This reverts commit f2c770e45e.
This patch reworks the attestations code back out of the Refs map. The
logic for this change is that the loss-of-granularity in the data
structure for the protobuf requires convoluted logic in the exporter to
be able to determine the correct multi-platform behaviour.
Prior to attestations, Refs directly mapped each platform to a
reference. Attestations changed this structure, which means that there
is no longer a concrete way to determine if a reference should be
exported with multi-platform semantics or not (e.g. should a local
export with a single platform be flat/nested, should an image export use
an oci manifest or an oci index).
This patch restores the previous semantics, moving the attestion refs
back, pushing the attestations back down into a separate struct. This
has the disadvantage of requiring the result.Attestation struct to be
generic, however, this does simplify some of the helper methods around
it.
By changing this logic, we're able to simplify a few key pieces of
logic:
- Fewer version interop concerns. Because we're not changing the
structure of Ref/Refs between buildkit versions, mixing frontends and
buildkit versions will *always* produce the expected result. If a
frontend attaches attestations they won't be transmitted at all
automatically. Additionally, because attestations can also be attached
to a single Ref, the frontend doesn't need to force an index in the
future.
- Less complex exporter logic, we don't need to any magic around
detecting the user intention with regards to multi-platform exports,
we simply follow the previous semantics of len(res.Refs) > 0. We only
need the small snippet that ensures that the inline-only attestations
don't get attached to a single manifest, to keep the docker load case
working.
- Some simplification of the SBOM scanner code, we can return an
Attestation[llb.State], which we can then easily Convert into an
actual Attestation[Ref].
The patch looks large, but most of the changes are mostly just function
signature changes - the meat of the changes is in the rework of the
platform detection code. This is so we can support the use case of Ref +
Attestations, Refs + Attestations (multi-platform=false) and Refs +
Attestations (multi-platform=true).
Signed-off-by: Justin Chadwell <me@jedevc.com>
Change how provenance information is captured from builds.
While previously frontend passed the buildinfo
sources with metadata, now all information is captured
through buildkit. A frontend does not need to implement
buildinfo and can't set incorrect/incomplete buildinfo
for a build result.
All LLB operations can now collect as much provenance
info as they like that will be used when making the
attestation. Previously this was limited to a single Pin
value. For example now we also detect secrets and SSH IDs
that the build uses, or if it accesses network, if local
sources are used etc.. The new design makes sure this
can be easily extended in the future.
Provenance capture can now detect builds that do
multiple separate subsolves in sequence. For example,
first subsolve gathers the sources for the build and
second one builds from immutable sources without a
network connection. If first solve does not participate
in final build result it does not end up in provenance.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This just makes sure the logic for the layer conversion is all in one
place and settable by a common option.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
compression-level option can be set on export to
define the preferred speed vs compression ratio. The
value is a number dependent on the compression algorithm.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This consists of just the base MergeOp with support for merging LLB
results that include deletions using hardlinks as the efficient path
and copies as fallback.
Signed-off-by: Erik Sipsma <erik@sipsma.dev>
This fixes panics in the moby integration of buildkit when using cache.
Panics come from nil Differ in computeBlobChain which is called in GetRemote().
GetRemote() got moved from Worker to ImmutableRef during the lazy-pull refactor.
However, the ability to easily override GetRemote() got lost with that refactor.
This patch attempts to allow for the override while keeping changes minimal.
Signed-off-by: Tibor Vass <tibor@docker.com>
