fix: plural edge download command (#624)

* fix plural edge download command

* replace containerd library

---------

Co-authored-by: test-cli-e2e-aws <test-cli-e2e-aws@srv.plural.sh>

Author: zreigz

cmd/command/edge/edge.go

@@ -143,7 +143,7 @@ func Commands(clients client.Plural, helmConfiguration *action.Configuration) []
 			Usage:  "pull and extract the edge image",
 			Flags: []cli.Flag{
 				cli.StringFlag{
-					Name:     "url",
+					Name:     "oci-url",
 					Usage:    "the url of the image to download",
 					Required: true,
 				},

cmd/command/edge/image.go

@@ -3,11 +3,17 @@ package edge
 import (
 	"bytes"
 	"fmt"
+	"io"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
+	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/mutate"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
 	gqlclient "github.com/pluralsh/console/go/client"
 	"github.com/pluralsh/plural-cli/pkg/console"
 	"github.com/pluralsh/plural-cli/pkg/utils"
@@ -269,7 +275,7 @@ func (p *Plural) handleEdgeDownload(c *cli.Context) error {
 	var err error
 
 	outputDir := c.String("to")
-	url := c.String("url")
+	url := c.String("oci-url")
 
 	if outputDir == "" {
 		outputDir, err = os.Getwd()
@@ -278,11 +284,51 @@ func (p *Plural) handleEdgeDownload(c *cli.Context) error {
 		}
 	}
 
-	utils.Highlight("unpacking image contents\n")
-	if err := utils.Exec("docker", "run", "-i", "--rm", "--privileged", "-v", fmt.Sprintf("%s:/image", outputDir),
-		"quay.io/luet/base", "util", "unpack", url, "/image"); err != nil {
+	return unpackImage(outputDir, url)
+}
+
+func unpackImage(outputDir, ociUrl string) error {
+	done := make(chan struct{})
+	defer close(done)
+
+	utils.Highlight("unpacking image contents to %s   ", outputDir)
+	imageDir := filepath.Join(outputDir, "build")
+	if !utils.IsDir(imageDir) {
+		if err := os.MkdirAll(outputDir, os.ModePerm); err != nil {
+			return err
+		}
+	}
+
+	ref, err := name.ParseReference(ociUrl)
+	if err != nil {
 		return err
 	}
+	img, err := remote.Image(ref, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	if err != nil {
+		return err
+	}
+	reader := mutate.Extract(img)
+	defer func(reader io.ReadCloser) {
+		err := reader.Close()
+		if err != nil {
+			utils.Error("%s", err.Error())
+		}
+	}(reader)
+	go progress(done)
+	return utils.Untar(outputDir, reader)
+}
 
-	return nil
+func progress(done <-chan struct{}) {
+	frames := []rune{'|', '/', '-', '\\'}
+	i := 0
+	for {
+		select {
+		case <-done:
+			return
+		default:
+			fmt.Printf("\b%c", frames[i%len(frames)])
+			time.Sleep(500 * time.Millisecond)
+			i++
+		}
+	}
 }

go.mod

@@ -27,6 +27,7 @@ require (
 	github.com/fatih/color v1.18.0
 	github.com/go-git/go-git/v5 v5.13.1
 	github.com/gofrs/flock v0.12.1
+	github.com/google/go-containerregistry v0.20.3
 	github.com/google/go-github/v45 v45.2.0
 	github.com/hashicorp/go-bexpr v0.1.14
 	github.com/ktrysmt/go-bitbucket v0.9.81
@@ -46,7 +47,7 @@ require (
 	github.com/urfave/cli v1.22.16
 	github.com/yuin/gopher-lua v1.1.1
 	gitlab.com/gitlab-org/api/client-go v0.118.0
-	golang.org/x/crypto v0.32.0
+	golang.org/x/crypto v0.35.0
 	golang.org/x/oauth2 v0.25.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -95,8 +96,9 @@ require (
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v27.4.1+incompatible // indirect
+	github.com/docker/cli v27.5.0+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker v27.5.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
@@ -134,6 +136,7 @@ require (
 	github.com/skeema/knownhosts v1.3.0 // indirect
 	github.com/sosodev/duration v1.3.1 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/vbatts/tar-split v0.11.6 // indirect
 	github.com/vektah/gqlparser/v2 v2.5.21 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
@@ -261,14 +264,14 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/sync v0.10.0 // indirect
-	golang.org/x/sys v0.29.0 // indirect
-	golang.org/x/term v0.28.0
-	golang.org/x/text v0.21.0
+	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/term v0.29.0
+	golang.org/x/text v0.22.0
 	golang.org/x/time v0.9.0 // indirect
 	google.golang.org/api v0.215.0
 	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.2 // indirect
+	google.golang.org/protobuf v1.36.3 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	k8s.io/apiextensions-apiserver v0.32.0 // indirect
@@ -285,3 +288,12 @@ require (
 	sigs.k8s.io/kustomize/kyaml v0.18.1 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.5.0 // indirect
 )
+
+replace (
+	// CVE-2024-40635
+	github.com/containerd/containerd => github.com/containerd/containerd v1.7.27
+	// CVE-2025-30204
+	github.com/golang-jwt/jwt/v5 => github.com/golang-jwt/jwt/v5 v5.2.2
+	// CVE-2025-22870
+	golang.org/x/net => golang.org/x/net v0.36.0
+)