vendor: Bump hcsshim to 0.9.0

This change bumps hcsshim to 0.9.0. Main thing this tag contains is support for
Kubernetes Host Process containers
See: https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/

Signed-off-by: Daniel Canter <dcanter@microsoft.com>

vendor/github.com/Microsoft/hcsshim/ext4/tar2ext4/tar2ext4.go

@@ -3,12 +3,17 @@ package tar2ext4
 import (
 	"archive/tar"
 	"bufio"
+	"bytes"
 	"encoding/binary"
+	"github.com/pkg/errors"
 	"io"
+	"io/ioutil"
 	"os"
 	"path"
 	"strings"
+	"unsafe"
 
+	"github.com/Microsoft/hcsshim/ext4/dmverity"
 	"github.com/Microsoft/hcsshim/ext4/internal/compactext4"
 	"github.com/Microsoft/hcsshim/ext4/internal/format"
 )
@@ -16,6 +21,7 @@ import (
 type params struct {
 	convertWhiteout bool
 	appendVhdFooter bool
+	appendDMVerity  bool
 	ext4opts        []compactext4.Option
 }
 
@@ -34,6 +40,12 @@ func AppendVhdFooter(p *params) {
 	p.appendVhdFooter = true
 }
 
+// AppendDMVerity instructs the converter to add a dmverity merkle tree for
+// the ext4 filesystem after the filesystem and before the optional VHD footer
+func AppendDMVerity(p *params) {
+	p.appendDMVerity = true
+}
+
 // InlineData instructs the converter to write small files into the inode
 // structures directly. This creates smaller images but currently is not
 // compatible with DAX.
@@ -53,6 +65,7 @@ func MaximumDiskSize(size int64) Option {
 const (
 	whiteoutPrefix = ".wh."
 	opaqueWhiteout = ".wh..wh..opq"
+	ext4blocksize  = compactext4.BlockSize
 )
 
 // Convert writes a compact ext4 file system image that contains the files in the
@@ -162,6 +175,54 @@ func Convert(r io.Reader, w io.ReadWriteSeeker, options ...Option) error {
 	if err != nil {
 		return err
 	}
+
+	if p.appendDMVerity {
+		ext4size, err := w.Seek(0, io.SeekEnd)
+		if err != nil {
+			return err
+		}
+
+		// Rewind the stream and then read it all into a []byte for
+		// dmverity processing
+		_, err = w.Seek(0, io.SeekStart)
+		if err != nil {
+			return err
+		}
+		data, err := ioutil.ReadAll(w)
+		if err != nil {
+			return err
+		}
+
+		mtree, err := dmverity.MerkleTree(data)
+		if err != nil {
+			return errors.Wrap(err, "failed to build merkle tree")
+		}
+
+		// Write dmverity superblock and then the merkle tree after the end of the
+		// ext4 filesystem
+		_, err = w.Seek(0, io.SeekEnd)
+		if err != nil {
+			return err
+		}
+		superblock := dmverity.NewDMVeritySuperblock(uint64(ext4size))
+		err = binary.Write(w, binary.LittleEndian, superblock)
+		if err != nil {
+			return err
+		}
+		// pad the superblock
+		sbsize := int(unsafe.Sizeof(*superblock))
+		padding := bytes.Repeat([]byte{0}, ext4blocksize-(sbsize%ext4blocksize))
+		_, err = w.Write(padding)
+		if err != nil {
+			return err
+		}
+		// write the tree
+		_, err = w.Write(mtree)
+		if err != nil {
+			return err
+		}
+	}
+
 	if p.appendVhdFooter {
 		size, err := w.Seek(0, io.SeekEnd)
 		if err != nil {