Bump patch-level dependencies while leaving
packageurl-go unchanged. This updates AWS config/credentials,
smithy-go, klauspost/compress, and sigstore-go, with required
companion bumps from their module constraints.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
A CONVERT rule whose selector uses matchType EXACT matched the source but
silently performed no conversion: the source identifier was left unchanged
and no error was returned.
The destination of a CONVERT is computed by selectorCache.Format(match,
format), where format is the rule's Updates.Identifier. For WILDCARD and
REGEX the groups captured from match are substituted into format. The EXACT
branch has no captures and should return the target format verbatim, but it
returned s.Identifier (the selector's own identifier, i.e. the matched
source) instead. mutate() then computed a destination equal to the source,
saw op.Identifier == dest, and returned mutated=false without applying the
update.
This made exact-match source pinning/substitution silently fail, e.g.
pinning an image tag to a digest for reproducible builds.
Return format from the EXACT branch. The empty-destination case is
unaffected: mutate() already falls back to the selector identifier before
calling Format, so an empty Updates.Identifier remains a correct no-op.
Add testConvertExact covering an explicit MatchType_EXACT conversion; the
existing testConvert only exercised the default wildcard path.
Signed-off-by: ZRHann <zrhann@foxmail.com>
Updating to the lowest release that includes [protobuf@dfab275], which
removed use of the github.com/golang/protobuf/ptypes/timestamp.Timestamp
type alias (deprecated).
[protobuf@dfab275]: dfab275eca
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
SelectorCache only stores the identifier and type. Constraints need to
be passed directly outside of cache.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add support for dynamic source policies via client session.
Client session can allow or deny specific source or
ask additional metadata information via sourcemetaresolver if
that is needed to make the decision.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Removes the `tools/tools.go` file used as a hack to get `go.mod` to
track tools in favor of the new method introduced in go 1.24 of being
formally supported in the `go.mod` file. This will allow the tools to be
managed with the new `go get tool` and `go install tool` commands.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
vtproto is an extra protobuf compiler that generates special methods
suffixed with `VT` that create typed and unrolled marshal and unmarshal
functions similar to gogo that can be used for performance sensitive
code. These extensions are optional for code to use but buildkit uses
them.
A codec is also included to utilize vtproto for grpc code. If the
package `github.com/moby/buildkit/util/grpcutil/encoding/proto` is
imported then vtproto will be used if it exists and otherwise it will
use the standard marshaling and unmarshaling methods.
This codec has an important difference from the default codec. The
default codec will always reset messages before unmarshaling. In most
cases, this is unnecessary and is only relevant for `RecvMsg` on
streams. In most cases, if we are passing in an existing message to this
method, we want to reuse the buffers. This codec will always merge the
message when unmarshaling instead of resetting the input message.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
The relative paths option for protoc generators doesn't work well when
it comes to dependencies. This simplifies the code generation to avoid
using `go generate` and to use one global command for protoc generation.
This is similar to https://github.com/docker/buildx/pull/2713 since the
same problems with code generation occur here too.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Remove gogoproto in favor of the standard protobuf compiler. This
removes any nonstandard extensions that were part of gogoproto such as
the custom types.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
This is more versatile function that works for any source,
not just images.
It can be used together with a policy that switches
between input and output source as well as for adding
additional metadata for other sources in the future.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Before this change, ResolveImageConfig was unaware of source policies.
This means that:
1. Images for denied sources may be resolved
2. Image configs may get pulled for sources that are later converted to
a different image
The update makes it so the image resolver first runs a given ref through
the source policy and uses any mutated ref for the actual resolve
(instead of the original ref).
It also returns the mutated ref so it can be used correctly by the
frontend (e.g. don't want to do llb.Image(oldRef@resolvedDigest)).
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Updates the field names for source policies to be a little less
confusing: `Source` -> `Selector`, `Destination` -> `Updates`.
Also collapse `Type` into the `Identifier` which matches how the rest of
buildkit works and greatly simplifies matching.. and generally makes it
so the policy engine doesn't need to care about schemes.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Per our discussion on github, each policy should be evaluated on it's
own.
ie. an "allow" in one policy should be able to change to a "deny" in
another policy.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
This defines a better type for wildcard matching as well as a more
appropritate package (contributed by Akihiro) for doing wildcard
matching.
Also some improvements to caching state such as compiled regexes.
Co-authored-by: Akihiro Suda <suda.kyoto@gmail.com>
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Alternative to PR 2816 ("dockerfile: support Dockerfile.pin for pinning sources")
This version is implemented on the llbsolver side and agnostic to the LLB frontends.
See `solver/llbsolver/vertex.go:loadLLB()`.
See `docs/build-repro.md` for the usage.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
