all: move to JSON deser based on encoding/json/v2

cmd/clairctl/client.go

@@ -210,7 +210,6 @@ func (c *Client) IndexReport(ctx context.Context, id claircore.Digest, m *clairc
 	}
 	var report claircore.IndexReport
 	dec := codec.GetDecoder(rd)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&report); err != nil {
 		slog.DebugContext(ctx, "unable to decode json payload",
 			"reason", err)
@@ -270,7 +269,6 @@ func (c *Client) VulnerabilityReport(ctx context.Context, id claircore.Digest) (
 	}
 	var report claircore.VulnerabilityReport
 	dec := codec.GetDecoder(res.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&report); err != nil {
 		slog.DebugContext(ctx, "unable to decode json payload",
 			"reason", err)

cmd/clairctl/jsonformatter.go

@@ -8,17 +8,16 @@ import (
 
 var _ Formatter = (*jsonFormatter)(nil)
 
-// JsonFormatter is a very simple formatter; it just calls
-// (*json.Encoder).Encode.
+// JsonFormatter outputs JSON.
 type jsonFormatter struct {
-	enc *codec.Encoder
+	enc codec.Encoder
 	c   io.Closer
 }
 
 func (f *jsonFormatter) Format(r *Result) error {
 	return f.enc.Encode(r.Report)
 }
+
 func (f *jsonFormatter) Close() error {
-	codec.PutEncoder(f.enc)
 	return f.c.Close()
 }

cmd/clairctl/manifest.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"path"
 	"strings"
+	"sync"
 
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
@@ -36,22 +37,16 @@ func manifestAction(c *cli.Context) error {
 	}
 
 	result := make(chan *claircore.Manifest)
-	done := make(chan struct{})
 	eg, ctx := errgroup.WithContext(c.Context)
-	go func() {
-		defer close(done)
-		enc := codec.GetEncoder(os.Stdout)
-		defer codec.PutEncoder(enc)
-		for m := range result {
-			enc.MustEncode(m)
-		}
-	}()
+	var workers sync.WaitGroup
+	workers.Add(args.Len())
 
-	for i := 0; i < args.Len(); i++ {
+	for i := range args.Len() {
 		name := args.Get(i)
 		l := slog.With("name", name)
 		l.DebugContext(ctx, "fetching")
 		eg.Go(func() error {
+			defer workers.Done()
 			m, err := Inspect(ctx, name)
 			if err != nil {
 				l.DebugContext(ctx, "inspect failure", "reason", err)
@@ -62,11 +57,24 @@ func manifestAction(c *cli.Context) error {
 			return nil
 		})
 	}
+	eg.Go(func() error {
+		workers.Wait()
+		close(result)
+		return nil
+	})
+	eg.Go(func() error {
+		enc := codec.GetEncoder(os.Stdout)
+		for m := range result {
+			if err := enc.Encode(m); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
 	if err := eg.Wait(); err != nil {
 		return err
 	}
-	close(result)
-	<-done
 	return nil
 }
 

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/go-stomp/stomp/v3 v3.1.5
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-containerregistry v0.21.5
+	github.com/google/jsonschema-go v0.4.2
 	github.com/google/uuid v1.6.0
 	github.com/grafana/pyroscope-go/godeltaprof v0.1.9
 	github.com/jackc/pgx/v5 v5.9.2
@@ -22,7 +23,6 @@ require (
 	github.com/remind101/migrate v0.0.0-20170729031349-52c1edff7319
 	github.com/rogpeppe/go-internal v1.14.1
 	github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80
-	github.com/ugorji/go/codec v1.2.14
 	github.com/urfave/cli/v2 v2.27.7
 	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0
@@ -42,6 +42,7 @@ require (
 	golang.org/x/net v0.53.0
 	golang.org/x/sync v0.20.0
 	golang.org/x/time v0.15.0
+	golang.org/x/tools v0.44.0
 	google.golang.org/grpc v1.80.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -100,7 +101,6 @@ require (
 	golang.org/x/mod v0.35.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
@@ -110,3 +110,5 @@ require (
 	modernc.org/memory v1.11.0 // indirect
 	modernc.org/sqlite v1.46.1 // indirect
 )
+
+tool github.com/quay/clair/v4/internal/cmd/alias_gen

