The base image config will be used later for avoiding applying
`SOURCE_DATE_EPOCH` to the base image layers (issue 4614).
The exporter stores this as the `ExporterImageBaseConfigKey` metadata.
NOTE: For a multi-stage Dockerfile like below, the base image refers to
`busybox`, not to `foo`:
```dockerfile
FROM busybox AS foo
FROM foo AS bar
```
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
`-partial-metadata-file` was substantially removed in
9acc6d30eb (`refactor buildinfo into provenance capture`)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This patch adds BUILDKIT_SBOM_SCAN_CONTEXT and BUILDKIT_SBOM_SCAN_STAGE
which configure scanning the build context and stages respectively.
To use these, the underlying Dockerfile must declare these args, and
optionally assign a default value. BUILDKIT_SBOM_SCAN_CONTEXT must
either be set in the global meta args before a FROM or in the target
stage, while BUILDKIT_SBOM_SCAN_STAGE must be set in each target stage.
The user can additionally override the values set in the Dockerfile to
change the behavior.
Signed-off-by: Justin Chadwell <me@jedevc.com>
Change how provenance information is captured from builds.
While previously frontend passed the buildinfo
sources with metadata, now all information is captured
through buildkit. A frontend does not need to implement
buildinfo and can't set incorrect/incomplete buildinfo
for a build result.
All LLB operations can now collect as much provenance
info as they like that will be used when making the
attestation. Previously this was limited to a single Pin
value. For example now we also detect secrets and SSH IDs
that the build uses, or if it accesses network, if local
sources are used etc.. The new design makes sure this
can be easily extended in the future.
Provenance capture can now detect builds that do
multiple separate subsolves in sequence. For example,
first subsolve gathers the sources for the build and
second one builds from immutable sources without a
network connection. If first solve does not participate
in final build result it does not end up in provenance.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
