vendor: update buildkit to ecde33610015

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

go.mod

@@ -29,7 +29,7 @@ require (
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/in-toto/in-toto-golang v0.10.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/moby/buildkit v0.28.0-rc1
+	github.com/moby/buildkit v0.28.0-rc1.0.20260226174804-ecde33610015
 	github.com/moby/go-archive v0.2.0
 	github.com/moby/moby/api v1.53.0
 	github.com/moby/moby/client v0.2.2

go.sum

@@ -422,8 +422,8 @@ github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.28.0-rc1 h1:DmO/S9uWXSDUPIgNiYHiqiPNcRAGxAaXYz2zhCRy+FA=
-github.com/moby/buildkit v0.28.0-rc1/go.mod h1:OvWR1wd21skG+T2wKP3J3dZO+C+oEbIXoyWQTl4dX2A=
+github.com/moby/buildkit v0.28.0-rc1.0.20260226174804-ecde33610015 h1:4Mz55WW5Y28MzqBJXlSCtHi4KzY9Sjd1MMRmNH831lQ=
+github.com/moby/buildkit v0.28.0-rc1.0.20260226174804-ecde33610015/go.mod h1:OvWR1wd21skG+T2wKP3J3dZO+C+oEbIXoyWQTl4dX2A=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=

vendor/github.com/moby/buildkit/frontend/gateway/grpcclient/client.go

@@ -472,14 +472,20 @@ func (c *grpcClient) Solve(ctx context.Context, creq client.SolveRequest) (res *
 }
 
 func (c *grpcClient) ResolveSourceMetadata(ctx context.Context, op *opspb.SourceOp, opt sourceresolver.Opt) (*sourceresolver.MetaResponse, error) {
+	requiresImageAttestationResolve := opt.ImageOpt != nil && (opt.ImageOpt.AttestationChain || len(opt.ImageOpt.ResolveAttestations) > 0)
+	requiresHTTPChecksumRequest := opt.HTTPOpt != nil && opt.HTTPOpt.ChecksumReq != nil
+
 	if c.caps.Supports(pb.CapSourceMetaResolver) != nil {
+		if requiresImageAttestationResolve {
+			return nil, errors.New("image attestation resolution requires source metadata resolver support")
+		}
 		var ref string
 		if v, ok := strings.CutPrefix(op.Identifier, "docker-image://"); ok {
 			ref = v
 		} else if v, ok := strings.CutPrefix(op.Identifier, "oci-layout://"); ok {
 			ref = v
 		} else {
-			if opt.HTTPOpt != nil && opt.HTTPOpt.ChecksumReq != nil {
+			if requiresHTTPChecksumRequest {
 				return nil, errors.New("http checksum request requires source metadata resolver support")
 			}
 			return &sourceresolver.MetaResponse{Op: op}, nil
@@ -503,6 +509,17 @@ func (c *grpcClient) ResolveSourceMetadata(ctx context.Context, op *opspb.Source
 		}, nil
 	}
 
+	if requiresImageAttestationResolve {
+		if err := c.caps.Supports(pb.CapSourceMetaResolverImageAttestations); err != nil {
+			return nil, errors.Wrap(err, "image attestation resolution requires additional source metadata resolver support")
+		}
+	}
+	if requiresHTTPChecksumRequest {
+		if err := c.caps.Supports(pb.CapSourceMetaResolverHTTPChecksumRequest); err != nil {
+			return nil, errors.Wrap(err, "http checksum request requires additional source metadata resolver support")
+		}
+	}
+
 	var platform *ocispecs.Platform
 	if imgOpt := opt.ImageOpt; imgOpt != nil && imgOpt.Platform != nil {
 		platform = imgOpt.Platform
@@ -544,7 +561,7 @@ func (c *grpcClient) ResolveSourceMetadata(ctx context.Context, op *opspb.Source
 			ReturnObject: opt.GitOpt.ReturnObject,
 		}
 	}
-	if opt.HTTPOpt != nil && opt.HTTPOpt.ChecksumReq != nil {
+	if requiresHTTPChecksumRequest {
 		algo, err := toPBHTTPChecksumAlgo(opt.HTTPOpt.ChecksumReq.Algo)
 		if err != nil {
 			return nil, err
@@ -598,7 +615,7 @@ func (c *grpcClient) ResolveSourceMetadata(ctx context.Context, op *opspb.Source
 			}
 		}
 	}
-	if opt.HTTPOpt != nil && opt.HTTPOpt.ChecksumReq != nil {
+	if requiresHTTPChecksumRequest {
 		if resp.HTTP == nil || resp.HTTP.ChecksumResponse == nil {
 			return nil, errors.New("http checksum request was sent but response did not include checksum response")
 		}

vendor/github.com/moby/buildkit/frontend/gateway/pb/caps.go

@@ -76,6 +76,12 @@ const (
 	// CapSourceMetaResolver is the capability to indicates support for ResolveSourceMetadata
 	// function in gateway API
 	CapSourceMetaResolver apicaps.CapID = "source.metaresolver"
+	// CapSourceMetaResolverImageAttestations is the capability to indicate support
+	// for attestation resolution fields in ResolveSourceMeta image requests.
+	CapSourceMetaResolverImageAttestations apicaps.CapID = "source.metaresolver.image.attestations"
+	// CapSourceMetaResolverHTTPChecksumRequest is the capability to indicate support
+	// for custom checksum request fields in ResolveSourceMeta http requests.
+	CapSourceMetaResolverHTTPChecksumRequest apicaps.CapID = "source.metaresolver.http.checksumrequest"
 )
 
 func init() {
@@ -253,4 +259,18 @@ func init() {
 		Enabled: true,
 		Status:  apicaps.CapStatusExperimental,
 	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceMetaResolverImageAttestations,
+		Name:    "source meta resolver image attestations",
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceMetaResolverHTTPChecksumRequest,
+		Name:    "source meta resolver http checksum request",
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
 }

vendor/modules.txt

@@ -652,7 +652,7 @@ github.com/mitchellh/go-wordwrap
 # github.com/mitchellh/hashstructure/v2 v2.0.2
 ## explicit; go 1.14
 github.com/mitchellh/hashstructure/v2
-# github.com/moby/buildkit v0.28.0-rc1
+# github.com/moby/buildkit v0.28.0-rc1.0.20260226174804-ecde33610015
 ## explicit; go 1.25.5
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types