go.sum

@@ -49,6 +49,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.21.5 h1:KTJG9Pn/jC0VdZR6ctV3/jcN+q6/Iqlx0sTVz3ywZlM=
 github.com/google/go-containerregistry v0.21.5/go.mod h1:ySvMuiWg+dOsRW0Hw8GYwfMwBlNRTmpYBFJPlkco5zU=
+github.com/google/jsonschema-go v0.4.2 h1:tmrUohrwoLZZS/P3x7ex0WAVknEkBZM46iALbcqoRA8=
+github.com/google/jsonschema-go v0.4.2/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -163,8 +165,6 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 h1:nrZ3ySNYwJbSpD6ce9duiP+QkD3JuLCcWkdaehUS/3Y=
 github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80/go.mod h1:iFyPdL66DjUD96XmzVL3ZntbzcflLnznH0fr99w5VqE=
-github.com/ugorji/go/codec v1.2.14 h1:yOQvXCBc3Ij46LRkRoh4Yd5qK6LVOgi0bYOXfb7ifjw=
-github.com/ugorji/go/codec v1.2.14/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=

httptransport/client/indexer.go

@@ -52,7 +52,6 @@ func (s *HTTP) AffectedManifests(ctx context.Context, v []claircore.Vulnerabilit
 	switch ct := req.Header.Get("content-type"); ct {
 	case "", `application/json`:
 		dec := codec.GetDecoder(resp.Body)
-		defer codec.PutDecoder(dec)
 		if err := dec.Decode(&a); err != nil {
 			return nil, err
 		}
@@ -98,7 +97,6 @@ func (s *HTTP) Index(ctx context.Context, manifest *claircore.Manifest) (*clairc
 	switch ct := resp.Header.Get("content-type"); ct {
 	case "", `application/json`:
 		dec := codec.GetDecoder(resp.Body)
-		defer codec.PutDecoder(dec)
 		if err := dec.Decode(&ir); err != nil {
 			return nil, err
 		}
@@ -142,7 +140,6 @@ func (s *HTTP) IndexReport(ctx context.Context, manifest claircore.Digest) (*cla
 
 	ir := &claircore.IndexReport{}
 	dec := codec.GetDecoder(resp.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(ir); err != nil {
 		return nil, false, &clairerror.ErrBadIndexReport{E: err}
 	}
@@ -199,7 +196,6 @@ func (s *HTTP) DeleteManifests(ctx context.Context, d ...claircore.Digest) ([]cl
 	}
 	var ret []claircore.Digest
 	dec := codec.GetDecoder(resp.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&ret); err != nil {
 		return nil, fmt.Errorf("failed to decode response: %w", err)
 	}

httptransport/client/matcher.go

@@ -51,7 +51,6 @@ func (c *HTTP) Scan(ctx context.Context, ir *claircore.IndexReport) (*claircore.
 	switch ct := req.Header.Get("content-type"); ct {
 	case "", `application/json`:
 		dec := codec.GetDecoder(resp.Body)
-		defer codec.PutDecoder(dec)
 		if err := dec.Decode(&vr); err != nil {
 			return nil, err
 		}
@@ -203,7 +202,6 @@ func (c *HTTP) updateOperations(ctx context.Context, req *http.Request, cache *u
 	case http.StatusOK:
 		m := make(map[string][]driver.UpdateOperation)
 		dec := codec.GetDecoder(res.Body)
-		defer codec.PutDecoder(dec)
 		if err := dec.Decode(&m); err != nil {
 			return nil, err
 		}
@@ -254,7 +252,6 @@ func (c *HTTP) UpdateDiff(ctx context.Context, prev, cur uuid.UUID) (*driver.Upd
 	}
 	d := driver.UpdateDiff{}
 	dec := codec.GetDecoder(res.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&d); err != nil {
 		return nil, err
 	}

httptransport/indexer_v1.go

@@ -90,7 +90,6 @@ func (h *IndexerV1) indexReport(w http.ResponseWriter, r *http.Request) {
 	}
 	defer r.Body.Close()
 	dec := codec.GetDecoder(r.Body)
-	defer codec.PutDecoder(dec)
 	switch r.Method {
 	case http.MethodPost:
 		state, err := h.srv.State(ctx)
@@ -130,7 +129,6 @@ func (h *IndexerV1) indexReport(w http.ResponseWriter, r *http.Request) {
 		defer writerError(w, &err)()
 		w.WriteHeader(http.StatusCreated)
 		enc := codec.GetEncoder(w)
-		defer codec.PutEncoder(enc)
 		err = enc.Encode(report)
 	case http.MethodDelete:
 		var ds []claircore.Digest
@@ -146,7 +144,6 @@ func (h *IndexerV1) indexReport(w http.ResponseWriter, r *http.Request) {
 		defer writerError(w, &err)()
 		w.WriteHeader(http.StatusOK)
 		enc := codec.GetEncoder(w)
-		defer codec.PutEncoder(enc)
 		err = enc.Encode(ds)
 	}
 }
@@ -200,7 +197,6 @@ func (h *IndexerV1) indexReportOne(w http.ResponseWriter, r *http.Request) {
 		w.Header().Add("etag", validator)
 		defer writerError(w, &err)()
 		enc := codec.GetEncoder(w)
-		defer codec.PutEncoder(enc)
 		err = enc.Encode(report)
 	case http.MethodDelete:
 		if _, err := h.srv.DeleteManifests(ctx, d); err != nil {
@@ -237,9 +233,8 @@ func (h *IndexerV1) indexState(w http.ResponseWriter, r *http.Request) {
 	}
 
