (
 	golang.org/x/net v0.46.0
 	golang.org/x/sync v0.18.0
 	golang.org/x/time v0.14.0
+	golang.org/x/tools v0.38.0
 	google.golang.org/grpc v1.76.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -60,6 +61,10 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
+	github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 // indirect
+	github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 // indirect
 	github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
@@ -69,6 +74,7 @@ require (
 	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/kaptinlin/go-i18n v0.1.4 // indirect
 	github.com/knqyf263/go-apk-version v0.0.0-20200609155635-041fdbb8563f // indirect
 	github.com/knqyf263/go-deb-version v0.0.0-20190517075300-09fca494f03d // indirect
 	github.com/knqyf263/go-rpm-version v0.0.0-20170716094938-74609b86c936 // indirect
@@ -105,7 +111,6 @@ require (
 	golang.org/x/mod v0.29.0 // indirect
 	golang.org/x/sys v0.37.0 // indirect
 	golang.org/x/text v0.30.0 // indirect
-	golang.org/x/tools v0.38.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect

go.sum

@@ -40,6 +40,10 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-stomp/stomp/v3 v3.1.5 h1:Pikz1OSusmSKUm5mRKYfXQZaDatfZ+EnBBA1JJ2xENQ=
 github.com/go-stomp/stomp/v3 v3.1.5/go.mod h1:ztzZej6T2W4Y6FlD+Tb5n7HQP3/O5UNQiuC169pIp10=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
+github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
@@ -58,6 +62,10 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 h1:b70jEaX2iaJSPZULSUxKtm73LBfsCrMsIlYCUgNGSIs=
+github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976/go.mod h1:ZGQeOwybjD8lkCjIyJfqR5LD2wMVHJ31d6GdPxoTsWY=
+github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 h1:c7gcNWTSr1gtLp6PyYi3wzvFCEcHJ4YRobDgqmIgf7Q=
+github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092/go.mod h1:ZZAN4fkkful3l1lpJwF8JbW41ZiG9TwJ2ZlqzQovBNU=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.9 h1:c1Us8i6eSmkW+Ez05d3co8kasnuOY813tbMN8i/a3Og=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.9/go.mod h1:2+l7K7twW49Ct4wFluZD3tZ6e0SjanjcUUBPVD/UuGU=
 github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc h1:GN2Lv3MGO7AS6PrRoT6yV5+wkrOpcszoIsO4+4ds248=
@@ -83,6 +91,10 @@ github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
 github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/kaptinlin/go-i18n v0.1.4 h1:wCiwAn1LOcvymvWIVAM4m5dUAMiHunTdEubLDk4hTGs=
+github.com/kaptinlin/go-i18n v0.1.4/go.mod h1:g1fn1GvTgT4CiLE8/fFE1hboHWJ6erivrDpiDtCcFKg=
+github.com/kaptinlin/jsonschema v0.4.6 h1:vOSFg5tjmfkOdKg+D6Oo4fVOM/pActWu/ntkPsI1T64=
+github.com/kaptinlin/jsonschema v0.4.6/go.mod h1:1DUd7r5SdyB2ZnMtyB7uLv64dE3zTFTiYytDCd+AEL0=
 github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
 github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
 github.com/knqyf263/go-apk-version v0.0.0-20200609155635-041fdbb8563f h1:GvCU5GXhHq+7LeOzx/haG7HSIZokl3/0GkoUFzsRJjg=
@@ -123,6 +135,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs=
 github.com/package-url/packageurl-go v0.1.3/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -176,8 +190,6 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 h1:nrZ3ySNYwJbSpD6ce9duiP+QkD3JuLCcWkdaehUS/3Y=
 github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80/go.mod h1:iFyPdL66DjUD96XmzVL3ZntbzcflLnznH0fr99w5VqE=
-github.com/ugorji/go/codec v1.2.14 h1:yOQvXCBc3Ij46LRkRoh4Yd5qK6LVOgi0bYOXfb7ifjw=
-github.com/ugorji/go/codec v1.2.14/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=

httptransport/client/indexer.go

@@ -52,7 +52,6 @@ func (s *HTTP) AffectedManifests(ctx context.Context, v []claircore.Vulnerabilit
 	switch ct := req.Header.Get("content-type"); ct {
 	case "", `application/json`:
 		dec := codec.GetDecoder(resp.Body)
-		defer codec.PutDecoder(dec)
 		if err := dec.Decode(&a); err != nil {
 			return nil, err
 		}
@@ -98,7 +97,6 @@ func (s *HTTP) Index(ctx context.Context, manifest *claircore.Manifest) (*clairc
 	switch ct := resp.Header.Get("content-type"); ct {
 	case "", `application/json`:
 		dec := codec.GetDecoder(resp.Body)
-		defer codec.PutDecoder(dec)
 		if err := dec.Decode(&ir); err != nil {
 			return nil, err
 		}
@@ -142,7 +140,6 @@ func (s *HTTP) IndexReport(ctx context.Context, manifest claircore.Digest) (*cla
 
 	ir := &claircore.IndexReport{}
 	dec := codec.GetDecoder(resp.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(ir); err != nil {
 		return nil, false, &clairerror.ErrBadIndexReport{E: err}
 	}
@@ -199,7 +196,6 @@ func (s *HTTP) DeleteManifests(ctx context.Context, d ...claircore.Digest) ([]cl
 	}
 	var ret []claircore.Digest
 	dec := codec.GetDecoder(resp.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&ret); err != nil {
 		return nil, fmt.Errorf("failed to decode response: %w", err)
 	}

httptransport/client/matcher.go

@@ -51,7 +51,6 @@ func (c *HTTP) Scan(ctx context.Context, ir *claircore.IndexReport) (*claircore.
 	switch ct := req.Header.Get("content-type"); ct {
 	case "", `application/json`:
 		dec := codec.GetDecoder(resp.Body)
-		defer codec.PutDecoder(dec)
 		if err := dec.Decode(&vr); err != nil {
 			return nil, err
 		}
@@ -203,7 +202,6 @@ func (c *HTTP) updateOperations(ctx context.Context, req *http.Request, cache *u
 	case http.StatusOK:
 		m := make(map[string][]driver.UpdateOperation)
 		dec := codec.GetDecoder(res.Body)
-		defer codec.PutDecoder(dec)
 		if err := dec.Decode(&m); err != nil {
 			return nil, err
 		}
@@ -254,7 +252,6 @@ func (c *HTTP) UpdateDiff(ctx context.Context, prev, cur uuid.UUID) (*driver.Upd
 	}
 	d := driver.UpdateDiff{}
 	dec := codec.GetDecoder(res.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&d); err != nil {
 		return nil, err
 	}