Concurrent calls of EncryptLayer seem to be racy

[mtrmac]

c/image can copy layers in parallel; that involves concurrent calls of EncryptLayer with the same EncryptConfig.

Looking at https://github.com/containers/ocicrypt/blob/ffc163c18e970386fcd1b35acf2d350c8665d080/keywrap/pkcs11/keywrapper_pkcs11.go#L44 , it seems that that could concurrently write to the same array underlying the ec.Parameters["pkcs11-pubkeys"] array.

That seems to be possible in principle in Go, as demonstrated by

package main

import "fmt"

func main() {
    a := []int{1, 11, 12, 13}
    a = append(a, 14, 15) // Creates a backing array with extra capacity
    b := append(a, 2, 21) // Writes to the backing array of a
    c := append(a, 3, 31) // ALSO writes to the backing array of a

    fmt.Printf("%#v@%d %#v@%d %#v@%d\n", a, cap(a), b, cap(b), c, cap(c))

    a[0] = 10
    fmt.Printf("%#v@%d %#v@%d %#v@%d\n", a, cap(a), b, cap(b), c, cap(c)) // See that both b and c are updated - and b contains c’s data
}