This reverts the change from #7012.
Referrer manifests may be pushed before their subject, and the OCI distribution spec requires registries to initially accept a manifest whose subject does not exist yet. Keep BuildKit's default push order aligned with that behavior instead of working around registries that reject this flow.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
OCI artifact attestations carry a subject reference to the image manifest.
Push manifests in an order that keeps child manifests before parent indexes
while also pushing any in-stack subject manifest before the attestation
that references it.
Add an integration test variant with a strict registry proxy to cover
registries that reject manifests whose subject doesn't already exist.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Add a FinalizeExport RPC to pass the combined exporter response back to
the session provider after all exports complete. This lets clients run
completion work while the build's gateway references remain available.
Keep the callback optional for compatibility with existing session
exporters. Ignore unsupported finalization, propagate callback failures,
and support providers that only register a finalization callback.
Signed-off-by: Alberto Garcia Hierro <alberto.hierro@docker.com>
Render parsed source identifiers back to their canonical SourceOp form before
source policy evaluation. This lets Git subdir cleanup use the existing source
parser and avoids policy-specific Git parsing.
Add String methods for source identifiers and cover them with unit tests, plus
a client integration regression for canonical Git subdir policy matching.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
client/build_test.go:2363:14: SA1019: proxy.Director has been deprecated since Go 1.26 and an alternative has been available since Go 1.20: Use Rewrite instead. (staticcheck)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move client integration test declarations out of the large harness files into
focused files for cache, exporters, sources, mounts, gateway behavior, and
related client features.
Keep registration lists grouped by source file, move non-gateway tests out of
the gateway harness, and remove the now-empty build_test.go. This is intended
as a mechanical split with no test logic changes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Replace Windows path separators and drive separators when platform IDs are
used as local and tar exporter path components. Add a regression test for tar
exporter output generated from frontend-controlled platform metadata.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use the worker default provider for proxy UNSET egress so host fallback
is preserved when no CNI config is configured.
Extend proxy integration coverage across default, host, bridge, and
default-no-cni worker network modes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Delay containerd stdin CloseIO until BuildKit's stdin reader reaches EOF.
This avoids racing the shim FIFO copy path, where closing stdin before
the copy completes can leave execs stuck or missing stdin data.
Add a client gateway regression that runs concurrent execs writing stdin
into files and verifies every payload is present.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Keep exec network modes limited to sandbox, host, and none, and pass proxy
network configuration separately through solve and executor runtime state.
Proxy execs now use bridge-style egress by default, host egress only for host
network mode with entitlement, and no proxy for none mode. Add integration
coverage for bridge, host, and none proxy behavior across OCI and containerd
workers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Apply the oci-mediatypes default at export time so the Docker tar exporter
does not treat variant=docker as implicit oci-mediatypes=false.
Keep Docker tar manifest.json output for legacy compatibility, and preserve
explicit oci-mediatypes=false behavior with test coverage.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Forward non-tty stdin through an os.Pipe so runc receives an *os.File
instead of the caller's reader. This lets runc exit after the container
process is killed without waiting on Go's internal stdin copy.
Add gateway coverage for graceful pid1 exit, release-based cleanup, and
explicit SIGKILL while pid1 stdin is still open.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add a passthrough LLB op that builds all inputs and exposes selected
inputs as outputs. Add State.Requires as a client shortcut for requiring
dependencies without returning their snapshots.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for exec proxy source policy conversion. The test
requests /foo, rewrites it to /bar, and verifies exported content and
provenance materials use the converted source.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Record each proxied exec request and print a redacted method and URL list in
the exec progress logs after the process completes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Record successful GET responses through the exec proxy as provenance
materials and report incomplete material coverage as a typed solve error.
Thread proxy policy and capture state through typed executor/network options.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add a build request option that rewrites default exec networking to an
internal proxy network while preserving explicit none networking.
Route HTTP and HTTPS traffic through a BuildKit-owned proxy namespace, enforce
source policy checks for proxied requests, and inject a temporary CA into Linux
rootfs trust bundles for HTTPS interception.
Share namespace pooling between CNI and proxy providers, and cover proxy mode
with unit and integration tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Wait before the second solve so previous local source refs can be released
before the reuse assertion runs.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add compatibility-version 30 for the new OCI media type default while keeping
version 20 pinned to the historical image exporter behavior through v0.31.x.
Track omitted oci-mediatypes separately from explicit false, add v30
compatibility goldens, and document the supported compatibility versions.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow annotation and attestation exports with OCI media types enabled, fix
the zstd media type map, and update integration tests for the new default.
Keep Docker media types explicit where legacy behavior is under test.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When support for zstd was introduced, these mediaTypes were not yet
available in released versions of their respective Go packages. That is
no longer the case.
Signed-off-by: Bjorn Neergaard <bjorn.neergaard@docker.com>
Use the resolver-cache ref ID directly when loading a cached HTTP snapshot.
This avoids dereferencing missing metadata for cache entries found during a
concurrent solve.
Reset the unauthorized checksum race request counter per solve iteration so
each retry applies the intended first-request delay.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Clone the existing slow-cache input result when wrapping errors instead of
creating a separate shared owner. This keeps SlowCacheError.Result tied to
the same release chain and avoids releasing the input while the error still
holds it.
Update the containerd cleanup check to ignore empty leases while still
failing on leases that retain resources, and add a deterministic regression.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Avoid storing typed nil HTTP metadata in the resolver cache after failed
metadata resolution. Also make resolver cache release functions consistently
callable when no error is returned.
Add a client integration test covering concurrent same-URL HTTP sources with
and without checksum when the server returns 401.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Update non-generated code for the newer lint recommendations by using typed
atomic values, strings.Cut, and slices.Backward where applicable.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