 	defer writerError(w, &err)()
-	// TODO(hank) Don't use an encoder to write out like 40 bytes of json.
+	// TODO(hank) Use the API type.
 	enc := codec.GetEncoder(w)
-	defer codec.PutEncoder(enc)
 	err = enc.Encode(struct {
 		State string `json:"state"`
 	}{
@@ -265,7 +260,6 @@ func (h *IndexerV1) affectedManifests(w http.ResponseWriter, r *http.Request) {
 		V []claircore.Vulnerability `json:"vulnerabilities"`
 	}
 	dec := codec.GetDecoder(r.Body)
-	defer codec.PutDecoder(dec)
 	if err := dec.Decode(&vulnerabilities); err != nil {
 		apiError(ctx, w, http.StatusBadRequest, "failed to deserialize vulnerabilities: %v", err)
 	}
@@ -277,7 +271,6 @@ func (h *IndexerV1) affectedManifests(w http.ResponseWriter, r *http.Request) {
 
 	defer writerError(w, &err)
 	enc := codec.GetEncoder(w)
-	defer codec.PutEncoder(enc)
 	err = enc.Encode(affected)
 }
 

httptransport/matcher_v1.go

@@ -140,7 +140,6 @@ func (h *MatcherV1) vulnerabilityReport(w http.ResponseWriter, r *http.Request)
 
 	defer writerError(w, &err)()
 	enc := codec.GetEncoder(w)
-	defer codec.PutEncoder(enc)
 	err = enc.Encode(vulnReport)
 }
 
@@ -176,7 +175,6 @@ func (h *MatcherV1) updateDiffHandler(w http.ResponseWriter, r *http.Request) {
 
 	defer writerError(w, &err)()
 	enc := codec.GetEncoder(w)
-	defer codec.PutEncoder(enc)
 	err = enc.Encode(&diff)
 }
 
@@ -223,7 +221,6 @@ func (h *MatcherV1) updateOperationHandlerGet(w http.ResponseWriter, r *http.Req
 
 	defer writerError(w, &err)()
 	enc := codec.GetEncoder(w)
-	defer codec.PutEncoder(enc)
 	err = enc.Encode(&uos)
 }
 

httptransport/notification_v1.go

@@ -169,7 +169,6 @@ func (h *NotificationV1) get(w http.ResponseWriter, r *http.Request) {
 
 	defer writerError(w, &err)()
 	enc := codec.GetEncoder(w)
-	defer codec.PutEncoder(enc)
 	err = enc.Encode(&response)
 }
 

httptransport/types/v1/affected_manifests.go

@@ -0,0 +1,9 @@
+package types
+
+import "github.com/quay/claircore"
+
+// VulnerabilitySummaries is a concrete type for
+// https://clairproject.org/api/http/v1/vulnerability_summaries.schema.json.
+type VulnerabilitySummaries struct {
+	Vulnerabilities []claircore.Vulnerability
+}

httptransport/types/v1/error.go

@@ -0,0 +1,24 @@
+package types
+
+import "fmt"
+
+// Error is the HTTP v1 API error return object, a.k.a
+// https://clairproject.org/api/http/v1/error.schema.json.
+type Error struct {
+	Code   int
+	format string
+	args   []any
+}
+
+// NewError constructs an [Error].
+func NewError(code int, format string, a ...any) *Error {
+	return &Error{
+		Code:   code,
+		format: format,
+		args:   a,
+	}
+}
+
+func (e *Error) Error() string {
+	return fmt.Sprintf(e.format, e.args...)
+}

httptransport/types/v1/state.go

@@ -0,0 +1,12 @@
+package types
+
+// IndexState is a concrete type for
+// https://clairproject.org/api/http/v1/index_state.schema.json.
+type IndexState struct {
+	State string
+}
+
+// NewIndexState constructs an [IndexState].
+func NewIndexState(tok string) *IndexState {
+	return &IndexState{State: tok}
+}