Validate the default branch returned by ls-remote before using it, so a
malicious remote cannot advertise a HEAD symref such as that would
later be reused as an argument to other git commands.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit a838953fe8776d68379d32a7af0776d538215763)
(cherry picked from commit eb63c321e8)
Update non-generated code for the newer lint recommendations by using typed
atomic values, strings.Cut, and slices.Backward where applicable.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Update golangci-lint and adjust code for new gosec diagnostics. Use
root-scoped filesystem operations where appropriate, preserve explicit
user path behavior for SSH keys, and avoid background contexts in
request-scoped cleanup paths.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Support importing git sources from OCI or registry-backed bundle blobs
and exporting resolved checkouts as single-file git bundles.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow git sources to fetch a pinned commit without resolving the ref
against the remote tip, while preserving cache keys for canonical
branch refs and covering the behavior with tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add solve-wide compatibility-version support for image and oci
exports, with historical goldens and release compatibility tests.
Backfill version 10 for v0.13-v0.14 git artifact behavior, keep
version 20 as current, and reject unsupported zstd on v10.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Resolve SOURCE_DATE_EPOCH=context in the Dockerfile frontend from the
main build context and pass the resolved numeric epoch through normal
ARG handling and exporter metadata.
Use git commit time for git contexts, HTTP Last-Modified when present,
and newest archive entry mtime for HTTP archives. Leave local contexts
unset.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use os.OpenRoot for git dir and checkout subdir access, and share root-
relative path normalization between validation and open paths.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Validate user-provided refs once during identifier construction and reject
option-like refs with leading '-'. There is no known attack related to
previous core, patch is to make ref handling more robust and improve
errors.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit e7f8093e1b386ffe711c8468ca8cdde8cfea0c72)
Normalize Git subdir fragments and validate checkout subdir components
so each segment must be a real directory, preventing traversal and symlink escapes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 8c994eb561a2646b35352e5663afecd225306214)
Add git.mtime=commit option that normalizes all file, symlink,
and directory mtimes in a git snapshot to the resolved commit
timestamp. This enables reproducible builds from git sources.
When SOURCE_DATE_EPOCH is set in the Dockerfile frontend, the
git context automatically uses commit-time mtimes. The URL
query parameter ?mtime=commit|checkout can override this.
New LLB attr (git.mtime) and capability (source.git.mtime) are
registered as experimental. Cache keys include the mtime policy
so that commit-time and checkout-time snapshots are distinct.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The `git checkout tree-ish -- pathspec` command run by buildkit to
populate the work tree defaults to overlay mode, so it won't delete objects
which exist in the work tree but don't exist in the tree-ish. It's not a
problem for ordinary file and directory objects because the work tree
starts out empty, but in the case where submodules are deleted or
renamed it will leave stale gitlink references in the index. The
subsequent `git submodule update ...` command will then fail with an
eror like 'No url found for submodule path ... in .gitmodules' as seen
in #4260.
Adding `--no-overlay` ensures that any deleted gitlink references are
removed from the index before the submodule update runs.
Signed-off-by: Brian Ristuccia <brian@ristuccia.com>
Add detached PGP verification for HTTP sources during metadata resolution
and expose LLB options/caps/attrs for signature validation.
Extract shared OpenPGP verification/parsing logic into util/pgpsign and
reuse it from git signing, plus add integration and source-level tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Make sure remote ref does not change to different commit if
git repo changes in the middle of the build.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This is more flexible as from the user standpoint it might not
be easy to know if a version tag is annotated or not.
Downside of this change is that we can't create a cache key
automatically when checksum was set and no keep-git-dir as we
don't know which checksum is being used.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Pin of annotated tag should be tha SHA of tag, not
the commit it is pointing to.
Cache key of annotated tag should be SHA of the tag
if keep-git-dir is enabled and SHA of underlying
commit otherwise.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
If tag was already pulled by --tags or without refs/tags
that creates ambigous reference in the shared repository.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This fails in `gitSourceHandler` because it can't handle *both* SHA-1 and SHA-256 before Git 2.45 (see PR comments), and there's not a simple way to fix that without newer Git or larger refactoring.
Signed-off-by: Tianon Gravi <admwiggin@gmail.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Because subdir filter happened before the submodule update it
resulted in empty directory being filtered and submodule update
being skipped because .gitmodules was already missing.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Convert usages of `github.com/docker/docker/pkg/idtools` to
`github.com/moby/sys/user` in order to break the dependency between
buildkit and docker.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
The current logic was incorrect in some places so that if first
session randomly chosen by `Any()` returned NotFound then other
sessions were not attempted.
For the main use case of mounting secrets as files the logic
was correct, but it was incorrect for example for the case of
adding secrets as environment variables.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The github.com/docker/docker/pkg/reexec package was moved to
a separate module; migrate to use that module instead.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
