Switch to use github.com/containerd/platforms module, because containerd's
platforms package has moved to a separate module. This allows updating the
platforms parsing independent of the containerd module itself.
The package in containerd is deprecated, but kept as an alias to provide
compatibility between codebases.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This also allows us to specify that local images should be generated
with exactly the same specification as remote images, but with the
pkg:oci scheme instead of pkg:docker.
Signed-off-by: Justin Chadwell <me@jedevc.com>
If the digest for an ImageSource is the empty string, then calling
`Digest.Algorithm` will panic at runtime.
This scenario *can* happen if `ResolveImageConfig` returns an empty
digest, but correctly returns a config object. This doesn't occur in
buildkit directly, however, buildkit-in-moby implements a custom worker
which also performs image lookups on local images, in which case the
digest for the index may not be available (though this may be possible
with the containerd image store?).
Therefore, we shouldn't assume that the digest is always available in
buildkit, and should instead check that is valid before inserting it
into the digest set (which is already an optional map).
Signed-off-by: Justin Chadwell <me@jedevc.com>
Change how provenance information is captured from builds.
While previously frontend passed the buildinfo
sources with metadata, now all information is captured
through buildkit. A frontend does not need to implement
buildinfo and can't set incorrect/incomplete buildinfo
for a build result.
All LLB operations can now collect as much provenance
info as they like that will be used when making the
attestation. Previously this was limited to a single Pin
value. For example now we also detect secrets and SSH IDs
that the build uses, or if it accesses network, if local
sources are used etc.. The new design makes sure this
can be easily extended in the future.
Provenance capture can now detect builds that do
multiple separate subsolves in sequence. For example,
first subsolve gathers the sources for the build and
second one builds from immutable sources without a
network connection. If first solve does not participate
in final build result it does not end up in provenance.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
