A build still running when its job was discarded stored its results
in states that were already released, leaking them. Keep the states
until the last running build returns, and reject new builds on a
discarded job. Release refs of a gateway solve that returns after the
forwarder was discarded.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
A request canceled while respondToIncoming was running could finish
the last incoming request while outgoing work was still active, so a
build returned before its exec completed. Decide on one snapshot of
the cancel state per call.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Retry HTTP 429 and 503 responses through the shared retry loop, honoring
Retry-After seconds and HTTP dates without extending the attempt limit.
Allow server-requested delays up to 30 seconds independently of the
exponential backoff limit. Stop when the requested delay exceeds this
limit instead of retrying earlier than the server requested.
Close failed response bodies before waiting and preserve cancellation.
Keep the cached HEAD probe best-effort, with retries applied to GET.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Spread concurrent retries, including the first retry, by waiting between
half and all of each exponential delay. Keep the unjittered backoff as
the stopping condition so the attempt limit remains unchanged.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
A chain computed before its blobs existed stayed memoized after export,
so the record was never matched to its image. Return nil until every
layer has a blob, and memoize only complete chains.
Diff chains now match the layers export creates for them.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Rebuilding an unchanged image can change its index digest through provenance
attestations, invalidating downstream cache despite an unchanged platform
manifest. Use the selected platform manifest as an alternate source cache
key while retaining the root manifest key for existing caches.
Capture the image manifest during the existing platform-filtered traversal,
including nested indexes and embedded manifests. Preserve the first image
manifest so malformed config or layer descriptors cannot replace its cache
identity.
Keep checksum validation and provenance pins tied to the root manifest.
Both cache keys use verified manifest digests, without restoring the
unverified DiffID fallback removed for GHSA-f2v9-hprr-32q3.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Keep reading until the buffer is full or an error occurs. Comparing the
last read count with the remaining buffer length could return a short
read without an error and perform an extra read after filling the buffer.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The HEAD request in resolveMetadataRef is an optimization that servers
are not required to support. Its error is already ignored and the code
falls through to the GET, which is retried.
Retrying the HEAD adds nothing, since the GET covers the same failures,
and costs up to ~7s of backoff before the GET even starts.
Signed-off-by: Adam Stokes <adam.stokes@docker.com>
Move signing commands, signature verification, and policy configuration into
cache/remotecache/signing so other remote cache backends can reuse them.
Keep GHA cache keys, signature storage, and TOML configuration unchanged.
Initialize the verifier for signing-only configurations and report signing
failures through the progress callback. Cover command execution, policy
matching, GHA import verification, cache namespaces, and config loading.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Independent local content stores only coordinate writers within each
store instance. Concurrent cache exports to the same directory can open
the same ingest files, causing rename failures or incomplete writes.
Acquire a filesystem lock per ingest reference before opening a writer
or aborting an ingest. Release it when the writer closes or commits,
including error paths, and report contention as unavailable so existing
retry logic can wait. Preserve references so interrupted uploads remain
resumable, and retain lock files to avoid races with replacement inodes.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Status batching only counted log bytes, allowing other fields and protobuf
overhead to push responses beyond the gRPC limit. Account for every field
against a 1 MiB encoded-size target, reset the counter between batches,
emit warnings once, and leave the input unchanged.
Split large log payloads into fixed 512 KiB chunks, preserving their bytes
and metadata. This favors simple splitting over filling each batch exactly
and applies to live status, history recording, and replay of older records.
Keep indivisible metadata entries intact. These can exceed the batch target
and still fail to send if they exceed the configured gRPC message limit.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
resolveMetadata stored its result into the resolver cache through
release(v) where v was a *Metadata. On a failed resolve or a cache
hit it set the pointer to nil, but passing a typed nil pointer as an
interface stores a non-nil value, so a nil *Metadata was cached for
that remote#ref. A later resolve of the same key read it back and
dereferenced nil, crashing buildkitd. Because the cache is shared
across the jobs on a solve state, an untrusted Dockerfile or frontend
could crash the daemon, and one build could poison another's.
Store an untyped nil instead, matching the HTTP source, so only a
successfully resolved Metadata is ever cached.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 4dd98355a71d79bdf93bd3456fda3a64847ce1de)
(cherry picked from commit c1399f7266310397f5615f4751147f886afff6d2)
(cherry picked from commit 16c6856432)
Tõnis Tiigi