Remove gogoproto in favor of the standard protobuf compiler. This
removes any nonstandard extensions that were part of gogoproto such as
the custom types.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Switch to use github.com/containerd/platforms module, because containerd's
platforms package has moved to a separate module. This allows updating the
platforms parsing independent of the containerd module itself.
The package in containerd is deprecated, but kept as an alias to provide
compatibility between codebases.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This modifies how build steps are unmarshaled from JSON into the
provenance attestation. The current method doesn't correctly handle
protobuf attributes that are used with `oneof`.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Trivially created by looking for every reference to .Variant and adding
OSVersion and OSFeatures, except the ones related to the string
representation of a Platform instance.
I then went through and ensured every assignment of OSFeatures that
might leak out, i.e., not local-only or for marhsalling purposes, uses
the append-to-nil idiom to avoid sharing the slice storage and allowing
accidental mutation after-the-fact.
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
The "reference" package was moved to a separate module, which was extracted
from b9b19409cf
Also updating docker/docker, which also switched to this new module;
vendor: github.com/docker/docker 032797ea4bcb (v25.0.0-dev)
full diff: afd4805278...032797ea4b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The data structures used by llbsolver shouldn't be bundled into the same
package as the actual creation of the build config.
As it was, it wasn't possible to use the data structures (in tests,
external libraries using buildkit, etc) without pulling in more of
buildkit than was probably intended.
Signed-off-by: Justin Chadwell <me@jedevc.com>
This also allows us to specify that local images should be generated
with exactly the same specification as remote images, but with the
pkg:oci scheme instead of pkg:docker.
Signed-off-by: Justin Chadwell <me@jedevc.com>
If the digest for an ImageSource is the empty string, then calling
`Digest.Algorithm` will panic at runtime.
This scenario *can* happen if `ResolveImageConfig` returns an empty
digest, but correctly returns a config object. This doesn't occur in
buildkit directly, however, buildkit-in-moby implements a custom worker
which also performs image lookups on local images, in which case the
digest for the index may not be available (though this may be possible
with the containerd image store?).
Therefore, we shouldn't assume that the digest is always available in
buildkit, and should instead check that is valid before inserting it
into the digest set (which is already an optional map).
Signed-off-by: Justin Chadwell <me@jedevc.com>
This reverts commit f2c770e45e.
This patch reworks the attestations code back out of the Refs map. The
logic for this change is that the loss-of-granularity in the data
structure for the protobuf requires convoluted logic in the exporter to
be able to determine the correct multi-platform behaviour.
Prior to attestations, Refs directly mapped each platform to a
reference. Attestations changed this structure, which means that there
is no longer a concrete way to determine if a reference should be
exported with multi-platform semantics or not (e.g. should a local
export with a single platform be flat/nested, should an image export use
an oci manifest or an oci index).
This patch restores the previous semantics, moving the attestion refs
back, pushing the attestations back down into a separate struct. This
has the disadvantage of requiring the result.Attestation struct to be
generic, however, this does simplify some of the helper methods around
it.
By changing this logic, we're able to simplify a few key pieces of
logic:
- Fewer version interop concerns. Because we're not changing the
structure of Ref/Refs between buildkit versions, mixing frontends and
buildkit versions will *always* produce the expected result. If a
frontend attaches attestations they won't be transmitted at all
automatically. Additionally, because attestations can also be attached
to a single Ref, the frontend doesn't need to force an index in the
future.
- Less complex exporter logic, we don't need to any magic around
detecting the user intention with regards to multi-platform exports,
we simply follow the previous semantics of len(res.Refs) > 0. We only
need the small snippet that ensures that the inline-only attestations
don't get attached to a single manifest, to keep the docker load case
working.
- Some simplification of the SBOM scanner code, we can return an
Attestation[llb.State], which we can then easily Convert into an
actual Attestation[Ref].
The patch looks large, but most of the changes are mostly just function
signature changes - the meat of the changes is in the rework of the
platform detection code. This is so we can support the use case of Ref +
Attestations, Refs + Attestations (multi-platform=false) and Refs +
Attestations (multi-platform=true).
Signed-off-by: Justin Chadwell <me@jedevc.com>
Change how provenance information is captured from builds.
While previously frontend passed the buildinfo
sources with metadata, now all information is captured
through buildkit. A frontend does not need to implement
buildinfo and can't set incorrect/incomplete buildinfo
for a build result.
All LLB operations can now collect as much provenance
info as they like that will be used when making the
attestation. Previously this was limited to a single Pin
value. For example now we also detect secrets and SSH IDs
that the build uses, or if it accesses network, if local
sources are used etc.. The new design makes sure this
can be easily extended in the future.
Provenance capture can now detect builds that do
multiple separate subsolves in sequence. For example,
first subsolve gathers the sources for the build and
second one builds from immutable sources without a
network connection. If first solve does not participate
in final build result it does not end up in provenance.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
