mirror of
https://github.com/moby/buildkit.git
synced 2026-08-04 14:50:21 +00:00
9acc6d30eb
Change how provenance information is captured from builds. While previously frontend passed the buildinfo sources with metadata, now all information is captured through buildkit. A frontend does not need to implement buildinfo and can't set incorrect/incomplete buildinfo for a build result. All LLB operations can now collect as much provenance info as they like that will be used when making the attestation. Previously this was limited to a single Pin value. For example now we also detect secrets and SSH IDs that the build uses, or if it accesses network, if local sources are used etc.. The new design makes sure this can be easily extended in the future. Provenance capture can now detect builds that do multiple separate subsolves in sequence. For example, first subsolve gathers the sources for the build and second one builds from immutable sources without a network connection. If first solve does not participate in final build result it does not end up in provenance. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
64 lines
1.3 KiB
Go
64 lines
1.3 KiB
Go
package opsutils
|
|
|
|
import (
|
|
"github.com/moby/buildkit/solver/pb"
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
func Validate(op *pb.Op) error {
|
|
if op == nil {
|
|
return errors.Errorf("invalid nil op")
|
|
}
|
|
|
|
switch op := op.Op.(type) {
|
|
case *pb.Op_Source:
|
|
if op.Source == nil {
|
|
return errors.Errorf("invalid nil source op")
|
|
}
|
|
case *pb.Op_Exec:
|
|
if op.Exec == nil {
|
|
return errors.Errorf("invalid nil exec op")
|
|
}
|
|
if op.Exec.Meta == nil {
|
|
return errors.Errorf("invalid exec op with no meta")
|
|
}
|
|
if len(op.Exec.Meta.Args) == 0 {
|
|
return errors.Errorf("invalid exec op with no args")
|
|
}
|
|
if len(op.Exec.Mounts) == 0 {
|
|
return errors.Errorf("invalid exec op with no mounts")
|
|
}
|
|
|
|
isRoot := false
|
|
for _, m := range op.Exec.Mounts {
|
|
if m.Dest == pb.RootMount {
|
|
isRoot = true
|
|
break
|
|
}
|
|
}
|
|
if !isRoot {
|
|
return errors.Errorf("invalid exec op with no rootfs")
|
|
}
|
|
case *pb.Op_File:
|
|
if op.File == nil {
|
|
return errors.Errorf("invalid nil file op")
|
|
}
|
|
if len(op.File.Actions) == 0 {
|
|
return errors.Errorf("invalid file op with no actions")
|
|
}
|
|
case *pb.Op_Build:
|
|
if op.Build == nil {
|
|
return errors.Errorf("invalid nil build op")
|
|
}
|
|
case *pb.Op_Merge:
|
|
if op.Merge == nil {
|
|
return errors.Errorf("invalid nil merge op")
|
|
}
|
|
case *pb.Op_Diff:
|
|
if op.Diff == nil {
|
|
return errors.Errorf("invalid nil diff op")
|
|
}
|
|
}
|
|
return nil
|
|
}
|