This is more versatile function that works for any source,
not just images.
It can be used together with a policy that switches
between input and output source as well as for adding
additional metadata for other sources in the future.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Since go 1.20, interfaces (that can be compared) now implement the
comparable interface. The use of reflection in solver/result was a
workaround for this limitation, however, we can remove this with the
upstream fix.
Signed-off-by: Justin Chadwell <me@jedevc.com>
This reverts commit 6f21d6b403.
We don't need the exporter opts for multiplatform, they were a hack to
attempt to preserve the semantics of converting between Ref->Refs
freely (both buildkit-side and frontend-side).
Signed-off-by: Justin Chadwell <me@jedevc.com>
This reverts commit f2c770e45e.
This patch reworks the attestations code back out of the Refs map. The
logic for this change is that the loss-of-granularity in the data
structure for the protobuf requires convoluted logic in the exporter to
be able to determine the correct multi-platform behaviour.
Prior to attestations, Refs directly mapped each platform to a
reference. Attestations changed this structure, which means that there
is no longer a concrete way to determine if a reference should be
exported with multi-platform semantics or not (e.g. should a local
export with a single platform be flat/nested, should an image export use
an oci manifest or an oci index).
This patch restores the previous semantics, moving the attestion refs
back, pushing the attestations back down into a separate struct. This
has the disadvantage of requiring the result.Attestation struct to be
generic, however, this does simplify some of the helper methods around
it.
By changing this logic, we're able to simplify a few key pieces of
logic:
- Fewer version interop concerns. Because we're not changing the
structure of Ref/Refs between buildkit versions, mixing frontends and
buildkit versions will *always* produce the expected result. If a
frontend attaches attestations they won't be transmitted at all
automatically. Additionally, because attestations can also be attached
to a single Ref, the frontend doesn't need to force an index in the
future.
- Less complex exporter logic, we don't need to any magic around
detecting the user intention with regards to multi-platform exports,
we simply follow the previous semantics of len(res.Refs) > 0. We only
need the small snippet that ensures that the inline-only attestations
don't get attached to a single manifest, to keep the docker load case
working.
- Some simplification of the SBOM scanner code, we can return an
Attestation[llb.State], which we can then easily Convert into an
actual Attestation[Ref].
The patch looks large, but most of the changes are mostly just function
signature changes - the meat of the changes is in the rework of the
platform detection code. This is so we can support the use case of Ref +
Attestations, Refs + Attestations (multi-platform=false) and Refs +
Attestations (multi-platform=true).
Signed-off-by: Justin Chadwell <me@jedevc.com>
Change how provenance information is captured from builds.
While previously frontend passed the buildinfo
sources with metadata, now all information is captured
through buildkit. A frontend does not need to implement
buildinfo and can't set incorrect/incomplete buildinfo
for a build result.
All LLB operations can now collect as much provenance
info as they like that will be used when making the
attestation. Previously this was limited to a single Pin
value. For example now we also detect secrets and SSH IDs
that the build uses, or if it accesses network, if local
sources are used etc.. The new design makes sure this
can be easily extended in the future.
Provenance capture can now detect builds that do
multiple separate subsolves in sequence. For example,
first subsolve gathers the sources for the build and
second one builds from immutable sources without a
network connection. If first solve does not participate
in final build result it does not end up in provenance.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
